loki-mode 7.50.0 → 7.52.0

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: Autonomous spec-driven build system with a built-in trust layer. It does not call work done until it is verified (RARV-C closure loop, 8 quality gates, completion council, verified-completion evidence gate). Triggers on "Loki Mode". Takes a spec (PRD, GitHub issue, OpenAPI doc, etc.) to deployed product with minimal human intervention. Provider-agnostic. Requires --dangerously-skip-permissions flag.
 ---
 
-# Loki Mode v7.50.0
+# Loki Mode v7.52.0
 
 **You are an autonomous agent. You make decisions. You do not ask questions. You do not stop.**
 
@@ -407,4 +407,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v7.50.0 | [Autonomi](https://www.autonomi.dev/) flagship product | ~260 lines core**
+**v7.52.0 | [Autonomi](https://www.autonomi.dev/) flagship product | ~260 lines core**

package/VERSION

@@ -1 +1 @@
-7.50.0
+7.52.0

package/autonomy/completion-council.sh

@@ -2038,7 +2038,7 @@ ISSUES: CRITICAL:description (optional, one per line per issue)"
             ;;
         codex)
             if command -v codex &>/dev/null; then
-                verdict=$(codex exec --full-auto "$prompt" 2>/dev/null)
+                verdict=$(codex exec --sandbox workspace-write "$prompt" 2>/dev/null)
             fi
             ;;
         gemini)
@@ -2139,7 +2139,7 @@ REASON: your reasoning"
             ;;
         codex)
             if command -v codex &>/dev/null; then
-                verdict=$(codex exec --full-auto "$prompt" 2>/dev/null)
+                verdict=$(codex exec --sandbox workspace-write "$prompt" 2>/dev/null)
             fi
             ;;
         gemini)

package/autonomy/grill.sh

@@ -227,7 +227,7 @@ grill_invoke_provider() {
                 return $GRILL_EXIT_ERROR
             fi
             local out
-            out="$(printf '%s' "$prompt" | _grill_with_timeout "${LOKI_GRILL_TIMEOUT:-180}" codex exec --full-auto - 2>/dev/null)"
+            out="$(printf '%s' "$prompt" | _grill_with_timeout "${LOKI_GRILL_TIMEOUT:-180}" codex exec --sandbox workspace-write - 2>/dev/null)"
             if [ -z "$out" ]; then
                 _grill_err "provider returned no output"
                 return $GRILL_EXIT_ERROR

package/autonomy/lib/claude-flags.sh

@@ -63,31 +63,35 @@ loki_remaining_budget() {
     local budget_file="${TARGET_DIR:-.}/.loki/metrics/budget.json"
     local spend="0"
     if [ -f "$budget_file" ]; then
-        spend=$(python3 -c "
-import json, sys
+        # Pass the path via env var (os.environ), NOT string interpolation, so a
+        # path containing a single quote (or other python/shell-breaking char)
+        # cannot break the parse. Single-quoted program -> bash interpolates nothing.
+        spend=$(_LOKI_BUDGET_FILE="$budget_file" python3 -c '
+import json, os, sys
 try:
-    with open('$budget_file') as f:
+    with open(os.environ["_LOKI_BUDGET_FILE"]) as f:
         d = json.load(f)
-    v = d.get('current_spend', 0)
+    v = d.get("current_spend", 0)
     print(float(v))
 except Exception:
     print(0)
-" 2>/dev/null)
+' 2>/dev/null)
     fi
     # Compute remaining via python3 (bash floats are unreliable across awk/bc variations).
-    python3 -c "
-import sys
+    # Pass limit/spend via env vars too (same hardening; single-quoted program).
+    _LOKI_BUDGET_LIMIT="$limit" _LOKI_BUDGET_SPEND="$spend" python3 -c '
+import os, sys
 try:
-    limit = float('$limit')
-    spend = float('$spend')
+    limit = float(os.environ["_LOKI_BUDGET_LIMIT"])
+    spend = float(os.environ["_LOKI_BUDGET_SPEND"])
     rem = limit - spend
     # Strictly positive; otherwise emit nothing (caller decides whether to bail or warn).
     if rem > 0:
         # Round to 2 decimal places for the CLI.
-        print(f'{rem:.2f}')
+        print(f"{rem:.2f}")
 except Exception:
     pass
-" 2>/dev/null
+' 2>/dev/null
 }
 
 # ---------- Fallback model ----------

package/autonomy/lib/wiki_llm.py

@@ -57,7 +57,7 @@ def invoke_llm(prompt, timeout=120):
 
     cmds = {
         "claude": ["claude", "-p", prompt],
-        "codex": ["codex", "exec", "--full-auto", prompt],
+        "codex": ["codex", "exec", "--sandbox", "workspace-write", prompt],
         "cline": ["cline", "-y", prompt],
         "aider": ["aider", "--message", prompt, "--yes-always", "--no-auto-commits"],
     }

package/autonomy/loki

@@ -3785,7 +3785,7 @@ cmd_provider_info() {
             echo "Name:        Codex CLI"
             echo "Vendor:      OpenAI"
             echo "CLI:         codex"
-            echo "Flag:        --full-auto"
+            echo "Flag:        --sandbox workspace-write"
             echo ""
             echo "Features:"
             echo "  - Autonomous mode"
@@ -11641,7 +11641,7 @@ except Exception: pass
                         done; } && phase_exit=0 || phase_exit=$?
                     ;;
                 codex)
-                    (cd "$codebase_path" && codex exec --full-auto "$phase_prompt" 2>&1) || phase_exit=$?
+                    (cd "$codebase_path" && codex exec --sandbox workspace-write "$phase_prompt" 2>&1) || phase_exit=$?
                     ;;
                 cline)
                     (cd "$codebase_path" && cline -y "$phase_prompt" 2>&1) || phase_exit=$?
@@ -11814,7 +11814,7 @@ except Exception: pass
                     done; } && doc_exit=0 || doc_exit=$?
                 ;;
             codex)
-                (cd "$codebase_path" && codex exec --full-auto "$doc_prompt" 2>&1) || doc_exit=$?
+                (cd "$codebase_path" && codex exec --sandbox workspace-write "$doc_prompt" 2>&1) || doc_exit=$?
                 ;;
             cline)
                 (cd "$codebase_path" && cline -y "$doc_prompt" 2>&1) || doc_exit=$?
@@ -12445,7 +12445,7 @@ except Exception: pass
                 done && heal_exit=0 || heal_exit=$?
             ;;
         codex)
-            (cd "$codebase_path" && codex exec --full-auto "$heal_prompt" 2>&1) || heal_exit=$?
+            (cd "$codebase_path" && codex exec --sandbox workspace-write "$heal_prompt" 2>&1) || heal_exit=$?
             ;;
         cline)
             (cd "$codebase_path" && cline -y "$heal_prompt" 2>&1) || heal_exit=$?
@@ -22069,7 +22069,7 @@ USER TASK: ${prompt}"
                     claude -p "$full_prompt" 2>&1 || agent_exit=$?
                     ;;
                 codex)
-                    codex exec --full-auto "$full_prompt" 2>&1 || agent_exit=$?
+                    codex exec --sandbox workspace-write "$full_prompt" 2>&1 || agent_exit=$?
                     ;;
                 cline)
                     cline -y "$full_prompt" 2>&1 || agent_exit=$?
@@ -22200,7 +22200,7 @@ $diff"
 
             case "$provider" in
                 claude)  claude -p "$review_prompt" 2>&1 ;;
-                codex)   codex exec --full-auto "$review_prompt" 2>&1 ;;
+                codex)   codex exec --sandbox workspace-write "$review_prompt" 2>&1 ;;
                 cline)   cline -y "$review_prompt" 2>&1 ;;
                 *)       echo -e "${RED}Unknown provider: $provider${NC}"; return 1 ;;
             esac
@@ -23870,7 +23870,7 @@ _docs_invoke_provider() {
             result=$($t_prefix env CAVEMAN_DEFAULT_MODE=off claude -p "$prompt" 2>/dev/null) || exit_code=$?
             ;;
         codex)
-            result=$($t_prefix codex exec --full-auto "$prompt" 2>/dev/null) || exit_code=$?
+            result=$($t_prefix codex exec --sandbox workspace-write "$prompt" 2>/dev/null) || exit_code=$?
             ;;
         cline)
             result=$($t_prefix cline -y "$prompt" 2>/dev/null) || exit_code=$?

