loki-mode 7.104.1 → 7.104.3

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: Autonomous spec-driven build system with a built-in trust layer. It does not call work done until it is verified (RARV-C closure loop, 8 quality gates, completion council, verified-completion evidence gate). Triggers on "Loki Mode". Takes a spec (PRD, GitHub issue, OpenAPI doc, etc.) to deployed product with minimal human intervention. Provider-agnostic. Requires --dangerously-skip-permissions flag.
 ---
 
-# Loki Mode v7.104.1
+# Loki Mode v7.104.3
 
 **You are an autonomous agent. You make decisions. You do not ask questions. You do not stop.**
 
@@ -408,4 +408,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v7.104.1 | [Autonomi](https://www.autonomi.dev/) flagship product | ~260 lines core**
+**v7.104.3 | [Autonomi](https://www.autonomi.dev/) flagship product | ~260 lines core**

package/VERSION

@@ -1 +1 @@
-7.104.1
+7.104.3

package/autonomy/loki

@@ -9957,12 +9957,27 @@ cmd_doctor() {
         echo -e "  ${GREEN}PASS${NC}  ANTHROPIC_API_KEY is set"
         pass_count=$((pass_count + 1))
     elif command -v claude &>/dev/null; then
-        # Zero-network check: warn if the Claude OAuth login has expired. An
-        # expired token would otherwise pass and then 401 mid-build (the build
-        # stalls at BOOTSTRAP). Mirror run.sh's fail-fast preflight here so a
-        # user catches it with `loki doctor` BEFORE starting a build.
+        # Zero-network login check. v7.104.2: prefer the CLI's own local
+        # auth-status (JSON with "loggedIn"), which is authoritative for BOTH the
+        # file-based and the native/Keychain login. This fixes doctor missing a
+        # genuine Keychain login (native install writes NO ~/.claude/.credentials
+        # .json). Fall back to the expiry stamp in the file for older CLIs.
+        _claude_login="$(claude auth status 2>/dev/null | python3 -c "
+import json, sys
+try:
+    v = json.load(sys.stdin).get('loggedIn')
+    # Only the explicit booleans are trusted; a missing/renamed field is
+    # inconclusive and falls through to the file-expiry check (never a spurious
+    # 'not logged in' warning). Matches the run.sh helper + bun doctor.
+    if v is True:
+        print('yes')
+    elif v is False:
+        print('no')
+except Exception:
+    pass
+" 2>/dev/null)"
         _claude_creds="${CLAUDE_CONFIG_DIR:-$HOME/.claude}/.credentials.json"
-        if [ -s "$_claude_creds" ] && [ "$(python3 -c "
+        _claude_expired="$( [ -s "$_claude_creds" ] && python3 -c "
 import json, sys, time
 try:
     d = json.load(open(sys.argv[1]))
@@ -9970,7 +9985,14 @@ try:
     print('expired' if isinstance(exp,(int,float)) and exp>0 and (exp/1000.0)<=(time.time()+60) else 'ok')
 except Exception:
     print('ok')
-" "$_claude_creds" 2>/dev/null || echo ok)" = "expired" ]; then
+" "$_claude_creds" 2>/dev/null || echo ok )"
+        if [ "$_claude_login" = "yes" ]; then
+            echo -e "  ${GREEN}PASS${NC}  Claude CLI is logged in (subscription/OAuth login)"
+            pass_count=$((pass_count + 1))
+        elif [ "$_claude_login" = "no" ]; then
+            echo -e "  ${YELLOW}WARN${NC}  Claude CLI is NOT logged in -- run 'claude login' before a build (it would otherwise stall)"
+            warn_count=$((warn_count + 1))
+        elif [ "$_claude_expired" = "expired" ]; then
             echo -e "  ${YELLOW}WARN${NC}  Claude login has EXPIRED -- run 'claude login' before a build (it would otherwise stall)"
             warn_count=$((warn_count + 1))
         else

