loki-mode 11.84.0 → 11.85.0

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: Runs an autonomous software factory that knows what it is supposed to deliver and proves it did, with a signed receipt. Use when the user says Loki Mode or asks to build, fix or verify software autonomously.
 ---
 
-# Loki Mode v11.84.0
+# Loki Mode v11.85.0
 
 **Current entry points (Loki 10 engine):** `loki "<task>"`, `loki owner/repo#N` and `loki quick "<task>"` run the Loki 10 engine and end with a signed receipt (`loki verify`). `loki backlog owner/repo --all` runs many issues in parallel. Guide: `docs/v10/GUIDE.md`. The skill instructions below, and `loki start`, describe the previous bash loop. PRD-file starts (`loki start ./prd.md`) and the opencode provider still run on it until FC38-SWEEP ports them; the legacy-engine command and the LOKI_ENGINE switch remain removed. Prefer `loki owner/repo#N` for issues.
 
@@ -475,4 +475,4 @@ Implemented, planned and deprecated items, with the version each landed in: `ski
 
 ---
 
-**v11.84.0 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**
+**v11.85.0 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**

package/VERSION

@@ -1 +1 @@
-11.84.0
+11.85.0

package/autonomy/grill.sh

@@ -191,6 +191,9 @@ _grill_with_timeout() {
 
 grill_invoke_provider() {
     local prompt="$1"
+    # Optional role: selects the lean-child flag set and ledger phase. The
+    # check author passes check_author (text-only, no tools).
+    local role="${2:-grill}"
     local provider="${LOKI_PROVIDER:-claude}"
 
     case "$provider" in
@@ -254,7 +257,7 @@ grill_invoke_provider() {
             if type loki_lean_child_flags >/dev/null 2>&1; then
                 while IFS= read -r _gr_lf; do
                     [ -n "$_gr_lf" ] && _gr_argv+=("$_gr_lf")
-                done < <(loki_lean_child_flags grill 2>/dev/null)
+                done < <(loki_lean_child_flags "$role" 2>/dev/null)
             fi
             if type loki_child_ledger_append >/dev/null 2>&1; then
                 _gr_ledger=true
@@ -274,7 +277,7 @@ grill_invoke_provider() {
             out="$(printf '%s' "$prompt" \
                 | _grill_with_timeout "${LOKI_GRILL_TIMEOUT:-180}" env CAVEMAN_DEFAULT_MODE=off claude "${_gr_argv[@]}" -p - 2>/dev/null)"
             if [ "$_gr_ledger" = true ] && [ -n "$out" ]; then
-                loki_child_ledger_append grill "$out" >/dev/null 2>&1 || true
+                loki_child_ledger_append "$role" "$out" >/dev/null 2>&1 || true
                 out="$(printf '%s' "$out" | python3 -I -c 'import json,sys
 raw = sys.stdin.read()
 try:
@@ -299,7 +302,9 @@ sys.stdout.write(str(d.get("result", "")) if isinstance(d, dict) else raw)' 2>/d
                 return $GRILL_EXIT_ERROR
             fi
             local out
-            out="$(printf '%s' "$prompt" | _grill_with_timeout "${LOKI_GRILL_TIMEOUT:-180}" codex exec --sandbox workspace-write - 2>/dev/null)"
+            local _cx_extra=()
+            [ "$role" = "check_author" ] && _cx_extra=(--skip-git-repo-check)
+            out="$(printf '%s' "$prompt" | _grill_with_timeout "${LOKI_GRILL_TIMEOUT:-180}" codex exec --sandbox workspace-write ${_cx_extra[@]+"${_cx_extra[@]}"} - 2>/dev/null)"
             if [ -z "$out" ]; then
                 _grill_err "provider returned no output"
                 return $GRILL_EXIT_ERROR

package/autonomy/lib/check_author.py

@@ -2,8 +2,9 @@
 """Check-author context (moat P3, interface A in tests/moat/p3-the-wall.sh).
 
   check_author.py context --spec <file> --repo <dir>
+  check_author.py accept  --spec <file> --repo <dir> --out <dir> [--context <file>] [--attempts N]
 
-Prints ONE JSON object on stdout: the exact and complete input handed to the
+context: prints ONE JSON object on stdout: the exact and complete input handed to the
 check-authoring model. No model call, no network, deterministic.
 
