loki-mode 11.75.5 → 11.76.0

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: Runs an autonomous software factory that knows what it is supposed to deliver and proves it did, with a signed receipt. Use when the user says Loki Mode or asks to build, fix or verify software autonomously.
 ---
 
-# Loki Mode v11.75.5
+# Loki Mode v11.76.0
 
 **Current entry points (Loki 10 engine):** `loki "<task>"`, `loki owner/repo#N` and `loki quick "<task>"` run the Loki 10 engine and end with a signed receipt (`loki verify`). `loki backlog owner/repo --all` runs many issues in parallel. Guide: `docs/v10/GUIDE.md`. The skill instructions below, and `loki start`, describe the previous bash loop. PRD-file starts (`loki start ./prd.md`) and the opencode provider still run on it until FC38-SWEEP ports them; the legacy-engine command and the LOKI_ENGINE switch remain removed. Prefer `loki owner/repo#N` for issues.
 
@@ -475,4 +475,4 @@ Implemented, planned and deprecated items, with the version each landed in: `ski
 
 ---
 
-**v11.75.5 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**
+**v11.76.0 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**

package/VERSION

@@ -1 +1 @@
-11.75.5
+11.76.0

package/api/openapi.yaml

@@ -1166,12 +1166,16 @@ components:
           properties:
             discoveryTokens:
               type: integer
+              nullable: true
             readTokens:
               type: integer
+              nullable: true
             ratio:
               type: number
+              nullable: true
             savingsPercent:
               type: number
+              nullable: true
 
     RetrieveResponse:
       type: object
@@ -1194,12 +1198,16 @@ components:
           properties:
             discoveryTokens:
               type: integer
+              nullable: true
             readTokens:
               type: integer
+              nullable: true
             ratio:
               type: number
+              nullable: true
             savingsPercent:
               type: number
+              nullable: true
 
 security:
   - {}

package/api/routes/memory.ts

@@ -41,6 +41,24 @@ import {
 // Base path for memory storage
 const MEMORY_BASE_PATH = ".loki/memory";
 
+// Python helper shared by the token-economics scripts. A session that recorded
+// nothing (all counters zero) is unmeasured: every metric is null, never 0 or
+// a 100% saving. Once anything is recorded the measured values pass through.
+const PY_TOKEN_METRICS = `
+def token_metrics_from(summary):
+    m = summary.get('metrics', {})
+    keys = ('discovery_tokens', 'read_tokens', 'layer1_loads', 'layer2_loads',
+            'layer3_loads', 'cache_hits', 'cache_misses')
+    if not any((m.get(k) or 0) > 0 for k in keys):
+        return {'discoveryTokens': None, 'readTokens': None, 'ratio': None, 'savingsPercent': None}
+    return {
+        'discoveryTokens': m.get('discovery_tokens'),
+        'readTokens': m.get('read_tokens'),
+        'ratio': summary.get('ratio'),
+        'savingsPercent': summary.get('savings_percent')
+    }
+`;
+
 // Default subprocess timeout (30 seconds)
 const SUBPROCESS_TIMEOUT_MS = 30000;
 
@@ -181,6 +199,7 @@ import json
 sys.path.insert(0, '.')
 from memory.engine import MemoryEngine
 from memory.token_economics import TokenEconomics
+${PY_TOKEN_METRICS}
 
 engine = MemoryEngine('${MEMORY_BASE_PATH}')
 stats = engine.get_stats()
@@ -195,12 +214,7 @@ try:
     te = TokenEconomics('api-session', '${MEMORY_BASE_PATH}')
     te.load()
     summary = te.get_summary()
-    token_metrics = {
-        'discoveryTokens': summary['metrics'].get('discovery_tokens', 0),
-        'readTokens': summary['metrics'].get('read_tokens', 0),
-        'ratio': summary.get('ratio', 0),
-        'savingsPercent': summary.get('savings_percent', 100)
-    }
+    token_metrics = token_metrics_from(summary)
 except:
     token_metrics = None
 