package/autonomy/run.sh

@@ -2023,6 +2023,118 @@ _loki_check_git_present() {
     return 0
 }
 
+# _loki_claude_login_state: report the Claude Code login state WITHOUT a network
+# call, printing exactly one of: loggedin | expired | loggedout | unknown.
+#
+# v7.104.2: the previous preflight assumed OAuth credentials always live in
+# ~/.claude/.credentials.json. That is false for the native install (Claude Code
+# 2.x on macOS), which stores the login in the macOS Keychain under the service
+# "Claude Code-credentials" and creates NO .credentials.json. A genuinely logged
+# in subscription user was therefore falsely told "installed but not logged in"
+# and blocked from every build -- the exact opposite of the zero-friction intent.
+#
+# Design: prefer the durable, CLI-owned signal (`claude auth status`, local +
+# fast + non-interactive, JSON with "loggedIn"), because the credential STORE
+# location has now moved twice (file -> keychain) and will move again. Fall back
+# to the file, then the keychain, for older CLIs that lack `auth status`. Crucial
+# rule (inconclusive-never-false-fails applied to auth): only ever return a hard
+# "loggedout" on POSITIVE evidence of no login; when we cannot tell, return
+# "unknown" and let the caller fail OPEN (warn, proceed, let the real call
+# decide) -- never hard-block a paying user on uncertainty.
+_loki_claude_login_state() {
+    # 1) Primary: the CLI's own local auth-status (zero-network, ~0.2s). Newer
+    #    claude CLIs print JSON with a boolean "loggedIn"; parse defensively.
+    if command -v claude >/dev/null 2>&1; then
+        local _status_json
+        _status_json="$(claude auth status 2>/dev/null)"
+        if [[ -n "$_status_json" ]]; then
+            local _parsed
+            _parsed="$(printf '%s' "$_status_json" | python3 -c "
+import json, sys
+try:
+    d = json.load(sys.stdin)
+    v = d.get('loggedIn')
+    # ONLY the two explicit booleans are trusted. Anything else -- a missing
+    # field, a renamed schema, a JSON error object -- is inconclusive and MUST
+    # fall through to the file/keychain checks, never a hard 'loggedout' (that
+    # would block a genuinely logged-in user with a valid creds file, violating
+    # fail-open). Mirrors the bun doctor's === true / === false / else shape.
+    if v is True:
+        print('loggedin')
+    elif v is False:
+        print('loggedout')
+    # else: print nothing -> fall through
+except Exception:
+    pass  # not JSON (older CLI / different output) -> stay silent, fall through
+" 2>/dev/null)"
+            if [[ "$_parsed" == "loggedin" ]]; then
+                echo "loggedin"; return 0
+            elif [[ "$_parsed" == "loggedout" ]]; then
+                echo "loggedout"; return 0
+            fi
+            # auth status ran but was inconclusive (unparseable, or valid JSON
+            # without an explicit loggedIn boolean) -> do NOT trust it as a
+            # negative; fall through to the credential-store checks below.
+        fi
+    fi
+
+    # 2) Fallback: a VALID (non-expired) OAuth credentials file (older CLIs write
+    #    it here). Compute the expiry once; a valid file is a positive login.
+    #    IMPORTANT: we do NOT conclude "expired" here yet -- a stale expired file
+    #    can sit next to a live macOS-Keychain login (the native install writes
+    #    the file once, then rotates only the Keychain). Concluding "expired" off
+    #    the file before consulting the Keychain would wrongly block a genuinely
+    #    logged-in user -- the exact class of bug this whole change fixes. So the
+    #    Keychain (step 3, a POSITIVE signal) is checked BEFORE we ever return
+    #    "expired" (step 4). Unknown schema -> treat as valid (fail open).
+    local _creds="${CLAUDE_CONFIG_DIR:-$HOME/.claude}/.credentials.json"
+    local _file_state=""   # ""=absent, "valid"=present+fresh, "expired"=present+stale
+    if [[ -s "$_creds" ]]; then
+        _file_state="$(python3 -c "
+import json, sys, time
+try:
+    d = json.load(open(sys.argv[1]))
+    exp = d.get('claudeAiOauth', {}).get('expiresAt')
+    if isinstance(exp, (int, float)) and exp > 0 and (exp / 1000.0) <= (time.time() + 60):
+        print('expired')
+    else:
+        print('valid')
+except Exception:
+    print('valid')  # unreadable/unknown -> fail open (treat as valid)
+" "$_creds" 2>/dev/null || echo valid)"
+    fi
+    if [[ "$_file_state" == "valid" ]]; then
+        echo "loggedin"; return 0
+    fi
+
+    # 3) macOS Keychain (native install stores the login here, often with NO file
+    #    at all, or alongside a now-stale file). A present Keychain entry is a
+    #    POSITIVE login signal and OVERRIDES an expired file. Existence check
+    #    ONLY -- never `-w` (reading the secret can pop a GUI keychain prompt that
+    #    would hang a headless/CI build). Guarded to Darwin.
+    if [[ "$(uname 2>/dev/null)" == "Darwin" ]] && command -v security >/dev/null 2>&1; then
+        if security find-generic-password -s "Claude Code-credentials" >/dev/null 2>&1; then
+            echo "loggedin"; return 0
+        fi
+    fi
+
+    # 4) Only now, with no valid file and no Keychain login, is an expired file a
+    #    real "expired" state (genuine expiry that would 401 mid-build).
+    if [[ "$_file_state" == "expired" ]]; then
+        echo "expired"; return 0
+    fi
+
+    # 5) No positive login evidence at all. On macOS (where the file AND the
+    #    Keychain are the two real stores, both absent) with the CLI present, that
+    #    is confident "logged out". Anywhere else we cannot prove absence of a
+    #    login (no Keychain to consult), so stay "unknown" and let the caller fail
+    #    open.
+    if [[ "$(uname 2>/dev/null)" == "Darwin" ]] && command -v claude >/dev/null 2>&1; then
+        echo "loggedout"; return 0
+    fi
+    echo "unknown"; return 0
+}
+
 # _loki_check_workspace_writable: the build writes state, proofs, and source into
 # the working directory and its .loki/ subtree on every iteration. A read-only
 # volume, a permission-denied directory, or a full disk would otherwise fail
@@ -2108,21 +2220,33 @@ validate_api_keys() {
 