   {"spec_sha256": "<hex>", "inputs": [{"path", "sha256"}...], "prompt": "<text>"}
@@ -19,6 +20,16 @@ Same MAX_BLOB size cap and control-character path rule as the Wall. The Wall's
 other two classes are implementation-bearing and are excluded here: TESTISH test
 sources (style examples) and "named" source files (signatures of files the task
 names). Anything outside the spec and CONFIG files never reaches the author.
+
+accept: reads the author model's stdout from stdin, extracts exactly one JSON
+object (prose or a fenced block around it is tolerated; zero or several objects
+fail), validates it against the schema the verifier runs, and writes
+<out>/checklist.json plus <out>/author.json {status: "authored"} atomically. Any
+failure writes <out>/author.json {status: "unknown", reason} and the critical
+failing verification-results.json sentinel (same shape as council_reverify_checklist
+in autonomy/completion-council.sh), never a checklist.json, and exits non-zero.
+accept reads only the spec file (for its sha256) and the optional --context file;
+--repo is accepted for symmetry and is never opened.
 """
 import argparse
 import hashlib
@@ -39,10 +50,36 @@ MAX_FILES = 300
 TESTISH = re.compile(r"(^|/)(tests?|__tests__|spec)/|\.(test|spec)\.[jt]sx?$|(^|/)test_[^/]*\.py$|_test\.(py|go)$")
 CTRL = re.compile(r"[\x00-\x1f\x7f]")
 
+# Verification types the verifier dispatches in autonomy/checklist-verify.py
+# run_check(): file_exists :57, file_contains :69, tests_pass :89, command :218,
+# grep_codebase :249, http_check :350. Each maps to the fields that make the check
+# runnable (a check missing them can only ever stay pending).
+VERIFY_TYPES = {
+    "file_exists": ("path|target|file",),
+    "file_contains": ("path|target|file", "pattern"),
+    "tests_pass": ("pattern",),
+    "command": ("command",),
+    "grep_codebase": ("pattern",),
+    "http_check": (),
+}
+PRIORITIES = ("critical", "major", "minor")
+MAX_ITEMS = 60
+MAX_INPUT_BYTES = 2_000_000
+RESULT_FIELDS = ("passed", "output", "status", "verified_at")
+SENTINEL = ('{"categories":[{"items":[{"id":"check_authoring_unknown","title":'
+            '"acceptance checks could not be authored","priority":"critical","status":"failing"}]}]}')
+
 PROMPT_HEAD = (
     "You are the acceptance check author. You see only the specification and the "
     "project's runner configuration below. You cannot see the implementation. "
-    "Write acceptance checks that prove the specification is met."
+    "Write acceptance checks that prove the specification is met.\n\n"
+    "Reply with exactly ONE JSON object and nothing else of substance, in this format:\n"
+    '{"categories":[{"name":"<group>","items":[{"id":"<unique id>","title":"<requirement>",'
+    '"priority":"critical|major|minor","verification":[{"type":"<type>", ...}]}]}]}\n'
+    "Every item needs id, title, priority and at least one verification. Allowed "
+    "verification types and their fields: file_exists {path}; file_contains {path, pattern}; "
+    "tests_pass {pattern}; command {command}; grep_codebase {pattern}; http_check {path}. "
+    "Use at most %d items. Do not include pass or result fields." % MAX_ITEMS
 )
 
 
@@ -124,12 +161,162 @@ def build_context(spec: str, repo: str) -> dict:
     return {"spec_sha256": inputs[0]["sha256"], "inputs": inputs, "prompt": "\n\n".join(parts)}
 
