loki-mode 7.77.0 → 7.79.0

package/autonomy/run.sh

@@ -40,7 +40,18 @@
 #   LOKI_AUDIT_DISABLED     - Disable audit logging (default: false)
 #   LOKI_MAX_PARALLEL_AGENTS - Limit concurrent agent spawning (default: 10)
 #   LOKI_SANDBOX_MODE       - Run in sandboxed container (default: false, requires Docker)
-#   LOKI_ALLOWED_PATHS      - Comma-separated paths agents can modify (default: all)
+#   LOKI_ALLOWED_PATHS      - Comma-separated path allowlist. PARTIAL enforcement
+#                             (honest scope): when set, run.sh rejects a sandbox
+#                             custom --mount whose host path is outside the
+#                             allowlist (a write surface run.sh itself controls).
+#                             It does NOT and CANNOT restrict provider-driven
+#                             agent file writes: claude/codex/cline/aider write
+#                             files directly, not through run.sh, so run.sh never
+#                             sees those writes. The containment for agent writes
+#                             is the OS user + the LOKI_SANDBOX_MODE container
+#                             (cap-drop, seccomp, read-only mounts), not this var.
+#                             Treat ALLOWED_PATHS as defense-in-depth on the
+#                             mount surface, not a complete write sandbox.
 #   LOKI_BLOCKED_COMMANDS   - Comma-separated blocked shell commands (default: rm -rf /)
 #
 # OIDC / SSO Authentication (optional, works alongside token auth):
@@ -225,6 +236,17 @@ fi
 # Configuration File Support (v4.1.0)
 # Loads settings from config file, environment variables take precedence
 #===============================================================================
+# #691: source the canonical config mapping + shared per-key export helper. This
+# is the SAME lib the loki CLI pre-pass uses, so the YAML/config-file mapping
+# cannot drift between the CLI and the runner. Side-effect-free on source. The
+# parsers below delegate to loki_config_export_key with override=0, preserving
+# the shipped env-wins auto-discovery contract byte-for-byte.
+_LOKI_CONFIG_MAP_LIB="$SCRIPT_DIR/lib/config-map.sh"
+if [ -f "$_LOKI_CONFIG_MAP_LIB" ]; then
+    # shellcheck source=lib/config-map.sh
+    source "$_LOKI_CONFIG_MAP_LIB"
+fi
+
 load_config_file() {
     local config_file=""
 
@@ -258,95 +280,22 @@ load_config_file() {
     parse_yaml_with_yq "$config_file"
 }
 
-# Fallback YAML parser for simple key: value format
+# Fallback YAML parser for simple key: value format.
+# #691: iterates the canonical LOKI_CONFIG_MAP (single source of truth) instead
+# of 64 hand-maintained set_from_yaml calls. override=0 -> ambient env still
+# wins (auto-discovery contract unchanged). Falls back to nothing if the lib is
+# absent (defensive; the lib ships alongside run.sh).
 parse_simple_yaml() {
     local file="$1"
-
-    # Parse core settings
-    set_from_yaml "$file" "core.max_retries" "LOKI_MAX_RETRIES"
-    set_from_yaml "$file" "core.base_wait" "LOKI_BASE_WAIT"
-    set_from_yaml "$file" "core.max_wait" "LOKI_MAX_WAIT"
-    set_from_yaml "$file" "core.skip_prereqs" "LOKI_SKIP_PREREQS"
-
-    # Dashboard
-    set_from_yaml "$file" "dashboard.enabled" "LOKI_DASHBOARD"
-    set_from_yaml "$file" "dashboard.port" "LOKI_DASHBOARD_PORT"
-
-    # Resources
-    set_from_yaml "$file" "resources.check_interval" "LOKI_RESOURCE_CHECK_INTERVAL"
-    set_from_yaml "$file" "resources.cpu_threshold" "LOKI_RESOURCE_CPU_THRESHOLD"
-    set_from_yaml "$file" "resources.mem_threshold" "LOKI_RESOURCE_MEM_THRESHOLD"
-
-    # Security
-    set_from_yaml "$file" "security.staged_autonomy" "LOKI_STAGED_AUTONOMY"
-    set_from_yaml "$file" "security.audit_log" "LOKI_AUDIT_LOG"
-    set_from_yaml "$file" "security.max_parallel_agents" "LOKI_MAX_PARALLEL_AGENTS"
-    set_from_yaml "$file" "security.sandbox_mode" "LOKI_SANDBOX_MODE"
-    set_from_yaml "$file" "security.allowed_paths" "LOKI_ALLOWED_PATHS"
-    set_from_yaml "$file" "security.blocked_commands" "LOKI_BLOCKED_COMMANDS"
-
-    # Phases
-    set_from_yaml "$file" "phases.unit_tests" "LOKI_PHASE_UNIT_TESTS"
-    set_from_yaml "$file" "phases.api_tests" "LOKI_PHASE_API_TESTS"
-    set_from_yaml "$file" "phases.e2e_tests" "LOKI_PHASE_E2E_TESTS"
-    set_from_yaml "$file" "phases.security" "LOKI_PHASE_SECURITY"
-    set_from_yaml "$file" "phases.integration" "LOKI_PHASE_INTEGRATION"
-    set_from_yaml "$file" "phases.code_review" "LOKI_PHASE_CODE_REVIEW"
-    set_from_yaml "$file" "phases.web_research" "LOKI_PHASE_WEB_RESEARCH"
-    set_from_yaml "$file" "phases.performance" "LOKI_PHASE_PERFORMANCE"
-    set_from_yaml "$file" "phases.accessibility" "LOKI_PHASE_ACCESSIBILITY"
-    set_from_yaml "$file" "phases.regression" "LOKI_PHASE_REGRESSION"
-    set_from_yaml "$file" "phases.uat" "LOKI_PHASE_UAT"
-
-    # Completion
-    set_from_yaml "$file" "completion.promise" "LOKI_COMPLETION_PROMISE"
-    set_from_yaml "$file" "completion.max_iterations" "LOKI_MAX_ITERATIONS"
-    set_from_yaml "$file" "completion.perpetual_mode" "LOKI_PERPETUAL_MODE"
-    set_from_yaml "$file" "completion.council.enabled" "LOKI_COUNCIL_ENABLED"
-    set_from_yaml "$file" "completion.council.size" "LOKI_COUNCIL_SIZE"
-    set_from_yaml "$file" "completion.council.threshold" "LOKI_COUNCIL_THRESHOLD"
-    set_from_yaml "$file" "completion.council.check_interval" "LOKI_COUNCIL_CHECK_INTERVAL"
-    set_from_yaml "$file" "completion.council.min_iterations" "LOKI_COUNCIL_MIN_ITERATIONS"
-    set_from_yaml "$file" "completion.council.stagnation_limit" "LOKI_COUNCIL_STAGNATION_LIMIT"
-    set_from_yaml "$file" "completion.uncertainty.escalation" "LOKI_UNCERTAINTY_ESCALATION"
-    set_from_yaml "$file" "completion.uncertainty.rounds" "LOKI_UNCERTAINTY_ROUNDS"
-    set_from_yaml "$file" "completion.uncertainty.nochange_min" "LOKI_UNCERTAINTY_NOCHANGE_MIN"
-    set_from_yaml "$file" "completion.uncertainty.split_rounds" "LOKI_UNCERTAINTY_SPLIT_ROUNDS"
-
-    # Model
-    set_from_yaml "$file" "model.prompt_repetition" "LOKI_PROMPT_REPETITION"
-    set_from_yaml "$file" "model.confidence_routing" "LOKI_CONFIDENCE_ROUTING"
-    set_from_yaml "$file" "model.autonomy_mode" "LOKI_AUTONOMY_MODE"
-    set_from_yaml "$file" "model.planning" "LOKI_MODEL_PLANNING"
-    set_from_yaml "$file" "model.development" "LOKI_MODEL_DEVELOPMENT"
-    set_from_yaml "$file" "model.fast" "LOKI_MODEL_FAST"
-
-    # Parallel
-    set_from_yaml "$file" "parallel.enabled" "LOKI_PARALLEL_MODE"
-    set_from_yaml "$file" "parallel.max_worktrees" "LOKI_MAX_WORKTREES"
-    set_from_yaml "$file" "parallel.max_sessions" "LOKI_MAX_PARALLEL_SESSIONS"
-    set_from_yaml "$file" "parallel.testing" "LOKI_PARALLEL_TESTING"
-    set_from_yaml "$file" "parallel.docs" "LOKI_PARALLEL_DOCS"
-    set_from_yaml "$file" "parallel.blog" "LOKI_PARALLEL_BLOG"
-    set_from_yaml "$file" "parallel.auto_merge" "LOKI_AUTO_MERGE"
-
-    # Complexity
-    set_from_yaml "$file" "complexity.tier" "LOKI_COMPLEXITY"
-
-    # GitHub
-    set_from_yaml "$file" "github.import" "LOKI_GITHUB_IMPORT"
-    set_from_yaml "$file" "github.pr" "LOKI_GITHUB_PR"
-    set_from_yaml "$file" "github.sync" "LOKI_GITHUB_SYNC"
-    set_from_yaml "$file" "github.repo" "LOKI_GITHUB_REPO"
-    set_from_yaml "$file" "github.labels" "LOKI_GITHUB_LABELS"
-    set_from_yaml "$file" "github.milestone" "LOKI_GITHUB_MILESTONE"
-    set_from_yaml "$file" "github.assignee" "LOKI_GITHUB_ASSIGNEE"
-    set_from_yaml "$file" "github.limit" "LOKI_GITHUB_LIMIT"
-    set_from_yaml "$file" "github.pr_label" "LOKI_GITHUB_PR_LABEL"
-
-    # Notifications
-    set_from_yaml "$file" "notifications.enabled" "LOKI_NOTIFICATIONS"
-    set_from_yaml "$file" "notifications.sound" "LOKI_NOTIFICATION_SOUND"
+    if ! declare -p LOKI_CONFIG_MAP >/dev/null 2>&1; then
+        return 0
+    fi
+    local mapping yaml_path env_var
+    for mapping in "${LOKI_CONFIG_MAP[@]}"; do
+        yaml_path="${mapping%%:*}"
+        env_var="${mapping##*:}"
+        set_from_yaml "$file" "$yaml_path" "$env_var"
+    done
 }
 