     # Zero-friction auth preflight for LOCAL runs (must run BEFORE the early
     # return below, which exits for non-Docker/K8s envs). When claude is the
-    # provider, the claude CLI is on PATH, there is no ANTHROPIC_API_KEY, and no
-    # OAuth credentials file exists (the user installed claude but never ran
-    # `claude login`), the build would otherwise enter, make a failing call, and
-    # 401 -- the worst first impression -- forcing the user to run `loki why`.
-    # Fail fast with the one-step fix instead. Opt out with LOKI_SKIP_AUTH_PREFLIGHT=1.
-    if [[ "$provider" == "claude" && "${LOKI_SKIP_AUTH_PREFLIGHT:-}" != "1" && -z "${ANTHROPIC_API_KEY:-}" ]] \
-       && command -v claude >/dev/null 2>&1; then
-        local _local_creds="${CLAUDE_CONFIG_DIR:-$HOME/.claude}/.credentials.json"
-        if [[ ! -s "$_local_creds" ]]; then
+    # provider and there is no ANTHROPIC_API_KEY, ask the login-state helper
+    # (auth-status -> file -> keychain, all zero-network) whether the user is
+    # actually logged in. A never-logged-in user would otherwise enter the build,
+    # make a failing call, and 401 -- the worst first impression -- so we fail
+    # fast with the one-step fix. But we ONLY hard-block on a confident
+    # "loggedout"; an "expired" login gets its own message; "unknown" (we cannot
+    # prove the login state, e.g. an older CLI on a non-macOS box with no file)
+    # fails OPEN so a genuinely logged-in user is never blocked. This is the
+    # v7.104.2 fix for the native/Keychain login being misread as logged out.
+    # Opt out entirely with LOKI_SKIP_AUTH_PREFLIGHT=1.
+    if [[ "$provider" == "claude" && "${LOKI_SKIP_AUTH_PREFLIGHT:-}" != "1" && -z "${ANTHROPIC_API_KEY:-}" ]]; then
+        local _login_state
+        _login_state="$(_loki_claude_login_state)"
+        if [[ "$_login_state" == "loggedout" ]]; then
             log_error "Claude Code is installed but not logged in -- the build would stall instead of running."
             log_error "Log in once, then retry:"
             log_error "    claude login"
             log_error "(or set ANTHROPIC_API_KEY, or LOKI_SKIP_AUTH_PREFLIGHT=1 to bypass this check)"
             return 1
+        elif [[ "$_login_state" == "expired" ]]; then
+            log_error "Your Claude Code login has expired -- the build would stall instead of running."
+            log_error "Fix it in one step, then retry:"
+            log_error "    claude login"
+            log_error "(or set ANTHROPIC_API_KEY, or LOKI_SKIP_AUTH_PREFLIGHT=1 to bypass this check)"
+            return 1
         fi
+        # "loggedin" or "unknown" -> proceed (fail open on uncertainty).
     fi
 