 
+class Reject(Exception):
+    pass
+
+
+def extract_one_object(text: str) -> dict:
+    """The single top-level JSON object in text; zero or several is a Reject."""
+    dec = json.JSONDecoder()
+    found = []
+    i = 0
+    while True:
+        i = text.find("{", i)
+        if i < 0:
+            break
+        try:
+            obj, end = dec.raw_decode(text, i)
+        except ValueError:
+            i += 1
+            continue
+        found.append(obj)
+        i = end
+    if not found:
+        raise Reject("no JSON object in author output")
+    if len(found) > 1:
+        raise Reject("%d JSON objects in author output, expected exactly one" % len(found))
+    return found[0]
+
+
+def validate_checklist(doc: dict) -> dict:
+    cats = doc.get("categories")
+    if not isinstance(cats, list) or not cats:
+        raise Reject("categories must be a non-empty list")
+    out_cats, seen, count = [], set(), 0
+    for ci, cat in enumerate(cats):
+        items = cat.get("items") if isinstance(cat, dict) else None
+        if not isinstance(items, list):
+            raise Reject("category %d has no items list" % ci)
+        out_items = []
+        for it in items:
+            count += 1
+            if count > MAX_ITEMS:
+                raise Reject("more than %d items" % MAX_ITEMS)
+            if not isinstance(it, dict):
+                raise Reject("item is not an object")
+            iid, title = it.get("id"), it.get("title")
+            if not isinstance(iid, str) or not iid.strip() or not isinstance(title, str) or not title.strip():
+                raise Reject("item needs a non-empty string id and title")
+            if iid in seen:
+                raise Reject("duplicate item id: %s" % iid)
+            seen.add(iid)
+            if it.get("priority") not in PRIORITIES:
+                raise Reject("item %s: priority must be one of %s" % (iid, "/".join(PRIORITIES)))
+            ver = it.get("verification")
+            if not isinstance(ver, list) or not ver:
+                raise Reject("item %s: needs at least one verification" % iid)
+            out_ver = []
+            for v in ver:
+                if not isinstance(v, dict) or v.get("type") not in VERIFY_TYPES:
+                    raise Reject("item %s: verification type must be one of %s"
+                                 % (iid, ", ".join(sorted(VERIFY_TYPES))))
+                for need in VERIFY_TYPES[v["type"]]:
+                    if not any(isinstance(v.get(k), str) and v.get(k).strip() for k in need.split("|")):
+                        raise Reject("item %s: %s check needs %s" % (iid, v["type"], need))
+                out_ver.append({k: x for k, x in v.items() if k not in RESULT_FIELDS})
+            out_items.append({"id": iid, "title": title, "priority": it["priority"], "verification": out_ver})
+        name = cat.get("name")
+        out_cats.append({"name": name if isinstance(name, str) else "", "items": out_items})
+    if count == 0:
+        raise Reject("checklist has no items")
+    return {"categories": out_cats}
+
+
+def atomic_write(path: str, text: str) -> None:
+    tmp = "%s.tmp.%d" % (path, os.getpid())
+    try:
+        with open(tmp, "w") as fh:
+            fh.write(text)
+        os.replace(tmp, path)
+    except BaseException:
+        try:
+            os.unlink(tmp)
+        except OSError:
+            pass
+        raise
+
+
+def record_unknown(out: str, reason: str, spec_sha, attempts) -> None:
+    """Failure record: drop every artifact of an earlier run, write the critical
+    failing sentinel first (the gate reads it), then status unknown."""
+    for name in ("checklist.json", "author.json", "verification-results.json"):
+        try:
+            os.unlink(os.path.join(out, name))
+        except OSError:
+            pass
+    atomic_write(os.path.join(out, "verification-results.json"), SENTINEL + "\n")
+    atomic_write(os.path.join(out, "author.json"), json.dumps(
+        {"status": "unknown", "reason": reason, "spec_sha256": spec_sha, "attempts": attempts},
+        sort_keys=True) + "\n")
+
+
+def run_accept(args) -> int:
+    out = args.out
+    try:
+        os.makedirs(out, exist_ok=True)
+    except OSError as e:
+        print("check_author: cannot create %s: %s" % (out, e), file=sys.stderr)
+        return 1
+    spec_sha = None
+    try:
+        spec_sha = sha256(read_bytes(args.spec))
+        inputs, prompt_sha = [{"path": os.path.realpath(args.spec), "sha256": spec_sha}], None
+        if args.context:
+            try:
+                with open(args.context) as fh:
+                    ctx = json.load(fh)
+                inputs, prompt_sha = ctx["inputs"], sha256(ctx["prompt"].encode("utf-8"))
+                ctx_spec = ctx.get("spec_sha256")
+            except (OSError, ValueError, KeyError, TypeError, AttributeError, RecursionError):
+                raise Reject("context file unreadable or malformed")
+            if ctx_spec != spec_sha:
+                raise Reject("context spec_sha256 does not match the spec")
+        raw = sys.stdin.buffer.read(MAX_INPUT_BYTES + 1)
+        if len(raw) > MAX_INPUT_BYTES:
+            raise Reject("author output exceeds %d bytes" % MAX_INPUT_BYTES)
+        text = raw.decode("utf-8", "replace")
+        if not text.strip():
+            raise Reject("empty author output")
+        checklist = validate_checklist(extract_one_object(text))
+        atomic_write(os.path.join(out, "checklist.json"), json.dumps(checklist, sort_keys=True, indent=2) + "\n")
+        atomic_write(os.path.join(out, "author.json"), json.dumps(
+            {"status": "authored", "spec_sha256": spec_sha, "inputs": inputs,
+             "prompt_sha256": prompt_sha, "attempts": args.attempts}, sort_keys=True) + "\n")
+        return 0
+    except Reject as e:
+        reason = str(e)
+    except Exception as e:
+        reason = "accept failed: %s" % type(e).__name__
+    try:
+        record_unknown(out, reason, spec_sha, args.attempts)
+    except Exception as e:
+        print("check_author: could not record failure: %s" % e, file=sys.stderr)
+    print("check_author: unknown: %s" % reason, file=sys.stderr)
+    return 1
+
+
 def main(argv=None) -> int:
     ap = argparse.ArgumentParser(prog="check_author.py")
     sub = ap.add_subparsers(dest="cmd", required=True)
     c = sub.add_parser("context", help="print the exact check-author input as JSON")
     c.add_argument("--spec", required=True)
     c.add_argument("--repo", required=True)
+    a = sub.add_parser("accept", help="validate the author model's stdout and write the checklist")
+    a.add_argument("--spec", required=True)
+    a.add_argument("--repo", required=True)
+    a.add_argument("--out", required=True)
+    a.add_argument("--context", help="saved context output, for inputs and prompt_sha256")
+    a.add_argument("--attempts", type=int, default=1)
     args = ap.parse_args(argv)
     if not os.path.isfile(args.spec):
         print("check_author: spec not found: %s" % args.spec, file=sys.stderr)
@@ -137,6 +324,8 @@ def main(argv=None) -> int:
     if not os.path.isdir(args.repo):
         print("check_author: repo not a directory: %s" % args.repo, file=sys.stderr)
         return 2
+    if args.cmd == "accept":
+        return run_accept(args)
     json.dump(build_context(args.spec, args.repo), sys.stdout, sort_keys=True)
     sys.stdout.write("\n")
     return 0

