loki-mode 9.30.1 → 9.32.0

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: Autonomous spec-driven build system with a built-in trust layer. It does not call work done until it is verified (RARV-C closure loop, 8 quality gates, completion council, verified-completion evidence gate). Triggers on "Loki Mode". Takes a spec (PRD, GitHub issue, OpenAPI doc, etc.) to deployed product with minimal human intervention. Provider-agnostic. Requires --dangerously-skip-permissions flag.
 ---
 
-# Loki Mode v9.30.1
+# Loki Mode v9.32.0
 
 **You are an autonomous agent. You make decisions. You do not ask questions. You do not stop.**
 
@@ -470,4 +470,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v9.30.1 | [Autonomi](https://www.autonomi.dev/) flagship product | ~410 lines core**
+**v9.32.0 | [Autonomi](https://www.autonomi.dev/) flagship product | ~410 lines core**

package/VERSION

@@ -1 +1 @@
-9.30.1
+9.32.0

package/autonomy/run.sh

@@ -2812,14 +2812,43 @@ check_policy() {
     local context_json="${2:-}"
     [ -z "$context_json" ] && context_json='{}'
 
-    # Only check if policy files exist
-    if [ ! -f ".loki/policies.json" ] && [ ! -f ".loki/policies.yaml" ]; then
+    # Only check if a policy file exists. This gate MUST agree with what
+    # src/policies/engine.js:_init actually loads, or the two disagree silently:
+    # engine.js falls back to the global ~/.loki policy (which is the only place
+    # the dashboard writes, api_v2.py:75,105), and a project-local-only test
+    # here would short-circuit before that fallback was ever consulted.
+    local _pol_global_dir="${LOKI_DATA_DIR:-$HOME/.loki}"
+    if [ ! -f ".loki/policies.json" ] && [ ! -f ".loki/policies.yaml" ] \
+       && [ ! -f "$_pol_global_dir/policies.json" ] \
+       && [ ! -f "$_pol_global_dir/policies.yaml" ]; then
         return 0
     fi
 
-    # Requires Node.js
+    # Requires Node.js. Reaching here means a policy file EXISTS, so the
+    # operator has expressed intent to enforce. Returning 0 for a missing
+    # runtime silently disables that enforcement and reports nothing: the run
+    # proceeds exactly as if every action were permitted. That is the worst
+    # shape a security control can take, because the operator believes it is on.
+    #
+    # Fail CLOSED instead, matching what check.js already does for a corrupt
+    # policy file (tests/test-policy-failclosed.sh). LOKI_POLICY_REQUIRE_NODE=0
+    # restores the old fail-open for a host that genuinely cannot install node
+    # and accepts running unenforced.
     if ! command -v node >/dev/null 2>&1; then
-        return 0
+        if [ "${LOKI_POLICY_REQUIRE_NODE:-1}" = "0" ]; then
+            log_warn "Policy file present but node is unavailable; enforcement SKIPPED (LOKI_POLICY_REQUIRE_NODE=0)"
+            return 0
+        fi
+        log_error "Policy file present but node is unavailable: cannot evaluate policy, refusing the action (fail-closed). Set LOKI_POLICY_REQUIRE_NODE=0 to run unenforced."
+        # Recorded like any other block. A refusal that leaves no trace is
+        # indistinguishable from a run that was never gated, and the receipt
+        # must be able to say WHY the action did not happen. The reason is
+        # distinct from a DENY: the policy was never evaluated.
+        audit_agent_action "policy_unevaluable" "Policy present but node unavailable" "enforcement=$enforcement_point"
+        emit_event_json "policy_unevaluable" \
+            "enforcement=$enforcement_point" \
+            "reason=node_unavailable"
+        return 1
     fi
 
     local result

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "9.30.1"
+__version__ = "9.32.0"
 
 # Expose the control app for easy import
 try:

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 The flagship product of [Autonomi](https://www.autonomi.dev/). Loki Mode is a spec-driven autonomous builder with a built-in trust layer that takes any spec to a deployed product and verifies completion with evidence (quality gates plus a completion council), not just a "done" claim. Complete installation instructions for all platforms and use cases.
 