@@ -746,6 +760,7 @@ from memory.engine import MemoryEngine
 from memory.retrieval import MemoryRetrieval
 from memory.storage import MemoryStorage
 from memory.token_economics import TokenEconomics
+${PY_TOKEN_METRICS}
 
 storage = MemoryStorage('${MEMORY_BASE_PATH}')
 engine = MemoryEngine(storage=storage, base_path='${MEMORY_BASE_PATH}')
@@ -775,19 +790,9 @@ try:
     te = TokenEconomics('retrieve-session', '${MEMORY_BASE_PATH}')
     te.load()
     summary = te.get_summary()
-    token_metrics = {
-        'discoveryTokens': summary['metrics'].get('discovery_tokens', 0),
-        'readTokens': summary['metrics'].get('read_tokens', 0),
-        'ratio': summary.get('ratio', 0),
-        'savingsPercent': summary.get('savings_percent', 100)
-    }
+    token_metrics = token_metrics_from(summary)
 except:
-    token_metrics = {
-        'discoveryTokens': 0,
-        'readTokens': 0,
-        'ratio': 0,
-        'savingsPercent': 100
-    }
+    token_metrics = token_metrics_from({})
 
 result = {
     'memories': memories,
@@ -840,10 +845,10 @@ print(json.dumps(result, default=str))
     const emptyResponse: RetrieveResponse = {
       memories: [],
       tokenMetrics: {
-        discoveryTokens: 0,
-        readTokens: 0,
-        ratio: 0,
-        savingsPercent: 100,
+        discoveryTokens: null,
+        readTokens: null,
+        ratio: null,
+        savingsPercent: null,
       },
     };
     return successResponse(emptyResponse);
@@ -949,6 +954,7 @@ import sys
 import json
 sys.path.insert(0, '.')
 from memory.token_economics import TokenEconomics
+${PY_TOKEN_METRICS}
 
 te = TokenEconomics('api-session', '${MEMORY_BASE_PATH}')
 te.load()
@@ -957,10 +963,7 @@ summary = te.get_summary()
 result = {
     'sessionId': summary.get('session_id', 'unknown'),
     'startedAt': summary.get('started_at', ''),
-    'discoveryTokens': summary['metrics'].get('discovery_tokens', 0),
-    'readTokens': summary['metrics'].get('read_tokens', 0),
-    'ratio': summary.get('ratio', 0),
-    'savingsPercent': summary.get('savings_percent', 100),
+    **token_metrics_from(summary),
     'layer1Loads': summary['metrics'].get('layer1_loads', 0),
     'layer2Loads': summary['metrics'].get('layer2_loads', 0),
     'layer3Loads': summary['metrics'].get('layer3_loads', 0),
@@ -991,10 +994,10 @@ print(json.dumps(result))
     const defaultEconomics: TokenEconomicsDetail = {
       sessionId: "none",
       startedAt: new Date().toISOString(),
-      discoveryTokens: 0,
-      readTokens: 0,
-      ratio: 0,
-      savingsPercent: 100,
+      discoveryTokens: null,
+      readTokens: null,
+      ratio: null,
+      savingsPercent: null,
       layer1Loads: 0,
       layer2Loads: 0,
       layer3Loads: 0,

package/api/types/memory.ts

@@ -9,10 +9,11 @@
 // -----------------------------------------------------------------------------
 
 export interface TokenMetrics {
-  discoveryTokens: number;
-  readTokens: number;
-  ratio: number;
-  savingsPercent: number;
+  // null until the session recorded token usage; never a fabricated 0 or 100
+  discoveryTokens: number | null;
+  readTokens: number | null;
+  ratio: number | null;
+  savingsPercent: number | null;
 }
 
 export interface ThresholdAction {

package/autonomy/checklist-verify.py

@@ -16,10 +16,12 @@ Timeout = item stays 'pending' (not 'failed') to prevent false failures.
 Atomic writes: temp file + os.replace() to never produce partial JSON.
 
 Usage:
-    python3 checklist-verify.py [--checklist PATH] [--timeout SECS]
+    python3 checklist-verify.py [--checklist PATH] [--timeout SECS] (--freeze | --expect-digest SHA256)
 """
 
 import argparse
+import hashlib
+import hmac
 import json
 import os
 import re
@@ -422,6 +424,27 @@ def determine_item_status(verifications: list) -> str:
     return "pending"
 