package/autonomy/lib/claude-flags.sh

@@ -249,11 +249,17 @@ _loki_apikey_helper_configured() {
 #   - Text-only roles additionally get the single argument "--tools=" (no tools). --tools is
 #     variadic: "--tools" plus an empty argument swallows a trailing prompt.
 # Every flag is probed with loki_claude_flag_supported; an unsupported flag and
-# its value are dropped. LOKI_LEAN_CHILDREN=0 prints nothing. Main-session
-# flags are not touched by this helper.
+# its value are dropped. LOKI_LEAN_CHILDREN=0 drops the lean flags but the walled
+# check_author still gets "--tools=" (its isolation does not depend on the toggle).
+# Main-session flags are not touched by this helper.
 loki_lean_child_flags() {
     local role="${1:-}"
-    [ "${LOKI_LEAN_CHILDREN:-1}" = "0" ] && return 0
+    if [ "${LOKI_LEAN_CHILDREN:-1}" = "0" ]; then
+        if [ "$role" = "check_author" ] && loki_claude_flag_supported "--tools"; then
+            printf '%s\n' "--tools="
+        fi
+        return 0
+    fi
     if loki_subcall_bare_enabled; then
         printf '%s\n' "--bare"
     else
@@ -271,7 +277,7 @@ loki_lean_child_flags() {
         fi
     fi
     case "$role" in
-        grill|council|vote|review|reviewer|enrich|wiki|docs|docgen|summary)
+        grill|check_author|council|vote|review|reviewer|enrich|wiki|docs|docgen|summary)
             if loki_claude_flag_supported "--tools"; then
                 printf '%s\n' "--tools="
             fi

