loki-mode 7.95.0 → 7.97.0

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: Autonomous spec-driven build system with a built-in trust layer. It does not call work done until it is verified (RARV-C closure loop, 8 quality gates, completion council, verified-completion evidence gate). Triggers on "Loki Mode". Takes a spec (PRD, GitHub issue, OpenAPI doc, etc.) to deployed product with minimal human intervention. Provider-agnostic. Requires --dangerously-skip-permissions flag.
 ---
 
-# Loki Mode v7.95.0
+# Loki Mode v7.97.0
 
 **You are an autonomous agent. You make decisions. You do not ask questions. You do not stop.**
 
@@ -408,4 +408,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v7.95.0 | [Autonomi](https://www.autonomi.dev/) flagship product | ~260 lines core**
+**v7.97.0 | [Autonomi](https://www.autonomi.dev/) flagship product | ~260 lines core**

package/VERSION

@@ -1 +1 @@
-7.95.0
+7.97.0

package/autonomy/hooks/migration-hooks.sh

@@ -162,7 +162,14 @@ hook_pre_file_edit() {
     [[ -z "$file_path" ]] && return 0
     local snap_base
     snap_base=$(_migration_snapshot_dir)
-    _heal_snapshot_save "$snap_base" "$file_path"
+    # Enforce the pairing contract: if the snapshot cannot be captured, BLOCK the
+    # edit. Proceeding would leave post_file_edit's block_and_rollback path with
+    # no snapshot to restore -- a test failure would then leave the broken edit
+    # in place (silent revert failure). Fail loud/closed here instead.
+    if ! _heal_snapshot_save "$snap_base" "$file_path"; then
+        echo "HOOK_BLOCKED: could not capture a pre-edit snapshot for ${file_path}; refusing to edit without a revert path. Check that ${snap_base}/snapshots is writable."
+        return 1
+    fi
     return 0
 }
 
@@ -348,6 +355,19 @@ hook_pre_healing_modify() {
     [[ "${LOKI_HEAL_MODE:-false}" != "true" ]] && return 0
     [[ -z "$file_path" ]] && return 0
 
+    # Fail CLOSED if the friction map is absent. Without it the friction safety
+    # gate below cannot run, so deleting (or never producing) friction-map.json
+    # would otherwise BYPASS protection and let unclassified institutional
+    # knowledge be destroyed -- and _heal_snapshot_save would still run, masking
+    # the gap. The map is produced by the archaeology phase (the phase gate
+    # blocks archaeology -> stabilize until friction-map.json has >=1 entry), so
+    # any modify in stabilize/isolate/modernize legitimately has one. Block
+    # before any friction check or snapshot proceeds.
+    if [[ ! -f "$heal_dir/friction-map.json" ]]; then
+        echo "HOOK_BLOCKED: friction-map.json missing at ${heal_dir}/friction-map.json. Run the archaeology phase first (loki heal <path> --phase archaeology) to catalog friction before modifying files in healing mode."
+        return 1
+    fi
+
     # Check if file has friction points
     if [[ -f "$heal_dir/friction-map.json" ]]; then
         local blocked
@@ -405,7 +425,15 @@ print('OK')
     # Capture a pre-edit snapshot so post_healing_modify can revert ONLY the
     # healing edit on test failure (not unrelated uncommitted changes, and not
     # via git checkout which discards everything). Keyed by file path.
-    _heal_snapshot_save "$heal_dir" "$file_path"
+    #
+    # Enforce the pairing contract: if the snapshot cannot be captured, BLOCK the
+    # edit. Proceeding would leave the edit with no revert path -- a later test
+    # failure would then leave the broken edit in place while honestly reporting
+    # "no snapshot" (silent revert failure). Fail loud/closed here instead.
+    if ! _heal_snapshot_save "$heal_dir" "$file_path"; then
+        echo "HOOK_BLOCKED: could not capture a pre-edit snapshot for ${file_path}; refusing to modify it without a revert path. Check that ${heal_dir}/snapshots is writable."
+        return 1
+    fi
 
