loki-mode 7.128.1 → 7.129.0

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: Autonomous spec-driven build system with a built-in trust layer. It does not call work done until it is verified (RARV-C closure loop, 8 quality gates, completion council, verified-completion evidence gate). Triggers on "Loki Mode". Takes a spec (PRD, GitHub issue, OpenAPI doc, etc.) to deployed product with minimal human intervention. Provider-agnostic. Requires --dangerously-skip-permissions flag.
 ---
 
-# Loki Mode v7.128.1
+# Loki Mode v7.129.0
 
 **You are an autonomous agent. You make decisions. You do not ask questions. You do not stop.**
 
@@ -408,4 +408,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v7.128.1 | [Autonomi](https://www.autonomi.dev/) flagship product | ~260 lines core**
+**v7.129.0 | [Autonomi](https://www.autonomi.dev/) flagship product | ~260 lines core**

package/VERSION

@@ -1 +1 @@
-7.128.1
+7.129.0

package/autonomy/council-v2.sh

@@ -296,7 +296,47 @@ Respond ONLY with a valid JSON object. No markdown fencing."
                 # inline prefix here is belt-and-suspenders so the carve-out is
                 # self-documenting and robust to sourcing order. No-op when caveman
                 # is absent.
-                result=$(echo "$full_prompt" | CAVEMAN_DEFAULT_MODE=off claude "${_c2_argv[@]}" -p 2>/dev/null || echo '{"verdict":"REJECT","reasoning":"review execution failed","issues":[]}')
+                #
+                # STRUCTURED VERDICT (v8.x): when the CLI supports --json-schema,
+                # force valid JSON so the sed-carve below never has to rescue
+                # prose-wrapped output. --json-schema takes INLINE content, not a
+                # path (CLI 2.1.207 rejects a path). On any failure fall through to
+                # the plain -p call + sed-carve (unchanged, fail-closed to REJECT).
+                # Opt out LOKI_REVIEW_JSON_SCHEMA=off. claude branch only.
+                local _c2_schema_dir _c2_schema
+                _c2_schema_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+                _c2_schema="${_c2_schema_dir}/loki-ts/data/council-v2-schema.json"
+                result=""
+                if [ "${LOKI_REVIEW_JSON_SCHEMA:-on}" != "off" ] && [ -f "$_c2_schema" ] \
+                   && type loki_claude_flag_supported >/dev/null 2>&1 \
+                   && loki_claude_flag_supported "--json-schema"; then
+                    local _c2_schema_content _c2_json
+                    _c2_schema_content="$(cat "$_c2_schema" 2>/dev/null)" || _c2_schema_content=""
+                    if [ -n "$_c2_schema_content" ]; then
+                        _c2_json="$(echo "$full_prompt" | CAVEMAN_DEFAULT_MODE=off claude "${_c2_argv[@]}" -p \
+                            --json-schema "$_c2_schema_content" --output-format json 2>/dev/null)" || _c2_json=""
+                        if [ -n "$_c2_json" ]; then
+                            # Pull the schema-validated object out of the envelope.
+                            result="$(printf '%s' "$_c2_json" | python3 -c 'import sys,json
+try:
+    e=json.load(sys.stdin)
+    p=e.get("structured_output")
+    if not isinstance(p,dict):
+        r=e.get("result")
+        p=json.loads(r) if isinstance(r,str) else None
+    if isinstance(p,dict) and str(p.get("verdict","")).upper() in ("APPROVE","REJECT"):
+        sys.stdout.write(json.dumps(p))
+    else:
+        sys.exit(1)
+except Exception:
+    sys.exit(1)' 2>/dev/null)" || result=""
+                        fi
+                    fi
+                fi
+                # Fall through to the plain text call (+ sed-carve) on any miss.
+                if [ -z "$result" ]; then
+                    result=$(echo "$full_prompt" | CAVEMAN_DEFAULT_MODE=off claude "${_c2_argv[@]}" -p 2>/dev/null || echo '{"verdict":"REJECT","reasoning":"review execution failed","issues":[]}')
+                fi
             else
                 result='{"verdict":"REJECT","reasoning":"reviewer CLI unavailable","issues":[]}'
             fi

