loki-mode 9.50.4 → 9.52.0

package/README.md

@@ -282,7 +282,8 @@ loki proof show <id>       # the facts, the assessments, and the headline
 loki proof verify <id>     # re-hash the receipt and re-derive the diff
 ```
 
-`loki proof verify` exits 0 clean, 1 on tamper or drift. Receipts are attached
+`loki proof verify` exits 0 clean, 1 on tamper or drift, 2 when it could not check
+(full table: [docs/exit-codes.md](docs/exit-codes.md)). Receipts are attached
 to pull requests automatically (`LOKI_PROVEN_PR=0` to opt out), so a reviewer
 sees the evidence next to the code.
 
@@ -368,7 +369,7 @@ Receipts are written to `.loki/proofs/<run_id>/` automatically at run completion
 ```bash
 loki proof list              # every receipt: run id, time, council verdict, cost, files
 loki proof show <id>         # the full proof.json (facts, assessments, honesty)
-loki proof verify <id>       # re-check the receipt against the repo (exit 0 clean, 1 tamper/drift)
+loki proof verify <id>       # re-check the receipt against the repo (exit 0 clean, 1 tamper/drift, 2 could not check)
 ```
 
 `loki proof verify` does two independent checks and prints the result as JSON:

package/SKILL.md

@@ -3,13 +3,13 @@ name: loki-mode
 description: Autonomous spec-driven build system with a built-in trust layer. It does not call work done until it is verified (RARV-C closure loop, 8 quality gates, completion council, verified-completion evidence gate). Triggers on "Loki Mode". Takes a spec (PRD, GitHub issue, OpenAPI doc, etc.) to deployed product with minimal human intervention. Provider-agnostic. Requires --dangerously-skip-permissions flag.
 ---
 
-# Loki Mode v9.50.4
+# Loki Mode v9.52.0
 
 **You are an autonomous agent. You make decisions. You do not ask questions. You do not stop.**
 
 **Spec in, verified product out.** Spec-driven: a "spec" is whatever describes the work -- a Markdown PRD, a GitHub issue, an OpenAPI doc, a Jira ticket (a PRD is one form of spec). The differentiator is the trust layer: Loki does not call work done until it is verified. The RARV-C closure loop, 8 quality gates, the completion council, and the verified-completion evidence gate must all clear before completion is accepted. The evidence gate blocks on empty-diff, red tests, an unhealthy serveable app (runtime-boot axis, `LOKI_EVIDENCE_BOOT_GATE=0` to opt out), and a leaked credential in the changed files (secret-leak axis, `LOKI_EVIDENCE_SECRET_GATE=0` to opt out) -- v8.0.0.
 
-**Evidence Receipt (verify it yourself).** Every run writes a receipt to `.loki/proofs/<run_id>/` (opt out with `LOKI_PROOF=0`) that separates deterministic FACTS (git diff with base/head SHAs and a `diff_sha256`, the test command + exit code, the build command + exit code, each gate verdict) from AI ASSESSMENTS (the council verdict, labeled judgment not proof). The headline is computed only from the facts: VERIFIED (tests ran a real command and exited 0, diff non-empty, nothing skipped), VERIFIED WITH GAPS (each gap listed by name), or NOT VERIFIED (a check ran and failed). Inspect and re-check with `loki proof list|show <id>|verify <id>` (aliased `loki receipt`); `loki proof verify` re-hashes the receipt (tamper) and re-derives the diff from the recorded base SHA against the live repo (drift), exiting 0 clean / 1 tamper-or-drift. This is honesty-of-done, not a claim that the code is bug-free.
+**Evidence Receipt (verify it yourself).** Every run writes a receipt to `.loki/proofs/<run_id>/` (opt out with `LOKI_PROOF=0`) that separates deterministic FACTS (git diff with base/head SHAs and a `diff_sha256`, the test command + exit code, the build command + exit code, each gate verdict) from AI ASSESSMENTS (the council verdict, labeled judgment not proof). The headline is computed only from the facts: VERIFIED (tests ran a real command and exited 0, diff non-empty, nothing skipped), VERIFIED WITH GAPS (each gap listed by name), or NOT VERIFIED (a check ran and failed). Inspect and re-check with `loki proof list|show <id>|verify <id>` (aliased `loki receipt`); `loki proof verify` re-hashes the receipt (tamper) and re-derives the diff from the recorded base SHA against the live repo (drift), exiting 0 clean / 1 tamper-or-drift / 2 could not check (64 usage, 66 unknown id; see `docs/exit-codes.md`). This is honesty-of-done, not a claim that the code is bug-free.