package/autonomy/run.sh

@@ -1480,7 +1480,40 @@ check_policy() {
     elif [ $exit_code -eq 2 ]; then
         log_warn "Policy requires APPROVAL: $result"
         audit_agent_action "policy_approval_required" "Policy requires approval" "enforcement=$enforcement_point"
-        # Log but proceed (full approval flow is P1-3 scope)
+        # P3-3 (v7.51.0): honor the approval requirement when the operator has
+        # opted into enforcement. This is OPT-IN and changes NOTHING for existing
+        # users: the wait fires only when staged autonomy is on
+        # (LOKI_STAGED_AUTONOMY=true) or the explicit
+        # LOKI_POLICY_APPROVAL_ENFORCE=1 knob is set. Otherwise it stays advisory
+        # (log + proceed), preserving the historical default behavior. The wait
+        # reuses the same .loki/signals/ file-signal mechanism as staged-autonomy
+        # plan approval (check_staged_autonomy), extended with a reject arm so an
+        # operator can deny (deny == policy DENIED == return 1).
+        if [ "$STAGED_AUTONOMY" = "true" ] || [ "${LOKI_POLICY_APPROVAL_ENFORCE:-0}" = "1" ]; then
+            local _approve_sig=".loki/signals/POLICY_APPROVED"
+            local _reject_sig=".loki/signals/POLICY_REJECTED"
+            log_warn "Policy enforcement: waiting for approval at enforcement point '$enforcement_point'."
+            log_warn "  Approve: create $_approve_sig  |  Reject: create $_reject_sig"
+            audit_agent_action "policy_approval_wait" "Waiting for policy approval signal" "enforcement=$enforcement_point"
+            while [ ! -f "$_approve_sig" ] && [ ! -f "$_reject_sig" ]; do
+                sleep 5
+            done
+            if [ -f "$_reject_sig" ]; then
+                rm -f "$_reject_sig" "$_approve_sig" 2>/dev/null || true
+                log_error "Policy REJECTED by operator at enforcement point '$enforcement_point'"
+                audit_agent_action "policy_approval_rejected" "Operator rejected policy approval" "enforcement=$enforcement_point"
+                emit_event_json "policy_denied" \
+                    "enforcement=$enforcement_point" \
+                    "result=operator_rejected"
+                return 1
+            fi
+            rm -f "$_approve_sig" 2>/dev/null || true
+            log_info "Policy approved by operator at enforcement point '$enforcement_point'; continuing."
+            audit_agent_action "policy_approval_granted" "Operator approved policy" "enforcement=$enforcement_point"
+            return 0
+        fi
+        # Default (no staged autonomy, no enforce knob): advisory only -- log and
+        # proceed. This preserves the historical behavior for existing users.
         return 0
     fi
     return 0
@@ -3231,7 +3264,7 @@ spawn_worktree_session() {
                 fi
                 ;;
             codex)
-                codex exec --full-auto --skip-git-repo-check \
+                codex exec --sandbox workspace-write --skip-git-repo-check \
                     "Loki Mode: $task_prompt. Read .loki/CONTINUITY.md for context." \
                     >> "$log_file" 2>&1 || _wt_exit=$?
                 ;;
@@ -3447,7 +3480,7 @@ Output ONLY the resolved file content with no conflict markers. No explanations.
                 resolution=$(CAVEMAN_DEFAULT_MODE=off claude "${_cr_argv[@]}" -p "$conflict_prompt" --output-format text 2>/dev/null)
                 ;;
             codex)
-                resolution=$(codex exec --full-auto --skip-git-repo-check "$conflict_prompt" 2>/dev/null)
+                resolution=$(codex exec --sandbox workspace-write --skip-git-repo-check "$conflict_prompt" 2>/dev/null)
                 ;;
             cline)
                 resolution=$(invoke_cline_capture "$conflict_prompt" 2>/dev/null)
@@ -6166,7 +6199,7 @@ check_command_allowed() {
     # run.sh does not directly execute arbitrary shell commands from user or agent
     # input. Command execution is handled by the AI CLI's own permission model:
     #   - Claude Code: --dangerously-skip-permissions (with its own allowlist)
-    #   - Codex CLI: --full-auto or exec --dangerously-bypass-approvals-and-sandbox
+    #   - Codex CLI: exec --sandbox workspace-write or exec --dangerously-bypass-approvals-and-sandbox
     #
     # HUMAN_INPUT.md content is injected as a text prompt to the AI agent (not
     # executed as a shell command), and is already guarded by:
@@ -7757,6 +7790,55 @@ os.replace(tmp, out)
         else
             log_info "Coverage: not measured (${COVERAGE_REASON:-unknown}); pass-through, not blocking"
         fi
+    else
+        # P3-5/coverage-honesty (v7.51.0): measurement is OPT-IN (it re-runs the
+        # suite instrumented, which would double every test run -- a UX
+        # regression for an autonomous loop). At default-off we deliberately do
+        # NOT measure, but we STILL write a coverage fact so the run manifest /
+        # reproducibility record always has one honest coverage shape. This is
+        # the "missing-artifact" fix, not a hollow gate: measured=false, pct=null,
+        # blocked=false, with an explicit reason. ZERO runtime (no instrumented
+        # re-run). Reuses the EXACT python3 writer + schema used at default-on so
+        # consumers see a single shape. Single-pass, never blocks.
+        _LOKI_COV_MEASURED="false" \
+        _LOKI_COV_PCT="" \
+        _LOKI_COV_TOOL="none" \
+        _LOKI_COV_REASON="not requested (set LOKI_COVERAGE_GATE=1 to measure)" \
+        _LOKI_COV_MIN="$min_coverage" \
+        _LOKI_COV_ENFORCED="0" \
+        _LOKI_COV_BLOCKED="false" \
+        _LOKI_COV_RUNNER="$test_runner" \
+        _LOKI_COV_OUT="$quality_dir/coverage.json" \
+        python3 -c "
+import json, os, tempfile
+out=os.environ['_LOKI_COV_OUT']
+measured = os.environ.get('_LOKI_COV_MEASURED','false') == 'true'
+pct_raw = os.environ.get('_LOKI_COV_PCT','')
+try:
+    pct = float(pct_raw) if (measured and pct_raw != '') else None
+except ValueError:
+    pct = None
+def b(v): return os.environ.get(v,'false') == 'true'
+def i(v):
+    try: return int(float(os.environ.get(v,'0')))
+    except (TypeError, ValueError): return 0
+rec = {
+    'measured': measured,
+    'pct': pct,
+    'tool': os.environ.get('_LOKI_COV_TOOL','none'),
+    'runner': os.environ.get('_LOKI_COV_RUNNER','none'),
+    'threshold': i('_LOKI_COV_MIN'),
+    'enforced': os.environ.get('_LOKI_COV_ENFORCED','0') == '1',
+    'blocked': b('_LOKI_COV_BLOCKED'),
+    'reason': os.environ.get('_LOKI_COV_REASON','') if not measured else '',
+    'timestamp': __import__('datetime').datetime.utcnow().strftime('%Y-%m-%dT%H:%M:%SZ'),
+}
+d=os.path.dirname(out)
+fd, tmp=tempfile.mkstemp(dir=d, suffix='.json')
+with os.fdopen(fd,'w') as f:
+    json.dump(rec, f, indent=2)
+os.replace(tmp, out)
+" 2>/dev/null || true
     fi
 
     if [ "$test_passed" = "true" ]; then
@@ -7854,6 +7936,65 @@ ensure_completion_test_evidence() {
     return 0
 }
 