 
+_DIGEST_RE = re.compile(r"^[0-9a-f]{64}$")
+
+# Result fields the verifier writes back; never part of a check definition.
+_RESULT_FIELDS = ("passed", "output", "status", "verified_at")
+
+
+def definition_digest(checklist: dict) -> str:
+    """SHA-256 over check definitions only (item ids + verification specs)."""
+    defs = []
+    for category in checklist.get("categories", []):
+        for item in category.get("items", []):
+            checks = [
+                {k: v for k, v in c.items() if k not in _RESULT_FIELDS}
+                for c in item.get("verification", [])
+                if isinstance(c, dict)
+            ]
+            defs.append({"id": item.get("id", ""), "verification": checks})
+    blob = json.dumps(defs, sort_keys=True, separators=(",", ":"))
+    return hashlib.sha256(blob.encode("utf-8")).hexdigest()
+
+
 def atomic_write_json(path: str, data: dict) -> None:
     """Write JSON atomically via temp file + os.replace()."""
     os.makedirs(os.path.dirname(path), exist_ok=True)
@@ -454,6 +477,17 @@ def main():
         default=30,
         help="Timeout per check in seconds (default: 30)",
     )
+    parser.add_argument(
+        "--freeze",
+        action="store_true",
+        help="Print the digest of the check definitions and exit; writes nothing",
+    )
+    parser.add_argument(
+        "--expect-digest",
+        default=None,
+        help="Required to verify: the definition digest the harness froze; "
+        "a mismatch, or a missing or malformed value, fails closed",
+    )
     args = parser.parse_args()
 
     checklist_path = args.checklist
@@ -468,6 +502,26 @@ def main():
         print(f"Failed to read checklist: {e}", file=sys.stderr)
         sys.exit(1)
 
+    if args.freeze:
+        print(definition_digest(checklist))
+        sys.exit(0)
+
+    expected = args.expect_digest
+    if expected is None or not _DIGEST_RE.match(expected):
+        print(
+            "Refusing to verify: --expect-digest is missing or not a sha256 hex "
+            "digest (fail closed)",
+            file=sys.stderr,
+        )
+        sys.exit(2)
+    if not hmac.compare_digest(expected, definition_digest(checklist)):
+        print(
+            "Checklist hash mismatch: check definitions differ from the frozen "
+            "digest; refusing to verify",
+            file=sys.stderr,
+        )
+        sys.exit(3)
+
     project_dir = os.getcwd()
     now = datetime.now(timezone.utc).isoformat()
 

package/autonomy/edit.sh

@@ -73,6 +73,14 @@ cmd_edit() {
     return "$_rc"
 }
 
+# One "<content-hash> <path>" line per untracked, non-ignored file.
+_loki_edit_untracked_hashes() {
+    local f
+    git ls-files --others --exclude-standard | while IFS= read -r f; do
+        [ -f "$f" ] && printf '%s %s\n' "$(git hash-object -- "$f" 2>/dev/null)" "$f"
+    done
+}
+
 _cmd_edit_run() {
     local do_verify=false do_receipt=false do_commit=false dry=false
     local paths=() change=""
@@ -125,6 +133,8 @@ _cmd_edit_run() {
     local before_head before_status
     before_head="$(git rev-parse HEAD 2>/dev/null || echo none)"
     before_status="$(git status --porcelain)"
+    local before_untracked
+    before_untracked="$(_loki_edit_untracked_hashes)"
 
     local prompt scope=""
     if [ "${#paths[@]}" -gt 0 ]; then
@@ -184,6 +194,13 @@ print("%s|%s|%s" % (c,err,(d.get("result") or "").strip().replace("\n"," ")[:400
     # Files touched by this pass: status delta against the pre-run snapshot.
     local touched
     touched="$(git status --porcelain | grep -vxF -f <(printf '%s\n' "$before_status") 2>/dev/null | sed 's/^...//' || true)"
+    # A file untracked before the run keeps the same porcelain line when edited,
+    # so also pick up untracked files whose content hash changed.
+    local changed_untracked
+    changed_untracked="$(_loki_edit_untracked_hashes | grep -vxF -f <(printf '%s\n' "$before_untracked") 2>/dev/null | sed 's/^[^ ]* //' || true)"
+    if [ -n "$changed_untracked" ]; then
+        touched="$(printf '%s\n%s\n' "$touched" "$changed_untracked" | sed '/^$/d' | sort -u)"
+    fi
     [ -n "$touched" ] || touched="$(git diff --name-only)"
 