-**Version:** v9.30.1
+**Version:** v9.32.0
 
 ---
 

package/loki-ts/dist/loki.js

@@ -1,5 +1,5 @@
 // @bun
-var St=Object.create;var{getPrototypeOf:yt,defineProperty:jG,getOwnPropertyNames:bt}=Object;var ft=Object.prototype.hasOwnProperty;function _t($){return this[$]}var vt,ht,gt=($,X,Q)=>{var z=$!=null&&typeof $==="object";if(z){var Z=X?vt??=new WeakMap:ht??=new WeakMap,K=Z.get($);if(K)return K}Q=$!=null?St(yt($)):{};let J=X||!$||!$.__esModule?jG(Q,"default",{value:$,enumerable:!0}):Q;for(let q of bt($))if(!ft.call(J,q))jG(J,q,{get:_t.bind($,q),enumerable:!0});if(z)Z.set($,J);return J};var zq=($,X)=>()=>(X||$((X={exports:{}}).exports,X),X.exports);var mt=($)=>$;function ut($,X){this[$]=mt.bind(null,X)}var B1=($,X)=>{for(var Q in X)jG($,Q,{get:X[Q],enumerable:!0,configurable:!0,set:ut.bind(X,Q)})};var s=($,X)=>()=>($&&(X=$($=0)),X);var w5=import.meta.require;var YR={};B1(YR,{lokiDir:()=>h0,homeLokiDir:()=>HQ,findRepoRootForVersion:()=>AG,REPO_ROOT:()=>L1});import{resolve as h2,dirname as LG}from"path";import{fileURLToPath as dt}from"url";import{existsSync as Zq}from"fs";import{homedir as pt}from"os";function ct(){let $=VR;for(let X=0;X<6;X++){if(Zq(h2($,"VERSION"))&&Zq(h2($,"autonomy/run.sh")))return $;let Q=LG($);if(Q===$)break;$=Q}return h2(VR,"..","..","..")}function AG($){let X=$;for(let Q=0;Q<6;Q++){if(Zq(h2(X,"VERSION"))&&Zq(h2(X,"autonomy/run.sh")))return X;let z=LG(X);if(z===X)break;X=z}return h2($,"..","..","..")}function h0(){return process.env.LOKI_DIR??h2(process.cwd(),".loki")}function HQ(){return h2(pt(),".loki")}var VR,L1;var k1=s(()=>{VR=LG(dt(import.meta.url));L1=ct()});import{readFileSync as lt}from"fs";import{resolve as it,dirname as at}from"path";import{fileURLToPath as ot}from"url";function j9(){if(n3!==null)return n3;let $="9.30.1";if(typeof $==="string"&&$.length>0)return n3=$,n3;try{let X=at(ot(import.meta.url)),Q=AG(X);n3=lt(it(Q,"VERSION"),"utf-8").trim()}catch{n3="unknown"}return n3}var n3=null;var Kq=s(()=>{k1()});var GR={};B1(GR,{runOrThrow:()=>Ue,run:()=>$1,readStreamCapped:()=>Jq,commandVersion:()=>We,commandExists:()=>g5,ShellError:()=>CG,MAX_STDOUT_BYTES:()=>WR});async function Jq($,X=WR){let Q=$.getReader(),z=new TextDecoder,Z="",K=0;try{while(K<X){let{done:J,value:q}=await Q.read();if(J)break;if(!q)continue;if(K+=q.byteLength,K>X){let V=q.byteLength-(K-X);Z+=z.decode(q.subarray(0,V),{stream:!0});break}Z+=z.decode(q,{stream:!0})}Z+=z.decode()}finally{try{await Q.cancel()}catch{}Q.releaseLock()}return Z}async function $1($,X={}){let Q=Bun.spawn({cmd:[...$],stdout:"pipe",stderr:"pipe",env:X.env?