+# P1-1 (v7.51.0): ADVISORY consumer for the evidence-gate detail record that
+# completion-council.sh:_write_evidence_details writes on EVERY evidence-gate run
+# (pass and block) to .loki/council/evidence-gate-details.json. Until now run.sh
+# had ZERO consumers of that file -- the audit record was durable but invisible
+# to the operator and to the next-iteration prompt. This surfaces a one-line
+# advisory summary (verdict + diff axis + tests axis). It NEVER blocks and NEVER
+# introduces a new gate (the evidence gate itself already blocks; this is purely
+# visibility). Absent or malformed file -> degrade silently (no error, no block).
+surface_evidence_gate_details() {
+    local _det_file="${TARGET_DIR:-.}/.loki/council/evidence-gate-details.json"
+    [ -f "$_det_file" ] || return 0
+    local _summary
+    _summary=$(_LOKI_EGD_FILE="$_det_file" python3 -c "
+import json, os, sys
+try:
+    with open(os.environ['_LOKI_EGD_FILE']) as f:
+        d = json.load(f)
+except Exception:
+    sys.exit(0)
+if not isinstance(d, dict):
+    sys.exit(0)
+verdict = d.get('verdict', 'unknown')
+diff = d.get('diff', {}) if isinstance(d.get('diff'), dict) else {}
+tests = d.get('tests', {}) if isinstance(d.get('tests'), dict) else {}
+diff_ok = diff.get('ok')
+tests_ok = tests.get('ok')
+runner = tests.get('runner', 'none')
+parts = ['verdict=%s' % verdict]
+parts.append('diff_ok=%s' % diff_ok)
+parts.append('tests_ok=%s (runner=%s)' % (tests_ok, runner))
+if diff.get('inconclusive'):
+    parts.append('diff_inconclusive=%s' % (diff.get('inconclusive_reason') or 'yes'))
+if tests.get('inconclusive'):
+    parts.append('tests_inconclusive=%s' % (tests.get('inconclusive_reason') or 'yes'))
+print(' '.join(str(p) for p in parts))
+" 2>/dev/null) || return 0
+    [ -n "$_summary" ] || return 0
+    if printf '%s' "$_summary" | grep -q "verdict=block"; then
+        log_warn "[Council] Evidence-gate details: $_summary"
+    else
+        log_info "[Council] Evidence-gate details: $_summary"
+    fi
+    return 0
+}
+
+# P1-1 (v7.51.0): wrapper that runs the evidence gate, then surfaces its detail
+# record on BOTH the pass and block paths, and returns the gate's exact rc. This
+# preserves the elif chain's `! council_evidence_gate` semantics byte-for-byte
+# (fall-through on pass so the held-out and assumption gates downstream still
+# evaluate; block on a 1). The surface call is advisory-only and never affects
+# the returned rc. The detail file is fresh here -- _write_evidence_details ran
+# inside council_evidence_gate just above on this same iteration.
+_evidence_gate_and_surface() {
+    local _rc=0
+    council_evidence_gate || _rc=$?
+    surface_evidence_gate_details || true
+    return $_rc
+}
+
 # ============================================================================
 # Documentation Staleness Check (v6.75.0)
 # Checks if generated documentation is stale relative to HEAD
@@ -8496,7 +8637,7 @@ _dispatch_reviewer() {
                 --output-format text > "$review_output" 2>/dev/null
             ;;
         codex)
-            codex exec --full-auto --skip-git-repo-check "$prompt_text" \
+            codex exec --sandbox workspace-write --skip-git-repo-check "$prompt_text" \
                 > "$review_output" 2>/dev/null
             ;;
         cline)
@@ -9220,7 +9361,7 @@ ADVERSARIAL_EOF
             ;;
         codex)
             if command -v codex &>/dev/null; then
-                codex exec --full-auto --skip-git-repo-check "$adversarial_prompt" \
+                codex exec --sandbox workspace-write --skip-git-repo-check "$adversarial_prompt" \
                     > "$result_file" 2>/dev/null || true
             fi
             ;;
@@ -14576,7 +14717,7 @@ if __name__ == "__main__":
                 # Uses dynamic tier from RARV phase (tier_param already set above)
                 { LOKI_CODEX_REASONING_EFFORT="$tier_param" \
                 CODEX_MODEL_REASONING_EFFORT="$tier_param" \
-                codex exec --full-auto --skip-git-repo-check \
+                codex exec --sandbox workspace-write --skip-git-repo-check \
                     "$prompt" 2>&1 | tee -a "$log_file" "$agent_log" "$iter_output"; \
                 } && exit_code=0 || exit_code=$?
                 ;;
@@ -14818,6 +14959,88 @@ if __name__ == "__main__":
                     log_warn "Mutation integrity gate FAILED ($mt_count consecutive) - HIGH test-fitting detected"
                 fi
             fi
+            # LSP diagnostics gate (P1-5 bash-route parity, v7.51.0). Closes the
+            # parity gap: the Bun route ships runLSPDiagnostics
+            # (loki-ts/src/runner/quality_gates.ts) with a route-neutral Python
+            # writer (mcp/lsp_proxy.py); the bash route had NO writer/reader.
+            # This block runs the SAME writer and mirrors the TS blocking
+            # semantics byte-for-byte:
+            #   - Gate is OPT-IN: default OFF. Enabled by LOKI_GATE_LSP_DIAGNOSTICS=true
+            #     (the single toggle; mirrors flag("LOKI_GATE_LSP_DIAGNOSTICS", false)
+            #     at quality_gates.ts:1717). No second knob.
+            #   - When enabled, count_errors > 0 -> BLOCK (mirrors
+            #     "if (errorCount > 0) { passed: false }" at quality_gates.ts:1667).
+            #   - warnings only -> advisory PASS (quality_gates.ts:1673).
+            #   - artifact absent/malformed -> honest pass-through, NEVER block
+            #     (quality_gates.ts:1646 returns passed:true on null artifact).
+            # The writer is OPT-OUT-able with LOKI_GATE_LSP_WRITER=0 (operator can
+            # supply a pre-built artifact), matching the TS escape hatch
+            # (quality_gates.ts:1630). cwd must be the install dir (PROJECT_DIR =
+            # $SCRIPT_DIR/.. ) so `-m mcp.lsp_proxy` imports, while --root points
+            # at the TARGET project the loop is building (mirrors
+            # runLSPDiagnosticsWriter: cwd=REPO_ROOT, --root=ctx.cwd).
+            if [ "${LOKI_GATE_LSP_DIAGNOSTICS:-false}" = "true" ] && [ "$ITERATION_COUNT" -gt 0 ]; then
+                log_info "Quality gate: LSP diagnostics..."
+                # WRITER: route-neutral Python, same program as the Bun route.
+                if [ "${LOKI_GATE_LSP_WRITER:-1}" != "0" ]; then
+                    ( cd "$PROJECT_DIR" && LOKI_DIR="${TARGET_DIR:-.}/.loki" python3 -m mcp.lsp_proxy --write-diagnostics --root "${TARGET_DIR:-.}" ) >/dev/null 2>&1 || true
+                fi
+                # READER: read counts, mirror TS block policy.
+                local _lsp_file="${TARGET_DIR:-.}/.loki/quality/lsp-diagnostics.json"
+                local _lsp_verdict="absent"
+                if [ -f "$_lsp_file" ]; then
+                    _lsp_verdict=$(_LOKI_LSP_FILE="$_lsp_file" python3 -c "
+import json, os, sys
+try:
+    with open(os.environ['_LOKI_LSP_FILE']) as f:
+        d = json.load(f)
+except Exception:
+    print('absent'); sys.exit(0)
+if not isinstance(d, dict):
+    print('absent'); sys.exit(0)
+diags = d.get('diagnostics') if isinstance(d.get('diagnostics'), list) else []
+ce = d.get('count_errors')
+cw = d.get('count_warnings')
+errors = ce if isinstance(ce, int) else sum(1 for x in diags if isinstance(x, dict) and x.get('severity') == 1)
+warns = cw if isinstance(cw, int) else sum(1 for x in diags if isinstance(x, dict) and x.get('severity') == 2)
+if errors > 0:
+    print('block %d %d' % (errors, warns))
+elif warns > 0:
+    print('warn %d %d' % (errors, warns))
+else:
+    print('clean 0 0')
+" 2>/dev/null) || _lsp_verdict="absent"
+                    [ -n "$_lsp_verdict" ] || _lsp_verdict="absent"
+                fi
+                case "$_lsp_verdict" in
+                    block*)
+                        local _lsp_e _lsp_w
+                        _lsp_e=$(printf '%s' "$_lsp_verdict" | awk '{print $2}')
+                        _lsp_w=$(printf '%s' "$_lsp_verdict" | awk '{print $3}')
+                        local lsp_count
+                        lsp_count=$(track_gate_failure "lsp_diagnostics")
+                        gate_failures="${gate_failures}lsp_diagnostics,"
+                        log_warn "LSP diagnostics gate FAILED ($lsp_count consecutive) - ${_lsp_e} error(s), ${_lsp_w} warning(s); LSP reports compiler/type errors"
+                        ;;
+                    warn*)
+                        local _lsp_w2
+                        _lsp_w2=$(printf '%s' "$_lsp_verdict" | awk '{print $3}')
+                        clear_gate_failure "lsp_diagnostics"
+                        log_info "LSP diagnostics: 0 errors, ${_lsp_w2} warning(s) (advisory)"
+                        ;;
+                    clean*)
+                        clear_gate_failure "lsp_diagnostics"
+                        log_info "LSP diagnostics: 0 errors, 0 warnings"
+                        ;;
+                    *)
+                        # Absent or malformed artifact: honest pass-through, never
+                        # block (mirrors quality_gates.ts:1646). Do not fabricate
+                        # a clean verdict from absence.
+                        clear_gate_failure "lsp_diagnostics"
+                        log_info "LSP diagnostics: no lsp-diagnostics.json artifact (lsp not available) -- gate did not run"
+                        ;;
+                esac
+            fi
             # Code review gate (upgraded from advisory, with escalation)
             if [ "$PHASE_CODE_REVIEW" = "true" ] && [ "$ITERATION_COUNT" -gt 0 ]; then
                 log_info "Quality gate: code review..."
@@ -15096,7 +15319,7 @@ if __name__ == "__main__":
             # LOKI_EVIDENCE_GATE=0 (council_evidence_gate returns 0 immediately
             # when disabled, so this branch never fires). Gate output (reason +
             # opt-out hint) is printed by council_evidence_gate itself.
-            elif [ "$_completion_claimed" = 1 ] && type council_evidence_gate &>/dev/null && ! council_evidence_gate; then
+            elif [ "$_completion_claimed" = 1 ] && type council_evidence_gate &>/dev/null && ! _evidence_gate_and_surface; then
                 log_warn "Completion claim rejected: evidence gate found no proof of completion (empty diff vs run-start SHA, or red tests)."
                 log_warn "  Details under .loki/council/evidence-block.json ; opt out with LOKI_EVIDENCE_GATE=0"
                 # Fall through; keep iterating until there is real evidence.
@@ -15595,7 +15818,7 @@ check_human_intervention() {
         fi
         if type council_checklist_gate &>/dev/null && ! council_checklist_gate; then
             log_info "Council force-review: blocked by checklist hard gate"
-        elif type council_evidence_gate &>/dev/null && ! council_evidence_gate; then
+        elif type council_evidence_gate &>/dev/null && ! _evidence_gate_and_surface; then
             log_info "Council force-review: blocked by evidence hard gate"
         elif type council_heldout_gate &>/dev/null && ! council_heldout_gate; then
             log_info "Council force-review: blocked by held-out spec-eval hard gate"