 # Validate YAML value to prevent injection attacks
@@ -359,11 +308,19 @@ validate_yaml_value() {
         return 1
     fi
 
-    # Reject values with dangerous shell metacharacters
-    # Allow alphanumeric, spaces, dots, dashes, underscores, slashes, colons, commas, @
-    if [[ "$value" =~ [\$\`\|\;\&\>\<\(\)\{\}\[\]\\] ]]; then
-        return 1
-    fi
+    # Reject values with dangerous shell metacharacters.
+    # SECURITY FIX (#691 wave): the previous [[ "$value" =~ [\$\`...] ]]
+    # bracket-regex matched NOTHING -- backslash escapes inside a bash regex
+    # bracket class are taken literally, so the guard ACCEPTED $(...), backticks,
+    # pipes, etc. (verified behaviorally: it returned 0 for "$(touch /tmp/x)").
+    # A `case` glob class has no such ambiguity and actually rejects the metachars.
+    # Allow alphanumeric, spaces, dots, dashes, underscores, slashes, colons,
+    # commas, @.
+    case "$value" in
+        *'$'* | *'`'* | *'|'* | *';'* | *'&'* | *'>'* | *'<'* | *'('* | *')'* \
+        | *'{'* | *'}'* | *'['* | *']'* | *'\'* )
+            return 1 ;;
+    esac
 
     # Reject values that are too long (DoS protection)
     if [ "${#value}" -gt "$max_length" ]; then
@@ -391,7 +348,8 @@ set_from_yaml() {
     local yaml_path="$2"
     local env_var="$3"
 
-    # Skip if env var is already set
+    # Skip if env var is already set (env-wins guard; the shared helper also
+    # enforces this with override=0, but checking here avoids the extraction).
     if [ -n "${!env_var:-}" ]; then
         return 0
     fi
@@ -409,95 +367,40 @@ set_from_yaml() {
     # Use read to avoid xargs command execution risks
     value=$(grep -E "^\s*${escaped_key}:" "$file" 2>/dev/null | head -1 | sed -E 's/.*:\s*//' | sed 's/#.*//' | sed 's/^["\x27]//;s/["\x27]$//' | tr -d '\n' | sed 's/^[[:space:]]*//;s/[[:space:]]*$//')
 
-    # Validate value before export (security check)
-    if [ -n "$value" ] && [ "$value" != "null" ] && validate_yaml_value "$value"; then
+    # #691: delegate the env-wins guard + ${VAR}-expand + validate + export to the
+    # single shared helper (override=0 -> ambient env wins). Falls back to the
+    # original inline export if the lib is unavailable, so behavior is identical
+    # either way.
+    if declare -f loki_config_export_key >/dev/null 2>&1; then
+        loki_config_export_key "$env_var" "$value" 0 || true
+    elif [ -n "$value" ] && [ "$value" != "null" ] && validate_yaml_value "$value"; then
         export "$env_var=$value"
     fi
 }
 
-# Parse YAML using yq (proper parser)
+# Parse YAML using yq (proper parser).
+# #691: iterates the canonical LOKI_CONFIG_MAP and delegates the env-wins guard +
+# expand + validate + export to the single shared helper (override=0 -> ambient
+# env wins; auto-discovery contract unchanged). The inline 61-entry table that
+# used to drift from parse_simple_yaml's 64 is gone.
 parse_yaml_with_yq() {
     local file="$1"
-    local mappings=(
-        "core.max_retries:LOKI_MAX_RETRIES"
-        "core.base_wait:LOKI_BASE_WAIT"
-        "core.max_wait:LOKI_MAX_WAIT"
-        "core.skip_prereqs:LOKI_SKIP_PREREQS"
-        "dashboard.enabled:LOKI_DASHBOARD"
-        "dashboard.port:LOKI_DASHBOARD_PORT"
-        "resources.check_interval:LOKI_RESOURCE_CHECK_INTERVAL"
-        "resources.cpu_threshold:LOKI_RESOURCE_CPU_THRESHOLD"
-        "resources.mem_threshold:LOKI_RESOURCE_MEM_THRESHOLD"
-        "security.staged_autonomy:LOKI_STAGED_AUTONOMY"
-        "security.audit_log:LOKI_AUDIT_LOG"
-        "security.max_parallel_agents:LOKI_MAX_PARALLEL_AGENTS"
-        "security.sandbox_mode:LOKI_SANDBOX_MODE"
-        "security.allowed_paths:LOKI_ALLOWED_PATHS"
-        "security.blocked_commands:LOKI_BLOCKED_COMMANDS"
-        "phases.unit_tests:LOKI_PHASE_UNIT_TESTS"
-        "phases.api_tests:LOKI_PHASE_API_TESTS"
-        "phases.e2e_tests:LOKI_PHASE_E2E_TESTS"
-        "phases.security:LOKI_PHASE_SECURITY"
-        "phases.integration:LOKI_PHASE_INTEGRATION"
-        "phases.code_review:LOKI_PHASE_CODE_REVIEW"
-        "phases.web_research:LOKI_PHASE_WEB_RESEARCH"
-        "phases.performance:LOKI_PHASE_PERFORMANCE"
-        "phases.accessibility:LOKI_PHASE_ACCESSIBILITY"
-        "phases.regression:LOKI_PHASE_REGRESSION"
-        "phases.uat:LOKI_PHASE_UAT"
-        "completion.promise:LOKI_COMPLETION_PROMISE"
-        "completion.max_iterations:LOKI_MAX_ITERATIONS"
-        "completion.perpetual_mode:LOKI_PERPETUAL_MODE"
-        "completion.council.enabled:LOKI_COUNCIL_ENABLED"
-        "completion.council.size:LOKI_COUNCIL_SIZE"
-        "completion.council.threshold:LOKI_COUNCIL_THRESHOLD"
-        "completion.council.check_interval:LOKI_COUNCIL_CHECK_INTERVAL"
-        "completion.council.min_iterations:LOKI_COUNCIL_MIN_ITERATIONS"
-        "completion.council.stagnation_limit:LOKI_COUNCIL_STAGNATION_LIMIT"
-        "completion.uncertainty.escalation:LOKI_UNCERTAINTY_ESCALATION"
-        "completion.uncertainty.rounds:LOKI_UNCERTAINTY_ROUNDS"
-        "completion.uncertainty.nochange_min:LOKI_UNCERTAINTY_NOCHANGE_MIN"
-        "completion.uncertainty.split_rounds:LOKI_UNCERTAINTY_SPLIT_ROUNDS"
-        "model.prompt_repetition:LOKI_PROMPT_REPETITION"
-        "model.confidence_routing:LOKI_CONFIDENCE_ROUTING"
-        "model.autonomy_mode:LOKI_AUTONOMY_MODE"
-        "parallel.enabled:LOKI_PARALLEL_MODE"
-        "parallel.max_worktrees:LOKI_MAX_WORKTREES"
-        "parallel.max_sessions:LOKI_MAX_PARALLEL_SESSIONS"
-        "parallel.testing:LOKI_PARALLEL_TESTING"
-        "parallel.docs:LOKI_PARALLEL_DOCS"
-        "parallel.blog:LOKI_PARALLEL_BLOG"
-        "parallel.auto_merge:LOKI_AUTO_MERGE"
-        "complexity.tier:LOKI_COMPLEXITY"
-        "github.import:LOKI_GITHUB_IMPORT"
-        "github.pr:LOKI_GITHUB_PR"
-        "github.sync:LOKI_GITHUB_SYNC"
-        "github.repo:LOKI_GITHUB_REPO"
-        "github.labels:LOKI_GITHUB_LABELS"
-        "github.milestone:LOKI_GITHUB_MILESTONE"
-        "github.assignee:LOKI_GITHUB_ASSIGNEE"
-        "github.limit:LOKI_GITHUB_LIMIT"
-        "github.pr_label:LOKI_GITHUB_PR_LABEL"
-        "notifications.enabled:LOKI_NOTIFICATIONS"
-        "notifications.sound:LOKI_NOTIFICATION_SOUND"
-    )
-
-    for mapping in "${mappings[@]}"; do
-        local yaml_path="${mapping%%:*}"
-        local env_var="${mapping##*:}"
+    if ! declare -p LOKI_CONFIG_MAP >/dev/null 2>&1; then
+        return 0
+    fi
 
-        # Skip if env var is already set
-        if [ -n "${!env_var:-}" ]; then
-            continue
-        fi
+    local mapping yaml_path env_var value
+    for mapping in "${LOKI_CONFIG_MAP[@]}"; do
+        yaml_path="${mapping%%:*}"
+        env_var="${mapping##*:}"
 
-        # Extract value using yq
-        local value
+        # Extract value using yq (env-wins guard is enforced by the shared helper).
         value=$(yq eval ".$yaml_path // \"\"" "$file" 2>/dev/null)
 