     if [ -z "$touched" ]; then

package/autonomy/loki

@@ -989,7 +989,7 @@ import sys; sys.path[:] = [p for p in sys.path if p not in ("", ".")]
 import json, sys, hashlib, urllib.request
 sys.path.insert(0, sys.argv[3])
 try:
-    from receipt_jwt import verify_attestation, check_seal_meta, _CRYPTO_AVAILABLE
+    from receipt_jwt import verify_attestation, keyset_problem, check_seal_meta, _CRYPTO_AVAILABLE
 except ImportError:
     sys.exit(1)          # -> "" : cannot check, never a verdict
 proof = json.load(open(sys.argv[1]))
@@ -1009,7 +1009,8 @@ except Exception:
 # A key set that is not {"keys": [{...}, ...]} -- INCLUDING an empty list -- is
 # a key-set problem: UNCHECKED, never an accusation against the receipt. An
 # empty keyset is an inability to check (no key was published to check
-# against), not evidence of tampering. Checked BEFORE anything below can print
+# against), not evidence of tampering. The same holds below for a set that
+# gives zero or several entries, or a non-EdDSA alg, for the token's kid. Checked BEFORE anything below can print
 # "bad", so a bad or empty key set can never read as TAMPERED.
 _keys = jwks.get("keys") if isinstance(jwks, dict) else None
 if not isinstance(_keys, list) or not _keys or not all(isinstance(k, dict) for k in _keys):
@@ -1024,9 +1025,16 @@ if not isinstance(tok, str):
 # dependency is UNCHECKED. Same guard in loki_proof_attestation_check below.
 if not _CRYPTO_AVAILABLE:
     sys.exit(1)
-# The key set is known-good here, so any crash inside verification comes from
-# the token: refuse it. Letting it propagate read as UNCHECKED, which let a
-# forger turn TAMPERED into "install python3 cryptography".
+# A key set that cannot give exactly one usable key for the token's kid is a
+# key-set problem, not an accusation: UNCHECKED.
+try:
+    if keyset_problem(tok, jwks):
+        sys.exit(1)
+except Exception:
+    print("bad"); sys.exit(0)
+# Any other crash inside verification comes from the token: refuse it.
+# Letting it propagate read as UNCHECKED, which let a forger turn TAMPERED
+# into "install python3 cryptography".
 try:
     ok, claims = verify_attestation(tok, jwks)
 except Exception:
@@ -1127,7 +1135,7 @@ import sys; sys.path[:] = [p for p in sys.path if p not in ("", ".")]
 import json, sys, os, hashlib, urllib.request
 sys.path.insert(0, sys.argv[3])
 try:
-    from receipt_jwt import verify_attestation, check_seal_meta, _CRYPTO_AVAILABLE
+    from receipt_jwt import verify_attestation, keyset_problem, check_seal_meta, _CRYPTO_AVAILABLE
 except ImportError:
     sys.exit(1)                      # "" : cannot check
 try:
@@ -1164,7 +1172,8 @@ except Exception:
 # a key-set problem: NOT CHECKED, never an accusation. An empty keyset is an
 # inability to check (no key was published to check against), not evidence of
 # tampering. Checked BEFORE anything below can print "bad", so a bad or empty
-# key set can never read as FAILED. Same order in loki_remote_attestation_status
+# key set (or one that is ambiguous or wrongly tagged for the token's kid, see
+# keyset_problem) can never read as FAILED. Same order in loki_remote_attestation_status
 # above -- change both.
 _keys = jwks.get("keys") if isinstance(jwks, dict) else None
 if not isinstance(_keys, list) or not _keys or not all(isinstance(k, dict) for k in _keys):
@@ -1180,9 +1189,17 @@ if not isinstance(tok, str):
 # loki_remote_attestation_status above -- change both.
 if not _CRYPTO_AVAILABLE:
     sys.exit(1)                      # "" : cannot check
-# The key set is known-good here, so any crash inside verification comes from
-# the token: refuse it. Letting it propagate read as NOT CHECKED (exit 2), which
-# let a forger turn FAILED into "could not check".
+# A key set that cannot give exactly one usable key for the token's kid is a
+# key-set problem, never an accusation: NOT CHECKED, with the reason on stdout.
+try:
+    _ksp = keyset_problem(tok, jwks)
+except Exception:
+    _ksp = None
+if _ksp:
+    print("keyset: " + _ksp); sys.exit(0)
+# Any other crash inside verification comes from the token: refuse it.
+# Letting it propagate read as NOT CHECKED (exit 2), which let a forger turn
+# FAILED into "could not check".
 try:
     ok, claims = verify_attestation(tok, jwks)
 except Exception:
@@ -15196,8 +15213,9 @@ EOF
 