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "7.50.0"
+__version__ = "7.52.0"
 
 # Expose the control app for easy import
 try:

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 The flagship product of [Autonomi](https://www.autonomi.dev/). Loki Mode is a spec-driven autonomous builder with a built-in trust layer that takes any spec to a deployed product and verifies completion with evidence (quality gates plus a completion council), not just a "done" claim. Complete installation instructions for all platforms and use cases.
 
-**Version:** v7.50.0
+**Version:** v7.52.0
 
 ---
 
@@ -396,7 +396,7 @@ provider works inside the container. Provide auth with your Anthropic API key:
 # Run Loki Mode in Docker (Claude provider, API-key auth)
 docker run --rm -e ANTHROPIC_API_KEY="$ANTHROPIC_API_KEY" \
   -v $(pwd):/workspace -w /workspace \
-  asklokesh/loki-mode:7.50.0 start ./my-spec.md
+  asklokesh/loki-mode:7.52.0 start ./my-spec.md
 ```
 
 ##### docker compose + .env (no host install)

package/loki-ts/dist/loki.js

@@ -1,5 +1,5 @@
 // @bun
-var r6=Object.defineProperty;var t6=($)=>$;function i6($,Q){this[$]=t6.bind(null,Q)}var h=($,Q)=>{for(var Z in Q)r6($,Z,{get:Q[Z],enumerable:!0,configurable:!0,set:i6.bind(Q,Z)})};var L=($,Q)=>()=>($&&(Q=$($=0)),Q);var K$=import.meta.require;var D1={};h(D1,{lokiDir:()=>P,homeLokiDir:()=>n$,findRepoRootForVersion:()=>o$,REPO_ROOT:()=>g});import{resolve as n,dirname as d$}from"path";import{fileURLToPath as e6}from"url";import{existsSync as P$}from"fs";import{homedir as $Q}from"os";function QQ(){let $=S1;for(let Q=0;Q<6;Q++){if(P$(n($,"VERSION"))&&P$(n($,"autonomy/run.sh")))return $;let Z=d$($);if(Z===$)break;$=Z}return n(S1,"..","..","..")}function o$($){let Q=$;for(let Z=0;Z<6;Z++){if(P$(n(Q,"VERSION"))&&P$(n(Q,"autonomy/run.sh")))return Q;let z=d$(Q);if(z===Q)break;Q=z}return n($,"..","..","..")}function P(){return process.env.LOKI_DIR??n(process.cwd(),".loki")}function n$(){return n($Q(),".loki")}var S1,g;var b=L(()=>{S1=d$(e6(import.meta.url));g=QQ()});import{readFileSync as ZQ}from"fs";import{resolve as zQ,dirname as XQ}from"path";import{fileURLToPath as KQ}from"url";function j$(){if($$!==null)return $$;let $="7.50.0";if(typeof $==="string"&&$.length>0)return $$=$,$$;try{let Q=XQ(KQ(import.meta.url)),Z=o$(Q);$$=ZQ(zQ(Z,"VERSION"),"utf-8").trim()}catch{$$="unknown"}return $$}var $$=null;var a$=L(()=>{b()});var b1={};h(b1,{runOrThrow:()=>qQ,run:()=>k,commandVersion:()=>WQ,commandExists:()=>f,ShellError:()=>s$});async function k($,Q={}){let Z=Bun.spawn({cmd:[...$],stdout:"pipe",stderr:"pipe",env:Q.env?{...process.env,...Q.env}:process.env,cwd:Q.cwd}),z,X;if(Q.timeoutMs&&Q.timeoutMs>0)z=setTimeout(()=>{try{Z.kill("SIGTERM")}catch{}X=setTimeout(()=>{try{Z.kill("SIGKILL")}catch{}},2000)},Q.timeoutMs);try{let[q,K,W]=await Promise.all([new Response(Z.stdout).text(),new Response(Z.stderr).text(),Z.exited]);return{stdout:q,stderr:K,exitCode:W}}finally{if(z)clearTimeout(z);if(X)clearTimeout(X)}}async function qQ($,Q={}){let Z=await k($,Q);if(Z.exitCode!==0)throw new s$(`command failed (${Z.exitCode}): ${$.join(" ")}`,Z.exitCode,Z.stdout,Z.stderr);return Z}async function f($){let Q=VQ($),Z=await k(["sh","-c",`command -v ${Q}`],{timeoutMs:5000});if(Z.exitCode===0)return Z.stdout.trim()||null;return null}function VQ($){if(!/^[A-Za-z0-9._/-]+$/.test($))throw Error(`refused to shell-escape suspect token: ${$}`);return $}async function WQ($,Q="--version"){if(!await f($))return null;let z=await k([$,Q],{timeoutMs:5000});if(z.exitCode!==0)return null;return((z.stdout||z.stderr).split(/\r?\n/)[0]?.trim()??"")||null}var s$;var d=L(()=>{s$=class s$ extends Error{message;exitCode;stdout;stderr;constructor($,Q,Z,z){super($);this.message=$;this.exitCode=Q;this.stdout=Z;this.stderr=z;this.name="ShellError"}}});function a($){return JQ?"":$}var JQ,T,S,_,wZ,I,R,y,V;var c=L(()=>{JQ=(process.env.NO_COLOR??"").length>0;T=a("\x1B[0;31m"),S=a("\x1B[0;32m"),_=a("\x1B[1;33m"),wZ=a("\x1B[0;34m"),I=a("\x1B[0;36m"),R=a("\x1B[1m"),y=a("\x1B[2m"),V=a("\x1B[0m")});import{existsSync as wQ}from"fs";async function Q$(){if(G$!==void 0)return G$;let $="/opt/homebrew/bin/python3.12";if(wQ($))return G$=$,$;let Q=await f("python3.12");if(Q)return G$=Q,Q;let Z=await f("python3");return G$=Z,Z}async function Z$($,Q={}){let Z=await Q$();if(!Z)return{stdout:"",stderr:"python3 not found",exitCode:127};return k([Z,"-c",$],Q)}var G$;var q$=L(()=>{d()});var e1={};h(e1,{runStatus:()=>uQ});import{existsSync as v,readFileSync as W$,readdirSync as d1,statSync as o1}from"fs";import{resolve as C,basename as DQ}from"path";import{homedir as CQ}from"os";function n1($){let Q=Math.trunc($);if(Q>=1e6)return`${(Math.trunc(Q/1e6*10)/10).toFixed(1)}M`;if(Q>=1000)return`${(Math.trunc(Q/1000*10)/10).toFixed(1)}K`;return String(Q)}function a1($,Q,Z){if(Q===0)return null;let z=Math.trunc($*100/Q),X=Math.trunc($*k$/Q);if(X>k$)X=k$;let q=k$-X,K=S;if(z>=80)K=T;else if(z>=50)K=_;let W="=".repeat(Math.max(0,X))+" ".repeat(Math.max(0,q)),J=n1($),U=n1(Q);return`  ${R}${Z}${V} ${K}[${W}]${V} ${z}% (${J} / ${U})`}async function hQ(){if(await f("jq"))return!0;return process.stdout.write(`${T}Error: jq is required but not installed.${V}
+var r6=Object.defineProperty;var t6=($)=>$;function i6($,Q){this[$]=t6.bind(null,Q)}var h=($,Q)=>{for(var Z in Q)r6($,Z,{get:Q[Z],enumerable:!0,configurable:!0,set:i6.bind(Q,Z)})};var L=($,Q)=>()=>($&&(Q=$($=0)),Q);var K$=import.meta.require;var D1={};h(D1,{lokiDir:()=>P,homeLokiDir:()=>n$,findRepoRootForVersion:()=>o$,REPO_ROOT:()=>g});import{resolve as n,dirname as d$}from"path";import{fileURLToPath as e6}from"url";import{existsSync as P$}from"fs";import{homedir as $Q}from"os";function QQ(){let $=S1;for(let Q=0;Q<6;Q++){if(P$(n($,"VERSION"))&&P$(n($,"autonomy/run.sh")))return $;let Z=d$($);if(Z===$)break;$=Z}return n(S1,"..","..","..")}function o$($){let Q=$;for(let Z=0;Z<6;Z++){if(P$(n(Q,"VERSION"))&&P$(n(Q,"autonomy/run.sh")))return Q;let z=d$(Q);if(z===Q)break;Q=z}return n($,"..","..","..")}function P(){return process.env.LOKI_DIR??n(process.cwd(),".loki")}function n$(){return n($Q(),".loki")}var S1,g;var b=L(()=>{S1=d$(e6(import.meta.url));g=QQ()});import{readFileSync as ZQ}from"fs";import{resolve as zQ,dirname as XQ}from"path";import{fileURLToPath as KQ}from"url";function j$(){if($$!==null)return $$;let $="7.52.0";if(typeof $==="string"&&$.length>0)return $$=$,$$;try{let Q=XQ(KQ(import.meta.url)),Z=o$(Q);$$=ZQ(zQ(Z,"VERSION"),"utf-8").trim()}catch{$$="unknown"}return $$}var $$=null;var a$=L(()=>{b()});var b1={};h(b1,{runOrThrow:()=>qQ,run:()=>k,commandVersion:()=>WQ,commandExists:()=>f,ShellError:()=>s$});async function k($,Q={}){let Z=Bun.spawn({cmd:[...$],stdout:"pipe",stderr:"pipe",env:Q.env?{...process.env,...Q.env}:process.env,cwd:Q.cwd}),z,X;if(Q.timeoutMs&&Q.timeoutMs>0)z=setTimeout(()=>{try{Z.kill("SIGTERM")}catch{}X=setTimeout(()=>{try{Z.kill("SIGKILL")}catch{}},2000)},Q.timeoutMs);try{let[q,K,W]=await Promise.all([new Response(Z.stdout).text(),new Response(Z.stderr).text(),Z.exited]);return{stdout:q,stderr:K,exitCode:W}}finally{if(z)clearTimeout(z);if(X)clearTimeout(X)}}async function qQ($,Q={}){let Z=await k($,Q);if(Z.exitCode!==0)throw new s$(`command failed (${Z.exitCode}): ${$.join(" ")}`,Z.exitCode,Z.stdout,Z.stderr);return Z}async function f($){let Q=VQ($),Z=await k(["sh","-c",`command -v ${Q}`],{timeoutMs:5000});if(Z.exitCode===0)return Z.stdout.trim()||null;return null}function VQ($){if(!/^[A-Za-z0-9._/-]+$/.test($))throw Error(`refused to shell-escape suspect token: ${$}`);return $}async function WQ($,Q="--version"){if(!await f($))return null;let z=await k([$,Q],{timeoutMs:5000});if(z.exitCode!==0)return null;return((z.stdout||z.stderr).split(/\r?\n/)[0]?.trim()??"")||null}var s$;var d=L(()=>{s$=class s$ extends Error{message;exitCode;stdout;stderr;constructor($,Q,Z,z){super($);this.message=$;this.exitCode=Q;this.stdout=Z;this.stderr=z;this.name="ShellError"}}});function a($){return JQ?"":$}var JQ,T,S,_,wZ,I,R,y,V;var c=L(()=>{JQ=(process.env.NO_COLOR??"").length>0;T=a("\x1B[0;31m"),S=a("\x1B[0;32m"),_=a("\x1B[1;33m"),wZ=a("\x1B[0;34m"),I=a("\x1B[0;36m"),R=a("\x1B[1m"),y=a("\x1B[2m"),V=a("\x1B[0m")});import{existsSync as wQ}from"fs";async function Q$(){if(G$!==void 0)return G$;let $="/opt/homebrew/bin/python3.12";if(wQ($))return G$=$,$;let Q=await f("python3.12");if(Q)return G$=Q,Q;let Z=await f("python3");return G$=Z,Z}async function Z$($,Q={}){let Z=await Q$();if(!Z)return{stdout:"",stderr:"python3 not found",exitCode:127};return k([Z,"-c",$],Q)}var G$;var q$=L(()=>{d()});var e1={};h(e1,{runStatus:()=>uQ});import{existsSync as v,readFileSync as W$,readdirSync as d1,statSync as o1}from"fs";import{resolve as C,basename as DQ}from"path";import{homedir as CQ}from"os";function n1($){let Q=Math.trunc($);if(Q>=1e6)return`${(Math.trunc(Q/1e6*10)/10).toFixed(1)}M`;if(Q>=1000)return`${(Math.trunc(Q/1000*10)/10).toFixed(1)}K`;return String(Q)}function a1($,Q,Z){if(Q===0)return null;let z=Math.trunc($*100/Q),X=Math.trunc($*k$/Q);if(X>k$)X=k$;let q=k$-X,K=S;if(z>=80)K=T;else if(z>=50)K=_;let W="=".repeat(Math.max(0,X))+" ".repeat(Math.max(0,q)),J=n1($),U=n1(Q);return`  ${R}${Z}${V} ${K}[${W}]${V} ${z}% (${J} / ${U})`}async function hQ(){if(await f("jq"))return!0;return process.stdout.write(`${T}Error: jq is required but not installed.${V}