-        # Set env var if value found and not empty/null
-        # Also validate for security (prevent injection)
-        if [ -n "$value" ] && [ "$value" != "null" ] && [ "$value" != "" ] && validate_yaml_value "$value"; then
+        if declare -f loki_config_export_key >/dev/null 2>&1; then
+            loki_config_export_key "$env_var" "$value" 0 || true
+        elif [ -n "$value" ] && [ "$value" != "null" ] && [ "$value" != "" ] \
+                && [ -z "${!env_var:-}" ] && validate_yaml_value "$value"; then
             export "$env_var=$value"
         fi
     done
@@ -588,9 +491,29 @@ STAGED_AUTONOMY=${LOKI_STAGED_AUTONOMY:-false}           # Require plan approval
 AUDIT_LOG_ENABLED=${LOKI_AUDIT_LOG:-true}                # Enable audit logging (on by default)
 MAX_PARALLEL_AGENTS=${LOKI_MAX_PARALLEL_AGENTS:-10}      # Limit concurrent agents
 SANDBOX_MODE=${LOKI_SANDBOX_MODE:-false}                 # Docker sandbox mode (informational; the real dispatch reads LOKI_SANDBOX_MODE at autonomy/loki:1965 and execs sandbox.sh -- this var is not consumed in run.sh)
-ALLOWED_PATHS=${LOKI_ALLOWED_PATHS:-""}                  # Empty = all paths allowed
+ALLOWED_PATHS=${LOKI_ALLOWED_PATHS:-""}                  # PARTIAL enforcement. When set, a sandbox custom --mount host path outside the allowlist is rejected in sandbox.sh (_sandbox_path_within_allowed), NOT in run.sh. Does NOT restrict provider-driven agent writes (run.sh never sees them); the sandbox container is the containment for those. Default empty = no restriction.
 BLOCKED_COMMANDS=${LOKI_BLOCKED_COMMANDS:-"rm -rf /,dd if=,mkfs,:(){ :|:& };:"}
 
+# LOKI_SESSION_ID is woven into many filesystem paths (.loki/sessions/<id>/...,
+# session locks, PID files, per-session state). It is operator/issue-derived
+# (trusted-ish), but a value like "../../tmp/x" would escape the .loki/ tree.
+# Sanitize ONCE here at intake: any char outside [A-Za-z0-9._-] is replaced with
+# "_" and a leading run of dots/dashes is neutralized, so every downstream
+# session path is contained. Unset stays unset (default behavior unchanged).
+if [ -n "${LOKI_SESSION_ID:-}" ]; then
+    _loki_sid_raw="$LOKI_SESSION_ID"
+    _loki_sid_safe="${_loki_sid_raw//[^A-Za-z0-9._-]/_}"
+    # Strip leading dots/dashes so "../x" -> "x" cannot reference a parent dir
+    # or look like an option; collapse a now-empty result to a safe literal.
+    _loki_sid_safe="${_loki_sid_safe#"${_loki_sid_safe%%[!.-]*}"}"
+    [ -n "$_loki_sid_safe" ] || _loki_sid_safe="session"
+    if [ "$_loki_sid_safe" != "$_loki_sid_raw" ]; then
+        printf 'loki: WARNING sanitized unsafe LOKI_SESSION_ID %s -> %s\n' "$_loki_sid_raw" "$_loki_sid_safe" >&2
+    fi
+    export LOKI_SESSION_ID="$_loki_sid_safe"
+    unset _loki_sid_raw _loki_sid_safe
+fi
+
 # Process Supervision (opt-in)
 WATCHDOG_ENABLED=${LOKI_WATCHDOG:-"false"}          # Enable process health monitoring
 WATCHDOG_INTERVAL=${LOKI_WATCHDOG_INTERVAL:-30}     # Check interval in seconds
@@ -1902,41 +1825,7 @@ detect_complexity() {
 }
 
 # Get phases based on complexity tier
-get_complexity_phases() {
-    case "$DETECTED_COMPLEXITY" in
-        simple)
-            echo "3"
-            ;;
-        standard)
-            echo "6"
-            ;;
-        complex)
-            echo "8"
-            ;;
-        *)
-            echo "6"  # Default to standard
-            ;;
-    esac
-}
-
 # Get phase names based on complexity tier
-get_phase_names() {
-    case "$DETECTED_COMPLEXITY" in
-        simple)
-            echo "IMPLEMENT TEST DEPLOY"
-            ;;
-        standard)
-            echo "RESEARCH DESIGN IMPLEMENT TEST REVIEW DEPLOY"
-            ;;
-        complex)
-            echo "RESEARCH ARCHITECTURE DESIGN IMPLEMENT TEST REVIEW SECURITY DEPLOY"
-            ;;
-        *)
-            echo "RESEARCH DESIGN IMPLEMENT TEST REVIEW DEPLOY"
-            ;;
-    esac
-}
-
 #===============================================================================
 # Dynamic Tier Selection (RARV-aware model routing)
 #===============================================================================
@@ -2629,32 +2518,6 @@ send_notification() {
     return 0
 }
 
-# Convenience notification functions
-notify_task_started() {
-    local task_name="$1"
-    send_notification "Task Started" "$task_name" "low"
-}
-
-notify_task_completed() {
-    local task_name="$1"
-    send_notification "Task Completed" "$task_name" "normal"
-}
-
-notify_task_failed() {
-    local task_name="$1"
-    local error="${2:-Unknown error}"
-    send_notification "Task Failed" "$task_name: $error" "critical"
-}
-
-notify_phase_complete() {
-    local phase_name="$1"
-    send_notification "Phase Complete" "$phase_name" "normal"
-}
-
-notify_all_complete() {
-    send_notification "All Tasks Complete" "Loki Mode has finished all tasks" "normal"
-}
-
 notify_intervention_needed() {
     local reason="$1"
     # Delegate-then-notify: this helper ONLY fires the (gated) desktop ping. It
@@ -3722,23 +3585,6 @@ init_parallel_streams() {
 }
 
 # Spawn feature worktree from task
-spawn_feature_stream() {
-    local feature_name="$1"
-    local task_description="$2"
-
-    # Check worktree limit
-    # BUG-PAR-012: Worktree count subtracts 1 for main (git worktree list includes main)
-    local worktree_count_raw=$(git -C "$TARGET_DIR" worktree list 2>/dev/null | wc -l)
-    local worktree_count=$((worktree_count_raw > 0 ? worktree_count_raw - 1 : 0))
-    if [ "$worktree_count" -ge "$MAX_WORKTREES" ]; then
-        log_warn "Max worktrees reached ($MAX_WORKTREES). Queuing feature: $feature_name"
-        return 1
-    fi
-
-    create_worktree "feature-$feature_name" "feature/$feature_name"
-    spawn_worktree_session "feature-$feature_name" "$task_description"
-}
-
 # Cleanup all worktrees on exit
 cleanup_parallel_streams() {
     log_header "Cleaning Up Parallel Streams"
@@ -4352,55 +4198,6 @@ EOF
 LAST_KNOWN_PHASE=""
 
 # Set the current phase and emit event if changed
-set_phase() {
-    local new_phase="$1"
-    local orch_file=".loki/state/orchestrator.json"
-
-    mkdir -p .loki/state
-
-    # Get current phase
-    local current_phase=""
-    if [ -f "$orch_file" ]; then
-        current_phase=$(python3 -c "import json; print(json.load(open('$orch_file')).get('currentPhase', ''))" 2>/dev/null || echo "")
-    fi
-
-    # Only emit event if phase changed
-    if [ "$new_phase" != "$current_phase" ]; then
-        emit_event_json "phase_change" \
-            "from=$current_phase" \
-            "to=$new_phase" \
-            "iteration=$ITERATION_COUNT"
-
-        log_info "Phase changed: $current_phase -> $new_phase"
-
-        # Update orchestrator state (atomic via temp file + mv)
-        # BUG ARCH-001 fix: prevent state corruption if process is killed mid-write
-        if [ -f "$orch_file" ]; then
-            python3 -c "
-import json, sys, os, tempfile
-orch_file = sys.argv[1]
-new_phase = sys.argv[2]
-with open(orch_file, 'r') as f:
-    data = json.load(f)
-data['currentPhase'] = new_phase
-orch_dir = os.path.dirname(orch_file)
-fd, tmp = tempfile.mkstemp(dir=orch_dir, suffix='.json')
-with os.fdopen(fd, 'w') as f:
-    json.dump(data, f, indent=2)
-os.replace(tmp, orch_file)
-" "$orch_file" "$new_phase" 2>/dev/null || true
-        fi
-    fi
-
-    LAST_KNOWN_PHASE="$new_phase"
-
-    # v7.5.12: Append a structured log entry to the active iteration task so
-    # the dashboard shows per-phase progress (REASON / ACT / REFLECT / VERIFY).
-    # No-op if no iteration is active or queue file is missing/corrupt.
-    append_iteration_task_log "${ITERATION_COUNT:-0}" "$new_phase" "info" \
-        "Phase entered: $new_phase" 2>/dev/null || true
-}
-
 # v7.5.12: append a log entry to the iteration-N task in in-progress.json.
 # Args: iteration, phase, level, message. All silent on failure -- this
 # must NEVER kill the run.
@@ -5729,438 +5526,6 @@ stop_status_monitor() {
 # Web Dashboard
 #===============================================================================
 