 # FC-EGRESS-AUDIT-HAND-LISTED: the registry of every env var that names an outbound
 # host. _loki_airgap_audit walks it, so a configured webhook, tracker, remote or model
-# gateway is named in the audit. tests/test-airgap-commands.sh greps autonomy/ and
-# loki-ts/src for LOKI_*_(URL|HOST|ENDPOINT|WEBHOOK) readers and fails on any name that
+# gateway is named in the audit. tests/test-airgap-commands.sh greps autonomy/,
+# loki-ts/src, providers, dashboard and web-app for LOKI_*_(URL|HOST|ENDPOINT|WEBHOOK|ISSUER)
+# and DATABASE_URL readers and fails on any name that
 # is in neither list. Entry: NAME|what it reaches.
 _LOKI_AIRGAP_EGRESS_ENV=(
     "LOKI_WEBHOOK_URL|custom webhook notifications"
@@ -15216,6 +15234,9 @@ _LOKI_AIRGAP_EGRESS_ENV=(
     "JIRA_BASE_URL|Jira write-back (alias of LOKI_JIRA_URL)"
     "LOKI_LINEAR_URL|Linear write-back"
     "LOKI_MODEL_BASE_URL|model route base URL"
+    "LOKI_AUDIT_SYSLOG_HOST|dashboard audit log forwarding to a remote syslog server"
+    "LOKI_OIDC_ISSUER|dashboard OIDC sign-in (fetches the issuer discovery document and JWKS keys)"
+    "DATABASE_URL|web-app Postgres database server (unset to use local file storage)"
 )
 # Names the guard skips because they never name an outbound host. NAME|reason.
 _LOKI_AIRGAP_EGRESS_NOT=(
@@ -15242,6 +15263,14 @@ _LOKI_AIRGAP_EGRESS_NOT=(
     "LOKI_LAST_GIST_URL|internal variable carrying a gist link this run already created"
     "LOKI_HOSTED_BODY|internal temp-file path"
     "LOKI_HOSTED_EP|internal copy of LOKI_HOSTED_ENDPOINT"
+    "LOKI_DASHBOARD_ALLOWED_HOSTS|the dashboard's own inbound Host-header allowlist, not a destination"
+    "LOKI_HOST_CHILD_PATH|a filesystem path for the host-guard sandbox, not a host"
+    "LOKI_HOST_PROTECTED_ROOT|a filesystem path for the host-guard sandbox, not a host"
+    "LOKI_HOST_RESERVED_PORTS|local ports the host-guard sandbox reserves, not a destination"
+    "LOKI_HOST_RUNTIME_READ_PATHS|filesystem paths for the host-guard sandbox, not a host"
+    "LOKI_HOST_RUNTIME_WRITE_PATHS|filesystem paths for the host-guard sandbox, not a host"
+    "LOKI_HOST_SEATBELT|a boolean switch for the host-guard sandbox, not a host"
+    "LOKI_HOST_SEATBELT_PROBE_SHA|a hash of the host-guard sandbox probe, not a host"
 )
 