 `),process.stdout.write(`Install with:
 `),process.stdout.write(`  brew install jq    (macOS)
 `),process.stdout.write(`  apt install jq     (Debian/Ubuntu)
@@ -790,4 +790,4 @@ Set LOKI_LEGACY_BASH=1 to force the bash CLI for every command.
 `),2}default:return process.stderr.write(`Unknown command: ${Q}
 `),process.stderr.write(s6),2}}l1();process.on("SIGINT",()=>process.exit(130));process.on("SIGTERM",()=>process.exit(143));var KZ=await XZ(Bun.argv.slice(2));process.exit(KZ);
 
-//# debugId=A55FF1A1CB2393EF64756E2164756E21
+//# debugId=D3609A2FE6BB9BAE64756E2164756E21

package/magic/core/debate.py

@@ -482,8 +482,10 @@ class DebateRunner:
         if provider == "claude":
             return ["claude", "--dangerously-skip-permissions", "-p", prompt]
         if provider == "codex":
-            # Codex uses `exec --full-auto` with the prompt as positional.
-            return ["codex", "exec", "--full-auto", prompt]
+            # Codex uses `exec --sandbox workspace-write` with the prompt as
+            # positional (codex 0.132.0 deprecated --full-auto; workspace-write
+            # is the documented replacement, exec is non-interactive by default).
+            return ["codex", "exec", "--sandbox", "workspace-write", prompt]
         if provider == "gemini":
             return ["gemini", "--approval-mode=yolo", prompt]
         if provider == "cline":

package/magic/core/generator.py

@@ -180,7 +180,7 @@ class ComponentGenerator:
         if provider == "claude":
             cmd = base_cmd + [binary, "-p", prompt]
         elif provider == "codex":
-            cmd = base_cmd + [binary, "exec", "--full-auto", prompt]
+            cmd = base_cmd + [binary, "exec", "--sandbox", "workspace-write", prompt]
         elif provider == "gemini":
             cmd = base_cmd + [binary, "--approval-mode=yolo", prompt]
         elif provider == "cline":

package/mcp/__init__.py

@@ -57,4 +57,4 @@ try:
 except ImportError:
     __all__ = ['mcp']
 
-__version__ = '7.50.0'
+__version__ = '7.52.0'

package/mcp/lsp_proxy.py

@@ -1304,6 +1304,180 @@ async def lsp_find_definition_by_name(symbol: str,
 # MAIN
 # ============================================================
 
+# ============================================================
+# DIAGNOSTICS WRITER (P1-5 quality gate)
+# ============================================================
+#
+# The LSP-diagnostics quality gate (loki-ts/src/runner/quality_gates.ts,
+# runLSPDiagnostics) READS <lokiDir>/quality/lsp-diagnostics.json but nothing
+# wrote it -- the gate was inert. This is the WRITER, invoked the same way on
+# both routes (Bun gate calls `python3 -m mcp.lsp_proxy --write-diagnostics`;
+# the bash route, when wired by the run.sh owner, calls the identical command),
+# so a single program produces byte-identical output for both. NO TS/bash
+# re-implementation of the aggregation -- that is the whole point of putting it
+# here.
+#
+# It enumerates the changed files itself (HEAD~1 -> --cached -> ls-files,
+# mirroring runStaticAnalysis's chain in quality_gates.ts so file selection
+# cannot diverge from the sibling static-analysis gate), queries each
+# supported file via the SAME in-process LSP client cache (_get_or_spawn_client,
+# one process for all files -- not python3-per-file), aggregates, and writes
+# the minimal deterministic shape the gate consumes.
+#
+# HONESTY (never fabricate a clean verdict from absence): when NO supported
+# language server is on PATH, or NO changed file maps to an available server,
+# the writer writes NO artifact and removes any stale one. The gate's existing
+# absence path then fires ("gate did not run") instead of a manufactured
+# "0 errors, 0 warnings" clean verdict. Likewise on any unrecoverable error
+# the writer leaves no artifact.
+#
+# DETERMINISM: the artifact carries ONLY the fields the gate reads
+# (count_errors, count_warnings, diagnostics[].severity/.message/.file).
+# Non-deterministic proxy fields (elapsed_ms, ranges, source) are dropped, and
+# diagnostics are sorted stably (file, severity, message) so the same inputs
+# always serialize byte-identically across runs and routes.
+
+_DIAG_ARTIFACT_REL = os.path.join('quality', 'lsp-diagnostics.json')
+
+
+def _writer_loki_dir() -> str:
+    """Resolve the .loki dir the artifact is written under. Honors LOKI_DIR
+    (matching loki-ts/src/util/paths.ts lokiDir()), else <cwd>/.loki."""
+    env = os.environ.get('LOKI_DIR')
+    if env:
+        return env
+    return os.path.join(os.getcwd(), '.loki')
+
+
+def _writer_changed_files(root: str) -> List[str]:
+    """Return changed files relative to `root`, mirroring the HEAD~1 ->
+    --cached -> ls-files chain in runStaticAnalysis (quality_gates.ts). An
+    empty-but-successful `git diff HEAD~1 HEAD` is honored as "no changes
+    this iteration" and does NOT fall through to ls-files (parity with the
+    tryGit null-vs-empty distinction in the TS gate)."""
+    def _try_git(git_args: List[str]) -> Optional[str]:
+        try:
+            proc = subprocess.run(
+                ['git', '-C', root, *git_args],
+                capture_output=True, text=True, timeout=30,
+            )
+        except (OSError, subprocess.SubprocessError):
+            return None
+        if proc.returncode != 0:
+            return None
+        return proc.stdout
+
+    raw: str
+    head_tilde = _try_git(['diff', '--name-only', 'HEAD~1', 'HEAD'])
+    if head_tilde is not None:
+        raw = head_tilde
+    else:
+        cached = _try_git(['diff', '--name-only', '--cached'])
+        if cached is not None and cached.strip():
+            raw = cached
+        else:
+            ls_files = _try_git(['ls-files'])
+            raw = ls_files if (ls_files is not None and ls_files.strip()) else ''
+    return [line.strip() for line in raw.splitlines() if line.strip()]
+
+
+def write_diagnostics_artifact(root: Optional[str] = None,
+                               loki_dir: Optional[str] = None) -> Dict[str, Any]:
+    """Enumerate changed files, query LSP diagnostics per supported file via
+    the shared in-process client cache, aggregate, and atomically write the
+    gate artifact. Returns a status dict (also printed by --write-diagnostics).
+
+    Writes NO artifact (and removes a stale one) when there is nothing real to
+    measure -- no detected server, or no changed file maps to a detected
+    server -- so the gate's absence path fires honestly instead of a fabricated
+    clean verdict."""
+    root = root or os.getcwd()
+    loki_dir = loki_dir or _writer_loki_dir()
+    artifact_path = os.path.join(loki_dir, _DIAG_ARTIFACT_REL)
+
+    def _remove_stale() -> None:
+        try:
+            if os.path.isfile(artifact_path):
+                os.remove(artifact_path)
+        except OSError:
+            pass
+
+    detected = _detect_lsps()
+    if not detected:
+        _remove_stale()
+        return {'measured': False, 'reason': 'no-language-server-on-path',
+                'wrote_artifact': False}
+
+    changed_rel = _writer_changed_files(root)
+    # Keep only files whose language has a detected server AND that exist on
+    # disk (skip deleted/renamed diff entries).
+    targets: List[str] = []
+    for rel in changed_rel:
+        abs_path = rel if os.path.isabs(rel) else os.path.join(root, rel)
+        if not os.path.isfile(abs_path):
+            continue
+        lang = _suffix_to_language(abs_path)
+        if lang is None or lang not in detected:
+            continue
+        targets.append(abs_path)
+
+    if not targets:
+        _remove_stale()
+        return {'measured': False, 'reason': 'no-changed-file-with-detected-server',
+                'wrote_artifact': False,
+                'detected': sorted(detected.keys())}
+
+    all_diags: List[Dict[str, Any]] = []
+    queried = 0
+    for abs_path in targets:
+        try:
+            raw = _lsp_get_diagnostics_blocking(abs_path)
+            parsed = json.loads(raw)
+        except (OSError, ValueError):
+            continue
+        if 'error' in parsed:
+            # Server present in detection but failed for this file (spawn
+            # failure, unsupported, etc.). Skip it -- do NOT count it clean.
+            continue
+        queried += 1
+        for d in parsed.get('diagnostics', []) or []:
+            sev = d.get('severity')
+            if not isinstance(sev, int):
+                continue
+            all_diags.append({
+                'file': abs_path,
+                'severity': sev,
+                'message': str(d.get('message', '')),