{...process.env,...X.env}:process.env,cwd:X.cwd}),z,Z;if(X.timeoutMs&&X.timeoutMs>0)z=setTimeout(()=>{try{Q.kill("SIGTERM")}catch{}Z=setTimeout(()=>{try{Q.kill("SIGKILL")}catch{}},2000)},X.timeoutMs);try{let[K,J,q]=await Promise.all([Jq(Q.stdout),new Response(Q.stderr).text(),Q.exited]);return{stdout:K,stderr:J,exitCode:q}}finally{if(z)clearTimeout(z);if(Z)clearTimeout(Z)}}async function Ue($,X={}){let Q=await $1($,X);if(Q.exitCode!==0)throw new CG(`command failed (${Q.exitCode}): ${$.join(" ")}`,Q.exitCode,Q.stdout,Q.stderr);return Q}async function g5($){let X=He($),Q=await $1(["sh","-c",`command -v ${X}`],{timeoutMs:5000});if(Q.exitCode===0)return Q.stdout.trim()||null;return null}function He($){if(!/^[A-Za-z0-9._/-]+$/.test($))throw Error(`refused to shell-escape suspect token: ${$}`);return $}async function We($,X="--version"){if(!await g5($))return null;let z=await $1([$,X],{timeoutMs:5000});if(z.exitCode!==0)return null;return((z.stdout||z.stderr).split(/\r?\n/)[0]?.trim()??"")||null}var WR=16777216,CG;var y8=s(()=>{CG=class CG extends Error{message;exitCode;stdout;stderr;constructor($,X,Q,z){super($);this.message=$;this.exitCode=X;this.stdout=Q;this.stderr=z;this.name="ShellError"}}});function g2($){return Ge?"":$}var Ge,p0,$5,q1,L61,A1,f1,m5,r;var t7=s(()=>{Ge=(process.env.NO_COLOR??"").length>0;p0=g2("\x1B[0;31m"),$5=g2("\x1B[0;32m"),q1=g2("\x1B[1;33m"),L61=g2("\x1B[0;34m"),A1=g2("\x1B[0;36m"),f1=g2("\x1B[1m"),m5=g2("\x1B[2m"),r=g2("\x1B[0m")});import{existsSync as De}from"fs";async function Z2(){if(GQ!==void 0)return GQ;let $="/opt/homebrew/bin/python3.12";if(De($))return GQ=$,$;let X=await g5("python3.12");if(X)return GQ=X,X;let Q=await g5("python3");return GQ=Q,Q}async function I4($,X={}){let Q=await Z2();if(!Q)return{stdout:"",stderr:"python3 not found",exitCode:127};return $1([Q,"-c",$],X)}var GQ;var m2=s(()=>{y8()});var yR={};B1(yR,{runStatus:()=>oe});import{existsSync as u5,readFileSync as A9,readdirSync as RR,statSync as IR}from"fs";import{resolve as A5,basename as ge}from"path";import{homedir as me}from"os";function wR($){let X=Math.trunc($);if(X>=1e6)return`${(Math.trunc(X/1e6*10)/10).toFixed(1)}M`;if(X>=1000)return`${(Math.trunc(X/1000*10)/10).toFixed(1)}K`;return String(X)}function PR($,X,Q){if(X===0)return null;let z=Math.trunc($*100/X),Z=Math.trunc($*Vq/X);if(Z>Vq)Z=Vq;let K=Vq-Z,J=$5;if(z>=80)J=p0;else if(z>=50)J=q1;let q="=".repeat(Math.max(0,Z))+" ".repeat(Math.max(0,K)),V=wR($),Y=wR(X);return`  ${f1}${Q}${r} ${J}[${q}]${r} ${z}% (${V} / ${Y})`}async function de(){if(await g5("jq"))return!0;return process.stdout.write(`${p0}Error: jq is required but not installed.${r}