     return 0
 }
@@ -425,27 +453,63 @@ _heal_snapshot_path() {
 # healing edit will CREATE it), write a sentinel marker instead so the revert
 # path knows to remove the file rather than restore content.
 #
-# Pairing contract: hook_pre_healing_modify (which calls this) MUST run for a
-# file before hook_post_healing_modify reverts it. The snapshot is refreshed on
+# Pairing contract (ENFORCED, fail-closed): hook_pre_healing_modify (which calls
+# this) MUST run for a file before hook_post_healing_modify reverts it, AND that
+# pre call MUST leave behind a revertable snapshot. The snapshot is refreshed on
 # every pre call, so a post without a matching fresh pre could restore a stale
 # blob. On the success path the snapshot is intentionally left in place; the
 # next pre overwrites it.
+#
+# Returns 0 ONLY when a revertable snapshot demonstrably exists on disk after
+# this call: exactly one of {content snapshot, ".absent" marker}. Returns 1 on
+# ANY failure (cannot create the snapshot dir, cp/sentinel write failed, the
+# wrong marker survived, or both/neither markers exist). A 1 return MUST block
+# the edit at the caller -- otherwise the edit proceeds with no revert path and a
+# later test failure leaves the broken edit in place (the silent-revert-failure
+# this guard exists to prevent). NEVER return 0 on a failure path.
 _heal_snapshot_save() {
     local heal_dir="$1"
     local file_path="$2"
+    # Empty file_path: nothing to snapshot. Callers treat empty file_path as a
+    # no-op (return 0 before reaching here in the hooks); not a contract breach.
     [[ -z "$file_path" ]] && return 0
     local snap_dir="$heal_dir/snapshots"
-    mkdir -p "$snap_dir" 2>/dev/null || return 0
+    if ! mkdir -p "$snap_dir" 2>/dev/null || [[ ! -d "$snap_dir" ]]; then
+        return 1
+    fi
     local snap
     snap=$(_heal_snapshot_path "$heal_dir" "$file_path")
     if [[ -f "$file_path" ]]; then
-        cp "$file_path" "$snap" 2>/dev/null || return 0
-        rm -f "$snap.absent" 2>/dev/null || true
+        # Capture content, then drop any stale absent-marker so EXACTLY the
+        # content snapshot survives. Fail closed if either step fails.
+        if ! cp "$file_path" "$snap" 2>/dev/null; then
+            return 1
+        fi
+        if ! rm -f "$snap.absent" 2>/dev/null; then
+            return 1
+        fi
+        # Verify exactly the content snapshot exists and the absent-marker is
+        # gone. A lingering marker is a contract violation (restore checks the
+        # content snapshot first, but the inconsistency must not be tolerated).
+        if [[ ! -f "$snap" || -f "$snap.absent" ]]; then
+            return 1
+        fi
     else
         # File does not exist pre-edit: record an "absent" marker, drop any
-        # stale content snapshot.
-        rm -f "$snap" 2>/dev/null || true
-        : > "$snap.absent" 2>/dev/null || true
+        # stale content snapshot. CRITICAL: if the stale content snapshot is not
+        # removed, restore checks the content snapshot FIRST and would restore
+        # content for a file that should have been REMOVED. Fail closed if the
+        # stale snapshot cannot be cleared or the marker cannot be written.
+        if ! rm -f "$snap" 2>/dev/null; then
+            return 1
+        fi
+        if ! : > "$snap.absent" 2>/dev/null; then
+            return 1
+        fi
+        # Verify exactly the absent-marker exists and no content snapshot does.
+        if [[ ! -f "$snap.absent" || -f "$snap" ]]; then
+            return 1
+        fi
     fi
     return 0
 }