+            })
+
+    if queried == 0:
+        # Every detected-server file failed to produce a usable result. We
+        # measured nothing real -- do not fabricate a clean artifact.
+        _remove_stale()
+        return {'measured': False, 'reason': 'no-file-yielded-diagnostics',
+                'wrote_artifact': False, 'detected': sorted(detected.keys())}
+
+    # Stable sort so the same inputs serialize identically across runs/routes.
+    all_diags.sort(key=lambda d: (d['file'], d['severity'], d['message']))
+    count_errors = sum(1 for d in all_diags if d['severity'] == 1)
+    count_warnings = sum(1 for d in all_diags if d['severity'] == 2)
+    artifact = {
+        'count_errors': count_errors,
+        'count_warnings': count_warnings,
+        'diagnostics': all_diags,
+    }
+
+    os.makedirs(os.path.dirname(artifact_path), exist_ok=True)
+    body = json.dumps(artifact, indent=2, sort_keys=True) + '\n'
+    tmp_path = f'{artifact_path}.tmp.{os.getpid()}'
+    with open(tmp_path, 'w', encoding='utf-8') as fh:
+        fh.write(body)
+    os.replace(tmp_path, artifact_path)
+    return {'measured': True, 'wrote_artifact': True, 'path': artifact_path,
+            'files_queried': queried, 'count_errors': count_errors,
+            'count_warnings': count_warnings}
+
+
 def main() -> None:
     import argparse
     parser = argparse.ArgumentParser(
@@ -1317,7 +1491,36 @@ def main() -> None:
         '--port', type=int, default=8422,
         help='Port for HTTP transport (default: 8422).',
     )
+    parser.add_argument(
+        '--write-diagnostics', action='store_true',
+        help='One-shot: enumerate changed files, query LSP diagnostics for '
+             'each supported file, and write the quality-gate artifact at '
+             '<LOKI_DIR>/quality/lsp-diagnostics.json. Writes nothing when no '
+             'language server is available (the gate then reports "did not '
+             'run"). Used by the LSP-diagnostics quality gate on both routes.',
+    )
+    parser.add_argument(
+        '--root', default=None,
+        help='Project root to enumerate changed files in (default: cwd). The '
+             'caller MUST pass the TARGET project dir here, not the loki '
+             'install dir -- the install dir is only the import path for '
+             '`-m mcp.lsp_proxy`.',
+    )
     args = parser.parse_args()
+
+    if args.write_diagnostics:
+        # One-shot writer mode -- no MCP server, no event loop. Always cleans
+        # up any spawned LSP clients before exit. `--root` is the TARGET
+        # project (where the diff lives); it is independent of the process cwd
+        # (which the caller may set to the install dir so `-m mcp.lsp_proxy`
+        # imports).
+        try:
+            status = write_diagnostics_artifact(root=args.root)
+        finally:
+            _cleanup_all_clients()
+        print(json.dumps(status))
+        return
+
     # SIGTERM handler so docker stop / supervisord stop triggers cleanup
     # symmetrically to atexit. Re-raises via default handler so the
     # process actually exits.

package/mcp/tests/test_lsp_proxy.py

@@ -373,5 +373,174 @@ class LSPClientShutdownTests(unittest.TestCase):
         fake_proc.kill.assert_called()
 
 
+class DiagnosticsWriterTests(unittest.TestCase):
+    """P1-5: the diagnostics WRITER that feeds the LSP-diagnostics quality
+    gate (loki-ts/src/runner/quality_gates.ts runLSPDiagnostics). Proves
+    non-vacuity (real severity-1 diagnostics -> blocking artifact) at the
+    recording/aggregation layer, and the no-false-fire honesty paths (no
+    server / no measurable file -> NO artifact, so the gate's absence path
+    fires instead of a fabricated clean verdict)."""
+
+    def setUp(self):
+        self.lp = _import_lsp_proxy()
+        self.lp._reset_detection_cache()
+
+    def _make_repo(self, files):
+        """Create a tmp dir with the given {relpath: contents} and return it."""
+        d = tempfile.mkdtemp(prefix='loki-lsp-writer-')
+        for rel, body in files.items():
+            p = os.path.join(d, rel)
+            os.makedirs(os.path.dirname(p), exist_ok=True)
+            with open(p, 'w', encoding='utf-8') as fh:
+                fh.write(body)
+        return d
+
+    def test_no_server_writes_no_artifact(self):
+        """No detected language server -> measured:false, no artifact. The
+        gate must then report 'did not run', never a clean verdict."""
+        root = self._make_repo({'a.ts': 'const x = 1;\n'})
+        loki = tempfile.mkdtemp(prefix='loki-lsp-out-')
+        with mock.patch.object(self.lp, '_detect_lsps', return_value={}):
+            status = self.lp.write_diagnostics_artifact(root=root, loki_dir=loki)
+        self.assertFalse(status['measured'])
+        self.assertFalse(status['wrote_artifact'])
+        self.assertFalse(os.path.isfile(
+            os.path.join(loki, 'quality', 'lsp-diagnostics.json')))
+
+    def test_server_present_but_no_matching_changed_file(self):
+        """Server detected for rust, but the changed file is .ts -> nothing
+        real to measure -> no artifact."""
+        root = self._make_repo({'a.ts': 'const x = 1;\n'})
+        loki = tempfile.mkdtemp(prefix='loki-lsp-out-')
+        with mock.patch.object(self.lp, '_detect_lsps',
+                               return_value={'rust': '/usr/bin/rust-analyzer'}), \
+             mock.patch.object(self.lp, '_writer_changed_files',
+                               return_value=['a.ts']):
+            status = self.lp.write_diagnostics_artifact(root=root, loki_dir=loki)
+        self.assertFalse(status['measured'])
+        self.assertEqual(status['reason'], 'no-changed-file-with-detected-server')
+        self.assertFalse(os.path.isfile(
+            os.path.join(loki, 'quality', 'lsp-diagnostics.json')))
+
+    def test_real_error_recorded_and_blocks(self):
+        """NON-VACUITY: a severity-1 diagnostic from the per-file LSP query is
+        recorded into the artifact with count_errors>0 -- the exact shape the
+        gate blocks on. Diagnostics source is mocked at the proxy boundary so
+        this exercises the writer's enumeration + aggregation + serialization
+        WITHOUT fabricating a verdict (the gate still independently reads the
+        file)."""
+        root = self._make_repo({'src/main.py': 'x: int = "nope"\n'})
+        loki = tempfile.mkdtemp(prefix='loki-lsp-out-')
+        fake = json.dumps({
+            'diagnostics': [
+                {'severity': 1, 'message': 'Type error', 'range': {}, 'source': 'x'},
+                {'severity': 2, 'message': 'Unused', 'range': {}},
+                {'severity': 3, 'message': 'Info note'},
+            ],
+            'count_errors': 1, 'count_warnings': 1,
+            'language': 'python', 'elapsed_ms': 123.4,
+        })
+        with mock.patch.object(self.lp, '_detect_lsps',
+                               return_value={'python': '/usr/bin/pyright'}), \
+             mock.patch.object(self.lp, '_writer_changed_files',
+                               return_value=['src/main.py']), \
+             mock.patch.object(self.lp, '_lsp_get_diagnostics_blocking',
+                               return_value=fake):
+            status = self.lp.write_diagnostics_artifact(root=root, loki_dir=loki)
+        self.assertTrue(status['measured'])
+        self.assertTrue(status['wrote_artifact'])
+        self.assertEqual(status['count_errors'], 1)
+        path = os.path.join(loki, 'quality', 'lsp-diagnostics.json')
+        self.assertTrue(os.path.isfile(path))
+        with open(path, encoding='utf-8') as fh:
+            artifact = json.load(fh)
+        self.assertEqual(artifact['count_errors'], 1)
+        self.assertEqual(artifact['count_warnings'], 1)
+        # Minimal deterministic shape: only severity/message/file survive;
+        # elapsed_ms / range / source are stripped.
+        self.assertEqual(len(artifact['diagnostics']), 3)
+        for d in artifact['diagnostics']:
+            self.assertEqual(set(d.keys()), {'file', 'severity', 'message'})
+        self.assertNotIn('elapsed_ms', artifact)
+
+    def test_per_file_lsp_error_does_not_count_clean(self):
+        """A detected server that returns {'error':...} for the only changed
+        file means we measured nothing -> no artifact (NOT a fabricated
+        clean verdict)."""
+        root = self._make_repo({'src/main.py': 'x = 1\n'})
+        loki = tempfile.mkdtemp(prefix='loki-lsp-out-')
+        with mock.patch.object(self.lp, '_detect_lsps',
+                               return_value={'python': '/usr/bin/pyright'}), \
+             mock.patch.object(self.lp, '_writer_changed_files',
+                               return_value=['src/main.py']), \
+             mock.patch.object(self.lp, '_lsp_get_diagnostics_blocking',
+                               return_value=json.dumps({'error': 'spawn failed'})):