package/autonomy/lib/cockpit-render.sh

@@ -131,20 +131,46 @@ fleet = []
 runs = []
 try:
     from dashboard import registry
+    # Self-heal: mark dead-pid "running" zombies as stopped before reading the
+    # fleet, so the cockpit does not show 100+ frozen "BUILDING" entries from
+    # reaped/crashed sessions. Best-effort; a failure here never blocks the render.
+    try:
+        registry.reconcile_stale_runs()
+    except Exception:
+        pass
     runs = registry.get_fleet_runs(include_inactive=True)
 except Exception:
     runs = []
 
 for r in runs:
+    _running = bool(r.get("running"))
+    _status = (r.get("status") or "").lower()
+    # A not-running entry must not display an in-flight phase (BUILDING/etc): the
+    # reconciled registry status is authoritative for dead runs, so a stopped or
+    # stale run shows its status, not a frozen phase left in a stale state file.
+    if _running:
+        _phase = r.get("phase", "") or ""
+    elif _status in ("stale", "stopped", "completed", "failed"):
+        _phase = _status
+    else:
+        _phase = r.get("phase", "") or _status
     fleet.append({
         "name": r.get("name") or os.path.basename(r.get("path", "") or "project"),
         "path": r.get("path", "") or "",
-        "phase": r.get("phase", "") or "",
+        "phase": _phase,
         "iteration": r.get("iteration", 0) or 0,
         "status": r.get("status", "") or "",
-        "running": bool(r.get("running")),
+        "running": _running,
     })
 
+# Live-first ordering: running builds, then everything else by most-recent.
+# Keeps the useful runs at the top when the fleet has many stopped/stale entries.
+def _fleet_sort_key(e):
+    st = (e.get("status") or "").lower()
+    rank = 0 if e.get("running") else (1 if st not in ("stale", "stopped") else 2)
+    return (rank, -(e.get("iteration") or 0))
+fleet.sort(key=_fleet_sort_key)
+
 # Focused run: --repo wins; else first running fleet run; else cwd.
 focus_path = focus or cwd
 focus_entry = None

package/autonomy/lib/cr-rematerialize.py

@@ -0,0 +1,120 @@
+#!/usr/bin/env python3
+"""Re-materialize a `claude --json-schema --output-format json` code-review
+envelope into the LEGACY 'VERDICT: X\\nFINDINGS:\\n- [severity] description'
+text, so the downstream text parsers (_classify_verdict, _severity_is_blocking,
+_count_nonblocking_findings in autonomy/run.sh, and the TS mirror) stay
+byte-identical. This is the adapter that lets the code-review verdict path adopt
+structured output WITHOUT rewriting any consumer.
+
+Contract:
+- Reads the raw CLI envelope JSON from env _LOKI_CR_JSON (or stdin if unset).
+- Writes legacy text to the path in env _LOKI_CR_OUT (or stdout if unset).
+- FAIL-CLOSED: exits non-zero on ANY structural miss so the bash caller falls
+  through to the text path. NEVER emits 'VERDICT: PASS' on a miss.
+- T1 SAFETY (cross-field enforcement JSON Schema cannot express): if ANY finding
+  is Critical or High, the verdict is FORCED to FAIL regardless of the model's
+  emitted verdict token. A self-contradictory PASS+Critical can never be waved
+  through as non-blocking.
+
+Live-verified envelope shape (claude 2.1.207): top-level 'structured_output'
+object is the payload; 'result' is the same JSON as a string (fallback);
+'stop_reason' is 'tool_use' for a valid structured turn.
+
+Exit codes (all non-zero == fail-closed, caller falls through to text):
+  0 success   2 no input/output target   3 envelope not JSON / not a dict
+  4 wrong stop_reason   5 no usable payload   6 missing/invalid verdict
+  7 write error
+"""
+import json
+import os
+import sys
+
+_BLOCKING = {"CRITICAL", "HIGH"}
+
+
+def rematerialize(raw):
+    """Return legacy VERDICT/FINDINGS text, or raise ValueError(exit_code)."""
+    try:
+        env = json.loads(raw)
+    except Exception:
+        raise ValueError(3)
+    if not isinstance(env, dict):
+        raise ValueError(3)
+
+    # A valid structured turn ends with tool_use. A refusal / max_tokens / other
+    # stop_reason means the schema was not honored -> fail-closed.
+    if env.get("stop_reason") not in (None, "tool_use"):
+        raise ValueError(4)
+
+    payload = env.get("structured_output")
+    if not isinstance(payload, dict):
+        res = env.get("result")
+        if isinstance(res, str):
+            try:
+                payload = json.loads(res)
+            except Exception:
+                payload = None
+    if not isinstance(payload, dict):
+        raise ValueError(5)
+
+    verdict = str(payload.get("verdict", "")).strip().upper()
+    if verdict not in ("PASS", "FAIL"):
+        raise ValueError(6)
+
+    findings = payload.get("findings")
+    if not isinstance(findings, list):
+        findings = []
+
+    body = []
+    has_blocking = False
+    for f in findings:
+        if not isinstance(f, dict):
+            continue
+        sev = str(f.get("severity", "")).strip()
+        desc = str(f.get("description", "")).strip()
+        if not sev or not desc:
+            continue
+        if sev.upper() in _BLOCKING:
+            has_blocking = True
+        # Bracketed severity form matches _severity_is_blocking /
+        # _count_nonblocking_findings regexes exactly.
+        body.append("- [" + sev + "] " + desc)
+
+    # T1: a Critical/High finding forces FAIL even if the model said PASS.
+    if has_blocking:
+        verdict = "FAIL"
+
+    lines = ["VERDICT: " + verdict, "FINDINGS:"]
+    if body:
+        lines.extend(body)
+    else:
+        lines.append("- None")
+    return "\n".join(lines) + "\n"
+
+
+def main():
+    raw = os.environ.get("_LOKI_CR_JSON")
+    if raw is None:
+        raw = sys.stdin.read()
+    out_path = os.environ.get("_LOKI_CR_OUT", "")
+    if not raw:
+        return 2
+
+    try:
+        text = rematerialize(raw)
+    except ValueError as e:
+        return int(e.args[0])
+
+    if out_path:
+        try:
+            with open(out_path, "w") as fp:
+                fp.write(text)
+        except OSError:
+            return 7
+    else:
+        sys.stdout.write(text)
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/autonomy/lib/done-recognition.sh

