loki-mode 9.16.0 → 9.17.0

package/autonomy/loki

@@ -1040,7 +1040,7 @@ show_help() {
     echo "  agent analyze api assets audit bench checkpoint (cp) ci cleanup"
     echo "  cluster cockpit code compliance completions compound config context (ctx)"
     echo "  cost council crash dashboard demo deploy docker docs doctor dogfood"
-    echo "  enterprise estimate explain export failover github grill heal help"
+    echo "  enterprise estimate explain export failover gates github grill heal help"
     echo "  import init intent"
     echo "  issue kpis logs magic mcp memory metrics migrate modernize monitor"
     echo "  next notify onboard open optimize otel outcomes own (handoff) pause plan preview"
@@ -13821,46 +13821,60 @@ set_ttfv_lightweight_profile() {
 # honest about being shallow -- it turns stated nouns into checkable lines and
 # claims nothing about intent it cannot see. Anything cleverer belongs in the
 # spec-interrogation grill, which already runs after this and does call a model.
+#
+# STABLE IDs. Each criterion is emitted as "AC-<AXIS>-NNN: <text>" rather than a
+# bare bullet. An anonymous bullet cannot be referred to: a receipt can say "3 of
+# 8 gates passed" but never "AC-PERSIST-001 is satisfied by this test", drift
+# cannot be tracked per criterion, and two runs of the same spec produce lists
+# nothing can diff. The ID is what turns a criterion into a citable claim, which
+# is the whole point of shipping a receipt someone can check.
+#
+# The axis is derived from WHICH obligation fired, not from the criterion's
+# position, so IDs are stable across runs: adding a payment criterion never
+# renumbers the persistence one. Same reason we do not use a running counter.
 _brief_acceptance_criteria() {
     local t
     t="$(printf '%s' "${1:-}" | tr '[:upper:]' '[:lower:]')"
     local out=""
-    _bac() { out="${out}- ${1}"$'\n'; }
+    # _bac <AXIS> <text>. The sequence is per-axis and always 001 today because
+    # each axis fires at most once; the NNN slot exists so a second criterion on
+    # the same axis can be added later without renumbering the first.
+    _bac() { out="${out}- AC-${1}-001: ${2}"$'\n'; }
 