-generate_dashboard() {
-    # Copy dashboard from skill installation (v4.0.0 with Anthropic design language)
-    local skill_dashboard="$SCRIPT_DIR/.loki/dashboard/index.html"
-    local project_name=$(basename "$(pwd)")
-    local project_path=$(pwd)
-
-    if [ -f "$skill_dashboard" ]; then
-        # v7.5.8: Escape sed-special chars in project_name/project_path before
-        # interpolating into the substitution RHS. Without this, a project
-        # whose path contains '|' (the chosen sed delimiter), '&' (RHS
-        # backref), '\' or '/' would either break the substitution or allow
-        # attacker-controlled text to be smuggled into the served HTML.
-        local project_name_sed project_path_sed
-        project_name_sed=$(printf '%s' "$project_name" | sed -e 's/[\\&|/]/\\&/g')
-        project_path_sed=$(printf '%s' "$project_path" | sed -e 's/[\\&|/]/\\&/g')
-
-        # Copy and inject project info
-        sed -e "s|Loki Mode</title>|Loki Mode - ${project_name_sed}</title>|g" \
-            -e "s|<div class=\"project-name\" id=\"project-name\">--|<div class=\"project-name\" id=\"project-name\">${project_name_sed}|g" \
-            -e "s|<div class=\"project-path\" id=\"project-path\" title=\"\">--|<div class=\"project-path\" id=\"project-path\" title=\"${project_path_sed}\">${project_path_sed}|g" \
-            "$skill_dashboard" > .loki/dashboard/index.html
-        log_info "Dashboard copied from skill installation"
-        log_info "Project: $project_name ($project_path)"
-        return
-    fi
-
-    # Fallback: Generate basic dashboard if external file not found
-    cat > .loki/dashboard/index.html << 'DASHBOARD_HTML'
-<!DOCTYPE html>
-<html lang="en">
-<head>
-    <meta charset="UTF-8">
-    <meta name="viewport" content="width=device-width, initial-scale=1.0">
-    <title>Loki Mode Dashboard</title>
-    <style>
-        * { box-sizing: border-box; margin: 0; padding: 0; }
-        body {
-            font-family: 'Söhne', -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif;
-            background: #FAF9F6;
-            color: #1A1A1A;
-            padding: 24px;
-            min-height: 100vh;
-        }
-        .header {
-            text-align: center;
-            padding: 32px 20px;
-            margin-bottom: 32px;
-        }
-        .header h1 {
-            color: #D97757;
-            font-size: 28px;
-            font-weight: 600;
-            letter-spacing: -0.5px;
-            margin-bottom: 8px;
-        }
-        .header .subtitle {
-            color: #666;
-            font-size: 14px;
-            font-weight: 400;
-        }
-        .header .phase {
-            display: inline-block;
-            margin-top: 16px;
-            padding: 8px 16px;
-            background: #FFF;
-            border: 1px solid #E5E3DE;
-            border-radius: 20px;
-            font-size: 13px;
-            color: #1A1A1A;
-            font-weight: 500;
-        }
-        .stats {
-            display: flex;
-            justify-content: center;
-            gap: 16px;
-            margin-bottom: 40px;
-            flex-wrap: wrap;
-        }
-        .stat {
-            background: #FFF;
-            border: 1px solid #E5E3DE;
-            border-radius: 12px;
-            padding: 20px 32px;
-            text-align: center;
-            min-width: 140px;
-            transition: box-shadow 0.2s ease;
-        }
-        .stat:hover { box-shadow: 0 4px 12px rgba(0,0,0,0.06); }
-        .stat .number { font-size: 36px; font-weight: 600; margin-bottom: 4px; }
-        .stat .label { font-size: 12px; color: #888; text-transform: uppercase; letter-spacing: 0.5px; }
-        .stat.pending .number { color: #D97757; }
-        .stat.progress .number { color: #5B8DEF; }
-        .stat.completed .number { color: #2E9E6E; }
-        .stat.failed .number { color: #D44F4F; }
-        .stat.agents .number { color: #9B6DD6; }
-        .section-header {
-            text-align: center;
-            font-size: 16px;
-            font-weight: 600;
-            color: #666;
-            margin: 40px 0 20px 0;
-            text-transform: uppercase;
-            letter-spacing: 1px;
-        }
-        .agents-grid {
-            display: grid;
-            grid-template-columns: repeat(auto-fill, minmax(320px, 1fr));
-            gap: 16px;
-            max-width: 1400px;
-            margin: 0 auto 40px auto;
-        }
-        .agent-card {
-            background: #FFF;
-            border: 1px solid #E5E3DE;
-            border-radius: 12px;
-            padding: 16px;
-            transition: box-shadow 0.2s ease, border-color 0.2s ease;
-        }
-        .agent-card:hover {
-            box-shadow: 0 4px 12px rgba(0,0,0,0.06);
-            border-color: #9B6DD6;
-        }
-        .agent-card .agent-header {
-            display: flex;
-            justify-content: space-between;
-            align-items: flex-start;
-            margin-bottom: 12px;
-        }
-        .agent-card .agent-id {
-            font-size: 11px;
-            color: #999;
-            font-family: monospace;
-        }
-        .agent-card .model-badge {
-            padding: 4px 10px;
-            border-radius: 6px;
-            font-size: 10px;
-            font-weight: 600;
-            text-transform: uppercase;
-            letter-spacing: 0.5px;
-        }
-        .agent-card .model-badge.sonnet {
-            background: #E8F0FD;
-            color: #5B8DEF;
-        }
-        .agent-card .model-badge.haiku {
-            background: #FFF4E6;
-            color: #F59E0B;
-        }
-        .agent-card .model-badge.opus {
-            background: #F3E8FF;
-            color: #9B6DD6;
-        }
-        .agent-card .agent-type {
-            font-size: 14px;
-            font-weight: 600;
-            color: #1A1A1A;
-            margin-bottom: 8px;
-        }
-        .agent-card .agent-status {
-            display: inline-block;
-            padding: 3px 8px;
-            border-radius: 4px;
-            font-size: 10px;
-            font-weight: 500;
-            margin-bottom: 12px;
-        }
-        .agent-card .agent-status.active {
-            background: #E6F5EE;
-            color: #2E9E6E;
-        }
-        .agent-card .agent-status.completed {
-            background: #F0EFEA;
-            color: #666;
-        }
-        .agent-card .agent-work {
-            font-size: 12px;
-            color: #666;
-            line-height: 1.5;
-            margin-bottom: 8px;
-        }
-        .agent-card .agent-meta {
-            display: flex;
-            gap: 12px;
-            font-size: 11px;
-            color: #999;
-            margin-top: 8px;
-            padding-top: 8px;
-            border-top: 1px solid #F0EFEA;
-        }
-        .agent-card .agent-meta span {
-            display: flex;
-            align-items: center;
-            gap: 4px;
-        }
-        .columns {
-            display: flex;
-            gap: 20px;
-            overflow-x: auto;
-            padding-bottom: 24px;
-            max-width: 1400px;
-            margin: 0 auto;
-        }
-        .column {
-            flex: 1;
-            min-width: 300px;
-            max-width: 350px;
-            background: #FFF;
-            border: 1px solid #E5E3DE;
-            border-radius: 12px;
-            padding: 20px;
-        }
-        .column h2 {
-            font-size: 13px;
-            font-weight: 600;
-            color: #666;
-            margin-bottom: 16px;
-            display: flex;
-            align-items: center;
-            gap: 10px;
-            text-transform: uppercase;
-            letter-spacing: 0.5px;
-        }
-        .column h2 .count {
-            background: #F0EFEA;
-            padding: 3px 10px;
-            border-radius: 12px;
-            font-size: 11px;
-            color: #1A1A1A;
-        }
-        .column.pending h2 .count { background: #FCEEE8; color: #D97757; }
-        .column.progress h2 .count { background: #E8F0FD; color: #5B8DEF; }
-        .column.completed h2 .count { background: #E6F5EE; color: #2E9E6E; }
-        .column.failed h2 .count { background: #FCE8E8; color: #D44F4F; }
-        .task {
-            background: #FAF9F6;
-            border: 1px solid #E5E3DE;
-            border-radius: 8px;
-            padding: 14px;
-            margin-bottom: 12px;
-            transition: border-color 0.2s ease;
-        }
-        .task:hover { border-color: #D97757; }
-        .task .id { font-size: 10px; color: #999; margin-bottom: 6px; font-family: monospace; }
-        .task .type {
-            display: inline-block;
-            background: #FCEEE8;
-            color: #D97757;
-            padding: 3px 10px;
-            border-radius: 4px;
-            font-size: 11px;
-            font-weight: 500;
-            margin-bottom: 8px;
-        }
-        .task .title { font-size: 13px; color: #1A1A1A; line-height: 1.5; }
-        .task .error {
-            font-size: 11px;
-            color: #D44F4F;
-            margin-top: 10px;
-            padding: 10px;
-            background: #FCE8E8;
-            border-radius: 6px;
-            font-family: monospace;
-        }
-        .refresh {
-            position: fixed;
-            bottom: 24px;
-            right: 24px;
-            background: #D97757;
-            color: white;
-            border: none;
-            padding: 12px 24px;
-            border-radius: 8px;
-            cursor: pointer;
-            font-size: 14px;
-            font-weight: 500;
-            transition: background 0.2s ease;
-            box-shadow: 0 4px 12px rgba(217, 119, 87, 0.3);
-        }
-        .refresh:hover { background: #C56747; }
-        .updated {
-            text-align: center;
-            color: #999;
-            font-size: 12px;
-            margin-top: 24px;
-        }
-        .empty {
-            color: #999;
-            font-size: 13px;
-            text-align: center;
-            padding: 24px;
-            font-style: italic;
-        }
-        .powered-by {
-            text-align: center;
-            margin-top: 40px;
-            padding-top: 24px;
-            border-top: 1px solid #E5E3DE;
-            color: #999;
-            font-size: 12px;
-        }
-        .powered-by span { color: #D97757; font-weight: 500; }
-    </style>
-</head>
-<body>
-    <div class="header">
-        <h1>LOKI MODE</h1>
-        <div class="subtitle">Autonomous Spec-to-Product System</div>
-        <div class="phase" id="phase">Loading...</div>
-    </div>
-    <div class="stats">
-        <div class="stat agents"><div class="number" id="agents-count">-</div><div class="label">Active Agents</div></div>
-        <div class="stat pending"><div class="number" id="pending-count">-</div><div class="label">Pending</div></div>
-        <div class="stat progress"><div class="number" id="progress-count">-</div><div class="label">In Progress</div></div>
-        <div class="stat completed"><div class="number" id="completed-count">-</div><div class="label">Completed</div></div>
-        <div class="stat failed"><div class="number" id="failed-count">-</div><div class="label">Failed</div></div>
-    </div>
-    <div class="section-header">Active Agents</div>
-    <div class="agents-grid" id="agents-grid"></div>
-    <div class="section-header">Task Queue</div>
-    <div class="columns">
-        <div class="column pending"><h2>Pending <span class="count" id="pending-badge">0</span></h2><div id="pending-tasks"></div></div>
-        <div class="column progress"><h2>In Progress <span class="count" id="progress-badge">0</span></h2><div id="progress-tasks"></div></div>
-        <div class="column completed"><h2>Completed <span class="count" id="completed-badge">0</span></h2><div id="completed-tasks"></div></div>
-        <div class="column failed"><h2>Failed <span class="count" id="failed-badge">0</span></h2><div id="failed-tasks"></div></div>
-    </div>
-    <div class="updated" id="updated">Last updated: -</div>
-    <div class="powered-by">Powered by <span>${PROVIDER_DISPLAY_NAME:-Claude}</span></div>
-    <button class="refresh" onclick="loadData()">Refresh</button>
-    <script>
-        async function loadJSON(path) {
-            try {
-                const res = await fetch(path + '?t=' + Date.now());
-                if (!res.ok) return [];
-                const text = await res.text();
-                if (!text.trim()) return [];
-                const data = JSON.parse(text);
-                return Array.isArray(data) ? data : (data.tasks || data.agents || []);
-            } catch { return []; }
-        }
-        function getModelClass(model) {
-            if (!model) return 'sonnet';
-            const m = model.toLowerCase();
-            if (m.includes('haiku')) return 'haiku';
-            if (m.includes('opus')) return 'opus';
-            return 'sonnet';
-        }
-        function formatDuration(isoDate) {
-            if (!isoDate) return 'Unknown';
-            const start = new Date(isoDate);
-            const now = new Date();
-            const seconds = Math.floor((now - start) / 1000);
-            if (seconds < 60) return seconds + 's';
-            if (seconds < 3600) return Math.floor(seconds / 60) + 'm';
-            return Math.floor(seconds / 3600) + 'h ' + Math.floor((seconds % 3600) / 60) + 'm';
-        }
-        function renderAgent(agent) {
-            const modelClass = getModelClass(agent.model);
-            const modelName = agent.model || 'Sonnet 4.5';
-            const agentType = agent.agent_type || 'general-purpose';
-            const status = agent.status === 'completed' ? 'completed' : 'active';
-            const currentTask = agent.current_task || (agent.tasks_completed && agent.tasks_completed.length > 0
-                ? 'Completed: ' + agent.tasks_completed.join(', ')
-                : 'Initializing...');
-            const duration = formatDuration(agent.spawned_at);
-            const tasksCount = agent.tasks_completed ? agent.tasks_completed.length : 0;
-
-            return `
-                <div class="agent-card">
-                    <div class="agent-header">
-                        <div class="agent-id">${agent.agent_id || 'Unknown'}</div>
-                        <div class="model-badge ${modelClass}">${modelName}</div>
-                    </div>
-                    <div class="agent-type">${agentType}</div>
-                    <div class="agent-status ${status}">${status}</div>
-                    <div class="agent-work">${currentTask}</div>
-                    <div class="agent-meta">
-                        <span>${duration}</span>
-                        <span>${tasksCount} tasks</span>
-                    </div>
-                </div>
-            `;
-        }
-        function renderTask(task) {
-            const payload = task.payload || {};
-            const title = payload.description || payload.action || task.type || 'Task';
-            const error = task.lastError ? `<div class="error">${task.lastError}</div>` : '';
-            return `<div class="task"><div class="id">${task.id}</div><span class="type">${task.type || 'general'}</span><div class="title">${title}</div>${error}</div>`;
-        }
-        async function loadData() {
-            const [pending, progress, completed, failed, agents] = await Promise.all([
-                loadJSON('../queue/pending.json'),
-                loadJSON('../queue/in-progress.json'),
-                loadJSON('../queue/completed.json'),
-                loadJSON('../queue/failed.json'),
-                loadJSON('../state/agents.json')
-            ]);
-
-            // Agent stats
-            document.getElementById('agents-count').textContent = agents.length;
-            document.getElementById('agents-grid').innerHTML = agents.length
-                ? agents.map(renderAgent).join('')
-                : '<div class="empty">No active agents</div>';
-
-            // Task stats
-            document.getElementById('pending-count').textContent = pending.length;
-            document.getElementById('progress-count').textContent = progress.length;
-            document.getElementById('completed-count').textContent = completed.length;
-            document.getElementById('failed-count').textContent = failed.length;
-            document.getElementById('pending-badge').textContent = pending.length;
-            document.getElementById('progress-badge').textContent = progress.length;
-            document.getElementById('completed-badge').textContent = completed.length;
-            document.getElementById('failed-badge').textContent = failed.length;
-            document.getElementById('pending-tasks').innerHTML = pending.length ? pending.map(renderTask).join('') : '<div class="empty">No pending tasks</div>';
-            document.getElementById('progress-tasks').innerHTML = progress.length ? progress.map(renderTask).join('') : '<div class="empty">No tasks in progress</div>';
-            document.getElementById('completed-tasks').innerHTML = completed.length ? completed.slice(-10).reverse().map(renderTask).join('') : '<div class="empty">No completed tasks</div>';
-            document.getElementById('failed-tasks').innerHTML = failed.length ? failed.map(renderTask).join('') : '<div class="empty">No failed tasks</div>';
-
-            try {
-                const state = await fetch('../state/orchestrator.json?t=' + Date.now()).then(r => r.json());
-                document.getElementById('phase').textContent = 'Phase: ' + (state.currentPhase || 'UNKNOWN');
-            } catch { document.getElementById('phase').textContent = 'Phase: UNKNOWN'; }
-            document.getElementById('updated').textContent = 'Last updated: ' + new Date().toLocaleTimeString();
-        }
-        loadData();
-        setInterval(loadData, 3000);
-    </script>
-</body>
-</html>
-DASHBOARD_HTML
-}
-
 update_agents_state() {
     # Aggregate agent information from .agent/sub-agents/*.json into .loki/state/agents.json
     local agents_dir=".agent/sub-agents"
@@ -6828,6 +6193,28 @@ check_command_allowed() {
     return 0
 }
 