+            status = self.lp.write_diagnostics_artifact(root=root, loki_dir=loki)
+        self.assertFalse(status['measured'])
+        self.assertEqual(status['reason'], 'no-file-yielded-diagnostics')
+        self.assertFalse(os.path.isfile(
+            os.path.join(loki, 'quality', 'lsp-diagnostics.json')))
+
+    def test_clean_file_writes_zero_artifact(self):
+        """A measured file with no diagnostics writes a real 0/0 artifact --
+        this is a MEASURED clean result (we queried a live server), distinct
+        from the absence path."""
+        root = self._make_repo({'src/main.py': 'x = 1\n'})
+        loki = tempfile.mkdtemp(prefix='loki-lsp-out-')
+        with mock.patch.object(self.lp, '_detect_lsps',
+                               return_value={'python': '/usr/bin/pyright'}), \
+             mock.patch.object(self.lp, '_writer_changed_files',
+                               return_value=['src/main.py']), \
+             mock.patch.object(self.lp, '_lsp_get_diagnostics_blocking',
+                               return_value=json.dumps({
+                                   'diagnostics': [], 'count_errors': 0,
+                                   'count_warnings': 0})):
+            status = self.lp.write_diagnostics_artifact(root=root, loki_dir=loki)
+        self.assertTrue(status['measured'])
+        path = os.path.join(loki, 'quality', 'lsp-diagnostics.json')
+        with open(path, encoding='utf-8') as fh:
+            artifact = json.load(fh)
+        self.assertEqual(artifact['count_errors'], 0)
+        self.assertEqual(artifact['count_warnings'], 0)
+        self.assertEqual(artifact['diagnostics'], [])
+
+    def test_stale_artifact_removed_when_unmeasured(self):
+        """A previously-written artifact must be removed when a later run
+        measures nothing, so last iteration's errors cannot block forever."""
+        root = self._make_repo({'a.ts': 'const x = 1;\n'})
+        loki = tempfile.mkdtemp(prefix='loki-lsp-out-')
+        qdir = os.path.join(loki, 'quality')
+        os.makedirs(qdir, exist_ok=True)
+        stale = os.path.join(qdir, 'lsp-diagnostics.json')
+        with open(stale, 'w', encoding='utf-8') as fh:
+            fh.write('{"count_errors": 5, "count_warnings": 0, "diagnostics": []}')
+        with mock.patch.object(self.lp, '_detect_lsps', return_value={}):
+            self.lp.write_diagnostics_artifact(root=root, loki_dir=loki)
+        self.assertFalse(os.path.isfile(stale))
+
+    def test_deterministic_serialization(self):
+        """Same inputs -> byte-identical artifact (route + run parity)."""
+        root = self._make_repo({'src/main.py': 'x = 1\n'})
+        loki1 = tempfile.mkdtemp(prefix='loki-lsp-out-')
+        loki2 = tempfile.mkdtemp(prefix='loki-lsp-out-')
+        fake = json.dumps({'diagnostics': [
+            {'severity': 2, 'message': 'b'},
+            {'severity': 1, 'message': 'a'},
+        ]})
+        for lk in (loki1, loki2):
+            with mock.patch.object(self.lp, '_detect_lsps',
+                                   return_value={'python': '/usr/bin/pyright'}), \
+                 mock.patch.object(self.lp, '_writer_changed_files',
+                                   return_value=['src/main.py']), \
+                 mock.patch.object(self.lp, '_lsp_get_diagnostics_blocking',
+                                   return_value=fake):
+                self.lp.write_diagnostics_artifact(root=root, loki_dir=lk)
+        with open(os.path.join(loki1, 'quality', 'lsp-diagnostics.json'), 'rb') as fh:
+            b1 = fh.read()
+        with open(os.path.join(loki2, 'quality', 'lsp-diagnostics.json'), 'rb') as fh:
+            b2 = fh.read()
+        self.assertEqual(b1, b2)
+
+
 if __name__ == '__main__':
     unittest.main()

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "loki-mode",
   "mcpName": "io.github.asklokesh/loki-mode",
-  "version": "7.50.0",
+  "version": "7.52.0",
   "description": "Loki Mode by Autonomi. Autonomous spec-to-product system: takes a PRD, GitHub issue, OpenAPI/JSON/YAML, or one-line brief to a deployed app via the RARV-C closure loop with 8 quality gates. Provider-agnostic (Claude Code, OpenAI Codex, Cline, Aider).",
   "keywords": [
     "agent",

package/plugins/loki-mode/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "loki-mode",
   "displayName": "Loki Mode",
-  "version": "7.50.0",
+  "version": "7.52.0",
   "description": "Autonomous spec-to-product build system with a built-in trust layer (RARV-C closure loop, 8 quality gates, completion council). Ships Loki's spec-hardening, drift-detection, and deterministic PR verification commands plus the Loki MCP server.",
   "author": {
     "name": "Autonomi",

package/providers/codex.sh

@@ -29,10 +29,14 @@ PROVIDER_CLI="codex"
 
 # CLI Invocation
 # Note: codex uses positional prompt after "exec" subcommand
-# VERIFIED: exec --full-auto confirmed in codex exec --help (v0.98.0)
-# --full-auto: sets --ask-for-approval on-request + --sandbox workspace-write (v0.98.0)
+# VERIFIED: codex 0.132.0 deprecates --full-auto (prints a deprecation warning
+# and the flag is gone from `codex exec --help`). Use --sandbox workspace-write,
+# which is the documented replacement and the sandbox --full-auto expanded to.
+# `codex exec` is the non-interactive subcommand: it runs at approval "never"
+# with no --ask-for-approval flag, so --sandbox workspace-write alone keeps the
+# loop fully autonomous (verified against codex 0.132.0: no approval prompt).
 # Alternative: "exec --dangerously-bypass-approvals-and-sandbox" (legacy, no sandbox)
-PROVIDER_AUTONOMOUS_FLAG="exec --full-auto --skip-git-repo-check"
+PROVIDER_AUTONOMOUS_FLAG="exec --sandbox workspace-write --skip-git-repo-check"
 PROVIDER_PROMPT_FLAG=""
 PROVIDER_PROMPT_POSITIONAL=true
 
@@ -124,7 +128,7 @@ provider_version() {
 provider_invoke() {
     local prompt="$1"
     shift
-    codex exec --full-auto --skip-git-repo-check \
+    codex exec --sandbox workspace-write --skip-git-repo-check \
         --model "$PROVIDER_MODEL_DEVELOPMENT" \
         "$prompt" "$@"
 }
@@ -182,11 +186,13 @@ resolve_model_for_tier() {
 
 # Tier-aware invocation.
 #
-# v7.4.18: aligned with codex CLI v0.125.0 (latest as of 2026-04-26).
-# Replaced --full-auto preset with the explicit flags it expands to:
-#   --ask-for-approval never
-#   --sandbox danger-full-access
-# Forward-compatible if the preset is renamed; readable in process listings.
+# Aligned with codex CLI 0.132.0 (verified: --full-auto deprecated/removed
+# from `codex exec --help`). `codex exec` is the non-interactive subcommand and
+# runs at approval "never" with no --ask-for-approval flag, so --sandbox
+# workspace-write alone keeps the loop autonomous (verified: no approval prompt
+# on codex 0.132.0). workspace-write is the documented --full-auto replacement
+# and the safer default (scoped disk writes) over danger-full-access; readable
+# in process listings.
 #
 # Optional env knobs:
 #   LOKI_CODEX_WEB_SEARCH=true      enable codex --search (live web)
@@ -227,8 +233,7 @@ provider_invoke_with_tier() {
     LOKI_CODEX_REASONING_EFFORT="$effort" \
     CODEX_MODEL_REASONING_EFFORT="$effort" \
     codex exec \
-        --ask-for-approval never \
-        --sandbox danger-full-access \
+        --sandbox workspace-write \
         --skip-git-repo-check \
         --model "$model" \
         "${extra_flags[@]}" \

package/references/multi-provider.md

@@ -286,7 +286,7 @@ All CLI flags have been verified against actual CLI help output:
 | Provider | Flag | Verified Version | Notes |
 |----------|------|------------------|-------|
 | Claude | `--dangerously-skip-permissions` | v2.1.34 | Autonomous mode |
-| Codex | `--full-auto` | v0.98.0 | Recommended; legacy: `exec --dangerously-bypass-approvals-and-sandbox` |
+| Codex | `--sandbox workspace-write` | v0.132.0 | Recommended (--full-auto deprecated 0.125+); legacy: `exec --dangerously-bypass-approvals-and-sandbox` |
 | Cline | `--auto-approve` | latest | Autonomous mode |
 | Aider | `--yes-always` | latest | Autonomous mode |
 

package/skills/model-selection.md

@@ -231,13 +231,16 @@ Claude models support an `effort` parameter that controls reasoning depth withou
 
 **Note:** The effort parameter and thinking prefixes serve different purposes. Effort controls the model's internal reasoning budget; thinking prefixes guide the structure of the response.
 
-### Codex --full-auto Flag
+### Codex --sandbox workspace-write Flag
 
-Codex CLI v0.98.0 supports `--full-auto` as the recommended autonomous mode flag, replacing the verbose `exec --dangerously-bypass-approvals-and-sandbox` invocation:
+Codex CLI deprecated `--full-auto` in v0.125+ (removed from `codex exec --help`,
+emits a deprecation warning if used). The documented replacement is
+`--sandbox workspace-write`. The `exec` subcommand is non-interactive by default
+(approval: never), so the sandbox flag alone keeps the loop autonomous:
 