     # Persistence. The single most common churn report is "I submitted the form
     # and nothing happened", so a stated store or form becomes an explicit
     # survives-a-reload obligation rather than an implied one.
     case "$t" in
         *save*|*persist*|*store*|*databas*|*crud*|*todo*|*note*|*task*|*record*)
-            _bac "Data the user creates survives a page reload and a server restart (it is written to a real store, not held in memory)." ;;
+            _bac PERSIST "Data the user creates survives a page reload and a server restart (it is written to a real store, not held in memory)." ;;
     esac
     case "$t" in
         *form*|*submit*|*signup*|*"sign up"*|*contact*|*upload*|*checkout*)
-            _bac "Every form actually submits: the happy path writes real data and the user sees a confirmation, and a validation failure shows an inline error." ;;
+            _bac FORM "Every form actually submits: the happy path writes real data and the user sees a confirmation, and a validation failure shows an inline error." ;;
     esac
     case "$t" in
         *auth*|*login*|*"log in"*|*"sign in"*|*account*|*user*|*password*|*session*)
-            _bac "Authentication works end to end: a real signup, a real login, and a protected route that returns 401 when logged out." ;;
+            _bac AUTH "Authentication works end to end: a real signup, a real login, and a protected route that returns 401 when logged out." ;;
     esac
     case "$t" in
         *api*|*endpoint*|*rest*|*graphql*|*backend*|*server*)
-            _bac "Each endpoint returns real data with correct status codes, and is callable with curl without a browser." ;;
+            _bac API "Each endpoint returns real data with correct status codes, and is callable with curl without a browser." ;;
     esac
     case "$t" in
         *payment*|*stripe*|*billing*|*subscription*|*checkout*|*invoice*)
-            _bac "The payment path is wired to the provider's test mode and a test transaction completes; no mocked charge stands in for the integration." ;;
+            _bac PAY "The payment path is wired to the provider's test mode and a test transaction completes; no mocked charge stands in for the integration." ;;
     esac
     case "$t" in
         *search*|*filter*|*sort*)
-            _bac "Search or filtering queries the real dataset and returns different results for different inputs." ;;
+            _bac SEARCH "Search or filtering queries the real dataset and returns different results for different inputs." ;;
     esac
     case "$t" in
         *dashboard*|*chart*|*graph*|*analytic*|*report*|*metric*)
-            _bac "Every figure shown traces to a real query. No hardcoded sample numbers." ;;
+            _bac DATA "Every figure shown traces to a real query. No hardcoded sample numbers." ;;
     esac
     case "$t" in
         *page*|*landing*|*site*|*website*|*ui*|*app*|*frontend*)
-            _bac "The page renders with real content, no lorem ipsum, and no placeholder image where a real asset belongs." ;;
+            _bac UI "The page renders with real content, no lorem ipsum, and no placeholder image where a real asset belongs." ;;
     esac
     printf '%s' "$out"
 }
@@ -19484,6 +19498,11 @@ main() {
             # Can an agent verify its own work here? Measured, not LLM-scored.
             cmd_readiness "$@"
             ;;
+        gates)
+            # What blocks here vs only advises, and what promoting a gate would
+            # have cost. Reports only; never promotes.
+            cmd_gates "$@"
+            ;;
         secure)
             # Secure-by-default gate surface: inspect findings + manage waivers.
             cmd_secure "$@"
@@ -31012,6 +31031,47 @@ cmd_verdict() {
 # is no test command" tells you what to do, "readiness 62%" does not. Criteria
 # that cannot be determined report UNKNOWN by name rather than counting as
 # failures. See autonomy/lib/agent_readiness.py.
+cmd_gates() {
+    local lib="${_LOKI_SCRIPT_DIR}/lib/gate_policy.py"
+    if [ ! -f "$lib" ]; then
+        echo "gate policy reporter is not installed at $lib" >&2
+        return 2
+    fi
+    case "${1:-}" in
+        --help|-h|help)
+            echo -e "${BOLD}loki gates${NC} - what blocks here, and what only advises"
+            echo ""
+            echo "Usage: loki gates [.loki-dir] [--json]"
+            echo ""
+            echo "Ona's Veto Exec ships an audit-first ladder: start in audit mode,"
+            echo "review what matched, then promote the confirmed rules to block. The"
+            echo "middle step is the load-bearing one -- a policy you cannot safely"
+            echo "turn on is a policy nobody turns on."
+            echo ""
+            echo "We had both ends and nothing between them: gates are advisory or"
+            echo "blocking, three promotion knobs exist, and the failure ledger has"
+            echo "counted per-gate hits all along. Nothing joined them, so deciding"
+            echo "whether to promote a gate meant guessing."
+            echo ""
+            echo "For each gate this prints its mode, how many times it has fired,"
+            echo "and -- for an advisory one -- the exact variable that promotes it."
+            echo ""
+            echo "Deterministic: reads two files and the environment. No model, no"
+            echo "key, no spend. Counts come from"
+            echo ".loki/quality/gate-failure-count.json; open it and count them"
+            echo "yourself."
+            echo ""
+            echo "A gate with no ledger entry reports 'not measured', never 0: an"
+            echo "absent measurement is not evidence a gate never fired."
+            echo ""
+            echo "This command NEVER promotes a gate. Promotion stays an explicit"
+            echo "operator act via the named variable."
+            return 0
+            ;;
+    esac
+    python3 "$lib" "$@"
+}
+
 cmd_readiness() {
     local lib="${_LOKI_SCRIPT_DIR}/lib/agent_readiness.py"
     if [ ! -f "$lib" ]; then
@@ -31022,7 +31082,7 @@ cmd_readiness() {
         --help|-h|help)
             echo -e "${BOLD}loki readiness${NC} - can an agent verify its own work in this repo?"
             echo ""
-            echo "Usage: loki readiness [path] [--json]"
+            echo "Usage: loki readiness [path] [--json] [--fix]"
             echo ""
             echo "Measures whether this repo gives an agent a way to check itself: a"
             echo "test command, a build, CI config, typed sources, a lockfile. Not"
@@ -31030,7 +31090,18 @@ cmd_readiness() {
             echo ""
             echo "Deterministic: no model, no key, no spend. Same commit, same answer."
             echo "Criteria that cannot be determined report UNKNOWN rather than failing."
-            echo "Read-only: it never writes to the repo it analyses."
+            echo ""
+            echo -e "${BOLD}--fix${NC} writes the missing files whose content can be derived"
+            echo "honestly (README.md, AGENTS.md, .gitignore) as TODO stubs, then"
+            echo "re-measures and reports what is true AFTER the change."
+            echo ""
+            echo "It deliberately REFUSES to generate a test command, a lockfile or a"
+            echo "CI config. Guessing one writes a line that lies: an invented"
+            echo "'npm test' in a repo with no runner fails forever, and this check"
+            echo "would then report the criterion present for something that does not"
+            echo "work. Those stay reported, never generated."
+            echo ""
+            echo "Without --fix it is read-only and never writes to the repo."
             return 0
             ;;
     esac

package/autonomy/notify.sh

@@ -86,6 +86,68 @@ _get_discord_color() {
 # Slack Notifications
 #===============================================================================
 