     # CLI tools (claude, codex, cline, aider) use their own login sessions.
@@ -6396,52 +6520,108 @@ EFF_EOF
     [ ! -f "$completed_file" ] && echo "[]" > "$completed_file"
     [ ! -f "$failed_file" ] && echo "[]" > "$failed_file"
 
-    # Create completed task entry
-    local task_json=$(cat <<EOF
-{
-  "id": "$task_id",
-  "type": "iteration",
-  "title": "Iteration $iteration",
-  "status": "$([ "$exit_code" = "0" ] && echo "completed" || echo "failed")",
-  "completedAt": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
-  "exitCode": $exit_code,
-  "provider": "${PROVIDER_NAME:-claude}"
-}
-EOF
-)
-
-    # Add to appropriate queue
+    # Build the completed iteration record + move it out of in-progress, ATOMICALLY.
+    # v7.104.3 task-list accuracy fix: the old writer emitted a THIN body
+    # {id,type,title:"Iteration N",status,exitCode,provider} with no description
+    # and no logs, and then DELETED the rich in-progress record -- so the done
+    # column showed empty cards. We now LIFT the honest per-iteration parts (logs,
+    # startedAt) from the in-progress record BEFORE removing it, and give the card
+    # an HONEST iteration-scoped title/description derived from values in scope
+    # ($phase/$exit_code/$duration_ms). We deliberately do NOT reuse the borrowed
+    # PRD-story title: because pending stories never leave the queue, the
+    # in-progress title is always pending[0] ("server.js..."), so carrying it onto
+    # N done cards would falsely imply that story was built N times (fake-green).
+    # We also upsert-by-id (no cross-sub-run "iteration-1 x5" accumulation) and
+    # keep completed/failed mutually exclusive per id.
     local target_file="$completed_file"
-    [ "$exit_code" != "0" ] && target_file="$failed_file"
-
+    local other_file="$failed_file"
+    [ "$exit_code" != "0" ] && { target_file="$failed_file"; other_file="$completed_file"; }
+    local _completed_ts; _completed_ts="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+    _LOKI_TASK_ID="$task_id" \
+    _LOKI_ITER="$iteration" \
+    _LOKI_PHASE="$phase" \
+    _LOKI_EXIT="$exit_code" \
+    _LOKI_DUR="$duration_ms" \
+    _LOKI_PROVIDER="${PROVIDER_NAME:-claude}" \
+    _LOKI_COMPLETED_TS="$_completed_ts" \
+    _LOKI_TARGET="$target_file" \
+    _LOKI_OTHER="$other_file" \
+    _LOKI_INPROG="$in_progress_file" \
     python3 -c "
-import sys, json
+import json, os
+
+tid = os.environ['_LOKI_TASK_ID']
+it = os.environ['_LOKI_ITER']
+phase = os.environ.get('_LOKI_PHASE') or 'unknown'
+exit_code = os.environ.get('_LOKI_EXIT', '1')
+dur = os.environ.get('_LOKI_DUR', '')
+provider = os.environ.get('_LOKI_PROVIDER', 'claude')
+completed_ts = os.environ['_LOKI_COMPLETED_TS']
+target = os.environ['_LOKI_TARGET']
+other = os.environ['_LOKI_OTHER']
+inprog = os.environ['_LOKI_INPROG']
+ok = (exit_code == '0')
+
+def load(p):
+    try:
+        with open(p) as f:
+            d = json.load(f)
+        return d if isinstance(d, list) else (d.get('tasks', []) if isinstance(d, dict) else [])
+    except Exception:
+        return []
+
+# Lift the honest body from the in-progress record before removing it.
+prior = next((t for t in load(inprog) if isinstance(t, dict) and t.get('id') == tid), {})
+logs = prior.get('logs') if isinstance(prior.get('logs'), list) else []
+started = prior.get('startedAt')
+
+dur_s = ''
 try:
-    with open('$target_file', 'r') as f:
-        data = json.load(f)
-except:
-    data = []
-data.append($task_json)
-# Keep only last 50 entries
+    if dur not in ('', None):
+        _ms = int(float(dur))
+        dur_s = f\", {_ms}ms\" if _ms < 1000 else f\", {round(_ms/1000)}s\"
+except Exception:
+    dur_s = ''
+
+if ok:
+    title = f'Iteration {it} complete - {phase}'
+    desc = f'Iteration {it} finished cleanly in the {phase} phase (exit 0{dur_s}).'
+else:
+    title = f'Iteration {it} failed (exit {exit_code})'
+    desc = f'Iteration {it} ended in the {phase} phase with exit code {exit_code}{dur_s}.'
+
+entry = {
+    'id': tid,
+    'type': 'iteration',
+    'title': title,
+    'description': desc,
+    'status': 'completed' if ok else 'failed',
+    'phase': phase,
+    'completedAt': completed_ts,
+    'exitCode': int(exit_code) if str(exit_code).lstrip('-').isdigit() else exit_code,
+    'provider': provider,
+    'logs': logs,
+}
+if started:
+    entry['startedAt'] = started
+
+# Upsert-by-id into target (drop any stale same-id), cap at 50.
+data = [t for t in load(target) if not (isinstance(t, dict) and t.get('id') == tid)]
+data.append(entry)
 data = data[-50:]
-with open('$target_file', 'w') as f:
+with open(target, 'w') as f:
     json.dump(data, f, indent=2)
-" 2>/dev/null || echo "[$task_json]" > "$target_file"
 