package/autonomy/run.sh

@@ -3801,6 +3801,82 @@ effective_session_cap() {
     return 0
 }
 
+# Auto-flag parity for parallel worktree Claude sessions (wave-5 fix).
+# The main RARV loop applies adaptive cost/resilience flags to its claude
+# invocation (run.sh:16007-16030 effort/max-budget/fallback) plus an MCP
+# bundle, but the parallel worktree spawn shipped a bare invocation that missed
+# them entirely. This populates the global _LOKI_WT_AUTO_FLAGS array with ONLY
+# the flags that are safe on the plain (non stream-json) worktree invocation:
+#   --effort           adaptive reasoning depth (dev tier)
+#   --max-budget-usd   per-call hard backstop
+#   --fallback-model   resilience to model overload/unavailability
+#   --mcp-config       (+ --strict-mcp-config) the same MCP bundle the Bun
+#                      route emits; a SUPERSET of the bash main loop, which does
+#                      NOT emit --mcp-config (see ledger run.sh:15990-15996).
+#                      Worktree dev streams benefit from the bundled MCP servers.
+# We deliberately do NOT replicate the stream-json-coupled flags
+# (--include-hook-events, --include-partial-messages) nor --output-format /
+# --session-id: this invocation logs free-form text, not parsed stream-json, so
+# those would be invalid or unwanted here. Each flag is gated on CLI support +
+# its opt-out env var, matching the main loop. Extracted from spawn_worktree_session
+# so it is unit-testable (tests/test-worktree-auto-flags.sh).
+_loki_build_worktree_claude_flags() {
+    _LOKI_WT_AUTO_FLAGS=()
+    # Non-claude providers never receive these flags.
+    if [ "${PROVIDER_NAME:-claude}" != "claude" ]; then
+        return 0
+    fi
+    # Dev-tier model param drives the fallback derivation (worktree streams are
+    # development work). Resolve via the provider helper when available.
+    local _loki_wt_primary=""
+    if type provider_get_tier_param >/dev/null 2>&1; then
+        _loki_wt_primary="$(provider_get_tier_param development 2>/dev/null || true)"
+    fi
+    if [ "${LOKI_AUTO_EFFORT:-on}" != "off" ] \
+       && type loki_effort_for_tier >/dev/null 2>&1 \
+       && type loki_claude_flag_supported >/dev/null 2>&1 \
+       && loki_claude_flag_supported "--effort"; then
+        local _loki_wt_effort
+        _loki_wt_effort="$(loki_effort_for_tier development "${DETECTED_COMPLEXITY:-${LOKI_COMPLEXITY:-standard}}")"
+        [ -n "$_loki_wt_effort" ] && _LOKI_WT_AUTO_FLAGS+=("--effort" "$_loki_wt_effort")
+    fi
+    if [ "${LOKI_AUTO_BUDGET:-on}" != "off" ] \
+       && type loki_remaining_budget >/dev/null 2>&1 \
+       && type loki_claude_flag_supported >/dev/null 2>&1 \
+       && loki_claude_flag_supported "--max-budget-usd"; then
+        local _loki_wt_rem
+        _loki_wt_rem="$(loki_remaining_budget)"
+        [ -n "$_loki_wt_rem" ] && _LOKI_WT_AUTO_FLAGS+=("--max-budget-usd" "$_loki_wt_rem")
+    fi
+    if [ "${LOKI_AUTO_FALLBACK:-on}" != "off" ] \
+       && [ -n "$_loki_wt_primary" ] \
+       && type loki_fallback_for_primary >/dev/null 2>&1 \
+       && type loki_claude_flag_supported >/dev/null 2>&1 \
+       && loki_claude_flag_supported "--fallback-model"; then
+        local _loki_wt_fb
+        _loki_wt_fb="$(loki_fallback_for_primary "$_loki_wt_primary")"
+        [ -n "$_loki_wt_fb" ] && _LOKI_WT_AUTO_FLAGS+=("--fallback-model" "$_loki_wt_fb")
+    fi
+    if type loki_mcp_config_argv >/dev/null 2>&1 \
+       && type loki_claude_flag_supported >/dev/null 2>&1 \
+       && loki_claude_flag_supported "--mcp-config"; then
+        local _loki_wt_mcp
+        if _loki_wt_mcp="$(loki_mcp_config_argv)" && [ -n "$_loki_wt_mcp" ]; then
+            _LOKI_WT_AUTO_FLAGS+=("--mcp-config")
+            local _loki_wt_mcp_path
+            for _loki_wt_mcp_path in $_loki_wt_mcp; do
+                _LOKI_WT_AUTO_FLAGS+=("$_loki_wt_mcp_path")
+            done
+            # --strict-mcp-config only alongside a real bundle, never bare.
+            if [ "${LOKI_STRICT_MCP:-1}" != "0" ] \
+               && loki_claude_flag_supported "--strict-mcp-config"; then
+                _LOKI_WT_AUTO_FLAGS+=("--strict-mcp-config")
+            fi
+        fi
+    fi
+    return 0
+}
+
 # Spawn a Claude session in a worktree
 spawn_worktree_session() {
     local stream_name="$1"
@@ -3843,6 +3919,11 @@ spawn_worktree_session() {
 