 
 **Provider-agnostic (stable since v5.0.0):** runs on Claude/Codex/Cline/Aider with abstract model tiers and degraded mode for non-Claude providers; no vendor lock-in. Gemini deprecated v7.5.18. See `skills/providers.md`. **Current track (v8.0.0):** the Anthropic Agent SDK route (see below), spec-mode expansion for OpenAPI/GraphQL/Postman contracts, the runtime-boot and secret-leak evidence axes, and `loki steer` / `loki why` for mid-run control. Earlier tracks: LSP grounding as a first-class agent tool (v7.7.x) and Phase 1 RARV-C closure (real provider judges, gate-failure flock, synthetic PRD e2e, status `--json`).
 
@@ -470,4 +470,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v9.50.4 | [Autonomi](https://www.autonomi.dev/) flagship product | ~410 lines core**
+**v9.52.0 | [Autonomi](https://www.autonomi.dev/) flagship product | ~410 lines core**

package/VERSION

@@ -1 +1 @@
-9.50.4
+9.52.0

package/autonomy/completion-council.sh

@@ -1937,7 +1937,9 @@ except (json.JSONDecodeError, IOError, KeyError, ValueError):
     print('INCONCLUSIVE:none:true')
     sys.exit(0)
 runner = d.get('runner', 'none')
-passed = d.get('pass', True)
+# No default of True: a results file with no "pass" key recorded no outcome, and
+# an unrecorded outcome is not a pass. None falls to INCONCLUSIVE below.
+passed = d.get('pass')
 status = d.get('status', '')
 #82 (zero-test-file hardening): a runner that ran but executed ZERO real tests
 # (node --test on a *.test.js with no test() calls; jest --passWithNoTests with
@@ -3558,9 +3560,11 @@ council_evaluate_member() {
     # the member stays CONTINUE.
     #
     # Parse verdict mirrors council_evidence_gate: runner=="none" => PASS,
-    # pass is False => FAIL, else PASS. Unparseable/missing => not present.
+    # pass is False => FAIL, only a boolean True (and not status no_tests_run)
+    # => PASS; a missing, null or non-boolean pass key recorded no outcome =>
+    # INCONCLUSIVE (not red, not positive). Unparseable/missing file => absent.
     local tr_file="$loki_dir/quality/test-results.json"
-    local test_evidence="absent"   # absent | pass | fail
+    local test_evidence="absent"   # absent | pass | fail | inconclusive
     local test_runner_seen="none"
     if [ -f "$tr_file" ]; then
         local _tr_status
@@ -3573,11 +3577,13 @@ except (json.JSONDecodeError, IOError, KeyError, ValueError):
     print('absent:none')
     sys.exit(0)
 runner = d.get('runner', 'none')
-passed = d.get('pass', True)
+passed = d.get('pass')
 if runner == 'none':
     print('pass:none')
 elif passed is False:
     print('fail:%s' % runner)
+elif passed is not True or d.get('status') == 'no_tests_run':
+    print('inconclusive:%s' % runner)
 else:
     print('pass:%s' % runner)
 " 2>/dev/null || echo "absent:none")
@@ -3595,19 +3601,42 @@ else:
     local positive="false"
     case "$role" in
         requirements_verifier)
-            # Positive: tests not red AND no pending tasks. A present queue file
-            # with pending>0 is a hard "not done"; an ABSENT queue file is not
-            # itself disqualifying (a legit run need not have one), it just means
-            # this member relies on the base test evidence.
-            local pending=0
-            if [ -f "$loki_dir/queue/pending.json" ]; then
-                pending=$(_QUEUE_FILE="$loki_dir/queue/pending.json" python3 -c "import json, os; print(len(json.load(open(os.environ['_QUEUE_FILE']))))" 2>/dev/null || echo "0")
-                if [ "$pending" -gt 0 ]; then
+            # Positive: tests not red AND no UNFINISHED work in any queue.
+            #
+            # UNFINISHED WORK SPANS EVERY QUEUE THAT HOLDS IT, not just pending.
+            #
+            # This counted ONLY pending.json, which was safe purely by accident:
+            # nothing in the runtime ever promoted a task out of pending, so the
+            # count never dropped and this member stayed negative. The moment a
+            # selector claims an item (pending -> in-progress), pending hits 0
+            # and this member would vote COMPLETE with the work still running --
+            # a gate weakened as a SIDE EFFECT of a throughput change, which is
+            # the one thing the trust core must never do.
+            #
+            # in-progress: claimed and running. blocked: parked awaiting a fact.
+            # Both are unfinished. An ABSENT queue file is still not
+            # disqualifying (a legit run need not have one); only a present file
+            # with a non-zero count blocks.
+            #
+            # Pinned by tests/test-completion-council-affirmative-evidence.sh
+            # Cases 6 and 7, with Case 8 as the positive control proving this
+            # can still reach COMPLETE when every queue really is empty.
