loki-mode 9.17.0 → 9.17.2

package/mcp/__init__.py

@@ -75,4 +75,4 @@ try:
 except ImportError:
     __all__ = ['mcp']
 
-__version__ = '9.17.0'
+__version__ = '9.17.2'

package/mcp/_sdk_loader.py

@@ -147,31 +147,6 @@ def _load_real_fastmcp():
         for _k in ("mcp", "mcp.server"):
             if _k in _saved_local:
                 sys.modules[_k] = _saved_local[_k]
-            elif _k in sys.modules:
-                # The SDK claimed a name the local package had NOT yet loaded,
-                # so there is no local module to re-pin and the old code left
-                # the SDK's module cached under it PERMANENTLY, process-wide.
-                #
-                # Measured (issue #190, python3.12 + SDK, from the repo root):
-                # any caller that reaches the loader before our own
-                # mcp/server.py is imported -- mcp/lsp_proxy.py, or a test that
-                # imports mcp._sdk_loader directly -- leaves the SDK's
-                # site-packages/mcp/server/__init__.py under "mcp.server". Every
-                # later `from mcp import server` in that process then silently
-                # gets the SDK instead of ours. That is how
-                # tests/test_mcp_agent_metrics_honesty.py skipped for its full
-                # life: it passed 7/7 alone but hit its capability guard in a
-                # full run, because tests/mcp/* ran first and poisoned the name.
-                #
-                # Deleting is correct where re-pinning is impossible: it leaves
-                # the name UNCLAIMED, so the next `import mcp.server` resolves
-                # through the local package exactly as it would have. Verified
-                # this does not disturb the SDK's own runtime subtree --
-                # mcp.types, mcp.server.lowlevel and mcp.server.fastmcp.* stay
-                # cached and FastMCP still instantiates, because FastMCP holds
-                # direct references to its dependencies rather than re-resolving
-                # "mcp.server" by name.
-                del sys.modules[_k]
         for _k, _v in _saved_local.items():
             # Restore any other purely-local submodules that the SDK import did
             # not legitimately replace (e.g. mcp.magic_tools, mcp.tools).

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "loki-mode",
   "mcpName": "io.github.asklokesh/loki-mode",
-  "version": "9.17.0",
+  "version": "9.17.2",
   "description": "Loki Mode by Autonomi. Autonomous spec-to-product system: takes a PRD, GitHub issue, OpenAPI/JSON/YAML, or one-line brief to a deployed app via the RARV-C closure loop with 8 quality gates. Provider-agnostic (Claude Code, OpenAI Codex, Cline, Aider).",
   "keywords": [
     "agent",

package/plugins/loki-mode/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "loki-mode",
   "displayName": "Loki Mode",
-  "version": "9.17.0",
+  "version": "9.17.2",
   "description": "Autonomous spec-to-product build system with a built-in trust layer (RARV-C closure loop, 8 quality gates, completion council). Ships Loki's spec-hardening, drift-detection, and deterministic PR verification commands plus the Loki MCP server.",
   "author": {
     "name": "Autonomi",