+var St=Object.create;var{getPrototypeOf:yt,defineProperty:jG,getOwnPropertyNames:bt}=Object;var ft=Object.prototype.hasOwnProperty;function _t($){return this[$]}var vt,ht,gt=($,X,Q)=>{var z=$!=null&&typeof $==="object";if(z){var Z=X?vt??=new WeakMap:ht??=new WeakMap,K=Z.get($);if(K)return K}Q=$!=null?St(yt($)):{};let J=X||!$||!$.__esModule?jG(Q,"default",{value:$,enumerable:!0}):Q;for(let q of bt($))if(!ft.call(J,q))jG(J,q,{get:_t.bind($,q),enumerable:!0});if(z)Z.set($,J);return J};var zq=($,X)=>()=>(X||$((X={exports:{}}).exports,X),X.exports);var mt=($)=>$;function ut($,X){this[$]=mt.bind(null,X)}var B1=($,X)=>{for(var Q in X)jG($,Q,{get:X[Q],enumerable:!0,configurable:!0,set:ut.bind(X,Q)})};var s=($,X)=>()=>($&&(X=$($=0)),X);var w5=import.meta.require;var YR={};B1(YR,{lokiDir:()=>h0,homeLokiDir:()=>HQ,findRepoRootForVersion:()=>AG,REPO_ROOT:()=>L1});import{resolve as h2,dirname as LG}from"path";import{fileURLToPath as dt}from"url";import{existsSync as Zq}from"fs";import{homedir as pt}from"os";function ct(){let $=VR;for(let X=0;X<6;X++){if(Zq(h2($,"VERSION"))&&Zq(h2($,"autonomy/run.sh")))return $;let Q=LG($);if(Q===$)break;$=Q}return h2(VR,"..","..","..")}function AG($){let X=$;for(let Q=0;Q<6;Q++){if(Zq(h2(X,"VERSION"))&&Zq(h2(X,"autonomy/run.sh")))return X;let z=LG(X);if(z===X)break;X=z}return h2($,"..","..","..")}function h0(){return process.env.LOKI_DIR??h2(process.cwd(),".loki")}function HQ(){return h2(pt(),".loki")}var VR,L1;var k1=s(()=>{VR=LG(dt(import.meta.url));L1=ct()});import{readFileSync as lt}from"fs";import{resolve as it,dirname as at}from"path";import{fileURLToPath as ot}from"url";function j9(){if(n3!==null)return n3;let $="9.32.0";if(typeof $==="string"&&$.length>0)return n3=$,n3;try{let X=at(ot(import.meta.url)),Q=AG(X);n3=lt(it(Q,"VERSION"),"utf-8").trim()}catch{n3="unknown"}return n3}var n3=null;var Kq=s(()=>{k1()});var GR={};B1(GR,{runOrThrow:()=>Ue,run:()=>$1,readStreamCapped:()=>Jq,commandVersion:()=>We,commandExists:()=>g5,ShellError:()=>CG,MAX_STDOUT_BYTES:()=>WR});async function Jq($,X=WR){let Q=$.getReader(),z=new TextDecoder,Z="",K=0;try{while(K<X){let{done:J,value:q}=await Q.read();if(J)break;if(!q)continue;if(K+=q.byteLength,K>X){let V=q.byteLength-(K-X);Z+=z.decode(q.subarray(0,V),{stream:!0});break}Z+=z.decode(q,{stream:!0})}Z+=z.decode()}finally{try{await Q.cancel()}catch{}Q.releaseLock()}return Z}async function $1($,X={}){let Q=Bun.spawn({cmd:[...$],stdout:"pipe",stderr:"pipe",env:X.env?{...process.env,...X.env}:process.env,cwd:X.cwd}),z,Z;if(X.timeoutMs&&X.timeoutMs>0)z=setTimeout(()=>{try{Q.kill("SIGTERM")}catch{}Z=setTimeout(()=>{try{Q.kill("SIGKILL")}catch{}},2000)},X.timeoutMs);try{let[K,J,q]=await Promise.all([Jq(Q.stdout),new Response(Q.stderr).text(),Q.exited]);return{stdout:K,stderr:J,exitCode:q}}finally{if(z)clearTimeout(z);if(Z)clearTimeout(Z)}}async function Ue($,X={}){let Q=await $1($,X);if(Q.exitCode!