     log_step "Spawning ${PROVIDER_DISPLAY_NAME:-Claude} session: $stream_name"
 
+    # Build the worktree auto-flag set (effort/max-budget/fallback/mcp-config)
+    # BEFORE the ( subshell so it is inherited (a `bash -c` would not). Populates
+    # the global _LOKI_WT_AUTO_FLAGS array. See _loki_build_worktree_claude_flags.
+    _loki_build_worktree_claude_flags
+
     (
         cd "$worktree_path" || exit 1
         _wt_exit=0
@@ -3858,12 +3939,17 @@ spawn_worktree_session() {
                 if type loki_caveman_activate_env >/dev/null 2>&1; then
                     _loki_wt_cm="$(loki_caveman_activate_env)"
                 fi
+                # Expand the auto-flag array with the bash-3.2 empty-array guard
+                # (${arr[@]+...}) so a bare "${arr[@]}" under set -u does not
+                # abort with "unbound variable" when no flags were collected.
                 if [ -n "$_loki_wt_cm" ]; then
                     CAVEMAN_DEFAULT_MODE="$_loki_wt_cm" claude --dangerously-skip-permissions \
+                        "${_LOKI_WT_AUTO_FLAGS[@]+"${_LOKI_WT_AUTO_FLAGS[@]}"}" \
                         -p "Loki Mode: $task_prompt. Read .loki/CONTINUITY.md for context." \
                         >> "$log_file" 2>&1 || _wt_exit=$?
                 else
                     claude --dangerously-skip-permissions \
+                        "${_LOKI_WT_AUTO_FLAGS[@]+"${_LOKI_WT_AUTO_FLAGS[@]}"}" \
                         -p "Loki Mode: $task_prompt. Read .loki/CONTINUITY.md for context." \
                         >> "$log_file" 2>&1 || _wt_exit=$?
                 fi
@@ -17773,7 +17859,24 @@ check_human_intervention() {
         if type ensure_completion_test_evidence &>/dev/null; then
             ensure_completion_test_evidence || true
         fi
-        if type council_checklist_gate &>/dev/null && ! council_checklist_gate; then
+        # TRUST MOAT (fail-CLOSED, parity with the default route ~17153): each gate
+        # arm below is `type fn && ! fn`, so a missing gate fn (council library
+        # failed to source) silently skips that gate and the chain can reach
+        # council_vote and force-approve completion UNGATED -- a fake-green. Probe
+        # the core gate fns first; if any is missing, refuse the force-review
+        # approval and fall through to continue iterating. No-op on healthy loads.
+        _frgate_loadable=1
+        for _frgate_fn in council_checklist_gate council_evidence_gate council_heldout_gate council_assumption_ledger_gate; do
+            if ! type "$_frgate_fn" &>/dev/null; then
+                log_error "Council force-review: gate unavailable: ${_frgate_fn} (council library incomplete)."
+                _frgate_loadable=0
+            fi
+        done
+        if [ "$_frgate_loadable" -eq 0 ]; then
+            log_error "Council force-review: required gates missing; refusing force approval (fail-closed)."
+            unset _frgate_loadable _frgate_fn
+        elif type council_checklist_gate &>/dev/null && ! council_checklist_gate; then
+            unset _frgate_loadable _frgate_fn
             log_info "Council force-review: blocked by checklist hard gate"
         elif type council_evidence_gate &>/dev/null && ! _evidence_gate_and_surface; then
             log_info "Council force-review: blocked by evidence hard gate"

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "7.95.0"
+__version__ = "7.97.0"
 
 # Expose the control app for easy import
 try: