loki-mode 9.18.4 → 9.20.0

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: Autonomous spec-driven build system with a built-in trust layer. It does not call work done until it is verified (RARV-C closure loop, 8 quality gates, completion council, verified-completion evidence gate). Triggers on "Loki Mode". Takes a spec (PRD, GitHub issue, OpenAPI doc, etc.) to deployed product with minimal human intervention. Provider-agnostic. Requires --dangerously-skip-permissions flag.
 ---
 
-# Loki Mode v9.18.4
+# Loki Mode v9.20.0
 
 **You are an autonomous agent. You make decisions. You do not ask questions. You do not stop.**
 
@@ -470,4 +470,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v9.18.4 | [Autonomi](https://www.autonomi.dev/) flagship product | ~410 lines core**
+**v9.20.0 | [Autonomi](https://www.autonomi.dev/) flagship product | ~410 lines core**

package/VERSION

@@ -1 +1 @@
-9.18.4
+9.20.0

package/autonomy/lib/deadline.py

@@ -281,7 +281,16 @@ def _process_has_lineage_token(pid: int, token: str) -> bool:
     if sys.platform.startswith("linux"):
         try:
             with open(f"/proc/{pid}/environ", "rb") as handle:
-                return needle in handle.read().split(b"\0")
+                payload = handle.read()
+            if not payload:
+                # A zero-length read raises NOTHING. The kernel empties
+                # /proc/<pid>/environ as the process is reaped, so a fast
+                # runner yields b"" -- which splits to [b""], does not contain
+                # the needle, and returns "no marker" for a process that
+                # carried one. Indistinguishable from the FileNotFoundError
+                # case below and must be answered the same way.
+                raise _LineageUnknown(pid)
+            return needle in payload.split(b"\0")
         except FileNotFoundError:
             # The process is already gone. /proc/<pid>/environ disappears the
             # moment a child is reaped, so a short-lived runner that exits
@@ -295,7 +304,18 @@ def _process_has_lineage_token(pid: int, token: str) -> bool:
             # macOS never hit this: it has the pipe-handle fallback, so the
             # bug was Linux-only and invisible on a developer Mac.
             raise _LineageUnknown(pid) from None
+        except ProcessLookupError:
+            # ESRCH: the pid was reaped between opening and reading. Same fact
+            # as ENOENT above -- the process is gone, so its marker is UNKNOWN,
+            # not absent. Listed BEFORE the OSError clause because it is a
+            # subclass and would otherwise be swallowed into "no marker",
+            # which fails the lineage guard and reports 127 for a process that
+            # launched and completed.
+            raise _LineageUnknown(pid) from None
         except OSError:
+            # Anything else (EACCES on a hardened /proc, EIO) is a genuine
+            # read failure rather than evidence of a completed child, so it
+            # stays fail-closed: no marker.
             return False
     return False
 