==0)throw new CG(`command failed (${Q.exitCode}): ${$.join(" ")}`,Q.exitCode,Q.stdout,Q.stderr);return Q}async function g5($){let X=He($),Q=await $1(["sh","-c",`command -v ${X}`],{timeoutMs:5000});if(Q.exitCode===0)return Q.stdout.trim()||null;return null}function He($){if(!/^[A-Za-z0-9._/-]+$/.test($))throw Error(`refused to shell-escape suspect token: ${$}`);return $}async function We($,X="--version"){if(!await g5($))return null;let z=await $1([$,X],{timeoutMs:5000});if(z.exitCode!==0)return null;return((z.stdout||z.stderr).split(/\r?\n/)[0]?.trim()??"")||null}var WR=16777216,CG;var y8=s(()=>{CG=class CG extends Error{message;exitCode;stdout;stderr;constructor($,X,Q,z){super($);this.message=$;this.exitCode=X;this.stdout=Q;this.stderr=z;this.name="ShellError"}}});function g2($){return Ge?"":$}var Ge,p0,$5,q1,L61,A1,f1,m5,r;var t7=s(()=>{Ge=(process.env.NO_COLOR??"").length>0;p0=g2("\x1B[0;31m"),$5=g2("\x1B[0;32m"),q1=g2("\x1B[1;33m"),L61=g2("\x1B[0;34m"),A1=g2("\x1B[0;36m"),f1=g2("\x1B[1m"),m5=g2("\x1B[2m"),r=g2("\x1B[0m")});import{existsSync as De}from"fs";async function Z2(){if(GQ!==void 0)return GQ;let $="/opt/homebrew/bin/python3.12";if(De($))return GQ=$,$;let X=await g5("python3.12");if(X)return GQ=X,X;let Q=await g5("python3");return GQ=Q,Q}async function I4($,X={}){let Q=await Z2();if(!Q)return{stdout:"",stderr:"python3 not found",exitCode:127};return $1([Q,"-c",$],X)}var GQ;var m2=s(()=>{y8()});var yR={};B1(yR,{runStatus:()=>oe});import{existsSync as u5,readFileSync as A9,readdirSync as RR,statSync as IR}from"fs";import{resolve as A5,basename as ge}from"path";import{homedir as me}from"os";function wR($){let X=Math.trunc($);if(X>=1e6)return`${(Math.trunc(X/1e6*10)/10).toFixed(1)}M`;if(X>=1000)return`${(Math.trunc(X/1000*10)/10).toFixed(1)}K`;return String(X)}function PR($,X,Q){if(X===0)return null;let z=Math.trunc($*100/X),Z=Math.trunc($*Vq/X);if(Z>Vq)Z=Vq;let K=Vq-Z,J=$5;if(z>=80)J=p0;else if(z>=50)J=q1;let q="=".repeat(Math.max(0,Z))+" ".repeat(Math.max(0,K)),V=wR($),Y=wR(X);return`  ${f1}${Q}${r} ${J}[${q}]${r} ${z}% (${V} / ${Y})`}async function de(){if(await g5("jq"))return!0;return process.stdout.write(`${p0}Error: jq is required but not installed.${r}
 `),process.stdout.write(`Install with:
 `),process.stdout.write(`  brew install jq    (macOS)
 `),process.stdout.write(`  apt install jq     (Debian/Ubuntu)
@@ -1334,4 +1334,4 @@ Set LOKI_LEGACY_BASH=1 to force the bash CLI for every command.
 `),2}case"start":{let{runStart:z}=await Promise.resolve().then(() => (Et(),Pt));return z(Q)}default:return process.stderr.write(`Unknown command: ${X}
 `),process.stderr.write(xt),2}}DR();process.on("SIGINT",()=>process.exit(130));process.on("SIGTERM",()=>process.exit(143));var X61=await $61(Bun.argv.slice(2));process.exit(X61);
 
