loki-mode 11.89.0 → 11.90.0

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: Runs an autonomous software factory that knows what it is supposed to deliver and proves it did, with a signed receipt. Use when the user says Loki Mode or asks to build, fix or verify software autonomously.
 ---
 
-# Loki Mode v11.89.0
+# Loki Mode v11.90.0
 
 **Current entry points (Loki 10 engine):** `loki "<task>"`, `loki owner/repo#N` and `loki quick "<task>"` run the Loki 10 engine and end with a signed receipt (`loki verify`). `loki backlog owner/repo --all` runs many issues in parallel. Guide: `docs/v10/GUIDE.md`. The skill instructions below, and `loki start`, describe the previous bash loop. PRD-file starts (`loki start ./prd.md`) and the opencode provider still run on it until FC38-SWEEP ports them; the legacy-engine command and the LOKI_ENGINE switch remain removed. Prefer `loki owner/repo#N` for issues.
 
@@ -475,4 +475,4 @@ Implemented, planned and deprecated items, with the version each landed in: `ski
 
 ---
 
-**v11.89.0 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**
+**v11.90.0 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**

package/VERSION

@@ -1 +1 @@
-11.89.0
+11.90.0

package/autonomy/lib/backlog.py

@@ -378,6 +378,15 @@ def main(argv):
                 tmp = dst + ".tmp%d" % os.getpid()
                 shutil.copyfile(src, tmp)
                 os.replace(tmp, dst)
+            # The sealed Wall copies travel with the receipt: integrate reruns them on the merged tree after the worktree is gone.
+            wsrc, wdst = os.path.join(src_dir, "wall"), os.path.join(dst_dir, "wall")
+            if os.path.isdir(wsrc) and not os.path.islink(wsrc) and not os.path.islink(wdst):
+                shutil.rmtree(wdst, ignore_errors=True)
+                os.makedirs(wdst, mode=0o700, exist_ok=True)
+                for name in os.listdir(wsrc):
+                    f = os.path.join(wsrc, name)
+                    if os.path.isfile(f) and not os.path.islink(f):
+                        shutil.copyfile(f, os.path.join(wdst, name))
         except OSError:
             pass
 

package/autonomy/loki

@@ -28170,13 +28170,75 @@ _pr_record_merge() {
     return 0
 }
 
+# Owner opt-in earned merge (LOKI_EARNED_MERGE=1, off by default). Every path
+# the PR changes (the new name and, for a rename, the previous name, listed by
+# paginated REST and required to match the PR's changedFiles count) must have a
+# Seal record from `loki trust --json` (path_seals) with at least
+# LOKI_EARNED_MERGE_MIN_VERIFIED (default 20, floor 1) VERIFIED receipts and
+# exactly 0 reverts in git history. A revert count of null (history
+# unreadable), a missing record, an unreadable trust output or an unreadable or
+# truncated file list or an unreadable diff all refuse, as does any PR whose
+# diff touches a symlink (120000) or submodule (160000) mode. Protected paths (.github/, .loki/, .env*,
+# .envrc, CODEOWNERS, plus the space-separated globs in
+# LOKI_EARNED_MERGE_PROTECTED), matched case-insensitively, always stay
+# PR-only. The reason for a refusal goes to stdout; the return code is 1.
+_pr_earned_merge_check() {
+    local pr="$1" min="${LOKI_EARNED_MERGE_MIN_VERIFIED:-20}" meta="" num="" want="" lines="" seals=""
+    local kind p lp g row v r got=0 globs=() diff="" bad_mode=""
+    case "$min" in ''|*[!0-9]*) min=20 ;; esac
+    [ "$min" -ge 1 ] || min=1
+    command -v jq >/dev/null 2>&1 || { echo "jq is required to read the Seal record"; return 1; }
+    meta="$(gh pr view "$pr" --json number,changedFiles -q '"\(.number) \(.changedFiles)"' 2>/dev/null)" || meta=""
+    num="${meta%% *}"; want="${meta#* }"
+    case "$num$want" in ''|*[!0-9]*) echo "the PR's changed files are unreadable"; return 1 ;; esac
+    lines="$(gh api --paginate "repos/{owner}/{repo}/pulls/${num}/files" -q '.[] | ("F\t" + .filename), (select(.previous_filename != null) | "P\t" + .previous_filename)' 2>/dev/null)" || lines=""
+    [ -n "$lines" ] || { echo "the PR's changed files are unreadable"; return 1; }
+    seals="$("$_LOKI_SCRIPT_DIR/../bin/loki" trust --json 2>/dev/null)" || seals=""
+    printf '%s' "$seals" | jq -e '.path_seals | type == "array"' >/dev/null 2>&1 || { echo "the Seal record is unreadable"; return 1; }
+    # read -a splits on whitespace without expanding globs against the cwd.
+    read -r -a globs <<EOF_GLOBS
+$(printf '%s' "${LOKI_EARNED_MERGE_PROTECTED:-}" | tr '[:upper:]' '[:lower:]')
+EOF_GLOBS
+    while IFS="$(printf '\t')" read -r kind p; do
+        [ -n "$p" ] || continue
+        [ "$kind" = "F" ] && got=$((got + 1))
+        lp="$(printf '%s' "$p" | tr '[:upper:]' '[:lower:]')"
+        case "$lp" in .github/*|.loki/*|.env|.env.*|*/.env|*/.env.*|.envrc|*/.envrc|codeowners|docs/codeowners)
+            echo "$p is a protected path"; return 1 ;;
+        esac
+        for g in ${globs[@]+"${globs[@]}"}; do
+            # shellcheck disable=SC2254
+            case "$lp" in $g) echo "$p is a protected path"; return 1 ;; esac
+        done
+        row="$(printf '%s' "$seals" | jq -r --arg p "$p" '[.path_seals[] | select(.path == $p)] | if length == 0 then "none" else "\(.[0].verified) \(.[0].reverts)" end')" || row="none"
+        [ "$row" != "none" ] || { echo "$p has no Seal record"; return 1; }
+        v="${row%% *}"; r="${row#* }"
+        case "$r" in
+            0) ;;
+            null) echo "$p revert status is unknown"; return 1 ;;
+            *) echo "$p has $r recorded revert(s)"; return 1 ;;
+        esac
+        [ "$v" -ge "$min" ] 2>/dev/null || { echo "$p has $v VERIFIED receipts, need $min"; return 1; }
+    done <<EOF_FILES
+$lines
+EOF_FILES
+    [ "$got" = "$want" ] || { echo "the PR lists $want changed files but $got were readable"; return 1; }
+    # A symlink (120000) or submodule (160000) can point an earned path anywhere:
+    # refuse any PR whose diff adds, removes, changes or re-modes one.
+    diff="$(gh pr diff "$pr" 2>/dev/null)" || diff=""
+    [ -n "$diff" ] || { echo "the PR's file modes are unreadable"; return 1; }
+    bad_mode="$(printf '%s\n' "$diff" | awk '/^diff --git /{h=$0} /^(new file mode|deleted file mode|old mode|new mode) (120000|160000)$/{print h; exit} /^index [0-9a-f.]+ (120000|160000)$/{print h; exit}')"
+    [ -z "$bad_mode" ] || { echo "${bad_mode#diff --git } involves a symlink or submodule"; return 1; }
+    return 0
+}
+
 # Shared merge gate. One PR (number or branch) merges only when it is not a
 # draft, `gh pr checks` exits 0 after polling pending (rc=8), and, with
 # --require-verified, every clean proof recorded for the PR's head commit
 # (facts.git.head_sha == headRefOid, dirty-tree proofs ignored) says VERIFIED; a stale or missing proof
 # refuses ("gate: head"). The merge passes --match-head-commit so a push after
 # the gate cannot land unjudged. On refusal it prints the exact blocking gate
-# ("gate: draft|head|verdict|checks") and leaves the PR open.
+# ("gate: draft|head|verdict|trust|checks") and leaves the PR open.
 # Usage: _merge_pr_gated <pr> [--require-verified] [--delete-branch]
 _merge_pr_gated() {
     local pr="$1" need_verified=false margs=(--squash) rc d
@@ -28252,6 +28314,14 @@ _merge_pr_gated() {
             return 1
         fi
     fi
+    if [ "${LOKI_EARNED_MERGE:-0}" = "1" ]; then
+        local trust_why=""
+        trust_why="$(_pr_earned_merge_check "$pr")" || {
+            echo "$pr: not merged, gate: trust ($trust_why); PR left open" >&2
+            _pr_record_merge "$pr" "blocked:trust" "trust"
+            return 1
+        }
+    fi
     rc=0; _pr_checks_wait "$pr" || rc=$?
     if [ "$rc" != "0" ]; then
         echo "$pr: not merged, gate: checks (gh pr checks rc=$rc); PR left open" >&2

package/dashboard/__init__.py

@@ -7,6 +7,6 @@ Modules:
     control: Session control helpers (status, atomic writes, origin check)
 """
 
-__version__ = "11.89.0"
+__version__ = "11.90.0"
 
 __all__ = ["__version__"]

package/docs/CLI-REFERENCE.md

@@ -1,6 +1,6 @@
 # CLI reference
 
-Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.89.0. Do not edit by hand.
+Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.90.0. Do not edit by hand.
 Hidden and legacy-only commands are omitted; see `docs/CLI-INVENTORY.md` for the full inventory.
 
 | Command | Description |

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 Loki Mode, by [Autonomi](https://www.autonomi.dev/), turns a spec or an issue into a verified pull request with a receipt you can check. This page covers installing it, a first run, and the options around it.
 
-**Version:** v11.89.0
+**Version:** v11.90.0
 
 **Engine note:** `loki start` is the primary command. `loki start`, `loki "<task>"`, `loki owner/repo#N` and `loki quick` all run the Loki 10 engine, whatever the flag order or input form (PRD file, issue ref, task or one-word brief). The previous loop runs only on `--engine legacy`, `LOKI_ENGINE=legacy`, or for one call when a flag Loki 10 cannot honor is present. See the [user guide](v10/GUIDE.md) and the [5-minute quickstart](QUICKSTART.md).
 

package/docs/v11/VERIFY-PR-SANDBOX.md

@@ -25,6 +25,7 @@ verify-pr-sandbox.sh --repo DIR --out DIR --cmd 'SHELL CMD' --image IMG [--timeo
 | Env scrub | `docker run` inherits no host env; only PATH, HOME=/work, CI=1 are passed. GH_TOKEN, GITHUB_TOKEN, SSH_AUTH_SOCK never reach argv |
 | Mounts | exactly one: the repo, read-only. No HOME, no docker socket, no output mount |
 | Output | stdout is captured by the host, capped in-container (`--max-output`); the host writes result.json and output.txt |
+| Report | `--report /work/NAME` returns the file the check's runner wrote there (up to 1 MiB, outside the output cap) between nonce-bearing markers; the host writes it as report.txt. verify-pr runs bun test, pytest, jest and vitest with a report flag and a random path, and reads pass/fail only from that file |
 
 Deviation from the card: there is no mounted output dir. A writable host mount would let the checked code fill the host disk, so the result travels on stdout and only the host writes `OUT`. Numeric flags are forced to base 10 (a leading zero is not octal) and every value flag requires a value. `--image` is restricted to `[A-Za-z0-9._/:@-]`.
 
@@ -35,6 +36,7 @@ Deviation from the card: there is no mounted output dir. A writable host mount w
 - Oversized output: capped by `--max-output`; `output_truncated` is set.
 - Fork bomb: `--pids-limit 256`. Memory bomb: `--memory`. Disk fill: tmpfs size caps.
 - Forged result: the checked code can print a fake `LOKI_VPR_END` line. A per-run 128-bit nonce is sent to the wrapper on stdin and the checked command runs with stdin from /dev/null; the host accepts only the last line carrying that nonce. Docker's default seccomp profile does NOT block ptrace or process_vm_readv on kernels >= 4.8, and the checked command runs as the same uid as the wrapper inside the container, so a hostile process can read the wrapper's memory and recover the nonce. The nonce therefore only stops accidental or naive forgery; it is not a security boundary. One cross-check is added: the wrapper exits with the check's code and the host rejects (status ERROR) a sentinel that disagrees with docker's own exit code. The PR code can still make its own check report success, which is why `result.json` is a signal about the check and not the final verdict (VPR-2 owns that, and it must not treat a bare COMPLETED exit 0 as proof). A custom seccomp profile denying ptrace is a possible hardening and is not shipped here.
+- Forged report: the report path is a per-run random name given only on the runner's command line, so printed totals cannot forge it. A hostile test that reads its parent's command line (or the nonce, see above) and rewrites the file after the runner exits can still forge a pass; the same ptrace-class residual applies.
 - Docker pool exhaustion: reported as BLOCKED, never as a failing check.
 
 ## Not covered (residual, tracked for VPR-2 review)