+# A5 (ALLOWED_PATHS enforcement) -- HONEST THREAT MODEL
+# --------------------------------------------------------------------------
+# The DOMINANT file-write path in an autonomous build is the PROVIDER CLI
+# (claude / codex / cline / aider) writing files directly. run.sh hands the
+# work to that CLI and never sees those writes as shell redirections, so run.sh
+# CANNOT intercept provider-driven writes. ALLOWED_PATHS therefore cannot be a
+# complete sandbox; the real containment for provider writes is the OS user +
+# the LOKI_SANDBOX_MODE container (sandbox.sh, cap-drop/seccomp/read-only
+# mounts), not this shell.
+#
+# Where ALLOWED_PATHS is actually enforced: the sandbox custom --mount surface.
+# That enforcement lives in sandbox.sh, NOT here. When ALLOWED_PATHS is set, a
+# host path that loki is about to bind-mount into the container is checked by
+# _sandbox_path_within_allowed (autonomy/sandbox.sh), and an operator-supplied
+# `loki sandbox run` argv is checked by _sandbox_command_allowed there too.
+# run.sh itself does not consume ALLOWED_PATHS for any write decision -- it has
+# no run.sh-controlled host-write surface to gate -- so there is no enforcement
+# helper here. (A run.sh-local helper existed previously but had zero call
+# sites; it was removed so the only enforcement path is the one that genuinely
+# runs. See tests/test-allowed-paths-a5.sh, which exercises the sandbox.sh
+# functions.)
+
 #===============================================================================
 # Cross-Project Learnings Database
 #===============================================================================
@@ -6853,34 +6240,6 @@ init_learnings_db() {
     log_info "Learnings database initialized at: $learnings_dir"
 }
 
-save_learning() {
-    # Save a learning to the cross-project database
-    local learning_type="$1"  # pattern, mistake, success
-    local category="$2"
-    local description="$3"
-    local project="${4:-$(basename "$(pwd)")}"
-
-    local learnings_dir="${HOME}/.loki/learnings"
-    local target_file="$learnings_dir/${learning_type}s.jsonl"
-
-    if [ ! -d "$learnings_dir" ]; then
-        init_learnings_db
-    fi
-
-    local learning_entry
-    if command -v jq >/dev/null 2>&1; then
-        learning_entry=$(jq -n --arg ts "$(date -u +%Y-%m-%dT%H:%M:%SZ)" --arg proj "$project" --arg cat "$category" --arg desc "$description" '{timestamp:$ts,project:$proj,category:$cat,description:$desc}')
-    else
-        local safe_proj safe_cat safe_desc
-        safe_proj=$(printf '%s' "$project" | sed 's/["\\]/\\&/g; s/\n/\\n/g')
-        safe_cat=$(printf '%s' "$category" | sed 's/["\\]/\\&/g; s/\n/\\n/g')
-        safe_desc=$(printf '%s' "$description" | sed 's/["\\]/\\&/g; s/\n/\\n/g')
-        learning_entry="{\"timestamp\":\"$(date -u +%Y-%m-%dT%H:%M:%SZ)\",\"project\":\"$safe_proj\",\"category\":\"$safe_cat\",\"description\":\"$safe_desc\"}"
-    fi
-    echo "$learning_entry" >> "$target_file"
-    log_info "Saved $learning_type: $category"
-}
-
 get_relevant_learnings() {
     # Get learnings relevant to the current context
     local context="$1"
@@ -7882,24 +7241,6 @@ with open(gate_file, 'w') as f:
 " 2>/dev/null || true
 }
 