package/autonomy/prd-checklist.sh

@@ -147,6 +147,143 @@ checklist_init() {
     return 0
 }
 
+#===============================================================================
+# Walled check author
+#===============================================================================
+# The agent that writes the code never writes the acceptance checks. After
+# checklist_init this authors them in a separate provider call that runs in an
+# EMPTY run-owned directory (the repo is never the cwd and never named in the
+# prompt), validates the reply with lib/check_author.py accept, and freezes the
+# result. Once per spec sha256, at most 2 attempts. A failed author leaves the
+# critical failing sentinel (council_checklist_gate then BLOCKs) and freeze
+# refuses any checklist.json the implementer writes afterwards.
+# Only claude gets hard no-tools; codex and seam providers are cwd-only and are
+# reported as such, never as tool-denied.
+CHECKLIST_AUTHOR_REQUIRED=${CHECKLIST_AUTHOR_REQUIRED:-false}
+CHECKLIST_AUTHOR_MAX_ATTEMPTS=2
+# sha256 of the checklist.json the author's accepted reply produced, held in
+# this shell's memory only (never exported, never written to a file). author.json
+# is an unsigned file the implementer can forge, so freeze trusts only this.
+_CHECKLIST_AUTHORED_DIGEST=""
+
+# _checklist_file_sha <path>: sha256 hex of the file, empty if unreadable.
+_checklist_file_sha() {
+    local py
+    py="$(_loki_snapshot_py_tool)" || return 0
+    "$py" -I -S -c 'import hashlib,sys;print(hashlib.sha256(open(sys.argv[1],"rb").read()).hexdigest())' "$1" 2>/dev/null || true
+}
+
+# _checklist_author_field <field>: field of the author record, empty if absent.
+_checklist_author_field() {
+    local py rec
+    py="$(_loki_snapshot_py_tool)" || return 0
+    rec="$(dirname "${CHECKLIST_FILE:-.loki/checklist/checklist.json}")/author.json"
+    [ -f "$rec" ] && [ ! -L "$rec" ] || return 0
+    "$py" -I -S -c 'import json,sys
+try:
+    v=json.load(open(sys.argv[1])).get(sys.argv[2])
+    print("" if v is None else v)
+except Exception:
+    pass' "$rec" "$1" 2>/dev/null || true
+}
+
+checklist_author_isolation() {
+    # no-tools only when the argv the check_author role sends carries --tools=.
+    if [ "${LOKI_PROVIDER:-claude}" = "claude" ] && type loki_lean_child_flags >/dev/null 2>&1 \
+        && loki_lean_child_flags check_author 2>/dev/null | grep -qx -- '--tools='; then
+        echo "check author isolation: no-tools"
+    else
+        echo "check author isolation: cwd-only"
+    fi
+}
+
+checklist_author() {
+    local prd_path="${1:-${CHECKLIST_PRD_PATH:-}}"
+    [ "$CHECKLIST_ENABLED" = "true" ] || return 0
+    [ "${LOKI_CHECKLIST_AUTHOR:-1}" != "0" ] || return 0
+    [ -n "$prd_path" ] && [ -f "$prd_path" ] || return 0
+    CHECKLIST_AUTHOR_REQUIRED=true
+
+    local script_dir ca py spec_sha prior_status prior_sha attempts out_dir
+    script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+    ca="${script_dir}/lib/check_author.py"
+    out_dir="${CHECKLIST_DIR:-.loki/checklist}"
+    CHECKLIST_FILE="${CHECKLIST_FILE:-${out_dir}/checklist.json}"
+    mkdir -p "$out_dir"
+    if [ ! -f "$ca" ] || ! py="$(_loki_snapshot_py_tool)"; then
+        log_warn "check author unavailable (fail closed): freeze refuses until the checks are authored"
+        return 1
+    fi
+    spec_sha="$("$py" -I -S -c 'import hashlib,sys;print(hashlib.sha256(open(sys.argv[1],"rb").read()).hexdigest())' "$prd_path" 2>/dev/null)" || spec_sha=""
+
+    prior_status="$(_checklist_author_field status)"
+    prior_sha="$(_checklist_author_field spec_sha256)"
+    attempts=0
+    if [ -n "$spec_sha" ] && [ "$prior_sha" = "$spec_sha" ]; then
+        # An authored record is only trusted by the process that wrote it: the
+        # accepted digest lives in memory, so a restarted process re-authors
+        # rather than believe an unsigned author.json.
+        if [ "$prior_status" = "authored" ] && [ -n "$_CHECKLIST_AUTHORED_DIGEST" ]; then
+            checklist_freeze_once || true
+            return 0
+        fi
+        if [ "$prior_status" = "authored" ]; then
+            prior_status=""
+        fi
+        attempts="$(_checklist_author_field attempts)"
+        case "$attempts" in ''|*[!0-9]*) attempts=0 ;; esac
+    fi
+
+    local work cwd ctx prompt rc out
+    work="$(mktemp -d "${TMPDIR:-/tmp}/loki-author.XXXXXXXX")" || return 1
+    cwd="${work}/cwd"
+    mkdir -p "$cwd"
+    ctx="${work}/context.json"
+    if ! "$py" -I -S "$ca" context --spec "$prd_path" --repo "$PWD" > "$ctx" 2>/dev/null; then
+        printf '' | "$py" -I -S "$ca" accept --spec "$prd_path" --repo "$PWD" --out "$out_dir" --attempts "$CHECKLIST_AUTHOR_MAX_ATTEMPTS" >/dev/null 2>&1 || true
+        rm -rf -- "$work"
+        log_warn "check author: could not build the author context (fail closed)"
+        return 1
+    fi
+    prompt="$("$py" -I -S -c 'import json,sys;sys.stdout.write(json.load(open(sys.argv[1]))["prompt"])' "$ctx" 2>/dev/null)" || prompt=""
+
+    if ! type grill_invoke_provider >/dev/null 2>&1; then
+        local _o
+        _o="$(set +o)"
+        # shellcheck disable=SC1091
+        . "${script_dir}/grill.sh" 2>/dev/null || true
+        eval "$_o"
+    fi
+
+    # The child ledger is written relative to LOKI_DIR; keep it pointing at the
+    # real state dir while the cwd is the empty directory.
+    local _ca_loki_dir="${LOKI_DIR:-$PWD/.loki}"
+    case "$_ca_loki_dir" in /*) ;; *) _ca_loki_dir="$PWD/$_ca_loki_dir" ;; esac
+    rc=1
+    while [ "$attempts" -lt "$CHECKLIST_AUTHOR_MAX_ATTEMPTS" ]; do
+        attempts=$((attempts + 1))
+        out=""
+        if [ -n "$prompt" ] && type grill_invoke_provider >/dev/null 2>&1; then
+            out="$(cd "$cwd" && LOKI_DIR="$_ca_loki_dir" grill_invoke_provider "$prompt" check_author 2>/dev/null)" || out=""
+        fi
+        if printf '%s' "$out" | "$py" -I -S "$ca" accept --spec "$prd_path" --repo "$PWD" \
+                --out "$out_dir" --context "$ctx" --attempts "$attempts" >/dev/null 2>&1; then
+            rc=0
+            break
+        fi
+    done
+    rm -rf -- "$work"
+    checklist_author_isolation > "${out_dir}/author-isolation.txt" 2>/dev/null || true
+    log_info "$(checklist_author_isolation)"
+    if [ "$rc" -ne 0 ]; then
+        log_warn "check author: no valid checks after ${attempts} attempt(s); completion stays blocked"
+        return 1
+    fi
+    _CHECKLIST_AUTHORED_DIGEST="$(_checklist_file_sha "$CHECKLIST_FILE")"
+    checklist_freeze_once || true
+    return 0
+}
+
 #===============================================================================
 # Acceptance-Oracle Triangulation (P2-3)
 #===============================================================================
@@ -1020,6 +1157,27 @@ checklist_freeze_once() {
     [ -z "$CHECKLIST_FROZEN_DIGEST" ] || return 0
     [ -n "$CHECKLIST_FILE" ] && [ -f "$CHECKLIST_FILE" ] || return 0
 