-//# debugId=1EB5CB676655413C8A4F19102A2C918F
+//# debugId=191E4536498A68A53512020705523C23

package/mcp/__init__.py

@@ -75,4 +75,4 @@ try:
 except ImportError:
     __all__ = ['mcp']
 
-__version__ = '9.30.1'
+__version__ = '9.32.0'

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "loki-mode",
   "mcpName": "io.github.asklokesh/loki-mode",
-  "version": "9.30.1",
+  "version": "9.32.0",
   "description": "Loki Mode by Autonomi. Autonomous spec-to-product system: takes a PRD, GitHub issue, OpenAPI/JSON/YAML, or one-line brief to a deployed app via the RARV-C closure loop with 8 quality gates. Provider-agnostic (Claude Code, OpenAI Codex, Cline, Aider, opencode).",
   "keywords": [
     "agent",

package/plugins/loki-mode/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "loki-mode",
   "displayName": "Loki Mode",
-  "version": "9.30.1",
+  "version": "9.32.0",
   "description": "Autonomous spec-to-product build system with a built-in trust layer (RARV-C closure loop, 8 quality gates, completion council). Ships Loki's spec-hardening, drift-detection, and deterministic PR verification commands plus the Loki MCP server.",
   "author": {
     "name": "Autonomi",

package/src/audit/subscriber.js

@@ -20,6 +20,11 @@ var EVENT_TO_AUDIT = {
     'session_end': { what: 'session_end', why: 'Loki session terminated' },
     'phase_change': { what: 'phase_change', why: 'RARV phase transition' },
     'policy_denied': { what: 'policy_violation', why: 'Policy engine blocked action' },
+    // Distinct from policy_denied: the policy was never EVALUATED. A policy
+    // file was present (so enforcement was intended) but node was unavailable,
+    // so run.sh refused fail-closed rather than proceeding unenforced. The
+    // receipt must be able to tell "denied by a rule" from "could not check".
+    'policy_unevaluable': { what: 'policy_unevaluable', why: 'Policy present but could not be evaluated; action refused fail-closed' },
     'policy_approval_required': { what: 'policy_approval', why: 'Policy requires approval' },
     'otel_span_start': null, // Skip OTEL internal events
     'otel_span_end': null,   // Skip OTEL internal events

package/src/policies/engine.js

@@ -18,6 +18,7 @@
 
 const fs = require('fs');
 const path = require('path');
+const os = require('os');
 const { Decision, evaluateRule, scanContent, validatePreExecution,
   validatePreDeployment, validateResource, validateData,
   validateApprovalGate, RULE_EVALUATORS } = require('./types');
@@ -250,11 +251,29 @@ class PolicyEngine {
     const jsonPath = path.join(lokiDir, 'policies.json');
     const yamlPath = path.join(lokiDir, 'policies.yaml');
 
-    // Try JSON first, then YAML
+    // The dashboard writes policies to ~/.loki/policies.json
+    // (dashboard/api_v2.py:75,105 via LOKI_DATA_DIR, default ~/.loki) while this
+    // reader only ever looked project-local. The ONE existing writer therefore
+    // fed a file this reader never opened, and an operator who created a policy
+    // through the UI got no enforcement at all and no error saying why.
+    //
+    // Project-local still WINS: a repo that ships its own policy must not be
+    // silently overridden by a machine-global one. The global file is a
+    // fallback, consulted only when the project defines nothing.
+    const globalDir = path.join(
+      process.env.LOKI_DATA_DIR || path.join(os.homedir(), '.loki'));
+    const globalJson = path.join(globalDir, 'policies.json');
+    const globalYaml = path.join(globalDir, 'policies.yaml');
+
+    // Try JSON first, then YAML, project-local before global.
     if (fs.existsSync(jsonPath)) {
       this._policyPath = jsonPath;
     } else if (fs.existsSync(yamlPath)) {
       this._policyPath = yamlPath;
+    } else if (fs.existsSync(globalJson)) {
+      this._policyPath = globalJson;
+    } else if (fs.existsSync(globalYaml)) {
+      this._policyPath = globalYaml;
     } else {
       // No policy file -- zero overhead mode
       this._policies = null;

package/web-app/server.py

@@ -7776,15 +7776,74 @@ class CreateTeamRequest(BaseModel):
 
 class AddMemberRequest(BaseModel):
     email: str
+    # NOT AN AUTHORIZATION CONTROL. This value is stored on the member record
+    # and echoed back; nothing in this server reads it to permit or deny
+    # anything (measured: the only other `role` occurrences in this file are
+    # chat-message roles around line 4166). /api/teams, /api/teams/{id}/members
+    # and /api/audit-log carry no auth dependency at all, and web-app/auth.py:1-4
+    # states that without DATABASE_URL authentication is completely disabled and
+    # every endpoint is open.
+    #
+    # It is kept because the UI displays it and removing it would break that
+    # surface, but a field that LOOKS like a permission and enforces nothing is
+    # worse than no field: a buyer may rely on it. Wiring real enforcement means
+    # adding an auth dependency to these routes first; until then this label is
+    # descriptive only.
     role: str = "viewer"
 