+            local unfinished=0
+            local _q _qcount
+            for _q in pending in-progress blocked; do
+                [ -f "$loki_dir/queue/${_q}.json" ] || continue
+                _qcount=$(_QUEUE_FILE="$loki_dir/queue/${_q}.json" python3 -c "import json, os
+d = json.load(open(os.environ['_QUEUE_FILE']))
+print(len(d.get('tasks', d) if isinstance(d, dict) else d))" 2>/dev/null || echo "0")
+                # Guard against a non-numeric read (malformed file, python absent).
+                case "$_qcount" in ''|*[!0-9]*) _qcount=0 ;; esac
+                if [ "$_qcount" -gt 0 ]; then
+                    unfinished=$((unfinished + _qcount))
                     blocked="true"
-                    reasons="${reasons}$pending tasks still pending; "
+                    reasons="${reasons}$_qcount tasks still ${_q}; "
                 fi
-            fi
-            if [ "$test_evidence" = "pass" ] && [ "$pending" -eq 0 ]; then
+            done
+            if [ "$test_evidence" = "pass" ] && [ "$unfinished" -eq 0 ]; then
                 positive="true"
             fi
             ;;
@@ -3619,6 +3648,8 @@ else:
             # a no-tests / greenfield project leaves test_auditor at CONTINUE.
             if [ "$test_evidence" = "absent" ]; then
                 reasons="${reasons}no structured test results found; "
+            elif [ "$test_evidence" = "inconclusive" ]; then
+                reasons="${reasons}structured test results inconclusive (runner '$test_runner_seen' recorded no boolean pass); "
             elif [ "$test_runner_seen" = "none" ]; then
                 reasons="${reasons}no real test suite ran (runner none); "
             elif [ "$test_evidence" = "pass" ]; then
@@ -3823,7 +3854,12 @@ council_devils_advocate_review() {
     # (.loki/quality/test-results.json, written by run.sh:ensure_completion_test
     # _evidence; parsed the same way as council_evaluate_member ~2414-2438 and the
     # evidence gate). Parse verdict: runner=="none" => PASS (no real suite to
-    # contradict completion), pass is False => FAIL, else PASS. The legacy log
+    # contradict completion), pass is False => FAIL, a boolean True => PASS,
+    # anything else (missing/null/non-boolean pass, status no_tests_run) =>
+    # INCONCLUSIVE. Only FAIL is an issue here: inconclusive does not contradict
+    # completion, exactly as council_evidence_gate lets it through, and vetoing
+    # it would stall a zero-test run (#82) that is meant to reach this vote.
+    # The legacy log
     # glob is kept ONLY as an ADDITIONAL red signal -- its absence is NOT an issue
     # (nothing writes .loki/logs/test-*.log, so an empty glob is the normal case
     # and must never veto a unanimous COMPLETE on its own).
@@ -3839,11 +3875,13 @@ except (json.JSONDecodeError, IOError, KeyError, ValueError):
     print('absent')
     sys.exit(0)
 runner = d.get('runner', 'none')
-passed = d.get('pass', True)
+passed = d.get('pass')
 if runner == 'none':
     print('pass')
 elif passed is False:
     print('fail')
+elif passed is not True or d.get('status') == 'no_tests_run':
+    print('inconclusive')
 else:
     print('pass')
 " 2>/dev/null || echo "absent")
@@ -4353,9 +4391,12 @@ try:
 except (json.JSONDecodeError, IOError, KeyError, ValueError):
     print('no'); sys.exit(0)
 runner = d.get('runner', 'none')
-passed = d.get('pass', True)
-# Affirmative green requires a REAL suite (runner != none) that did not fail.
-print('yes' if (runner != 'none' and passed is not False) else 'no')
+passed = d.get('pass')
+# Affirmative green requires a REAL suite (runner != none) that recorded a
+# boolean True pass. A missing/null/non-boolean pass key or a zero-test run
+# (status no_tests_run) is inconclusive, which is not green.
+print('yes' if (runner != 'none' and passed is True
+                and d.get('status') != 'no_tests_run') else 'no')
 " 2>/dev/null || echo "no")
     [ "$tr_state" = "yes" ] || return 1
 

package/autonomy/loki

@@ -786,7 +786,13 @@ loki_remote_gpg_status() {
     local pj="$1"
     local d="${TMPDIR:-/tmp}/loki-sigcheck.$$"
     mkdir -p "$d" || return 0
-    python3 - "$pj" "$d" <<'PY' 2>/dev/null || { rm -rf "$d"; return 0; }
+    python3 -E - "$pj" "$d" <<'PY' 2>/dev/null || { rm -rf "$d"; return 0; }
+# The cwd is the checkout being verified: drop it from sys.path before any
+# other import, or a committed hashlib.py/json.py could print the verdict.