-get_gate_failure_count() {
-    local gate_name="$1"
-    local gate_file="${TARGET_DIR:-.}/.loki/quality/gate-failure-count.json"
-    [ -f "$gate_file" ] || { echo "0"; return; }
-
-    _GATE_FILE="$gate_file" _GATE_NAME="$gate_name" python3 -c "
-import json, os
-gate_file = os.environ['_GATE_FILE']
-gate_name = os.environ['_GATE_NAME']
-try:
-    with open(gate_file) as f:
-        counts = json.load(f)
-    print(counts.get(gate_name, 0))
-except (json.JSONDecodeError, FileNotFoundError, OSError):
-    print(0)
-" 2>/dev/null || echo "0"
-}
-
 # ============================================================================
 # Hard Quality Gate: Test Coverage (v6.7.0)
 # Detects test runner and runs tests with coverage reporting
@@ -10102,182 +9443,6 @@ DA_AGG_PATCH
 # Only runs when complexity >= standard (6+ agents).
 #===============================================================================
 
-run_adversarial_testing() {
-    local loki_dir="${TARGET_DIR:-.}/.loki"
-    local adversarial_dir="$loki_dir/quality/adversarial"
-    local test_id
-    test_id="adversarial-$(date -u +%Y%m%dT%H%M%SZ)-${ITERATION_COUNT:-0}"
-    mkdir -p "$adversarial_dir/$test_id"
-
-    # Only run for Standard+ complexity
-    local complexity="${LOKI_COMPLEXITY:-auto}"
-    if [ "$complexity" = "simple" ]; then
-        log_debug "Adversarial testing skipped: simple complexity tier"
-        return 0
-    fi
-
-    # Check if adversarial testing is disabled
-    if [ "${LOKI_ADVERSARIAL_TESTING:-true}" = "false" ]; then
-        log_debug "Adversarial testing disabled via LOKI_ADVERSARIAL_TESTING=false"
-        return 0
-    fi
-
-    log_header "ADVERSARIAL TESTING: $test_id"
-
-    # Get diff for adversarial analysis
-    local diff_content
-    diff_content=$(git -C "${TARGET_DIR:-.}" diff HEAD~1 2>/dev/null || git -C "${TARGET_DIR:-.}" diff --cached 2>/dev/null || echo "")
-    if [ -z "$diff_content" ]; then
-        log_info "Adversarial testing: No diff to test, skipping"
-        return 0
-    fi
-
-    local changed_files
-    changed_files=$(git -C "${TARGET_DIR:-.}" diff --name-only HEAD~1 2>/dev/null || git -C "${TARGET_DIR:-.}" diff --name-only --cached 2>/dev/null || echo "")
-
-    # Write analysis files -- use printf to prevent shell variable expansion (#78)
-    local diff_file="$adversarial_dir/$test_id/diff.txt"
-    local files_file="$adversarial_dir/$test_id/files.txt"
-    printf '%s\n' "$diff_content" > "$diff_file"
-    printf '%s\n' "$changed_files" > "$files_file"
-
-    # Build adversarial prompt -- use heredoc with quoted delimiter to prevent
-    # shell variable expansion in diff content (fixes #78)
-    local files_content changed_content
-    files_content=$(cat "$files_file")
-    changed_content=$(head -500 "$diff_file")
-    local adversarial_prompt
-    read -r -d '' adversarial_prompt <<'ADVERSARIAL_EOF' || true
-You are an ADVERSARIAL TESTER. Your goal is to BREAK the implementation.
-
-CHANGED FILES:
-__FILES_PLACEHOLDER__
-
-DIFF:
-__DIFF_PLACEHOLDER__
-
-YOUR MISSION:
-1. Find edge cases that will cause crashes or incorrect behavior
-2. Identify inputs that bypass validation
-3. Find race conditions or concurrency issues
-4. Discover security vulnerabilities (injection, auth bypass, SSRF)
-5. Find resource exhaustion vectors (unbounded loops, memory leaks)
-6. Identify error handling gaps (missing try/catch, unchecked returns)
-
-OUTPUT FORMAT (STRICT):
-ATTACK_VECTORS:
-- [severity] [category] description | reproduction steps
-  Severity: Critical, High, Medium, Low
-  Category: crash, security, correctness, performance, resource
-
-SUGGESTED_TESTS:
-- Test description that would catch this issue
-
-OVERALL_RISK: HIGH or MEDIUM or LOW
-ADVERSARIAL_EOF
-    # Substitute placeholders with actual content (safe from shell expansion)
-    adversarial_prompt="${adversarial_prompt/__FILES_PLACEHOLDER__/$files_content}"
-    adversarial_prompt="${adversarial_prompt/__DIFF_PLACEHOLDER__/$changed_content}"
-
-    local result_file="$adversarial_dir/$test_id/result.txt"
-
-    # Run adversarial agent
-    log_info "Spawning adversarial agent..."
-    case "${PROVIDER_NAME:-claude}" in
-        claude)
-            if command -v claude &>/dev/null; then
-                # EMBED 2 + 3 (v7.33.0). Adversarial probe subcall.
-                # $adversarial_prompt is fully self-contained (instructions +
-                # changed files + diff inlined via the heredoc above) and output
-                # is captured to $result_file. So:
-                #   EMBED 2 (--bare): no hooks/LSP/CLAUDE.md/MCP needed; cheaper.
-                #     Opt out LOKI_BARE_SUBCALLS=0.
-                #   EMBED 3 (--disallowedTools): keep an adversarial agent from
-                #     casually mutating the tree. Deny Edit/Write/NotebookEdit +
-                #     git mutation forms (incl. git -C / --git-dir evasions);
-                #     read-only git stays allowed. Guardrail, not a sandbox.
-                #     Opt out LOKI_REVIEW_TOOL_GUARD=0.
-                local _adv_argv=("--dangerously-skip-permissions")
-                if type loki_subcall_bare_enabled >/dev/null 2>&1 && loki_subcall_bare_enabled; then
-                    _adv_argv+=("--bare")
-                fi
-                if type loki_review_guard_enabled >/dev/null 2>&1 && loki_review_guard_enabled; then
-                    _adv_argv+=("--disallowedTools" "$(loki_review_guard_denylist)")
-                fi
-                #   EMBED 3b (--allowedTools, #167): positive least-privilege
-                #     allowlist. DEFAULT OFF (opt-in LOKI_REVIEW_ALLOWLIST=1).
-                #     Emitted ALONGSIDE the denylist (deny precedence verified
-                #     live, holds under --dangerously-skip-permissions). See
-                #     loki_review_allowlist.
-                if type loki_review_allowlist_enabled >/dev/null 2>&1 && loki_review_allowlist_enabled; then
-                    _adv_argv+=("--allowedTools" "$(loki_review_allowlist)")
-                fi
-                # caveman HARD-SUPPRESS (parsed output): the adversarial probe's
-                # output is parsed for findings/severity. Disable caveman
-                # unconditionally (CAVEMAN_DEFAULT_MODE=off) so compression cannot
-                # drop or reword a finding. No-op when caveman is absent.
-                CAVEMAN_DEFAULT_MODE=off \
-                claude "${_adv_argv[@]}" -p "$adversarial_prompt" \
-                    --output-format text > "$result_file" 2>/dev/null || true
-            fi
-            ;;
-        codex)
-            if command -v codex &>/dev/null; then
-                codex exec --sandbox workspace-write --skip-git-repo-check "$adversarial_prompt" \
-                    > "$result_file" 2>/dev/null || true
-            fi
-            ;;
-        cline)
-            if command -v cline &>/dev/null; then
-                invoke_cline_capture "$adversarial_prompt" \
-                    > "$result_file" 2>/dev/null || true
-            fi
-            ;;
-        aider)
-            if command -v aider &>/dev/null; then
-                invoke_aider_capture "$adversarial_prompt" \
-                    > "$result_file" 2>/dev/null || true
-            fi
-            ;;
-        *)
-            echo "ATTACK_VECTORS: None (unknown provider)" > "$result_file"
-            echo "OVERALL_RISK: LOW" >> "$result_file"
-            ;;
-    esac
-
-    if [ ! -s "$result_file" ]; then
-        log_warn "Adversarial agent produced no output"
-        return 0
-    fi
-
-    # Parse risk level
-    local risk_level
-    risk_level=$(grep -i "OVERALL_RISK:" "$result_file" | head -1 | sed 's/.*OVERALL_RISK:[[:space:]]*//' | awk '{print toupper($1)}')
-
-    # Count critical/high attack vectors
-    local critical_count high_count
-    critical_count=$(grep -ci "\[critical\]" "$result_file" 2>/dev/null || echo "0")
-    high_count=$(grep -ci "\[high\]" "$result_file" 2>/dev/null || echo "0")
-
-    log_info "Adversarial testing complete: risk=$risk_level, critical=$critical_count, high=$high_count"
-
-    emit_event_json "adversarial_test_complete" \
-        "test_id=$test_id" \
-        "risk_level=${risk_level:-UNKNOWN}" \
-        "critical_count=$critical_count" \
-        "high_count=$high_count" \
-        "iteration=$ITERATION_COUNT"
-
-    # Block on critical findings
-    if [ "$critical_count" -gt 0 ]; then
-        log_error "ADVERSARIAL TEST BLOCKED: $critical_count critical attack vectors found"
-        log_error "Details: $adversarial_dir/$test_id/result.txt"
-        return 1
-    fi
-
-    return 0
-}
-
 load_solutions_context() {
     # Load relevant structured solutions for the current task context
     local context="$1"
@@ -10468,6 +9633,18 @@ create_checkpoint() {
             cp ".loki/$f" "$cp_dir/$f" 2>/dev/null || true
         fi
     done
+    # A6: under a namespaced session the live state file is at
+    # .loki/sessions/<id>/autonomy-state.json, which the legacy loop above misses.
+    # Snapshot it into the checkpoint as autonomy-state.json so a rollback still
+    # captures the current run's machine state. (Default `loki start` has no
+    # LOKI_SESSION_ID, so this block is skipped and the loop above is unchanged.)
+    if [ -n "${LOKI_SESSION_ID:-}" ]; then
+        local _ns_state_file
+        _ns_state_file="$(_loki_state_file)"
+        if [ -f "$_ns_state_file" ]; then
+            cp "$_ns_state_file" "$cp_dir/autonomy-state.json" 2>/dev/null || true
+        fi
+    fi
 