package/autonomy/lib/outcome_contract.py

@@ -0,0 +1,128 @@
+"""Pure-stdlib validation and deterministic identity for Outcome Contract v0.1."""
+
+import hashlib
+import json
+
+SCHEMA = "autonomi-outcome-contract/v0.1"
+KINDS = {"human", "agent", "service", "organization"}
+TOP_KEYS = {"schema", "id", "intent", "acceptance", "executor", "verifier",
+            "constraints", "evidence", "risk", "budget", "deployment",
+            "rollback", "dispute"}
+
+
+class ContractValidationError(ValueError):
+    def __init__(self, path, message):
+        self.path = path
+        self.message = message
+        super().__init__("%s: %s" % (path, message))
+
+
+def _fail(path, message):
+    raise ContractValidationError(path, message)
+
+
+def _text(value, path):
+    if not isinstance(value, str) or not value.strip():
+        _fail(path, "must be a non-empty string")
+
+
+def _identity(value, path):
+    if not isinstance(value, dict):
+        _fail(path, "must be an object")
+    extra = sorted(set(value) - {"id", "kind"})
+    if extra:
+        _fail(path + "." + extra[0], "unknown property")
+    for key in ("id", "kind"):
+        if key not in value:
+            _fail(path + "." + key, "is required")
+    _text(value["id"], path + ".id")
+    if value["kind"] not in KINDS:
+        _fail(path + ".kind", "must be one of: %s" % ", ".join(sorted(KINDS)))
+
+
+def _object(value, path, required, allowed):
+    if not isinstance(value, dict):
+        _fail(path, "must be an object")
+    extra = sorted(set(value) - set(allowed))
+    if extra:
+        _fail(path + "." + extra[0], "unknown property")
+    for key in required:
+        if key not in value:
+            _fail(path + "." + key, "is required")
+
+
+def validate(contract):
+    if not isinstance(contract, dict):
+        _fail("$", "must be an object")
+    extra = sorted(set(contract) - TOP_KEYS)
+    if extra:
+        _fail("$." + extra[0], "unknown property")
+    for key in ("schema", "id", "intent", "acceptance", "executor", "verifier"):
+        if key not in contract:
+            _fail("$." + key, "is required")
+    if contract["schema"] != SCHEMA:
+        _fail("$.schema", "must equal %s" % SCHEMA)
+    _text(contract["id"], "$.id")
+    _text(contract["intent"], "$.intent")
+    acceptance = contract["acceptance"]
+    if not isinstance(acceptance, list) or not acceptance:
+        _fail("$.acceptance", "must be a non-empty array")
+    for index, item in enumerate(acceptance):
+        _text(item, "$.acceptance[%d]" % index)
+    _identity(contract["executor"], "$.executor")
+    _identity(contract["verifier"], "$.verifier")
+    if contract["executor"]["id"] == contract["verifier"]["id"]:
+        _fail("$.verifier.id", "must differ from executor.id")
+    if "constraints" in contract and not isinstance(contract["constraints"], dict):
+        _fail("$.constraints", "must be an object")
+    if "risk" in contract:
+        value = contract["risk"]
+        _object(value, "$.risk", ("level",), ("level", "notes"))
+        if value["level"] not in {"low", "medium", "high", "critical"}:
+            _fail("$.risk.level", "must be one of: low, medium, high, critical")
+        if "notes" in value:
+            _text(value["notes"], "$.risk.notes")
+    if "budget" in contract:
+        value = contract["budget"]
+        _object(value, "$.budget", ("max_amount", "currency"),
+                ("max_amount", "currency"))
+        if isinstance(value["max_amount"], bool) or not isinstance(
+                value["max_amount"], (int, float)) or value["max_amount"] < 0:
+            _fail("$.budget.max_amount", "must be a non-negative number")
+        _text(value["currency"], "$.budget.currency")
+    if "deployment" in contract:
+        value = contract["deployment"]
+        _object(value, "$.deployment", ("environment", "approval_required"),
+                ("environment", "approval_required"))
+        _text(value["environment"], "$.deployment.environment")
+        if not isinstance(value["approval_required"], bool):
+            _fail("$.deployment.approval_required", "must be a boolean")
+    if "rollback" in contract:
+        value = contract["rollback"]
+        _object(value, "$.rollback", ("required", "strategy"),
+                ("required", "strategy"))
+        if not isinstance(value["required"], bool):
+            _fail("$.rollback.required", "must be a boolean")
+        _text(value["strategy"], "$.rollback.strategy")
+    if "dispute" in contract:
+        value = contract["dispute"]
+        _object(value, "$.dispute", ("process",), ("process", "arbiter"))
+        _text(value["process"], "$.dispute.process")
+        if "arbiter" in value:
+            _identity(value["arbiter"], "$.dispute.arbiter")
+    if "evidence" in contract:
+        if not isinstance(contract["evidence"], list):
+            _fail("$.evidence", "must be an array")
+        for index, item in enumerate(contract["evidence"]):
+            _text(item, "$.evidence[%d]" % index)
+    return contract
+
+
+def canonicalize(contract):
+    validate(contract)
+    return json.dumps(contract, sort_keys=True, separators=(",", ":"),
+                      ensure_ascii=False)
+
+
+def digest(contract):
+    return hashlib.sha256(canonicalize(contract).encode("utf-8")).hexdigest()

package/autonomy/lib/proof-generator.py

@@ -1867,6 +1867,51 @@ def generate(args):
         if sig:
             verification["gpg_signature"] = sig
 