 
-def _audit(action: str, user: str = "system", target: str = "", details: str = ""):
-    """Record an audit log entry."""
+def _audit_actor(request=None) -> tuple:
+    """Resolve WHO performed an action, honestly.
+
+    Returns (actor, actor_state). actor_state is one of:
+      "identified"     - an authenticated principal; actor is their id
+      "unauthenticated"- auth is not configured, so the actor is genuinely
+                         unknowable. web-app/auth.py:1-4 states that with no
+                         DATABASE_URL, authentication is completely disabled and
+                         all endpoints are open. That is the DEFAULT.
+      "unreadable"     - an actor should have been resolvable but the lookup
+                         failed; recorded so it is never mistaken for the above
+
+    Why this exists: _audit() previously hardcoded user="system" for every
+    entry. An audit trail that cannot say who did something is not an audit
+    trail, and "system" is worse than blank because it asserts an actor that was
+    never established. Never invent an actor; say which of the three states
+    applies and let the reader judge.
+    """
+    if request is None:
+        return ("unknown", "unauthenticated")
+    try:
+        principal = getattr(request.state, "user", None)
+        if isinstance(principal, dict):
+            ident = principal.get("sub") or principal.get("email") or principal.get("id")
+            if ident:
+                return (str(ident), "identified")
+        elif principal:
+            return (str(principal), "identified")
+        return ("unknown", "unauthenticated")
+    except Exception:  # noqa: BLE001 - never let attribution break the action
+        return ("unknown", "unreadable")
+
+
+def _audit(action: str, user: str = "", target: str = "", details: str = "",
+           request=None):
+    """Record an audit log entry.
+
+    NOTE ON WHAT THIS LOG IS: _append_audit_log rewrites a 500-entry JSON array
+    in place on every call. It is a recent-activity view, NOT tamper-evident and
+    NOT append-only, and it is a different thing from the hash-chained log in
+    dashboard/audit.py. Do not cite it as audit evidence. See
+    docs/AUDIT-CHAIN-THREAT-MODEL.md.
+    """
+    if user:
+        actor, actor_state = (user, "identified")
+    else:
+        actor, actor_state = _audit_actor(request)
     entry = {
         "id": str(uuid.uuid4()),
         "action": action,
-        "user": user,
+        "user": actor,
+        "actor_state": actor_state,
         "target": target,
         "timestamp": datetime.now().isoformat(),
         "details": details,
@@ -7800,7 +7859,7 @@ async def list_teams() -> JSONResponse:
 
 
 @app.post("/api/teams")
-async def create_team(req: CreateTeamRequest) -> JSONResponse:
+async def create_team(req: CreateTeamRequest, request: Request = None) -> JSONResponse:
     """Create a new team."""
     team_id = f"team-{uuid.uuid4().hex[:8]}"
     team = {
@@ -7812,7 +7871,7 @@ async def create_team(req: CreateTeamRequest) -> JSONResponse:
     store = _load_teams()
     store[team_id] = team
     _save_teams(store)
-    _audit("team.created", target=req.name)
+    _audit("team.created", target=req.name, request=request)
     return JSONResponse(content={"id": team_id, "name": req.name, "created": True})
 
 
@@ -7827,7 +7886,7 @@ async def list_team_members(team_id: str) -> JSONResponse:
 
 
 @app.post("/api/teams/{team_id}/members")
-async def add_team_member(team_id: str, req: AddMemberRequest) -> JSONResponse:
+async def add_team_member(team_id: str, req: AddMemberRequest, request: Request = None) -> JSONResponse:
     """Add a member to a team."""
     store = _load_teams()
     team = store.get(team_id)
@@ -7843,7 +7902,7 @@ async def add_team_member(team_id: str, req: AddMemberRequest) -> JSONResponse:
     }
     team.setdefault("members", []).append(member)
     _save_teams(store)
-    _audit("member.added", target=req.email, details=f"Role: {req.role}")
+    _audit("member.added", target=req.email, details=f"Role: {req.role}", request=request)
     return JSONResponse(content={"added": True, "member_id": member_id})