 # _loki_airgap_configured_egress -- one TSV line per configured outbound host that is
@@ -21913,6 +21942,18 @@ def _resolve_session_pin(alias):
         _m = 'opus'
     else:  # development (and the '*' fallthrough)
         _m = _provider_model_development()
+    # Explicit top / floor setup, mirrors claude.sh resolve_model_for_tier: a
+    # planning pin dispatches opus, a fast pin haiku (skipped when
+    # LOKI_ALLOW_HAIKU is explicitly set to anything but 'true'), unless legacy
+    # tier switching or an explicit per-tier pin applies.
+    if os.environ.get('LOKI_LEGACY_TIER_SWITCHING') != 'true':
+        if (_pin_tier == 'planning' and alias == 'planning'
+                and not (os.environ.get('LOKI_CLAUDE_MODEL_PLANNING') or os.environ.get('LOKI_MODEL_PLANNING'))):
+            _m = 'opus'
+        elif (_pin_tier == 'fast' and alias == 'fast'
+                and not (os.environ.get('LOKI_CLAUDE_MODEL_FAST') or os.environ.get('LOKI_MODEL_FAST'))
+                and os.environ.get('LOKI_ALLOW_HAIKU', 'true') == 'true'):
+            _m = 'haiku'
     # Apply the shared LOKI_MAX_TIER clamp with the REAL tier and resolved model
     # (loki_apply_max_tier_clamp(model, tier)), NOT the alias==alias override
     # convention. This is the one place where the two paths legitimately diverge
@@ -23515,12 +23556,13 @@ main() {
 #   - Non-TTY/CI without --yes (and no LOKI_ULTRAREVIEW=1): REFUSE with exit 2
 #     and ZERO ultrareview calls (the no-silent-bill guard). Never hang on read.
 #   - --yes or LOKI_ULTRAREVIEW=1 proceeds without prompting (this command only).
-# Args: <format> <assume_yes> <timeout_minutes> <target>
+# Args: <format> <assume_yes> <timeout_minutes> <target> <trust_workspace>
 _review_ultra() {
     local fmt="${1:-text}"
     local assume_yes="${2:-false}"
     local timeout_min="${3:-}"
     local target="${4:-}"
+    local trust_ws="${5:-false}"
 
     # Make the ultrareview gate predicates available even though autonomy/loki
     # does not source claude-flags.sh globally (same on-demand pattern as
@@ -23605,14 +23647,31 @@ _review_ultra() {
     if [ -n "$timeout_min" ]; then
         ur_argv+=("--timeout" "$timeout_min")
     fi
+    # Claude Code 2.1.309+ needs --trust-workspace for scripted runs. Forward it
+    # only when the user passed it AND the CLI lists it; never trust by default.
+    local ur_trust_ok=false
+    if { claude ultrareview --help 2>&1; claude --help 2>&1; } | grep -q -- '--trust-workspace'; then
+        ur_trust_ok=true
+    fi
+    if [ "$trust_ws" = true ]; then
+        if [ "$ur_trust_ok" = true ]; then
+            ur_argv+=("--trust-workspace")
+        else
+            echo "Note: this claude CLI does not list --trust-workspace; not forwarding it." >&2
+        fi
+    fi
     if [ -n "$target" ]; then
         ur_argv+=("$target")
     fi
 
     echo -e "${DIM}Running: claude ${ur_argv[*]}${NC}" >&2
     echo "" >&2
-    claude "${ur_argv[@]}"
-    return $?
+    local ur_rc=0
+    claude "${ur_argv[@]}" || ur_rc=$?
+    if [ "$ur_rc" -ne 0 ] && [ "$trust_ws" != true ] && [ "$ur_trust_ok" = true ]; then
+        echo "If claude reported an untrusted folder, re-run: loki review --ultra --yes --trust-workspace" >&2
+    fi
+    return "$ur_rc"
 }
 
 # v7.38.0: optional native Claude Code Dynamic Workflow passthrough
@@ -23800,6 +23859,7 @@ cmd_review() {
     local review_format="text"
     local review_severity="all"
     local review_ultra=false
+    local review_trust_ws=false
     local review_assume_yes=false
     local review_timeout=""
     local review_risk=false
@@ -23836,6 +23896,8 @@ cmd_review() {
                 echo "                       'loki review <pr-number> --risk' also works. Use --json"
                 echo "  --yes, -y            Skip the --ultra confirmation prompt"
                 echo "  --timeout <minutes>  --ultra: max minutes to wait (default 30)"
+                echo "  --trust-workspace    --ultra: forward claude's --trust-workspace (needed for"
+                echo "                       scripted runs in an untrusted folder; never default)"
                 echo "  --help, -h           Show this help"
                 echo ""
                 echo "Exit codes:"
@@ -23857,6 +23919,7 @@ cmd_review() {
                 return 0
                 ;;
             --ultra) review_ultra=true; shift ;;
+            --trust-workspace) review_trust_ws=true; shift ;;
             --risk) review_risk=true; shift ;;
             --json) review_format="json"; shift ;;
             --yes|-y) review_assume_yes=true; shift ;;
@@ -23910,7 +23973,7 @@ cmd_review() {
     # below: --ultra is a different operation (paid cloud), not a flag that
     # augments the local static analysis.
     if [ "$review_ultra" = true ]; then
-        _review_ultra "$review_format" "$review_assume_yes" "$review_timeout" "$review_target"
+        _review_ultra "$review_format" "$review_assume_yes" "$review_timeout" "$review_target" "$review_trust_ws"
         return $?
     fi
 