+    # Walled author: refuse unless the checks were authored by the check author
+    # for this spec. An implementer-written checklist.json has no authored record.
+    if [ "$CHECKLIST_AUTHOR_REQUIRED" = "true" ]; then
+        local _fa_status _fa_sha _fa_want="" _fa_py
+        _fa_status="$(_checklist_author_field status)"
+        _fa_sha="$(_checklist_author_field spec_sha256)"
+        if [ -n "${CHECKLIST_PRD_PATH:-}" ] && [ -f "$CHECKLIST_PRD_PATH" ] && _fa_py="$(_loki_snapshot_py_tool)"; then
+            _fa_want="$("$_fa_py" -I -S -c 'import hashlib,sys;print(hashlib.sha256(open(sys.argv[1],"rb").read()).hexdigest())' "$CHECKLIST_PRD_PATH" 2>/dev/null)" || _fa_want=""
+        fi
+        if [ "$_fa_status" != "authored" ] || [ -z "$_fa_sha" ] || [ "$_fa_sha" != "$_fa_want" ]; then
+            log_warn "checklist freeze refused: the checks were not authored by the check author (status: ${_fa_status:-none})"
+            return 1
+        fi
+        # author.json is forgeable; bind the freeze to the digest the harness
+        # recorded in memory when it accepted the author's checklist.
+        if [ -z "$_CHECKLIST_AUTHORED_DIGEST" ] || [ "$(_checklist_file_sha "$CHECKLIST_FILE")" != "$_CHECKLIST_AUTHORED_DIGEST" ]; then
+            log_warn "checklist freeze refused: checklist.json does not match the checklist the check author produced"
+            return 1
+        fi
+    fi
+
     local script_dir verify_script _cl_py digest
     script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
     verify_script="${script_dir}/checklist-verify.py"
@@ -1222,6 +1380,10 @@ checklist_as_evidence() {
         echo ""
         echo "## PRD Checklist Verification"
         echo ""
+        if [ -f "$(dirname "$CHECKLIST_RESULTS_FILE")/author-isolation.txt" ]; then
+            cat "$(dirname "$CHECKLIST_RESULTS_FILE")/author-isolation.txt"
+            echo ""
+        fi
 
