loki-mode 7.41.5 → 7.43.0

package/providers/codex.sh

@@ -116,10 +116,17 @@ provider_version() {
 # Invocation function
 # Note: Codex uses positional prompt, not -p flag
 # Note: Reasoning effort is configured via environment or config, not CLI flag
+# v7.x: pin the resolved model explicitly via -m/--model. Without it, codex
+# falls back to the installed CLI's built-in default (e.g. gpt-5.5 on codex
+# 0.132.0), which silently ignores _codex_validate_model and makes the run.sh
+# cost table (priced for gpt-5.3-codex) wrong. --model is the documented model
+# selector and is readable in process listings.
 provider_invoke() {
     local prompt="$1"
     shift
-    codex exec --full-auto --skip-git-repo-check "$prompt" "$@"
+    codex exec --full-auto --skip-git-repo-check \
+        --model "$PROVIDER_MODEL_DEVELOPMENT" \
+        "$prompt" "$@"
 }
 
 # Model tier to effort level parameter (Codex uses effort, not separate models)
@@ -197,6 +204,18 @@ provider_invoke_with_tier() {
     local effort
     effort=$(resolve_model_for_tier "$tier")
 
+    # Resolve the model name by tier. These three vars can diverge via the
+    # generic LOKI_MODEL_* env (each validated by _codex_validate_model), so
+    # honor the tier rather than hardcoding development. Capability aliases
+    # (best/balanced/cheap) mirror resolve_model_for_tier's mapping.
+    local model
+    case "$tier" in
+        planning|best)        model="$PROVIDER_MODEL_PLANNING" ;;
+        development|balanced) model="$PROVIDER_MODEL_DEVELOPMENT" ;;
+        fast|cheap)           model="$PROVIDER_MODEL_FAST" ;;
+        *)                    model="$PROVIDER_MODEL_DEVELOPMENT" ;;
+    esac
+
     local extra_flags=()
     if [ "${LOKI_CODEX_WEB_SEARCH:-false}" = "true" ]; then
         extra_flags+=(--search)
@@ -211,6 +230,7 @@ provider_invoke_with_tier() {
         --ask-for-approval never \
         --sandbox danger-full-access \
         --skip-git-repo-check \
+        --model "$model" \
         "${extra_flags[@]}" \
         "$prompt" "$@"
 }

package/references/core-workflow.md

@@ -74,6 +74,13 @@ Every iteration follows this cycle:
 
 The RARV cycle now closes with an explicit Critique step (RARV-C). After VERIFY, an override council of real provider judges (v7.5.4) issues a binding decision before the iteration is marked complete. See `references/quality-control.md` for the override council protocol.
 
+### Verified Completion: Evidence Required (v7.41.1, v7.41.5)
+
+Completion is gated on affirmative test evidence, not the absence of a detected failure.
+
+- **Test evidence captured before the gate reads it (v7.41.1).** Loki runs the project's own tests and persists `.loki/quality/test-results.json` before the completion evidence gate evaluates it, so absent test evidence can no longer silently pass the test axis. Default-on; opt out with `LOKI_COMPLETION_TEST_CAPTURE=0`. It reuses the quality-ladder run (no double test execution per iteration) and a project with no runner records `{"runner":"none","pass":true}`. Source: `autonomy/run.sh` (`ensure_completion_test_evidence`, `:7236`).
+- **Completion council heuristic fallback defaults to CONTINUE (v7.41.5).** When no AI provider is available for the council, the heuristic member evaluation starts each vote at CONTINUE and flips to COMPLETE only when no failure is detected AND affirmative positive evidence is present (the same non-red `test-results.json` signal the evidence hard gate uses). An empty `.loki/` with no test evidence no longer clears the threshold on "absence of failure". Legitimate finished projects (passing or genuinely no-test) still vote COMPLETE. Source: `autonomy/completion-council.sh` (`council_evaluate_member`, `:2044`-`:2063`, `:2127`-`:2140`).
+
 ---
 
 ## CONTINUITY.md - Working Memory Protocol

package/references/quality-control.md

@@ -287,6 +287,12 @@ Task(subagent_type="general-purpose", model="opus",
 - ALWAYS re-run ALL 3 reviewers after fixes (not just the one that found the issue)
 - Wait for all reviews to complete before aggregating results
 
+### Inconclusive Reviews Block (v7.41.1)
+
+A code-review round must produce real verdicts to pass. `run_code_review` counts only reviewer outputs that exist, are non-empty, and carry a recognized `VERDICT:` line. If every reviewer returns no usable verdict (all NO_OUTPUT or unparseable), the round is treated as INCONCLUSIVE and BLOCKS rather than silently passing with zero findings. A bounded one-shot retry runs first; the block is opt-out via `LOKI_REVIEW_INCONCLUSIVE_BLOCK=0` (records, never blocks). APPROVE / PASS-with-concerns still pass.
+
+The reviewer-prompt diff excludes `.loki/` and `.git/` via git pathspec (`git diff <sha>..HEAD -- . ':(exclude).loki/'`). This mirrors the completion evidence gate and prevents a `.loki/`-tracked repo from ballooning the diff to the point that the reviewer model overflows and returns empty (the original NO_OUTPUT cause). Source: `autonomy/run.sh` (`run_code_review`, diff at `:2578`, inconclusive handling at `:8134`-`:8270`).
+
 ---
 
 ## Structured Prompting for Subagents

package/skills/agents.md

@@ -135,6 +135,7 @@ Task(
 - WAIT for all 3 before aggregating
 - IF unanimous PASS: run Devil's Advocate reviewer (anti-sycophancy)
 - Critical/High = BLOCK, Medium = TODO, Low = informational
+- IF every reviewer returns no usable verdict (all NO_OUTPUT / unparseable): the round is INCONCLUSIVE and BLOCKS, never silently passes (v7.41.1, bounded retry first; opt out `LOKI_REVIEW_INCONCLUSIVE_BLOCK=0`). The reviewer diff excludes `.loki/` and `.git/` so a tracked `.loki/` cannot overflow the prompt into the empty-output that caused the original silent pass. See `skills/quality-gates.md` for the env knobs.
 
 ---