@@ -39218,6 +39281,13 @@ print(json.dumps(json.load(open(os.environ['LOKI_PROOF_JSON'])), indent=2))
                         _pv_rc=1
                         _pv_attestation_field="ABSENT"
                         ;;
+                    keyset:*)
+                        echo -e "${YELLOW}attestation: NOT CHECKED -- ${_pv_att#keyset: }.${NC}" >&2
+                        echo "  The key set at ${_pv_jwks} cannot give one usable key for this receipt." >&2
+                        echo "  This is not a failure of the receipt. Nothing was proven either way (exit 2)." >&2
+                        if [ "$_pv_rc" -eq 0 ]; then _pv_rc=2; fi
+                        _pv_attestation_field="NOT CHECKED"
+                        ;;
                     *)
                         # Unreachable key set, unreadable file, missing python
                         # deps. NOT a verdict: an absent measurement must never

package/autonomy/prd-checklist.sh

@@ -106,6 +106,10 @@ fi
 # Internal state
 CHECKLIST_DIR=""
 CHECKLIST_FILE=""
+# Digest of the check definitions, frozen by the harness the first time it sees
+# the checklist and held only in this process's memory (never on disk, where an
+# agent could rewrite it). Every verify passes it as --expect-digest.
+CHECKLIST_FROZEN_DIGEST=""
 CHECKLIST_RESULTS_FILE=""
 CHECKLIST_LAST_VERIFY_ITERATION=0
 # Path to the spec/PRD that drove this checklist. Used by the acceptance-oracle
@@ -1009,6 +1013,27 @@ except Exception:
 # Verification
 #===============================================================================
 
+# Freeze the check definitions once. Idempotent: a second call keeps the first
+# digest, so an edit made after the freeze can never become the new baseline.
+checklist_freeze_once() {
+    [ "$CHECKLIST_ENABLED" = "true" ] || return 0
+    [ -z "$CHECKLIST_FROZEN_DIGEST" ] || return 0
+    [ -n "$CHECKLIST_FILE" ] && [ -f "$CHECKLIST_FILE" ] || return 0
+
+    local script_dir verify_script _cl_py digest
+    script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+    verify_script="${script_dir}/checklist-verify.py"
+    [ -f "$verify_script" ] || return 1
+    _cl_py="$(_loki_snapshot_py_tool)" || return 1
+    digest="$("$_cl_py" -I -S "$verify_script" --checklist "$CHECKLIST_FILE" --freeze 2>/dev/null)" || return 1
+    case "$digest" in
+        *[!0-9a-f]* | "") return 1 ;;
+    esac
+    [ "${#digest}" -eq 64 ] || return 1
+    CHECKLIST_FROZEN_DIGEST="$digest"
+    return 0
+}
+
 checklist_verify() {
     if [ "$CHECKLIST_ENABLED" != "true" ]; then
         return 0
@@ -1045,11 +1070,22 @@ checklist_verify() {
         return 1
     fi
 
+    if ! checklist_freeze_once; then
+        log_warn "checklist verification skipped: could not freeze the check definitions (fail closed)"
+        return 1
+    fi
+
     log_step "Running PRD checklist verification..."
 
-    "$_cl_py" -I -S "$verify_script" \
+    local _cl_rc=0 _cl_err
+    _cl_err="$("$_cl_py" -I -S "$verify_script" \
         --checklist "$CHECKLIST_FILE" \
-        --timeout "$CHECKLIST_TIMEOUT" 2>/dev/null || true
+        --expect-digest "$CHECKLIST_FROZEN_DIGEST" \
+        --timeout "$CHECKLIST_TIMEOUT" 2>&1 >/dev/null)" || _cl_rc=$?
+    if [ "$_cl_rc" -ne 0 ]; then
+        log_warn "checklist verification refused (rc=$_cl_rc): ${_cl_err##*$'\n'}"
+        return "$_cl_rc"
+    fi
 
     CHECKLIST_LAST_VERIFY_ITERATION="${ITERATION_COUNT:-0}"