         _CHECKLIST_RESULTS="$CHECKLIST_RESULTS_FILE" "$_cl_py" -I -S -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
 import json, os

package/autonomy/run.sh

@@ -23461,10 +23461,7 @@ if lines:
 
     # PRD Checklist status injection (v5.44.0)
     local checklist_status=""
-    if [ -n "$prd" ] && [ ! -f ".loki/checklist/checklist.json" ]; then
-        # First iteration with PRD but no checklist yet: instruct AI to create it
-        checklist_status="PRD_CHECKLIST_INIT: Create .loki/checklist/checklist.json from the PRD. Extract requirements into categories with items. Each item needs: id, title, description, priority (critical|major|minor), and verification checks (file_exists, file_contains, tests_pass, grep_codebase, command). This checklist will be auto-verified every ${CHECKLIST_INTERVAL:-5} iterations."
-    elif type checklist_summary &>/dev/null && [ -f ".loki/checklist/verification-results.json" ]; then
+    if type checklist_summary &>/dev/null && [ -f ".loki/checklist/verification-results.json" ]; then
         checklist_status=$(checklist_summary 2>/dev/null || true)
         if [ -n "$checklist_status" ]; then
             checklist_status="PRD_CHECKLIST_STATUS: ${checklist_status}. Review failing items and prioritize fixing them in this iteration."
@@ -25347,6 +25344,9 @@ except Exception:
         fi
         if type checklist_init &>/dev/null; then
             checklist_init "$prd_path"
+            if type checklist_author &>/dev/null; then
+                checklist_author "$prd_path" || true
+            fi
         fi
     fi
 

package/autonomy/spec.sh

@@ -662,6 +662,7 @@ loki spec - the living spec: the spec is the contract; we keep it true.
 
 USAGE:
     loki spec <lock|status|sync> [<spec-path>] [options]
+    loki spec checklist-reset <spec-sha256>
 
 DESCRIPTION:
     Binds a spec (PRD) to content hashes so drift between the spec and the code
@@ -680,6 +681,15 @@ SUBCOMMANDS:
     sync      Refresh the lock after a human review (explicit action). This MVP
               NEVER auto-rewrites the spec itself.
 
+    checklist-reset <spec-sha256>
+              Operator reset for a spec whose acceptance-check authoring failed
+              twice. That failure leaves a check_authoring_unknown sentinel in
+              .loki/checklist that fails the completion gate closed. This
+              command, and nothing else, clears it for exactly the named spec
+              sha256 (the value in .loki/checklist/author.json), so the next run
+              authors the checks again. Refuses while a run is live. Exit 0
+              cleared, 1 refused or no such sentinel, 2 usage error.
+
 SPEC RESOLUTION (when <spec-path> is omitted, first match wins):
     .loki/generated-prd.md  ->  prd.md  ->  PRD.md  ->  docs/prd.md
 