 ```bash
-# Recommended (v0.98.0+)
-codex --full-auto "$prompt"
+# Recommended (codex 0.125+)
+codex exec --sandbox workspace-write "$prompt"
 
 # Legacy (still supported)
 codex exec --dangerously-bypass-approvals-and-sandbox "$prompt"

package/skills/providers.md

@@ -6,7 +6,7 @@ Loki Mode supports four AI providers for autonomous execution.
 
 > **CLI Flags Verified:** The autonomous mode flags have been verified against actual CLI help output:
 > - Claude: `--dangerously-skip-permissions` (verified)
-> - Codex: `exec --full-auto --skip-git-repo-check` (the harness invocation; --skip-git-repo-check required on fresh non-git dirs) or `exec --dangerously-bypass-approvals-and-sandbox` (legacy)
+> - Codex: `exec --sandbox workspace-write --skip-git-repo-check` (the harness invocation; --skip-git-repo-check required on fresh non-git dirs; --full-auto deprecated in codex 0.125+, workspace-write is the documented replacement) or `exec --dangerously-bypass-approvals-and-sandbox` (legacy)
 
 | Feature | Claude Code | OpenAI Codex | Cline CLI | Aider |
 |---------|-------------|--------------|-----------|-------|
@@ -70,7 +70,7 @@ Task(model="haiku", ...)   # Fast tier (parallelize)
 **Invocation:**
 ```bash
 # Recommended (v0.98.0+)
-codex exec --full-auto --skip-git-repo-check "$prompt"
+codex exec --sandbox workspace-write --skip-git-repo-check "$prompt"
 
 # Legacy (still supported)
 codex exec --dangerously-bypass-approvals-and-sandbox "$prompt"