     # R6: capture a real working-tree snapshot so code can be truly undone later.
     # Loki does not commit per iteration, so git_sha (HEAD) cannot reconstruct
@@ -10565,118 +9742,47 @@ print(json.dumps({'id':m['id'],'ts':m['timestamp'],'iter':m['iteration'],'task':
     # it without parsing stdout (log_info writes to stdout, so command-substitution
     # capture would include log lines).
     _LAST_CHECKPOINT_ID="$checkpoint_id"
-}
-
-rollback_to_checkpoint() {
-    # Rollback state files to a specific checkpoint
-    # Args: $1 = checkpoint_id
-    local checkpoint_id="$1"
-    local checkpoint_dir=".loki/state/checkpoints"
-
-    # Validate checkpoint ID (prevent path traversal)
-    if [[ ! "$checkpoint_id" =~ ^[a-zA-Z0-9_-]+$ ]]; then
-        log_error "Invalid checkpoint ID: must be alphanumeric, hyphens, underscores only"
-        return 1
-    fi
-
-    local cp_dir="${checkpoint_dir}/${checkpoint_id}"
-
-    if [ ! -d "$cp_dir" ]; then
-        log_error "Checkpoint not found: ${checkpoint_id}"
-        return 1
-    fi
-
-    # Read checkpoint metadata
-    local git_sha
-    git_sha=$(_CP_META="${cp_dir}/metadata.json" python3 -c "import json, os; print(json.load(open(os.environ['_CP_META']))['git_sha'])" 2>/dev/null || echo "")
-
-    log_warn "Rolling back to checkpoint: ${checkpoint_id}"
-
-    # R6 re-undoability invariant: force a pre-rollback snapshot of CURRENT state
-    # before overwriting, even if the git tree is clean (the .loki/ state we are
-    # about to clobber is not git-tracked). _LOKI_CP_FORCE bypasses the clean-tree
-    # guard. Capture the snapshot id so we can tell the user how to undo the undo.
-    _LOKI_CP_FORCE=1 create_checkpoint "pre-rollback snapshot (before restoring ${checkpoint_id})" "rollback"
-    local pre_rollback_id="${_LAST_CHECKPOINT_ID:-}"
-    if [ -n "$pre_rollback_id" ]; then
-        log_info "Saved prior state as ${pre_rollback_id} (undo this rollback with: loki rollback to ${pre_rollback_id})"
-    fi
-
-    # Restore state files (R6: CONTINUITY.md restores iteration/conversation context)
-    for f in state/orchestrator.json queue/pending.json queue/completed.json queue/in-progress.json queue/current-task.json CONTINUITY.md; do
-        if [ -f "${cp_dir}/${f}" ]; then
-            local target_dir=".loki/$(dirname "$f")"
-            mkdir -p "$target_dir"
-            cp "${cp_dir}/${f}" ".loki/${f}" 2>/dev/null || true
-        fi
-    done
-
-    # Log the rollback (use python3 for safe JSON serialization)
-    # v7.5.10: route through safe_append_event_jsonl() so parallel-worktree
-    # rollbacks cannot interleave partial JSONL lines (POSIX append is
-    # only atomic for <PIPE_BUF and not all platforms honor it).
-    local timestamp rb_event
-    timestamp=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
-    rb_event=$(_RB_CPID="$checkpoint_id" _RB_SHA="$git_sha" _RB_TS="$timestamp" \
-    python3 -c "
-import json,os
-print(json.dumps({'event':'rollback','checkpoint':os.environ['_RB_CPID'],'git_sha':os.environ['_RB_SHA'],'timestamp':os.environ['_RB_TS']}))
-" 2>/dev/null) || rb_event=""
-    if [ -n "$rb_event" ]; then
-        # Source the emit lib once per call to get safe_append_event_jsonl.
-        # Lib-only mode skips the emit script's normal CLI execution.
-        # shellcheck disable=SC1091
-        if [ -z "${_LOKI_EMIT_LIB_LOADED:-}" ]; then
-            LOKI_EMIT_LIB_ONLY=1 . "$(dirname "${BASH_SOURCE[0]}")/../events/emit.sh" 2>/dev/null \
-                && _LOKI_EMIT_LIB_LOADED=1
-        fi
-        if declare -f safe_append_event_jsonl >/dev/null 2>&1; then
-            safe_append_event_jsonl ".loki/events.jsonl" "$rb_event" 2>/dev/null || true
-        else
-            # Last-resort fallback: bare append (preserves prior behavior).
-            printf '%s\n' "$rb_event" >> ".loki/events.jsonl" 2>/dev/null || true
-        fi
-    fi
-
-    log_info "State files restored from checkpoint: ${checkpoint_id}"
 
-    # R6: the prior hint `git reset --hard ${git_sha}` was MISLEADING. git_sha is
-    # HEAD (the last commit), and Loki does not commit per iteration, so a hard
-    # reset would discard the iteration's work rather than reconstruct it. The
-    # correct, durable recovery is the anchored working-tree snapshot, if present.
-    if [ -f "${cp_dir}/worktree-snapshot.txt" ]; then
-        log_info "To also restore the working tree to this checkpoint:"
-        log_info "  git stash apply refs/loki/cp/${checkpoint_id}"
-    elif [ -n "$git_sha" ] && [ "$git_sha" != "no-git" ]; then
-        log_info "Git SHA at checkpoint (last commit): ${git_sha}"
-        log_info "Note: no working-tree snapshot was captured for this checkpoint;"
-        log_info "code changes since the last commit are not restorable from here."
-    fi
+    # A3: best-effort object-store sync of checkpoint state. No-op unless
+    # LOKI_STORAGE_BACKEND is set to a non-local backend. Never blocks/fails the
+    # build on a sync error (the shim swallows errors; we also `|| true`).
+    _loki_object_store_sync_checkpoints || true
 }
 
-list_checkpoints() {
-    # List recent checkpoints
-    local checkpoint_dir=".loki/state/checkpoints"
-    local index_file="${checkpoint_dir}/index.jsonl"
-    local limit="${1:-10}"
+# A3: push .loki/state/checkpoints/** to the configured object store (best-effort).
+# Local/unset backend => no-op (zero behavior change for local users). Provider
+# writes are out of scope; this syncs only the checkpoint state run.sh owns.
+_loki_object_store_sync_checkpoints() {
+    local backend="${LOKI_STORAGE_BACKEND:-local}"
+    case "$backend" in
+        local|""|file|filesystem) return 0 ;;
+    esac
+    command -v python3 >/dev/null 2>&1 || return 0
+    local shim="${SCRIPT_DIR}/lib/checkpoint_sync.py"
+    [ -f "$shim" ] || return 0
+    python3 "$shim" sync >/dev/null 2>&1 || log_warn "Object-store checkpoint sync skipped (backend=$backend); build continues."
+    return 0
+}
 
-    if [ ! -f "$index_file" ]; then
-        echo "No checkpoints found."
-        return
+# A3: hydrate .loki/state/checkpoints/** from the object store on a durable
+# resume when the local volume is empty (best-effort). No-op unless
+# LOKI_DURABLE_STATE=1 AND a non-local LOKI_STORAGE_BACKEND is set. The shim
+# itself guards against overwriting a non-empty local volume.
+_loki_object_store_hydrate_checkpoints() {
+    [ "${LOKI_DURABLE_STATE:-0}" = "1" ] || return 0
+    local backend="${LOKI_STORAGE_BACKEND:-local}"
+    case "$backend" in
+        local|""|file|filesystem) return 0 ;;
+    esac
+    command -v python3 >/dev/null 2>&1 || return 0
+    local shim="${SCRIPT_DIR}/lib/checkpoint_sync.py"
+    [ -f "$shim" ] || return 0
+    if python3 "$shim" hydrate >/dev/null 2>&1; then
+        log_info "Durable resume: checked object store ($backend) for prior checkpoints."
+    else
+        log_warn "Object-store checkpoint hydrate skipped (backend=$backend); build continues with local state."
     fi
-
-    tail -n "$limit" "$index_file" | python3 -c "
-import sys, json
-lines = sys.stdin.readlines()
-for line in reversed(lines):
-    try:
-        cp = json.loads(line)
-        sha = cp.get('sha','')[:8]
-        task = cp.get('task','')[:60]
-        print(f\"  {cp['id']}  {cp['ts']}  [{sha}]  {task}\")
-    except:
-        continue
-"
+    return 0
 }
 
 start_dashboard() {
@@ -11928,17 +11034,6 @@ except Exception as e:
 }
 
 # Load relevant learnings
-load_learnings_context() {
-    local learnings=""
-
-    # Get recent learnings (last 7 days)
-    for learning in $(find .loki/memory/learnings -name "*.md" -mtime -7 2>/dev/null | head -5); do
-        learnings+="$(head -30 "$learning")\n---\n"
-    done
-
-    echo -e "$learnings"
-}
-
 # Load pre-computed relevant learnings from CLI startup (SYN-008)
 # Reads .loki/state/memory-context.json written by load_memory_context() in CLI
 # Note: Different from get_relevant_learnings() which writes to relevant-learnings.json
@@ -12700,89 +11795,44 @@ PYEOF
 #===============================================================================
 