@@ -704,6 +714,73 @@ VERIFY INTEGRATION:
 EOF
 }
 
+# Operator reset of the check_authoring_unknown sentinel for exactly one spec
+# sha256. The sentinel (verification-results.json) and its record (author.json,
+# status unknown, spec_sha256) are written together by lib/check_author.py
+# record_unknown; this is the only path that clears them. is_session_running is
+# the live-run detection `loki` already uses; without it the live state is
+# unknown, so the reset refuses.
+spec_checklist_reset() {
+    local sha="${1:-}"
+    case "$sha" in
+        *[!0-9a-f]*|"") _spec_err "usage: loki spec checklist-reset <spec-sha256> (64 lowercase hex characters)"; return $SPEC_EXIT_USAGE ;;
+    esac
+    if [ "${#sha}" -ne 64 ]; then
+        _spec_err "usage: loki spec checklist-reset <spec-sha256> (64 lowercase hex characters)"
+        return $SPEC_EXIT_USAGE
+    fi
+    if ! type is_session_running >/dev/null 2>&1; then
+        _spec_err "cannot tell whether a run is live; run this through 'loki spec checklist-reset'"
+        return $SPEC_EXIT_DRIFT
+    fi
+    if is_session_running; then
+        _spec_err "a run is live; stop it ('loki stop') before resetting the checklist sentinel"
+        return $SPEC_EXIT_DRIFT
+    fi
+    local dir="${LOKI_DIR:-.loki}/checklist"
+    local rec="$dir/author.json" res="$dir/verification-results.json"
+    local state
+    if [ -L "$dir" ]; then
+        _spec_err "$dir is a symlink; refusing to clear anything through it"
+        return $SPEC_EXIT_DRIFT
+    fi
+    state="$(python3 -I -S -c 'import json,sys
+try:
+    d=json.load(open(sys.argv[1]))
+    print("%s %s" % (d.get("status",""), d.get("spec_sha256","")))
+except Exception:
+    print("unreadable")' "$rec" 2>/dev/null)" || state="unreadable"
+    if [ ! -f "$rec" ] || [ -L "$rec" ] || [ "$state" = "unreadable" ]; then
+        _spec_err "no check_authoring_unknown sentinel recorded in $dir (nothing cleared)"
+        return $SPEC_EXIT_DRIFT
+    fi
+    if [ "${state%% *}" != "unknown" ]; then
+        _spec_err "the author record in $dir is not a failed authoring (status ${state%% *}); nothing cleared"
+        return $SPEC_EXIT_DRIFT
+    fi
+    if [ "${state#* }" != "$sha" ]; then
+        _spec_err "no sentinel for spec sha256 $sha (the recorded failure is for ${state#* }); nothing cleared"
+        return $SPEC_EXIT_DRIFT
+    fi
+    local removed="$rec"
+    if [ -e "$res" ] || [ -L "$res" ]; then
+        if [ -f "$res" ] && [ ! -L "$res" ] && grep -q 'check_authoring_unknown' "$res" 2>/dev/null; then
+            removed="$rec, $res"
+        else
+            _spec_err "$res is not the check_authoring_unknown sentinel; refusing a partial clear (nothing cleared)"
+            return $SPEC_EXIT_DRIFT
+        fi
+    fi
+    if [ "$removed" != "$rec" ]; then
+        rm -f -- "${res:?}"
+    fi
+    rm -f -- "${rec:?}"
+    printf 'Cleared the check_authoring_unknown sentinel for spec sha256 %s\n' "$sha"
+    printf 'Removed: %s\n' "$removed"
+    printf 'The next run authors the acceptance checks again (attempt count reset).\n'
+    return $SPEC_EXIT_OK
+}
+
 # ---------------------------------------------------------------------------
 # Entry point
 # ---------------------------------------------------------------------------
@@ -715,6 +792,16 @@ spec_main() {
         -h|--help|help|"") spec_help; return $SPEC_EXIT_OK ;;
     esac
 
+    if [ "$sub" = "checklist-reset" ]; then
+        case "${1:-}" in -h|--help) spec_help; return $SPEC_EXIT_OK ;; esac
+        if [ $# -ne 1 ]; then
+            _spec_err "usage: loki spec checklist-reset <spec-sha256>"
+            return $SPEC_EXIT_USAGE
+        fi
+        spec_checklist_reset "$1"
+        return $?
+    fi
+
     local spec_arg=""
     local out_dir="$SPEC_DIR_DEFAULT"
     local as_json="false"

package/dashboard/__init__.py

@@ -7,6 +7,6 @@ Modules:
     control: Session control helpers (status, atomic writes, origin check)
 """
 
-__version__ = "11.84.0"
+__version__ = "11.85.0"
 
 __all__ = ["__version__"]

package/docs/CLI-REFERENCE.md

@@ -1,6 +1,6 @@
 # CLI reference
 
-Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.84.0. Do not edit by hand.
+Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.85.0. Do not edit by hand.
 Hidden and legacy-only commands are omitted; see `docs/CLI-INVENTORY.md` for the full inventory.
 
 | Command | Description |