@@ -51,6 +51,54 @@
 _loki_done_recog_invoke() {
     local prompt="$1"
     command -v claude >/dev/null 2>&1 || return 1
+
+    # STRUCTURED VERDICT (v8.x): when the CLI supports --json-schema, force valid
+    # JSON so parse_object never has to brace-slice prose. --json-schema takes
+    # INLINE content, not a path (CLI 2.1.207 rejects a path). On any miss (flag
+    # unsupported, empty, no structured_output) fall through to the plain -p call
+    # below; parse_object then handles it and defaults to inconclusive (safe).
+    # Opt out LOKI_REVIEW_JSON_SCHEMA=off.
+    local _dr_schema_dir _dr_schema
+    _dr_schema_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+    _dr_schema="${_dr_schema_dir}/loki-ts/data/done-recognition-schema.json"
+    if [ "${LOKI_REVIEW_JSON_SCHEMA:-on}" != "off" ] && [ -f "$_dr_schema" ] \
+       && type loki_claude_flag_supported >/dev/null 2>&1 \
+       && loki_claude_flag_supported "--json-schema"; then
+        local _dr_schema_content _dr_json _dr_obj
+        _dr_schema_content="$(cat "$_dr_schema" 2>/dev/null)" || _dr_schema_content=""
+        if [ -n "$_dr_schema_content" ]; then
+            if command -v timeout >/dev/null 2>&1; then
+                _dr_json=$(CAVEMAN_DEFAULT_MODE=off timeout "${LOKI_DONE_RECOG_TIMEOUT}" \
+                    claude --dangerously-skip-permissions -p "$prompt" \
+                    --json-schema "$_dr_schema_content" --output-format json 2>/dev/null) || _dr_json=""
+            else
+                _dr_json=$(CAVEMAN_DEFAULT_MODE=off \
+                    claude --dangerously-skip-permissions -p "$prompt" \
+                    --json-schema "$_dr_schema_content" --output-format json 2>/dev/null) || _dr_json=""
+            fi
+            if [ -n "$_dr_json" ]; then
+                _dr_obj=$(printf '%s' "$_dr_json" | python3 -c 'import sys,json
+try:
+    e=json.load(sys.stdin)
+    p=e.get("structured_output")
+    if not isinstance(p,dict):
+        r=e.get("result")
+        p=json.loads(r) if isinstance(r,str) else None
+    if isinstance(p,dict) and "requirements" in p:
+        sys.stdout.write(json.dumps(p))
+    else:
+        sys.exit(1)
+except Exception:
+    sys.exit(1)' 2>/dev/null) || _dr_obj=""
+                if [ -n "$_dr_obj" ]; then
+                    printf '%s' "$_dr_obj"
+                    return 0
+                fi
+            fi
+        fi
+        # fall through to the plain text call (parse_object handles it, inconclusive-safe)
+    fi
+
     local rc=0
     local out=""
     if command -v timeout >/dev/null 2>&1; then