package/autonomy/lib/gate_policy.py

@@ -1,166 +0,0 @@
-#!/usr/bin/env python3
-"""Which gates block, which only advise, and what promoting one would have cost.
-
-Ona's Veto Exec ships an audit-first ladder: "Start with audit rules, review
-matches, then promote confirmed rules to block." The load-bearing part is the
-MIDDLE step. A policy you cannot safely turn on is a policy nobody turns on, so
-before flipping a gate to blocking you get to see what it WOULD have blocked.
-
-We already had both ends and nothing in between: gates are advisory or blocking,
-three promotion knobs exist (LOKI_GATE_MAGIC_DEBATE_BLOCKING, LOKI_COV_ENFORCE,
-LOKI_POLICY_APPROVAL_ENFORCE), and .loki/quality/gate-failure-count.json has
-counted per-gate failures the whole time. Nothing joined them, so an operator
-deciding whether to promote a gate had to guess.
-
-DETERMINISTIC. Reads two files and the environment. No model, no network, no
-spend -- same repo state, same answer, and every number is a count a reader can
-recompute by opening the same file.
-
-NEVER PROMOTES ANYTHING. This reports; it does not change policy. Turning a gate
-blocking stays an explicit operator act via the named environment variable,
-because a tool that silently starts blocking is the thing operators most
-reasonably fear.
-
-Shape (assess() and --json, schema_version 1). This is the contract the
-dashboard endpoint GET /api/gate-policy and tests/test_gate_policy_endpoint.py
-both read against, so field names here are load-bearing:
-
-  schema_version int    1
-  status         str    "measured"
-  ledger         str    "present" | "absent" -- whether the per-gate failure
-                        ledger .loki/quality/gate-failure-count.json was read
-  gates          list   one record per known gate, blocking gates first, each
-                        group sorted by name:
-    gate         str    gate name (e.g. "code_review")
-    mode         str    "blocking" | "advisory" -- for a promotable gate this
-                        depends on the ENVIRONMENT at call time
-    promotable   bool   True when a real promotion knob exists in run.sh
-    audit_hits   int|null  failures counted for this gate. null means
-                        UNMEASURED -- no ledger, or no entry for this gate.
-                        NEVER 0 for an unmeasured gate: 0 is the positive claim
-                        that the gate ran and never fired, which is the false
-                        green an absent measurement always produces.
-    why          str    one-line description of what the gate checks
-    promote_with str|null  "VAR=value" to make an advisory gate blocking; null
-                        when the gate already blocks
-"""
-
-import json
-import os
-import sys
-
-SCHEMA_VERSION = 1
-
-# Gates that can be promoted from advisory to blocking, and the knob that does
-# it. Only gates with a REAL knob in run.sh appear here -- listing an aspiration
-# would tell an operator to set a variable nothing reads.
-PROMOTABLE = {
-    "magic_debate": ("LOKI_GATE_MAGIC_DEBATE_BLOCKING", "true",
-                     "spec-vs-implementation debate on generated modules"),
-    "test_coverage": ("LOKI_COV_ENFORCE", "1",
-                      "project test runner pass/fail"),
-    "policy_approval": ("LOKI_POLICY_APPROVAL_ENFORCE", "1",
-                        "staged-autonomy approval policy"),
-}
-
-# Gates that block unconditionally. Listed so the report is a complete picture
-# rather than only the promotable subset -- an operator asking "what blocks here"
-# should not have to read run.sh to find out.
-ALWAYS_BLOCKING = {
-    "static_analysis": "CodeQL, ESLint/Pylint, type-checker findings on the diff",
-    "code_review": "3-reviewer blind review; Critical/High = BLOCK",
-    "mock_integrity": "tautological-assertion and mock-ratio detection",
-    "mutation_integrity": "assertion-churn (test-fitting) detection",
-}
-
-
-def _counts(loki_dir):
-    """Per-gate failure counts, or {} when the ledger has not been written."""
-    path = os.path.join(loki_dir, "quality", "gate-failure-count.json")
-    try:
-        with open(path) as fh:
-            data = json.load(fh)
-        return data if isinstance(data, dict) else {}
-    except (OSError, ValueError):
-        return {}
-
-
-def assess(loki_dir=".loki", env=None):
-    env = os.environ if env is None else env
-    counts = _counts(loki_dir)
-    have_ledger = bool(counts)
-
-    gates = []
-    for name, why in sorted(ALWAYS_BLOCKING.items()):
-        gates.append({
-            "gate": name, "mode": "blocking", "promotable": False,
-            "audit_hits": counts.get(name) if have_ledger else None,
-            "why": why, "promote_with": None,
-        })
-    for name, (var, val, why) in sorted(PROMOTABLE.items()):
-        on = str(env.get(var, "")).lower() in ("1", "true", "yes")
-        gates.append({
-            "gate": name,
-            "mode": "blocking" if on else "advisory",
-            "promotable": True,
-            # None, not 0: an absent ledger means UNMEASURED, and reporting 0
-            # would read as "this gate never fired" -- the same false green a
-            # missing measurement always produces.
-            "audit_hits": counts.get(name) if have_ledger else None,
-            "why": why,
-            "promote_with": None if on else f"{var}={val}",
-        })
-
-    return {
-        "schema_version": SCHEMA_VERSION,
-        "status": "measured",
-        "ledger": "present" if have_ledger else "absent",
-        "gates": gates,
-    }
-
-
-def render_text(res):
-    out = ["Gate policy -- what blocks here, and what only advises", ""]
-    for g in res["gates"]:
-        hits = g["audit_hits"]
-        if hits is None:
-            hit_s = "not measured"
-        elif hits == 0:
-            hit_s = "0 hits"
-        else:
-            hit_s = f"{hits} hit{'s' if hits != 1 else ''}"
-        mode = g["mode"].upper()
-        out.append(f"  {mode:9} {g['gate']:20} {hit_s}")
-        out.append(f"            {g['why']}")
-        if g["promote_with"]:
-            verb = "would have blocked" if (hits or 0) > 0 else "has not fired"
-            out.append(f"            advisory: {verb} -- promote with {g['promote_with']}")
-        out.append("")
-
-    if res["ledger"] == "absent":
-        out.append("  No gate ledger yet (.loki/quality/gate-failure-count.json).")
-        out.append("  Counts read 'not measured' rather than 0: an absent")
-        out.append("  measurement is not evidence a gate never fired.")
-    else:
-        out.append("  Hits come from .loki/quality/gate-failure-count.json.")
-        out.append("  Open it and count the same numbers yourself.")
-    out.append("")
-    out.append("  This command never promotes a gate. Promotion is an explicit")
-    out.append("  operator act via the variable named above.")
-    return "\n".join(out)
-
-
-def main(argv):
-    as_json = "--json" in argv
-    loki_dir = ".loki"
-    for a in argv:
-        if not a.startswith("-"):
-            loki_dir = a
-            break
-    res = assess(loki_dir)
-    print(json.dumps(res, indent=2) if as_json else render_text(res))
-    return 0
-
-
-if __name__ == "__main__":
-    sys.exit(main(sys.argv[1:]))