+    # Optional Ed25519 attestation over the SAME digest, for the case gpg
+    # cannot serve: a receipt checked by someone who does not hold the signing
+    # key. gpg proves provenance only to a verifier who already imported the
+    # public key, which a customer, auditor or CI system handed a proof.json
+    # generally has not. An attestation is checkable against a published JWKS
+    # (or a jwks.json file, offline) with no key exchange at all.
+    #
+    # Binds the DIGEST, not the body, so it attests to exactly the bytes a
+    # verifier independently recomputes. Written INSIDE `verification`, which
+    # the hash excludes -- anywhere else would change the hashed bytes and make
+    # every honest receipt read as tampered the moment it was signed.
+    #
+    # Same default-OFF discipline as gpg above: absent the key, no field, and
+    # the bytes stay identical to an unattested proof. Best-effort for the same
+    # reason -- a signing failure must not cost the user their receipt.
+    # This env check is an EARLY EXIT, not the control that enforces default-off.
+    # Mutation testing showed that removing it changes nothing observable:
+    # load_signing_key() returns (None, "") when neither variable is set, so the
+    # block below cannot attest anyway. It is kept because it skips an import
+    # and a try/except on the overwhelmingly common unconfigured path -- stated
+    # here rather than left to imply a guarantee it does not provide.
+    att_key = (os.environ.get("LOKI_RECEIPT_SIGNING_KEY_FILE", "").strip()
+               or os.environ.get("LOKI_RECEIPT_SIGNING_KEY", "").strip())
+    if att_key:
+        try:
+            sys.path.insert(0, os.path.dirname(os.path.dirname(
+                os.path.abspath(__file__))))
+            from receipt_jwt import load_signing_key, sign_attestation
+            _priv, _kid = load_signing_key()
+            if _priv is not None:
+                _tok = sign_attestation(
+                    _priv, _kid,
+                    job_id=str(redacted.get("run_id") or ""),
+                    run_id=str(redacted.get("run_id") or ""),
+                    receipt_hash=digest,
+                )
+                if _tok:
+                    verification["attestation"] = _tok
+                    verification["attestation_kid"] = _kid
+        except Exception:
+            # Swallowed deliberately, matching the gpg path: an unattested
+            # receipt is a valid state with an existing verdict. Losing the
+            # receipt entirely because signing failed would be strictly worse.
+            pass
+
     redacted["verification"] = verification
 
     # Determine output dir.

package/autonomy/lib/proof-verify.py

@@ -76,6 +76,46 @@ if _HERE not in sys.path:
 from tree_digest import compute_tree_digest
 from workspace_diff import collect_workspace_diff
 
+# Receipt schema major this verifier understands. proof-generator.py writes
+# schema_version ("1.1" today) and NOTHING read it -- a version stamped on
+# every receipt and enforced nowhere, so a future incompatible receipt would
+# have been verified against rules written for a different shape and reported
+# as a clean pass.
+#
+# FAIL CLOSED on absent or unknown: a receipt we cannot place is not a receipt
+# we can verify, and "cannot tell" must never render as "verified".
+#
+# ACCEPT EVERY MINOR of the supported major -- that is the legacy compatibility
+# guarantee, and it is what keeps this from being a breaking change. Minor bumps
+# are additive by convention, so 1.0 and today's 1.1 both verify; only a MAJOR
+# bump (2.x) means the shape changed enough that these rules no longer apply.
+SUPPORTED_SCHEMA_MAJOR = 1
+
+
+def check_schema_version(proof):
+    """Return None when the receipt's schema is supported, else a reason string.
+
+    Returns a reason rather than raising so the caller folds it into the normal
+    reason/reasons/ok contract, which every consumer (loki proof verify, the
+    remote receipt path, the dashboard) already handles.
+    """
+    raw = proof.get("schema_version")
+    if raw is None:
+        return ("receipt has no schema_version, so the rules to verify it "
+                "cannot be established (expected major %d)" % SUPPORTED_SCHEMA_MAJOR)
+    text = str(raw).strip()
+    major_text = text.split(".", 1)[0]
+    try:
+        major = int(major_text)
+    except (TypeError, ValueError):
+        return ("receipt schema_version %r is not a parseable version, so the "
+                "rules to verify it cannot be established" % raw)
+    if major != SUPPORTED_SCHEMA_MAJOR:
+        return ("receipt schema_version %s is major %d; this verifier "
+                "understands major %d only, so its checks may not apply"
+                % (text, major, SUPPORTED_SCHEMA_MAJOR))
+    return None
+
 
 # ---------------------------------------------------------------------------
 # canonicalization (MUST match proof-generator._canonical exactly)
@@ -863,11 +903,24 @@ def verify(proof_path, repo_dir="."):
                     "working tree changed after the receipt was generated" % (
                         recorded_tree, current_tree))
 
+    # ----- schema version --------------------------------------------------
+    # Folded into the verdict rather than raised, so every existing caller
+    # inherits it through reason/reasons/ok with no signature change. ANDed in
+    # below: an unsupported schema cannot be rescued by a passing hash, because
+    # the hash only proves the bytes are unedited -- not that these rules are
+    # the right ones to judge them by.
+    schema_reason = check_schema_version(proof)
+    result["schema_version"] = proof.get("schema_version")
+    result["schema_supported"] = schema_reason is None
+    if schema_reason:
+        result["reasons"].append(schema_reason)
+
     # ----- overall verdict -------------------------------------------------
     result["ok"] = bool(
         integrity["ok"]
         and result["diff_drift"] is False
         and (not recorded_tree or result["tree_drift"] is False)
+        and schema_reason is None
     )
     if result["ok"]:
         result["reason"] = ""