package/autonomy/lib/voter-agents.sh

@@ -2,7 +2,7 @@
 # autonomy/lib/voter-agents.sh -- Phase C (v7.5.20) bash side.
 #
 # Builds the JSON declaration of the council voter agents and orchestrates a
-# single `claude --agents <json> --json-schema <path>` dispatch per iteration.
+# single `claude --agents <json> --json-schema <inline-content>` dispatch per iteration.
 # Replaces the ad-hoc per-voter heuristic loop in council_aggregate_votes when
 # the locally installed Claude CLI supports both flags.
 #
@@ -176,7 +176,7 @@ loki_finding_schema_path() {
 #      --json-schema in `claude --help`. Either missing -> return 1 (fallback).
 #   2. Build the agents JSON via loki_voter_agents_json.
 #   3. Invoke `claude --dangerously-skip-permissions -p <prompt>
-#                    --agents <json> --json-schema <path>` and capture stdout.
+#                    --agents <json> --json-schema <inline-content>` and capture stdout.
 #      Any non-zero exit or empty stdout -> return 1 (fallback).
 #   4. Parse the response via python3 (no jq dependency): extract
 #      findings[].{role, vote, reason, confidence}. On parse failure -> 1.
@@ -236,6 +236,16 @@ loki_council_dispatch_agents() {
     local schema_path
     schema_path=$(loki_finding_schema_path) || return 1
 
+    # v8.x FIX: `claude --json-schema` takes the schema JSON as INLINE CONTENT,
+    # not a file path. Live-verified on CLI 2.1.207: passing a path errors with
+    # "--json-schema is not valid JSON: Unrecognized token '/'" -> rc!=0 ->
+    # fail-closed to the heuristic path, so this structured dispatch was SILENTLY
+    # DEAD (never actually schema-constrained the council). Read the file and pass
+    # its content. Fail-closed if unreadable/empty (return 1 -> heuristic path).
+    local schema_content
+    schema_content=$(cat "$schema_path" 2>/dev/null) || return 1
+    [ -n "$schema_content" ] || return 1
+
     # 3. Invoke claude. Guard against absent binary or non-zero exit.
     command -v claude >/dev/null 2>&1 || return 1
 
@@ -274,7 +284,7 @@ loki_council_dispatch_agents() {
                       env CAVEMAN_DEFAULT_MODE=off claude --dangerously-skip-permissions \
                       -p "$prompt" \
                       --agents "$agents_json" \
-                      --json-schema "$schema_path" 2>"$stderr_log") || rc=$?
+                      --json-schema "$schema_content" 2>"$stderr_log") || rc=$?
     if [ "$rc" -ne 0 ] || [ -z "$response" ]; then
         return 1
     fi