 # Enrich prompt context with relevant cross-project patterns
-enrich_from_knowledge_graph() {
-    local context="$1"
-    local max_patterns="${2:-5}"
-
-    _LOKI_KG_CONTEXT="$context" _LOKI_KG_MAX="$max_patterns" \
-    _LOKI_PROJECT_DIR="$PROJECT_DIR" \
-    python3 << 'PYEOF' 2>/dev/null || echo ""
-import sys
-import os
-import json
-
-project_dir = os.environ.get('_LOKI_PROJECT_DIR', '')
-context = os.environ.get('_LOKI_KG_CONTEXT', '')
-max_results = int(os.environ.get('_LOKI_KG_MAX', '5'))
-
-if not project_dir:
-    sys.exit(0)
-sys.path.insert(0, project_dir)
-try:
-    from memory.knowledge_graph import OrganizationKnowledgeGraph
-    kg = OrganizationKnowledgeGraph()
-    patterns = kg.query_patterns(context, max_results=max_results)
-    if patterns:
-        output = "\n## Cross-Project Knowledge (from knowledge graph)\n"
-        for p in patterns:
-            name = p.get('name', p.get('pattern', 'unnamed'))
-            category = p.get('category', '')
-            desc = p.get('description', '')
-            output += f"- **{name}** ({category}): {desc}\n"
-        print(output)
-except Exception:
-    pass
-PYEOF
-}
-
 # Store new patterns to the knowledge graph after successful iterations
-store_to_knowledge_graph() {
-    local target_dir="${TARGET_DIR:-.}"
-
-    _LOKI_PROJECT_DIR="$PROJECT_DIR" _LOKI_TARGET_DIR="$target_dir" \
-    python3 << 'PYEOF' 2>/dev/null || true
-import sys
-import os
-
-project_dir = os.environ.get('_LOKI_PROJECT_DIR', '')
-target_dir = os.environ.get('_LOKI_TARGET_DIR', '.')
-
-sys.path.insert(0, project_dir)
-try:
-    from memory.knowledge_graph import OrganizationKnowledgeGraph
-    from pathlib import Path
-
-    kg = OrganizationKnowledgeGraph()
-    project_dirs = [Path(target_dir)]
-
-    # Extract and store patterns
-    patterns = kg.extract_patterns(project_dirs)
-    if patterns:
-        patterns = kg.deduplicate_patterns(patterns)
-        kg.save_patterns(patterns)
-
-    # Rebuild graph
-    kg.build_graph(project_dirs)
-    kg.save_graph()
-except Exception:
-    pass
-PYEOF
-}
-
 #===============================================================================
 # Save/Load Wrapper State
 #===============================================================================
 
+# A6 (multi-build-per-pod state isolation): resolve the autonomy-state.json path.
+# The existing .loki/sessions/<id>/ scoping (v6.4.0) namespaces PID + lock files
+# so concurrent sessions in the SAME TARGET_DIR do not collide. autonomy-state.json
+# was NOT covered by that scoping, so two concurrent builds with distinct
+# LOKI_SESSION_IDs still raced on the one global .loki/autonomy-state.json
+# (lost-update on retry/iteration counts). When LOKI_SESSION_ID is set we mirror
+# the session scoping and put the file under .loki/sessions/<id>/. When unset
+# (the normal `loki start ./prd.md` case) the legacy .loki/autonomy-state.json
+# path is returned UNCHANGED, so default single-session behavior is byte-identical.
+_loki_state_file() {
+    if [ -n "${LOKI_SESSION_ID:-}" ]; then
+        printf '%s' ".loki/sessions/${LOKI_SESSION_ID}/autonomy-state.json"
+    else
+        printf '%s' ".loki/autonomy-state.json"
+    fi
+}
+
 save_state() {
     local retry_count="$1"
     local status="$2"
     local exit_code="$3"
 
-    # BUG-ST-013: Ensure .loki directory exists (defensive -- may be called from signal handler)
-    mkdir -p .loki 2>/dev/null || true
+    local state_file
+    state_file="$(_loki_state_file)"
+
+    # BUG-ST-013: Ensure target directory exists (defensive -- may be called from
+    # signal handler). For a namespaced session path this also creates
+    # .loki/sessions/<id>/; for the default path it is .loki/ as before.
+    mkdir -p "$(dirname "$state_file")" 2>/dev/null || true
 
-    # BUG-XC-004: Atomic write via temp file + mv
-    local state_tmp=".loki/autonomy-state.json.tmp.$$"
+    # BUG-XC-004: Atomic write via temp file + mv (temp lives beside the target so
+    # the rename stays on the same filesystem)
+    local state_tmp="${state_file}.tmp.$$"
     cat > "$state_tmp" << EOF
 {
     "retryCount": $retry_count,
@@ -12796,23 +11846,30 @@ save_state() {
     "baseWait": $BASE_WAIT
 }
 EOF
-    mv -f "$state_tmp" ".loki/autonomy-state.json"
+    mv -f "$state_tmp" "$state_file"
 }
 
 load_state() {
+    local state_file
+    state_file="$(_loki_state_file)"
+
     # BUG-EP-015: Clean up orphaned temp files from kill -9 crashes
     # These are left behind when the process is killed during atomic writes
     find .loki/ -maxdepth 1 -name "*.tmp.*" -mmin +5 -delete 2>/dev/null || true
     find .loki/state/ -name "*.tmp.*" -mmin +5 -delete 2>/dev/null || true
+    # A6: also sweep namespaced session state temps when running under a session id
+    if [ -n "${LOKI_SESSION_ID:-}" ]; then
+        find ".loki/sessions/${LOKI_SESSION_ID}/" -maxdepth 1 -name "*.tmp.*" -mmin +5 -delete 2>/dev/null || true
+    fi
 
-    if [ -f ".loki/autonomy-state.json" ]; then
+    if [ -f "$state_file" ]; then
         if command -v python3 &> /dev/null; then
             # BUG-ST-006: Validate checkpoint integrity before loading state
             local state_valid
-            state_valid=$(python3 -c "
-import json, sys
+            state_valid=$(LOKI_STATE_FILE="$state_file" python3 -c "
+import json, os, sys
 try:
-    with open('.loki/autonomy-state.json') as f:
+    with open(os.environ['LOKI_STATE_FILE']) as f:
         d = json.load(f)
     # Validate required fields exist and have sane types
     rc = d.get('retryCount', 0)
@@ -12834,16 +11891,16 @@ except (json.JSONDecodeError, KeyError, TypeError, OSError):
                 RETRY_COUNT=0
                 ITERATION_COUNT=0
                 # Back up corrupted state file for diagnosis
-                mv ".loki/autonomy-state.json" ".loki/autonomy-state.json.corrupt.$(date +%s)" 2>/dev/null || true
+                mv "$state_file" "${state_file}.corrupt.$(date +%s)" 2>/dev/null || true
                 return
             fi
 
             # Load retry count, iteration count, and status from previous session
             local prev_status
-            prev_status=$(python3 -c "import json; print(json.load(open('.loki/autonomy-state.json')).get('status', 'unknown'))" 2>/dev/null || echo "unknown")
-            RETRY_COUNT=$(python3 -c "import json; print(json.load(open('.loki/autonomy-state.json')).get('retryCount', 0))" 2>/dev/null || echo "0")
+            prev_status=$(LOKI_STATE_FILE="$state_file" python3 -c "import json, os; print(json.load(open(os.environ['LOKI_STATE_FILE'])).get('status', 'unknown'))" 2>/dev/null || echo "unknown")
+            RETRY_COUNT=$(LOKI_STATE_FILE="$state_file" python3 -c "import json, os; print(json.load(open(os.environ['LOKI_STATE_FILE'])).get('retryCount', 0))" 2>/dev/null || echo "0")
             # BUG-RUN-003: Restore ITERATION_COUNT from persisted state
-            ITERATION_COUNT=$(python3 -c "import json; print(json.load(open('.loki/autonomy-state.json')).get('iterationCount', 0))" 2>/dev/null || echo "0")
+            ITERATION_COUNT=$(LOKI_STATE_FILE="$state_file" python3 -c "import json, os; print(json.load(open(os.environ['LOKI_STATE_FILE'])).get('iterationCount', 0))" 2>/dev/null || echo "0")
 
             # Reset retry count + iteration count if previous session ended in a
             # terminal state. A fresh `loki start` after a terminal run is a NEW
@@ -14945,7 +14002,7 @@ except Exception as exc:
 
     # Check max iterations before starting
     if check_max_iterations; then
-        log_error "Max iterations already reached. Reset with: rm .loki/autonomy-state.json"
+        log_error "Max iterations already reached. Reset with: rm $(_loki_state_file)"
         # Delegate-then-notify: terminal state. Mirror the in-loop max-iterations
         # site so a detached (--bg) run still writes COMPLETION.txt + fires the
         # ping on this pre-loop exit. _LOKI_RUN_START_SHA is already exported
@@ -17784,6 +16841,14 @@ main() {
     # durable mount, so a misconfigured volume never silently loses build state.
     assert_durable_state_mount
 
+    # A3: on a durable resume with an object-store backend, hydrate this run's
+    # checkpoints from the store IF the local volume came up empty (a fresh pod /
+    # non-durable volume). Best-effort + idempotent: the shim no-ops when the
+    # backend is local, when the local volume already has checkpoints, or when
+    # the store has nothing for this run. Runs before the main loop so any
+    # resume/rollback sees the restored state. Zero behavior change for local.
+    _loki_object_store_hydrate_checkpoints || true
+
     # Setup agent branch protection (isolates agent changes to a feature branch)
     setup_agent_branch
 
@@ -18001,8 +17066,9 @@ main() {
     #        because the process was SIGKILLed before reaching here). Retryable;
     #        the restarted Job resumes via the ENT-2 durable-resume path.
     if [ "${LOKI_DURABLE_STATE:-0}" = "1" ]; then
-        local _final_status
-        _final_status=$(python3 -c "import json; print(json.load(open('.loki/autonomy-state.json')).get('status','unknown'))" 2>/dev/null || echo "unknown")
+        local _final_status _final_state_file
+        _final_state_file="$(_loki_state_file)"
+        _final_status=$(LOKI_STATE_FILE="$_final_state_file" python3 -c "import json, os; print(json.load(open(os.environ['LOKI_STATE_FILE'])).get('status','unknown'))" 2>/dev/null || echo "unknown")
         case "$_final_status" in
             council_approved|council_force_approved|completion_promise_fulfilled|force_stopped|paused|interrupted|budget_exceeded|stopped)
                 result=0 ;;