+# Verdict fields for a Slack card, from the newest Evidence Receipt.
+#
+# Roadmap item 9: "put the receipt where review already happens". Slack
+# notifications carried the event name and the project name and nothing else --
+# grep for receipt/verdict/proof in this file returned 0. A team watching a
+# channel saw "build finished" and had to go somewhere else to learn whether it
+# was verified, which is the surface problem item 9 names: verification nobody
+# sees does not build trust.
+#
+# Emits Slack `fields` entries (the payload already has that array), so this
+# adds to the card rather than restructuring it.
+#
+# SILENT AND EMPTY ON ANY DOUBT. No receipt, unreadable JSON, no python -- emit
+# nothing. A notification is a side channel; it must never fail a build, and it
+# must never guess a verdict. An absent receipt yields no verdict field at all
+# rather than a reassuring default.
+_slack_verdict_fields() {
+    local loki_dir="${LOKI_DIR:-.loki}"
+    [ -d "$loki_dir/proofs" ] || return 0
+    command -v python3 >/dev/null 2>&1 || return 0
+    python3 - "$loki_dir" <<'PY' 2>/dev/null || true
+import glob, json, os, sys
+d = sys.argv[1]
+paths = sorted(glob.glob(os.path.join(d, "proofs", "*", "proof.json")))
+if not paths:
+    sys.exit(0)
+try:
+    r = json.load(open(paths[-1]))
+except (OSError, ValueError):
+    sys.exit(0)
+
+def esc(s):
+    return json.dumps(str(s))[1:-1]
+
+out = []
+qg = r.get("quality_gates") or {}
+gates = qg.get("gates") or []
+if gates:
+    passed = sum(1 for g in gates if str(g.get("status", "")).startswith("pass"))
+    out.append(("Gates", f"{passed}/{len(gates)} passed"))
+
+git = (r.get("facts") or {}).get("git") or {}
+# base_sha empty means the receipt cannot be anchored, so it cannot be
+# verified. Say that plainly rather than showing a diff count that implies it.
+if not git.get("base_sha"):
+    out.append(("Verified", "no (unanchored receipt)"))
+else:
+    diff = git.get("diff") or {}
+    if diff.get("count") is not None:
+        out.append(("Files changed", str(diff["count"])))
+
+run_id = r.get("run_id")
+if run_id:
+    out.append(("Receipt", esc(run_id)))
+
+print(",".join(
+    '{"title": "%s", "value": "%s", "short": true}' % (esc(t), esc(v))
+    for t, v in out
+))
+PY
+}
+
 _notify_slack() {
     local event="$1"
     local title="$2"
@@ -106,6 +168,13 @@ _notify_slack() {
     escaped_event="$(_json_escape "$event")"
     escaped_project="$(_json_escape "$project")"
 
+    # Receipt-derived fields. Empty on any doubt, and the ${var:+,...} expansion
+    # below means an empty value adds no trailing comma -- a malformed payload
+    # would make Slack reject the whole card, so the failure mode of "no receipt"
+    # must be a card without verdict fields, never a card that does not send.
+    local verdict_fields
+    verdict_fields="$(_slack_verdict_fields 2>/dev/null || true)"
+
     # Build Slack payload with attachment
     local payload
     payload=$(cat <<PAYLOAD
@@ -116,7 +185,7 @@ _notify_slack() {
         "text": "$escaped_message",
         "fields": [
             {"title": "Event", "value": "$escaped_event", "short": true},
-            {"title": "Project", "value": "$escaped_project", "short": true}
+            {"title": "Project", "value": "$escaped_project", "short": true}${verdict_fields:+,$verdict_fields}
         ],
         "footer": "Loki Mode",
         "ts": $(date +%s)

package/autonomy/queue-consumer.sh

@@ -30,11 +30,30 @@
 #   - Only redis and file are shipped. SQS, Pub/Sub, RabbitMQ, Kafka, etc. are
 #     BRING-YOUR-OWN: override queue.command in values.yaml with your own
 #     consumer. They are documented, not implemented here.
-#   - The redis backend is at-most-once (LPOP-then-run). It has no visibility
-#     timeout / dead-letter requeue. If a build crashes after the item is popped,
-#     that item is lost from the queue. For at-least-once delivery use the file
-#     backend (a crashed build leaves the item in processing/ for manual
-#     re-drive) or bring a real broker.
+#   - The redis backend is AT-LEAST-ONCE by default. LMOVE (RPOPLPUSH pre-6.2)
+#     pops and records the item in <key>:processing atomically, and the ack
+#     (LREM) runs only after a zero-exit build. A crashed worker leaves its item
+#     in <key>:processing for re-drive -- the same shape as the file backend's
+#     processing/ directory.
+#     It was at-most-once (LPOP-then-run) until this was fixed; a crash after
+#     the pop lost the build with no record anywhere.
+#     A VISIBILITY TIMEOUT now exists: `queue-consumer.sh --reap` requeues
+#     in-flight items whose claim is older than LOKI_QUEUE_VISIBILITY_SEC
+#     (default 7200). Run it on a schedule (a CronJob) or by hand. It is a
+#     separate mode, not folded into the consume loop, because a consumer that
+#     reaped on every poll would race its peers on a busy queue.
+#     `--reap` works on BOTH backends. It was redis-only until this was fixed,
+#     which left the file backend with no crash recovery at all: a dead worker's
+#     item sat in processing/ forever and an unattended fleet stalled on it.
+#     A FRESH claim is never reaped -- requeuing a live item would build the
+#     user's work twice -- and an in-flight item with NO claim is treated as
+#     infinitely old, since that means the worker died between the LMOVE and the
+#     claim stamp, which is exactly the case that must be recoverable.
+#     LOKI_QUEUE_ACK=0 restores the legacy lossy path.
+#     The file backend's claim time is the item file's MTIME, stamped on claim,
+#     since a flat directory carries no claim hash. The limit is real and worth
+#     stating: a consumer that rewrote its own item file would reset that clock
+#     and look fresh forever. See file_reap.
 #   - The file backend's atomicity relies on `mv` being atomic within a single
 #     filesystem (true for a normal PVC). Two consumers racing the same pending
 #     dir is safe (mv either wins or fails-and-skips), but is not load-balanced.
@@ -55,6 +74,8 @@
 #   LOKI_QUEUE_POLL_SEC  loop-mode empty-poll wait, seconds (default: 5)
 #   LOKI_QUEUE_BLOCK_SEC redis BLPOP block timeout, seconds (default: 5)
 #   LOKI_TERMINAL_EXIT   run.sh terminal-failure exit code (default: 20)
+#   LOKI_QUEUE_VISIBILITY_SEC  --reap requeues in-flight items older than this,
+#                        both backends, seconds (default: 7200)
 #===============================================================================
 
 set -uo pipefail
@@ -176,17 +197,136 @@ redis_cli() {
     redis-cli -u "$QUEUE_URL" "$@"
 }
 