package/autonomy/loki

@@ -826,7 +826,7 @@ show_help() {
     echo "New here? Try these in order:"
     echo "  loki doctor               Check your setup is ready (a few seconds)"
     echo "  loki quickstart           Guided first build from your idea (no PRD needed)"
-    echo "  loki start ./prd.md       Build from a spec (PRD file, GitHub issue, or no arg)"
+    echo "  loki start ./prd.md       Build from a spec (PRD file, GitHub/GitLab/Jira/Azure issue, or no arg)"
     echo "  quickstart = guided first build; quick = one small task (3 iters max)."
     echo "  Docs: https://github.com/asklokesh/loki-mode  |  Report a problem: loki crash"
     echo ""
@@ -846,7 +846,7 @@ show_help() {
     echo "Commands:"
     echo ""
     echo "Build:"
-    echo "  start [SPEC]     Start a build (PRD file, GitHub issue, or no arg)"
+    echo "  start [SPEC]     Start a build (PRD file, GitHub/GitLab/Jira/Azure issue, or no arg)"
     echo "  plan <PRD-file>  Dry-run analysis: complexity, cost, execution plan"
     echo "  quickstart [idea]  Guided first build: setup, idea, template, plan, go"
     echo ""
@@ -1043,7 +1043,7 @@ show_landing() {
     echo -e "  ${CYAN}loki tour${NC}             See a real result now (no provider, no key, no spend)"
     echo -e "  ${CYAN}loki doctor${NC}           Check your setup is ready (a few seconds)"
     echo -e "  ${CYAN}loki quickstart${NC}       Guided first build from your idea (no PRD needed)"
-    echo -e "  ${CYAN}loki start ./prd.md${NC}   Build from a spec (PRD file, GitHub issue, or no arg)"
+    echo -e "  ${CYAN}loki start ./prd.md${NC}   Build from a spec (PRD file, GitHub/GitLab/Jira/Azure issue, or no arg)"
     echo "  quickstart = guided first build; quick = one small task (3 iters max)."
     echo ""
     echo -e "Need help? ${CYAN}loki help${NC} lists every command."
@@ -8821,7 +8821,13 @@ if council:
 fleet = s.get('fleet') or []
 if fleet:
     cap = 8  # cap so a huge registry (e.g. 171 runs) never floods the summary
-    print(f"  Fleet ({len(fleet)}):")
+    active = sum(1 for r in fleet if r.get("running"))
+    # Header shows active vs total so a long tail of finished/stale runs reads
+    # honestly (e.g. "0 active / 136 total") instead of an alarming bare count.
+    if active:
+        print(f"  Fleet ({active} active / {len(fleet)} total):")
+    else:
+        print(f"  Fleet ({len(fleet)} total, none active):")
     for r in fleet[:cap]:
         mark = "*" if r.get("running") else " "
         print(f"    {mark} {r.get('name','?'):<28} iter {r.get('iteration',0)}  {r.get('phase') or r.get('status') or ''}")