package/docs/QUEUE-OPERATIONS.md

@@ -1,107 +0,0 @@
-# Queue operations: what happens when a worker dies
-
-Written for the person on call when builds stop coming out.
-
-## The short version
-
-A build that vanished is recoverable. Run:
-
-```bash
-bash autonomy/queue-consumer.sh --reap
-```
-
-It requeues in-flight items whose worker died. It never touches a build that is
-still running, and it never deletes anything.
-
-## What the queue guarantees, and what it does not
-
-| | redis backend | file backend |
-|---|---|---|
-| Delivery | at-least-once (default) | at-least-once |
-| Crash leaves the item | in `<key>:processing` | in `processing/` |
-| Automatic recovery | `--reap` | see below |
-| Claim time recorded | `<key>:claims` hash | file mtime |
-
-**A crashed worker does not lose the build.** It used to: the redis backend was
-at-most-once (`LPOP`-then-run), so a worker killed between the pop and the
-finish took the item with it and nothing anywhere recorded that it existed.
-Proven against a real redis 8.6.3, then fixed with `LMOVE`, which pops and
-records in-flight in one atomic step.
-
-`LOKI_QUEUE_ACK=0` restores the old lossy behaviour if you are running a broker
-that already guarantees delivery and do not want a second in-flight record.
-
-## Recovering a stalled fleet
-
-Symptom: items are queued, workers are up, and nothing completes.
-
-```bash
-# 1. What is stuck?
-redis-cli -u "$LOKI_QUEUE_URL" LLEN loki-builds             # waiting
-redis-cli -u "$LOKI_QUEUE_URL" LLEN loki-builds:processing  # claimed, in flight
-
-# 2. Requeue anything whose worker is gone.
-bash autonomy/queue-consumer.sh --reap
-# -> reap: requeued 2, left 1 in flight (timeout 7200s)
-```
-
-The reaper reports what it did. "left 1 in flight" means one item's claim is
-still inside the visibility timeout, so it is treated as a running build and not
-touched.
-
-### The timeout is the safety knob
-
-`LOKI_QUEUE_VISIBILITY_SEC` (default 7200) is how long an item may be in flight
-before the reaper assumes its worker died.
-
-**It must exceed your longest legitimate build.** Set it too low and the reaper
-requeues work that is still running, and the user gets the same build twice.
-That is the only way this tool can hurt you, so it errs long by default.
-
-### An item with no claim is reaped immediately
-
-If a worker dies between claiming the item and stamping the claim time, the
-item sits in `processing` with no entry in `<key>:claims`. The reaper treats
-that as infinitely old, not infinitely young -- it is exactly the case that must
-be recoverable, and erring the other way would strand the items this exists to
-rescue.
-
-## Running the reaper unattended
-
-A CronJob is the intended shape. It is a separate mode rather than part of the
-consume loop on purpose: a consumer that reaped on every poll would race its own
-peers on a busy queue.
-
-```yaml
-schedule: "*/15 * * * *"
-command: ["bash", "autonomy/queue-consumer.sh", "--reap"]
-```
-
-## What is NOT claimed
-
-- **The file backend has no automatic reaper.** `--reap` is redis-only today; a
-  crashed worker on the file backend leaves its item in `processing/` for a
-  human to move back to `pending/`. The item is not lost, but nothing recovers
-  it on its own.
-- **No dead-letter queue.** An item that fails repeatedly is requeued
-  repeatedly. There is no automatic give-up-and-park.
-- **`LREM` clears every equal copy.** Two identical specs queued twice both
-  clear on the first ack. Accepted deliberately: the alternative needs a
-  per-item token from the producer, and the failure mode here is one duplicate
-  re-drive rather than a lost build.
-- **Only redis and file ship.** SQS, Pub/Sub, RabbitMQ and Kafka are
-  bring-your-own: override `queue.command` with your own consumer.
-
-## Check any of this yourself
-
-```bash
-bash tests/test-queue-at-least-once.sh    # 16 assertions; live half needs a broker
-redis-server --port 6399 --save '' --appendonly no &
-LOKI_TEST_REDIS_PORT=6399 bash tests/test-queue-at-least-once.sh
-```
-
-The live checks SKIP with a named reason when no broker is present rather than
-passing on a mock. Both bugs found building this were invisible to a fake:
-`redis-cli --no-raw` escapes the inner quotes of a JSON payload, which mangled
-the item and made the ack a silent no-op. A green mock would have certified both
-as working.