-# Pop one item from the redis list. In loop mode use BLPOP (blocks up to
-# BLOCK_SEC, then returns empty so we can check the stop flag); in one-shot use
-# LPOP (non-blocking, exits immediately on an empty queue).
-# Prints the popped item to stdout, or nothing if the queue was empty.
+# Pop one item from the redis list, ATOMICALLY RECORDING IT AS IN-FLIGHT.
+#
+# THE DEFECT THIS FIXES, proven on a real redis 8.6.3 before it was written:
+#
+#   RPUSH loki-builds '{"spec":"build a todo app"}'   -> LLEN 1
+#   LPOP  loki-builds                                 -> worker holds the item
+#   <worker is OOM-killed / node evicted / kill -9>
+#   LLEN  loki-builds                                 -> 0
+#
+# The user's build is gone and NOTHING anywhere records that it existed. For a
+# product whose entire thesis is "we hand you a receipt you can check", silently
+# losing the work is the worst failure mode available: there is no receipt, no
+# error, and no queue entry to retry.
+#
+# LMOVE (redis 6.2+) pops and pushes to a processing list in ONE atomic step, so
+# a crash between the two is impossible. A dead worker leaves its item in
+# <key>:processing where `loki queue reap` (or an operator) can re-drive it.
+# RPOPLPUSH is the pre-6.2 equivalent and is tried automatically.
+#
+# Kept OPT-OUT rather than opt-in (LOKI_QUEUE_ACK=0 restores LPOP). At-least-once
+# is the safer default: its failure mode is a duplicate build, which the
+# idempotence work already handles, versus silent data loss. But an operator
+# running a broker that already guarantees delivery should be able to turn it
+# off rather than maintain two in-flight records.
+#
+# In loop mode with acking we use a short-poll LMOVE plus a sleep instead of
+# BLMOVE, because BLMOVE blocks the connection and the stop-flag check has to
+# stay responsive; the empty-poll backoff below already bounds the cost.
 redis_pop() {
-    if [ "$ONESHOT" = "1" ]; then
-        redis-cli -u "$QUEUE_URL" --no-raw LPOP "$QUEUE_KEY" 2>/dev/null | _redis_unquote
-    else
-        # BLPOP returns two lines: the key name, then the value. Take the value.
-        redis-cli -u "$QUEUE_URL" BLPOP "$QUEUE_KEY" "$BLOCK_SEC" 2>/dev/null | sed -n '2p'
+    if [ "${LOKI_QUEUE_ACK:-1}" = "0" ]; then
+        # Legacy at-most-once path, explicitly requested.
+        if [ "$ONESHOT" = "1" ]; then
+            redis-cli -u "$QUEUE_URL" --no-raw LPOP "$QUEUE_KEY" 2>/dev/null | _redis_unquote
+        else
+            redis-cli -u "$QUEUE_URL" BLPOP "$QUEUE_KEY" "$BLOCK_SEC" 2>/dev/null | sed -n '2p'
+        fi
+        return 0
+    fi
+
+    # RAW output, not --no-raw. `--no-raw` escapes the INNER quotes of a JSON
+    # payload ({"spec":"x"} comes back as "{\"spec\":\"x\"}"), and
+    # _redis_unquote only strips the outer pair -- so the item reaching
+    # extract_spec was mangled AND the string handed to LREM no longer matched
+    # what redis stored, silently acking nothing. Both were caught by running
+    # against a real redis 8.6.3; neither is visible in a mock.
+    local out
+    out="$(redis-cli -u "$QUEUE_URL" LMOVE "$QUEUE_KEY" "${QUEUE_KEY}:processing" LEFT RIGHT 2>/dev/null)"
+    # Pre-6.2 servers reject LMOVE as an unknown command (stderr, empty stdout),
+    # so fall back rather than reporting an empty queue.
+    if [ -z "$out" ]; then
+        out="$(redis-cli -u "$QUEUE_URL" RPOPLPUSH "$QUEUE_KEY" "${QUEUE_KEY}:processing" 2>/dev/null)"
+    fi
+    # Record WHEN this item was claimed. A bare list carries no time, so nothing
+    # could tell a stale entry (dead worker) from a running one (long build) --
+    # and requeuing a live item duplicates the user's build. The claim hash is
+    # what makes the reaper below safe to run at all.
+    #
+    # Written AFTER the move, so a crash between them leaves the item in-flight
+    # with no claim time. The reaper treats a missing claim as INFINITELY OLD
+    # rather than infinitely young: an item nothing is tracking is exactly the
+    # case that must be recoverable.
+    if [ -n "$out" ]; then
+        redis-cli -u "$QUEUE_URL" HSET "${QUEUE_KEY}:claims" "$out" "$(date +%s)" >/dev/null 2>&1 || true
     fi
+    printf '%s' "$out"
+}
+
+# Remove a completed item from the in-flight list. Called ONLY after the build
+# finished; until then the item stays recoverable.
+#
+# LREM with count 0 removes every equal element. Two identical specs queued twice
+# would both clear on the first ack -- accepted deliberately: the alternative is
+# a per-item token, which needs a producer change, and the failure mode here is
+# one duplicate re-drive rather than a lost build.
+redis_ack() {
+    [ "${LOKI_QUEUE_ACK:-1}" = "0" ] && return 0
+    [ -n "${1:-}" ] || return 0
+    redis-cli -u "$QUEUE_URL" LREM "${QUEUE_KEY}:processing" 0 "$1" >/dev/null 2>&1 || true
+    # Drop the claim too, or the hash grows without bound and every completed
+    # item looks like a candidate for reaping forever.
+    redis-cli -u "$QUEUE_URL" HDEL "${QUEUE_KEY}:claims" "$1" >/dev/null 2>&1 || true
+}
+
+# Requeue in-flight items whose claim is older than the visibility timeout.
+#
+# THE GAP THIS CLOSES. LMOVE made a crashed worker's item RECOVERABLE, but
+# nothing recovered it: re-drive was an operator action, so an unattended fleet
+# still stalled on every dead worker. That was documented rather than claimed;
+# this closes it.
+#
+# SAFETY IS THE WHOLE DESIGN. Requeuing an item a worker is still building
+# duplicates the user's build, so the timeout must exceed the longest legitimate
+# build. Default 2h (LOKI_MAX_DURATION territory), tunable.
+#
+# An item with NO claim entry is treated as INFINITELY OLD, not young: it means
+# the worker died between the LMOVE and the HSET, which is precisely the case
+# that must be recoverable. Erring the other way would strand exactly the items
+# this exists to rescue.
+#
+# Reports what it did on stdout. Requeues nothing when the timeout has not
+# elapsed, and says so rather than printing a silent zero.
+redis_reap() {
+    [ "${LOKI_QUEUE_ACK:-1}" = "0" ] && { echo "reap: acking disabled, nothing to reap"; return 0; }
+    local timeout now items requeued=0 kept=0
+    timeout="${LOKI_QUEUE_VISIBILITY_SEC:-7200}"
+    now="$(date +%s)"
+    items="$(redis-cli -u "$QUEUE_URL" LRANGE "${QUEUE_KEY}:processing" 0 -1 2>/dev/null)"
+    [ -n "$items" ] || { echo "reap: nothing in flight"; return 0; }
+    while IFS= read -r it; do
+        [ -n "$it" ] || continue
+        local claimed age
+        claimed="$(redis-cli -u "$QUEUE_URL" HGET "${QUEUE_KEY}:claims" "$it" 2>/dev/null)"
+        if [ -z "$claimed" ]; then
+            age="$((timeout + 1))"   # unclaimed == infinitely old, see above
+        else
+            age="$((now - claimed))"
+        fi
+        if [ "$age" -gt "$timeout" ]; then
+            # LREM then RPUSH, not LMOVE: the item may appear more than once and
+            # LREM 0 clears every copy, so the queue cannot gain duplicates.
+            redis-cli -u "$QUEUE_URL" LREM "${QUEUE_KEY}:processing" 0 "$it" >/dev/null 2>&1 || true
+            redis-cli -u "$QUEUE_URL" HDEL "${QUEUE_KEY}:claims" "$it" >/dev/null 2>&1 || true
+            redis-cli -u "$QUEUE_URL" RPUSH "$QUEUE_KEY" "$it" >/dev/null 2>&1 || true
+            requeued=$((requeued + 1))
+            log "reaped stale item (age ${age}s > ${timeout}s), requeued"
+        else
+            kept=$((kept + 1))
+        fi
+    done <<< "$items"
+    echo "reap: requeued $requeued, left $kept in flight (timeout ${timeout}s)"
 }
 
 # --no-raw LPOP wraps the value in quotes; strip a single surrounding pair and
@@ -207,10 +347,21 @@ redis_consume_one() {
     if [ -z "$item" ]; then
         return 100  # sentinel: queue empty
     fi
-    local spec
+    local spec rc
     spec="$(extract_spec "$item")"
     run_build "$spec"
-    return $?
+    rc=$?
+    # ACK ONLY ON SUCCESS, and the order is load-bearing: acking before the
+    # build would reintroduce the exact data loss this exists to prevent, and
+    # acking a FAILED build would discard work that a re-drive could complete.
+    # A failed item stays in <key>:processing so `loki queue reap` can requeue
+    # it -- the same shape as the file backend leaving it in processing/.
+    if [ "$rc" -eq 0 ]; then
+        redis_ack "$item"
+    else
+        log "item left in ${QUEUE_KEY}:processing for re-drive (exit $rc)"
+    fi
+    return "$rc"
 }
 
 # =============================================================================
@@ -241,6 +392,18 @@ file_claim_oldest() {
         base="$(basename "$f")"
         dest="$QUEUE_DIR/processing/$base"
         if mv "$f" "$dest" 2>/dev/null; then
+            # Stamp the CLAIM TIME. This is the file-backend analogue of the
+            # `HSET <key>:claims` that redis_pop does right after its LMOVE, and
+            # file_reap below depends on it being here.
+            #
+            # Load-bearing: `mv` is a rename(2), which PRESERVES mtime. An item
+            # that sat in pending/ behind a backlog for longer than the
+            # visibility timeout would arrive in processing/ already looking
+            # stale, and the reaper would requeue it while a worker was actively
+            # building it -- the exact duplicate build the timeout exists to
+            # prevent, firing on precisely the busy queues that need a reaper.
+            # Verified on darwin: mv of a file stamped 2020 kept the 2020 mtime.
+            touch "$dest" 2>/dev/null || true
             printf '%s' "$dest"
             return 0
         fi
@@ -272,13 +435,110 @@ file_consume_one() {
         mv "$claimed" "$QUEUE_DIR/failed/$base" 2>/dev/null || log "WARN: could not move $base to failed/"
         log "item $base TERMINAL-FAILED (exit $rc); moved to failed/, not acked"
     else
-        # Transient crash: leave it in processing/ for manual re-drive. We do NOT
-        # auto-requeue (no retry counter in a flat dir); honest at-least-once.
+        # Transient crash: leave it in processing/ for re-drive. We do not
+        # requeue INLINE (no retry counter in a flat dir, so an instant retry
+        # could hot-loop a poison item). `--reap` picks it up once the
+        # visibility timeout has elapsed; see file_reap.
         log "item $base crashed (exit $rc); left in processing/ for re-drive"
     fi
     return "$rc"
 }
 
+# Requeue in-flight items whose claim is older than the visibility timeout.
+#
+# THE GAP THIS CLOSES. The redis backend got a reaper; the file backend did not,
+# so an item left in processing/ by a dead worker stayed there FOREVER and an
+# unattended fleet on the file backend stalled on every crash. `--reap` answered
+# "redis-only" and changed nothing.
+#
+# CLAIM TIME IS THE FILE MTIME. The file backend has no claim hash, so the mtime
+# stamped by file_claim_oldest stands in for one.
+#
+# THE LIMIT, stated plainly: mtime is whatever last WROTE the file. A build that
+# rewrites its own item file resets the clock and would look fresh forever, so
+# it would never be reaped. Nothing here writes back to a claimed item, but a
+# custom consumer that did would silently opt out of recovery. The redis claim
+# hash does not have this weakness; the file backend accepts it rather than
+# maintain a second sidecar file whose own staleness would need reaping too.
+#
+# There is also no retry counter (a flat dir carries none), so a poison item can
+# be reaped repeatedly. That is the same shape the backend already documents for
+# manual re-drive, not a new failure introduced here.
+#
+# SAFETY IS THE WHOLE DESIGN, mirroring redis_reap:
+#   - a FRESH item is NEVER requeued; a live build requeued is the user's work
+#     built twice, which is worse than the stranding this fixes
+#   - it NEVER deletes an item -- a name collision in pending/ leaves the item
+#     in processing/ and says so, rather than clobbering the pending copy
+#   - it reports counts on stdout; per-item detail goes to stderr via log()
+file_reap() {
+    local timeout now requeued=0 kept=0 seen=0 f base mt age
+    timeout="${LOKI_QUEUE_VISIBILITY_SEC:-7200}"
+    now="$(date +%s)"
+    if [ ! -d "$QUEUE_DIR/processing" ]; then
+        echo "reap: nothing in flight"
+        return 0
+    fi
+    mkdir -p "$QUEUE_DIR/pending" 2>/dev/null || true
+    # Glob, not `ls`: a filename with a space or newline survives it.
+    for f in "$QUEUE_DIR"/processing/*; do
+        [ -e "$f" ] || continue   # unmatched glob stays literal
+        [ -f "$f" ] || continue
+        seen=$((seen + 1))
+        base="$(basename "$f")"
+        # GNU FIRST, and the order is load-bearing. `stat -f` means
+        # --file-system on GNU coreutils and EXITS 0, printing a mount point
+        # rather than an mtime -- so a `-f`-first probe never falls through on
+        # Linux and hands back garbage. BSD `stat -c` has no such ambiguity: it
+        # is an illegal option and exits 1 (verified on darwin), so `-f %m` is
+        # reached only where it means what we want.
+        # `find -printf` and `-mmin` are GNU-only / minute-granular, and the
+        # fresh-vs-stale distinction needs seconds.
+        mt="$(stat -c %Y "$f" 2>/dev/null || stat -f %m "$f" 2>/dev/null)"
+        case "$mt" in
+            ''|*[!0-9]*)
+                # Unreadable or non-numeric claim time. KEEP the item, and note
+                # the ASYMMETRY with redis_reap deliberately: a missing redis
+                # claim is DIAGNOSTIC (the worker died between LMOVE and HSET),
+                # but a file that exists ALWAYS has an mtime, so failing to read
+                # one means our stat invocation is wrong -- a portability bug,
+                # not a dead worker.
+                # MEASURED, not assumed: with a `stat` that prints a non-number
+                # and exits 0, the un-guarded arithmetic aborts the reaper under
+                # `set -uo pipefail` (rc=1, nothing requeued). So the observed
+                # failure is a DEAD REAPER on the affected platform, not a
+                # duplicate build. Keeping the item is correct either way, and
+                # the WARN names the reason instead of exiting silently.
+                kept=$((kept + 1))
+                log "WARN: cannot read mtime for $base (got '$mt'); left in processing/ rather than guess a claim time"
+                continue
+                ;;
+        esac
+        age="$((now - mt))"
+        if [ "$age" -le "$timeout" ]; then
+            kept=$((kept + 1))
+            continue
+        fi
+        if [ -e "$QUEUE_DIR/pending/$base" ]; then
+            kept=$((kept + 1))
+            log "stale item $base NOT requeued: pending/$base already exists (never overwrite an item)"
+            continue
+        fi
+        if mv "$f" "$QUEUE_DIR/pending/$base" 2>/dev/null; then
+            requeued=$((requeued + 1))
+            log "reaped stale item $base (age ${age}s > ${timeout}s), requeued"
+        else
+            kept=$((kept + 1))
+            log "WARN: could not requeue $base; left in processing/"
+        fi
+    done
+    if [ "$seen" -eq 0 ]; then
+        echo "reap: nothing in flight"
+        return 0
+    fi
+    echo "reap: requeued $requeued, left $kept in flight (timeout ${timeout}s)"
+}
+
 # =============================================================================
 # Driver
 # =============================================================================
@@ -307,6 +567,18 @@ main() {
         return 2
     fi
 