-    # Remove from in-progress
-    if [ -f "$in_progress_file" ]; then
-        python3 -c "
-import sys, json
-try:
-    with open('$in_progress_file', 'r') as f:
-        data = json.load(f)
-    data = [t for t in data if t.get('id') != '$task_id']
-    with open('$in_progress_file', 'w') as f:
-        json.dump(data, f, indent=2)
-except:
-    pass
-" 2>/dev/null || true
-    fi
+# Mutual exclusion: remove this id from the OTHER terminal file.
+odata = [t for t in load(other) if not (isinstance(t, dict) and t.get('id') == tid)]
+with open(other, 'w') as f:
+    json.dump(odata, f, indent=2)
+
+# Remove from in-progress.
+idata = [t for t in load(inprog) if not (isinstance(t, dict) and t.get('id') == tid)]
+with open(inprog, 'w') as f:
+    json.dump(idata, f, indent=2)
+" 2>/dev/null || echo "[{\"id\":\"$task_id\",\"type\":\"iteration\",\"title\":\"Iteration $iteration\",\"status\":\"$([ "$exit_code" = "0" ] && echo completed || echo failed)\",\"completedAt\":\"$_completed_ts\",\"exitCode\":$exit_code,\"provider\":\"${PROVIDER_NAME:-claude}\"}]" > "$target_file"
 
     # BUG-ST-014: Atomic current-task.json clear via temp file + mv
     local ct_tmp=".loki/queue/current-task.json.tmp.$$"
@@ -19023,7 +19203,7 @@ main() {
             _handoff_dir="${TARGET_DIR:-.}"
             _handoff_md="$_handoff_dir/HANDOFF.md"
             _handoff_tmp="$_handoff_dir/.HANDOFF.md.tmp"
-            if python3 "$_own_render" --loki-dir "$LOKI_DIR" --md > "$_handoff_tmp" 2>/dev/null; then
+            if python3 "$_own_render" --loki-dir "${LOKI_DIR:-${TARGET_DIR:-.}/.loki}" --md > "$_handoff_tmp" 2>/dev/null; then
                 mv -f "$_handoff_tmp" "$_handoff_md" 2>/dev/null || rm -f "$_handoff_tmp" 2>/dev/null || true
             else
                 rm -f "$_handoff_tmp" 2>/dev/null || true

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "7.104.1"
+__version__ = "7.104.3"
 