package/autonomy/run.sh

@@ -5911,8 +5911,15 @@ compute_codebase_signature() {
           # truncating the output and misaligning the path<->hash pairing. Drop
           # them; their removal from the list is itself the detected change.
           gitc_deleted=$(git ls-files --deleted -z 2>/dev/null | tr '\0' '\n')
+          # Exclude .loki/ AND Loki's own session-end artifacts (HANDOFF.md,
+          # USAGE.md) written+committed to the repo ROOT by the completion path
+          # (LOKI_HANDOFF / commit_session_changes, both default-on). Those are
+          # runtime OUTPUT of the session, not user codebase; counting them would
+          # make the next PRD-reuse check see a spurious "codebase changed" and
+          # flip reuse->update (the signature is persisted per-iteration BEFORE
+          # the after-loop HANDOFF write, so it can never account for them).
           gitc_paths=$( { git ls-files -z 2>/dev/null; git ls-files --others --exclude-standard -z 2>/dev/null; } \
-              | tr '\0' '\n' | grep -vE '(^|/)\.loki(/|$)' | LC_ALL=C sort -u )
+              | tr '\0' '\n' | grep -vE '(^|/)\.loki(/|$)|^HANDOFF\.md$|^USAGE\.md$' | LC_ALL=C sort -u )
           if [ -n "$gitc_deleted" ]; then
               gitc_paths=$(printf '%s\n' "$gitc_paths" | grep -vxF -f <(printf '%s\n' "$gitc_deleted") || true)
           fi
@@ -5933,6 +5940,7 @@ compute_codebase_signature() {
                          -o -name build -o -name .next -o -name target -o -name vendor \
                          -o -name __pycache__ -o -name .venv -o -name venv \) -prune -o \
               -type f -print 2>/dev/null \
+              | grep -vE '^\./(HANDOFF|USAGE)\.md$' \
               | while IFS= read -r f; do
                     local sz
                     sz=$(stat -f%z "$f" 2>/dev/null || stat -c%s "$f" 2>/dev/null || echo 0)
@@ -9658,8 +9666,16 @@ sys.stdout.write(t.strip())
             local output
             # Pass matched files explicitly (node --test globbing is
             # Node-version-sensitive); quote each so paths with spaces survive.
+            # Force --test-reporter=tap: Node 20+ made the human "spec" reporter
+            # the default for a TTY and Node 26 emits it even under capture
+            # ("i pass N" / check+cross marks) instead of the TAP "# pass N" /
+            # "ok N - " lines that BOTH the count parser below AND
+            # _loki_zero_tests_executed rely on. TAP has been stable since Node 18,
+            # so forcing it restores a deterministic, version-independent format
+            # without touching any parser. Older node ignores nothing here (tap is
+            # a valid built-in reporter on every supported version).
             output=$(cd "${TARGET_DIR:-.}" && timeout "${LOKI_GATE_TIMEOUT:-300}" \
-                         node --test "${_nt_files[@]}" 2>&1) || test_passed=false
+                         node --test --test-reporter=tap "${_nt_files[@]}" 2>&1) || test_passed=false
             # tail -14 so node's TAP summary block (# tests / # pass N / # fail N,
             # ~10 lines) survives truncation for the best-effort count parse below.
             details="node --test: $(echo "$output" | tail -14 | tr '\n' ' ')"
@@ -10994,6 +11010,39 @@ _dispatch_reviewer() {
             # then deletes its flag and emits nothing). Set inline, not via
             # the helper, so the carve-out holds even when the helper is
             # out of scope. No-op when caveman is absent.
+            # STRUCTURED VERDICT (v8.x): when the CLI supports --json-schema,
+            # force valid JSON and re-materialize the LEGACY VERDICT/FINDINGS text
+            # so every downstream consumer (_classify_verdict,
+            # _severity_is_blocking, _count_nonblocking_findings, mergeability,
+            # DA arm, aggregate.json) stays byte-identical. Fail-closed: any
+            # failure falls through to the text path below (which itself may leave
+            # an empty file -> NO_VERDICT -> inconclusive block). NEVER a PASS on a
+            # miss. --json-schema takes INLINE content, not a path (CLI 2.1.207
+            # rejects a path). Opt out with LOKI_REVIEW_JSON_SCHEMA=off.
+            local _cr_root _cr_here _cr_schema _cr_remat
+            _cr_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+            _cr_here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+            _cr_schema="${_cr_root}/loki-ts/data/code-review-schema.json"
+            _cr_remat="${_cr_here}/lib/cr-rematerialize.py"
+            if [ "${LOKI_REVIEW_JSON_SCHEMA:-on}" != "off" ] \
+               && [ -f "$_cr_schema" ] && [ -f "$_cr_remat" ] \
+               && type loki_claude_flag_supported >/dev/null 2>&1 \
+               && loki_claude_flag_supported "--json-schema"; then
+                local _cr_schema_content _cr_json _cr_rc=0
+                _cr_schema_content="$(cat "$_cr_schema" 2>/dev/null)" || _cr_schema_content=""
+                if [ -n "$_cr_schema_content" ]; then
+                    _cr_json="$(CAVEMAN_DEFAULT_MODE=off \
+                        claude "${_rv_argv[@]}" -p "$prompt_text" \
+                            --json-schema "$_cr_schema_content" \
+                            --output-format json 2>/dev/null)" || _cr_rc=$?
+                    if [ "$_cr_rc" -eq 0 ] && [ -n "$_cr_json" ] \
+                       && _LOKI_CR_JSON="$_cr_json" _LOKI_CR_OUT="$review_output" \
+                          python3 "$_cr_remat"; then
+                        return 0
+                    fi
+                fi
+                # fall through to the text path below (fail-closed)
+            fi
             CAVEMAN_DEFAULT_MODE=off \
             claude "${_rv_argv[@]}" -p "$prompt_text" \
                 --output-format text > "$review_output" 2>/dev/null

package/autonomy/verify.sh

@@ -427,6 +427,14 @@ _verify_zero_tests_executed() {
 verify_gate_tests() {
     local tree="$1"
     local timeout_s="${LOKI_GATE_TIMEOUT:-300}"
+    # Bounded-exec prefix: "timeout <secs>" / "gtimeout <secs>", or EMPTY when
+    # neither is on PATH (bare macOS, or a shadowed PATH). A bare `timeout ...`
+    # would exit 127 (command not found) and be misread as a test FAILURE ->
+    # spurious BLOCKED verdict. Degrade to running without a wall-clock cap
+    # instead. Mirrors run.sh's with_timeout discipline.
+    local _vt_bin _vt
+    _vt_bin="$(_verify_runtime_timeout_bin)"
+    if [ -n "$_vt_bin" ]; then _vt="$_vt_bin $timeout_s"; else _vt=""; fi
     local runner="none"
     local rc=0
     local out=""
@@ -434,13 +442,13 @@ verify_gate_tests() {
     if [ -f "$tree/package.json" ]; then
         if grep -q '"vitest"' "$tree/package.json" 2>/dev/null; then
             runner="vitest"
-            out="$(cd "$tree" && timeout "$timeout_s" npx vitest run 2>&1)" || rc=$?
+            out="$(cd "$tree" && $_vt npx vitest run 2>&1)" || rc=$?
         elif grep -q '"jest"' "$tree/package.json" 2>/dev/null; then
             runner="jest"
-            out="$(cd "$tree" && timeout "$timeout_s" npx jest --passWithNoTests --forceExit 2>&1)" || rc=$?
+            out="$(cd "$tree" && $_vt npx jest --passWithNoTests --forceExit 2>&1)" || rc=$?
         elif grep -q '"mocha"' "$tree/package.json" 2>/dev/null; then
             runner="mocha"
-            out="$(cd "$tree" && timeout "$timeout_s" npx mocha 2>&1)" || rc=$?
+            out="$(cd "$tree" && $_vt npx mocha 2>&1)" || rc=$?
         fi
     fi
 