+    # --reap requeues stale in-flight items and exits. Kept a SEPARATE mode
+    # rather than folded into the consume loop: a reaper wants its own cadence
+    # (a CronJob, or an operator hand-running it), and a consumer that reaped on
+    # every poll would race its own peers on a busy queue.
+    if [ "${1:-}" = "--reap" ] || [ "${LOKI_QUEUE_REAP:-0}" = "1" ]; then
+        case "$backend" in
+            redis) redis_reap ;;
+            file)  file_init_dirs && file_reap ;;
+        esac
+        return $?
+    fi
+
     if [ "$ONESHOT" = "1" ]; then
         log "mode=oneshot backend=$backend (serverless: process one item then exit)"
         consume_one "$backend"

package/autonomy/run.sh

@@ -24889,7 +24889,17 @@ check_human_intervention() {
     # Security: Check it's a regular file (not symlink) to prevent symlink attacks
     if [ -f "$loki_dir/HUMAN_INPUT.md" ] && [ ! -L "$loki_dir/HUMAN_INPUT.md" ]; then
         # Security: Prompt injection disabled by default for enterprise security
-        if [ "${LOKI_PROMPT_INJECTION:-false}" != "true" ]; then
+        # Accepts "1" AND "true". It used to accept only "true", while
+        # `loki steer` prints "Enable it: export LOKI_PROMPT_INJECTION=1" and
+        # then "The next iteration will read and apply it." A user who followed
+        # that instruction exactly had their steering note moved to
+        # logs/human-input-REJECTED-*.md and never read -- the CLI reported
+        # success, the runner silently discarded it, and the only warning went
+        # to the runner log rather than to the person who typed the command.
+        #
+        # Both forms is the convention here (LOKI_GATE_SEMANTIC_TESTS_BLOCK and
+        # LOKI_DURABLE_STATE each test for both); this flag was the outlier.
+        if [ "${LOKI_PROMPT_INJECTION:-false}" != "true" ] && [ "${LOKI_PROMPT_INJECTION:-false}" != "1" ]; then
             log_warn "HUMAN_INPUT.md detected but prompt injection is DISABLED"
             log_warn "To enable, set LOKI_PROMPT_INJECTION=true (only in trusted environments)"
             # Move to rejected instead of processed

package/completions/_loki

@@ -120,6 +120,7 @@ function _loki {
 function _loki_commands {
     local -a commands
     commands=(
+        'gates:What blocks here vs only advises, and the promotion knob'
         'start:Start Loki Mode'
         'quick:Quick single-task mode'
         'quickstart:Guided first build from your idea'