 # Expose the control app for easy import
 try:

package/dashboard/server.py

@@ -1816,10 +1816,30 @@ async def list_tasks(
                     }
                     for _f in ("acceptance_criteria", "notes", "logs", "user_story",
                                "project", "source", "specification", "provider",
-                               "startedAt", "full_content"):
+                               "startedAt", "full_content",
+                               # v7.104.3: iteration terminal fields so the card
+                               # can show real outcome (and the read-time honest
+                               # description synthesis for legacy thin markers can
+                               # see exitCode). exitCode may be 0, which is falsy,
+                               # so it is guarded separately below.
+                               "completedAt", "phase", "exitCode"):
                         _v = task.get(_f)
                         if _v not in (None, "", [], {}):
                             task_entry[_f] = _v
+                    # exitCode == 0 is a real, meaningful value but falsy; the
+                    # loop above drops it via the "not in" filter, so carry it
+                    # explicitly when the source record has the key at all.
+                    if "exitCode" in task and task.get("exitCode") == 0:
+                        task_entry["exitCode"] = 0
+                    # v7.104.3: preserve the record's OWN terminal outcome. Both
+                    # the "completed" and "failed" groups map to the "done"
+                    # column, so `status` alone can no longer tell success from
+                    # failure. The honest-description synthesis and the dedup
+                    # tie-break both need to distinguish them, and NEVER call a
+                    # failed iteration "completed" (fake-green). Derived from the
+                    # source group key, which is authoritative.
+                    if group_key in ("completed", "failed"):
+                        task_entry["_terminal_outcome"] = group_key
                     all_tasks.append(task_entry)
         except (json.JSONDecodeError, KeyError):
             pass
@@ -1846,12 +1866,32 @@ async def list_tasks(
                         items = raw_items
                     else:
                         items = []
+                    # v7.104.3: which terminal outcome (if any) does THIS queue
+                    # file represent? completed.json -> completed; failed/dead-
+                    # letter -> failed. Non-terminal files (pending/in-progress)
+                    # have none.
+                    _qf_terminal = None
+                    if queue_file == "completed.json":
+                        _qf_terminal = "completed"
+                    elif queue_file in ("failed.json", "dead-letter.json"):
+                        _qf_terminal = "failed"
                     if isinstance(items, list):
                         for i, item in enumerate(items):
                             if isinstance(item, dict):
                                 tid = item.get("id", f"q-{q_status}-{i}")
-                                # Skip if already in all_tasks
-                                if any(t["id"] == tid for t in all_tasks):
+                                # Skip if already in all_tasks -- EXCEPT for
+                                # terminal (completed/failed) records. v7.104.3:
+                                # the old unconditional skip dropped a failed
+                                # sibling before it could be tagged with
+                                # _terminal_outcome, so the failed-outranks-
+                                # completed dedup below never saw it and a
+                                # completed card masked a real failure (a
+                                # fake-green from the queue source). Let terminal
+                                # records always enter, tagged; the global dedup
+                                # then resolves the collision honestly. Non-
+                                # terminal records keep the skip (they cannot
+                                # override an existing terminal entry anyway).
+                                if _qf_terminal is None and any(t["id"] == tid for t in all_tasks):
                                     continue
                                 task_entry = {
                                     "id": tid,
@@ -1876,6 +1916,20 @@ async def list_tasks(
                                     task_entry["notes"] = item["notes"]
                                 if isinstance(item.get("logs"), list):
                                     task_entry["logs"] = item["logs"]
+                                # v7.104.3: iteration terminal fields + the
+                                # source-file terminal outcome, so the honest
+                                # description synthesis can distinguish a clean
+                                # exit from a failure and never mislabels a
+                                # failed iteration "completed".
+                                for _qf in ("provider", "startedAt", "completedAt", "phase"):
+                                    if item.get(_qf) not in (None, "", [], {}):
+                                        task_entry[_qf] = item[_qf]
+                                if "exitCode" in item and isinstance(item.get("exitCode"), int):
+                                    task_entry["exitCode"] = item["exitCode"]
+                                if queue_file == "completed.json":
+                                    task_entry["_terminal_outcome"] = "completed"
+                                elif queue_file in ("failed.json", "dead-letter.json"):
+                                    task_entry["_terminal_outcome"] = "failed"
                                 all_tasks.append(task_entry)
                 except (json.JSONDecodeError, KeyError):
                     pass
@@ -1903,6 +1957,95 @@ async def list_tasks(
                 except Exception:
                     pass
 