@@ -480,7 +488,7 @@ verify_gate_tests() {
         if [ "$has_python" = "true" ]; then
             if command -v pytest >/dev/null 2>&1; then
                 runner="pytest"
-                out="$(cd "$tree" && timeout "$timeout_s" pytest --tb=short 2>&1)" || rc=$?
+                out="$(cd "$tree" && $_vt pytest --tb=short 2>&1)" || rc=$?
             elif command -v python3 >/dev/null 2>&1; then
                 # #139 parity: pytest ABSENT but a Python suite exists -> run it with
                 # stdlib unittest (zero third-party deps) instead of going blindly
@@ -490,7 +498,7 @@ verify_gate_tests() {
                 # a "Ran 0 tests" line detected by the zero-test guard on the run.sh
                 # mirror) so this never green-washes an empty suite.
                 runner="unittest"
-                out="$(cd "$tree" && timeout "$timeout_s" python3 -m unittest discover -p 'test_*.py' 2>&1)" || rc=$?
+                out="$(cd "$tree" && $_vt python3 -m unittest discover -p 'test_*.py' 2>&1)" || rc=$?
             else
                 # Applicable but cannot run -> inconclusive (Entanglement 2).
                 _verify_add_gate "tests" "inconclusive" "pytest" "python project detected but no pytest/python3 on PATH" "true"
@@ -502,7 +510,7 @@ verify_gate_tests() {
     if [ "$runner" = "none" ] && [ -f "$tree/go.mod" ]; then
         if command -v go >/dev/null 2>&1; then
             runner="go-test"
-            out="$(cd "$tree" && timeout "$timeout_s" go test ./... 2>&1)" || rc=$?
+            out="$(cd "$tree" && $_vt go test ./... 2>&1)" || rc=$?
         else
             _verify_add_gate "tests" "inconclusive" "go-test" "go project detected but go not on PATH" "true"
             return 0
@@ -512,7 +520,7 @@ verify_gate_tests() {
     if [ "$runner" = "none" ] && [ -f "$tree/Cargo.toml" ]; then
         if command -v cargo >/dev/null 2>&1; then
             runner="cargo-test"
-            out="$(cd "$tree" && timeout "$timeout_s" cargo test 2>&1)" || rc=$?
+            out="$(cd "$tree" && $_vt cargo test 2>&1)" || rc=$?
         else
             _verify_add_gate "tests" "inconclusive" "cargo-test" "rust project detected but cargo not on PATH" "true"
             return 0
@@ -550,7 +558,13 @@ verify_gate_tests() {
             runner="node-test"
             # Pass matched files explicitly (node --test globbing is
             # Node-version-sensitive); quote each so paths with spaces survive.
-            out="$(cd "$tree" && timeout "$timeout_s" node --test "${_nt_files[@]}" 2>&1)" || rc=$?
+            # Force --test-reporter=tap: Node 20+ defaults to the human "spec"
+            # reporter (Node 26 emits it even under capture), whose "i pass N" /
+            # check-mark lines the count parser + zero-tests detector below do NOT
+            # match; they expect TAP "# pass N" / "ok N - ". TAP is stable since
+            # Node 18, so forcing it restores a version-independent format with no
+            # parser change. Parity with autonomy/run.sh:9662.
+            out="$(cd "$tree" && $_vt node --test --test-reporter=tap "${_nt_files[@]}" 2>&1)" || rc=$?
         fi
     fi
 
@@ -564,6 +578,22 @@ verify_gate_tests() {
         return 0
     fi
 
+    # #82 (Python 3.12+): `python3 -m unittest` exits 5 (NOT 0) when it discovers
+    # ZERO tests -- e.g. a suite of pytest-style bare `def test_*` functions that
+    # unittest (TestCase-only) cannot collect. That non-zero exit would otherwise
+    # fall into the fail branch below and record tests=fail -> BLOCKED, when the
+    # honest classification is "applicable but ran no real tests" = inconclusive
+    # -> CONCERNS. Route the unittest zero-discovery case through the same guard
+    # the rc==0 path uses (its unittest arm matches "Ran 0 tests"/"NO TESTS RAN"
+    # but was unreachable behind rc==0). Scoped to unittest so pytest/go/cargo/node
+    # non-zero exits still correctly record fail.
+    if [ "$rc" -eq 5 ] && [ "$runner" = "unittest" ] \
+       && _verify_zero_tests_executed "$runner" "$out" "${_nt_files[@]:-}"; then
+        _verify_add_gate "tests" "inconclusive" "$runner" \
+            "runner ran but discovered zero tests (source_without_runnable_tests)" "true"
+        return 0
+    fi
+
     if [ "$rc" -eq 0 ]; then
         # #82: a green run that executed ZERO real tests is a mini fake-green.
         # Record it as HONEST inconclusive (forces at-least-CONCERNS), NOT pass

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "7.128.1"
+__version__ = "7.129.0"
 
 # Expose the control app for easy import
 try:

package/dashboard/registry.py

@@ -396,6 +396,41 @@ def prune_missing_projects(running_ids: Optional[set] = None) -> list[dict]:
     return pruned
 
 
+def reconcile_stale_runs() -> int:
+    """Self-heal the registry: mark dead-pid in-flight entries as stopped.
+
+    `loki start` records status="running" for a build, and an exit trap marks it
+    stopped on clean shutdown. But a reaped session, a crash, or a SIGKILL skips
+    that trap, leaving the entry frozen at "running"/"building" forever with a
+    dead pid. Over time these zombies accumulate (a fleet of 130+ "BUILDING"
+    entries with no live process), polluting the cockpit and dashboard.
+
+    This reconciles reality: for every entry whose recorded pid is NOT alive but
+    whose status is still in-flight (running/building/active/in_progress), set
+    status="stopped". Non-destructive (the entry is kept, just corrected) and
+    never touches a live-pid entry or an already-terminal status. Best-effort and
+    concurrency-safe (runs under the registry lock with the atomic save).
+
+    Returns:
+        The number of entries reconciled (0 when the registry is already clean).
+    """
+    IN_FLIGHT = {"running", "building", "active", "in_progress"}
+    reconciled = 0
+    with _registry_lock():
+        registry = _load_registry()
+        projects = registry.get("projects", {})
+        changed = False
+        for project in projects.values():
+            status = str(project.get("status") or "").lower()
+            if status in IN_FLIGHT and not _pid_alive(project.get("pid")):
+                project["status"] = "stopped"
+                reconciled += 1
+                changed = True
+        if changed:
+            _save_registry(registry)
+    return reconciled
+
+
 def check_project_health(identifier: str) -> dict:
     """
     Check the health status of a project.
@@ -754,11 +789,17 @@ def get_fleet_runs(include_inactive: bool = True) -> list[dict]:
         running = _pid_alive(pid)
         snap = _read_project_run_snapshot(path)
 
-        # A live pid is authoritative for "running"; otherwise reflect the
-        # registry status (stopped/active/missing). This mirrors the
-        # running-projects endpoint's pid-first precedence.
+        # A live pid is authoritative for "running". When the pid is DEAD but the
+        # registry still says the run is in-flight (running/building/active), the
+        # run was reaped or crashed without its exit trap marking it stopped -- it
+        # is a stale zombie, NOT still building. Report it honestly as "stale" so
+        # the fleet does not show 100+ frozen "BUILDING" entries. A dead pid with
+        # a terminal registry status (stopped/completed/failed) keeps that status.
+        reg_status = (p.get("status") or "unknown").lower()
         if running:
             status = "running"
+        elif reg_status in ("running", "building", "active", "in_progress"):
+            status = "stale"
         else:
             status = p.get("status") or "unknown"