+    # v7.104.3 task-list accuracy: global dedup-by-id with a terminal-wins rule.
+    # The dashboard-state.json groups (read first, above) can carry the same id in
+    # more than one column when the underlying queue files hold stale entries -
+    # e.g. real anonima data showed iteration-13 in BOTH inProgress and completed,
+    # and completed listing iteration-1 five times (a pre-fix blind-append run).
+    # The run.sh write-side fix (upsert-by-id + terminal mutual-exclusion) stops
+    # NEW collisions, but the dashboard must render correctly against state that
+    # was written before the fix, or during a partial write. We keep, per id, the
+    # single most-authoritative entry.
+    #
+    # Priority is TERMINAL-WINS, deliberately NOT the naive
+    # in_progress > pending > done: the reported symptom is a completed iteration
+    # still showing in in-progress/todo, so letting in_progress outrank done would
+    # perpetuate exactly that bug. A record that reached a terminal state (has a
+    # completedAt, i.e. status == done) is the truth for that id; among non-terminal
+    # states we fall back to in_progress > review > pending. This is safe globally
+    # here because pending PRD-story ids (prd-NNN) and iteration ids (iteration-N)
+    # never share an id, so no task is legitimately both pending and done.
+    #
+    # Within the terminal (done) column, a same-id collision between a completed
+    # and a failed record must resolve to FAILED, never completed: masking a real
+    # failure behind a success is a fake-green the trust model forbids. So the
+    # authority key is a 2-tuple (column-rank, terminal-outcome-rank) where a
+    # failed terminal record outranks a completed one; non-terminal states carry a
+    # neutral 0 in the second slot.
+    _rank = {"done": 3, "in_progress": 2, "review": 1, "pending": 0}
+    _term = {"failed": 1, "completed": 0}
+
+    def _authority(_task):
+        return (_rank.get(_task.get("status"), -1),
+                _term.get(_task.get("_terminal_outcome"), 0))
+
+    _by_id: dict = {}
+    _order: list = []
+    for _t in all_tasks:
+        _id = _t.get("id")
+        if _id is None:
+            _order.append(_t)  # cannot dedup an id-less entry; keep as-is
+            continue
+        _prev = _by_id.get(_id)
+        if _prev is None:
+            _by_id[_id] = _t
+            _order.append(_id)
+        elif _authority(_t) > _authority(_prev):
+            _by_id[_id] = _t  # higher-authority state replaces in place (order kept)
+    all_tasks = [t if not isinstance(t, str) else _by_id[t] for t in _order]
+
+    # v7.104.3 task-list accuracy: HONEST render-time description for legacy
+    # iteration cards. Iterations completed BEFORE the run.sh write-side fix were
+    # persisted as thin markers - they carry real captured fields (status,
+    # exitCode, provider, completedAt) but no description or logs, so they render
+    # as empty "Iteration N" cards with nothing inside (the exact symptom the
+    # dashboard showed). These iterations will never re-run, so the write-side
+    # fix cannot backfill them. We synthesize a one-line description at READ time
+    # from the fields that ARE present - never mutating the stored state (no
+    # fabrication, fully reversible) and never inventing an outcome the record
+    # does not attest. New (post-fix) cards already carry a real description and
+    # are left untouched.
+    for _t in all_tasks:
+        if _t.get("type") == "iteration" and not _t.get("description"):
+            _ec = _t.get("exitCode")
+            _prov = _t.get("provider")
+            # The record's OWN terminal outcome (completed vs failed) is
+            # authoritative. Both map to the "done" column, so status alone can
+            # not tell them apart - a failed iteration must NEVER be described as
+            # "completed" (fake-green). Prefer the exit code when it is a real
+            # integer; otherwise fall back to the terminal outcome; and when even
+            # that is absent, use a neutral verb that asserts no success.
+            _failed = (_t.get("_terminal_outcome") == "failed")
+            _outcome = None
+            if isinstance(_ec, int) and _ec == 0 and not _failed:
+                _outcome = "completed cleanly (exit 0)"
+            elif isinstance(_ec, int) and _ec != 0:
+                _outcome = f"failed (exit {_ec})"
+            elif _failed:
+                # failed record without a usable exit code: honest, no exit claim
+                _outcome = "failed"
+            elif _t.get("_terminal_outcome") == "completed":
+                _outcome = "completed"
+            elif _t.get("status") == "done":
+                # terminal but neither outcome nor exit code is known: neutral
+                # verb that does not assert success or failure
+                _outcome = "finished"
+            if _outcome:
+                _desc = f"Iteration {_outcome}"
+                if _prov:
+                    _desc += f", built by {_prov}"
+                _t["description"] = _desc + "."
+
     # Apply project_id filter if provided
     if project_id is not None:
         all_tasks = [t for t in all_tasks if t.get("project_id") == project_id]

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 The flagship product of [Autonomi](https://www.autonomi.dev/). Loki Mode is a spec-driven autonomous builder with a built-in trust layer that takes any spec to a deployed product and verifies completion with evidence (quality gates plus a completion council), not just a "done" claim. Complete installation instructions for all platforms and use cases.
 
-**Version:** v7.104.1
+**Version:** v7.104.3
 
 ---