+# The interpreter runs with -E so PYTHONPATH (an empty component would add
+# the cwd as an absolute path) and a committed sitecustomize.py cannot act
+# before this line.
+import sys; sys.path[:] = [p for p in sys.path if p not in ("", ".")]
 import json, sys, os
 proof = json.load(open(sys.argv[1]))
 d = sys.argv[2]
@@ -825,16 +831,22 @@ loki_remote_attestation_status() {
     local tok
     tok="$(jq -r '.verification.attestation // empty' "$pj" 2>/dev/null)"
     [ -n "$tok" ] || { printf ''; return 0; }
-    python3 - "$pj" "$url" "${_LOKI_SCRIPT_DIR}" <<'PY' 2>/dev/null || printf ''
+    python3 -E - "$pj" "$url" "${_LOKI_SCRIPT_DIR}" <<'PY' 2>/dev/null || printf ''
+# The cwd is the checkout being verified: drop it from sys.path before any
+# other import, or a committed hashlib.py/json.py could print the verdict.
+# The interpreter runs with -E so PYTHONPATH (an empty component would add
+# the cwd as an absolute path) and a committed sitecustomize.py cannot act
+# before this line.
+import sys; sys.path[:] = [p for p in sys.path if p not in ("", ".")]
 import json, sys, hashlib, urllib.request
 sys.path.insert(0, sys.argv[3])
 try:
-    from receipt_jwt import verify_attestation
+    from receipt_jwt import verify_attestation, _CRYPTO_AVAILABLE
 except ImportError:
     sys.exit(1)          # -> "" : cannot check, never a verdict
 proof = json.load(open(sys.argv[1]))
-tok = (proof.get("verification") or {}).get("attestation") or ""
-if not tok:
+tok = (proof.get("verification") or {}).get("attestation")
+if tok is None or tok == "":
     sys.exit(1)
 try:
     with urllib.request.urlopen(
@@ -842,7 +854,28 @@ try:
         jwks = json.loads(r.read())
 except Exception:
     sys.exit(1)          # unreachable JWKS is UNCHECKED, not a failure
-ok, claims = verify_attestation(tok, jwks)
+# A key set that is not {"keys": [{...}, ...]} is a key-set problem: UNCHECKED,
+# never an accusation against the receipt. Checked BEFORE anything below can
+# print "bad", so a bad key set can never read as TAMPERED.
+_keys = jwks.get("keys") if isinstance(jwks, dict) else None
+if not isinstance(_keys, list) or not all(isinstance(k, dict) for k in _keys):
+    sys.exit(1)
+# The receipt's builder controls the token. An attestation that is not a JWT
+# string is a malformed receipt: TAMPERED, decided without any crypto.
+if not isinstance(tok, str):
+    print("bad"); sys.exit(0)
+# Without `cryptography`, verify_attestation returns False and this would print
+# "bad" -- a TAMPERED accusation for a check that never ran. A missing verifier
+# dependency is UNCHECKED. Same guard in loki_proof_attestation_check below.
+if not _CRYPTO_AVAILABLE:
+    sys.exit(1)
+# The key set is known-good here, so any crash inside verification comes from
+# the token: refuse it. Letting it propagate read as UNCHECKED, which let a
+# forger turn TAMPERED into "install python3 cryptography".
+try:
+    ok, claims = verify_attestation(tok, jwks)
+except Exception:
+    print("bad"); sys.exit(0)
 if not ok:
     print("bad"); sys.exit(0)
 # The signature verifying is not enough on its own: it must attest to THIS
@@ -880,19 +913,25 @@ loki_proof_attestation_check() {
     local pj="$1" src="$2"
     [ -n "$src" ] || { printf ''; return 0; }
     command -v python3 >/dev/null 2>&1 || { printf ''; return 0; }
-    python3 - "$pj" "$src" "${_LOKI_SCRIPT_DIR}" <<'PY' 2>/dev/null || printf ''
+    python3 -E - "$pj" "$src" "${_LOKI_SCRIPT_DIR}" <<'PY' 2>/dev/null || printf ''
+# The cwd is the checkout being verified: drop it from sys.path before any
+# other import, or a committed hashlib.py/json.py could print the verdict.
+# The interpreter runs with -E so PYTHONPATH (an empty component would add
+# the cwd as an absolute path) and a committed sitecustomize.py cannot act
+# before this line.
+import sys; sys.path[:] = [p for p in sys.path if p not in ("", ".")]
 import json, sys, os, hashlib, urllib.request
 sys.path.insert(0, sys.argv[3])
 try:
-    from receipt_jwt import verify_attestation
+    from receipt_jwt import verify_attestation, _CRYPTO_AVAILABLE
 except ImportError:
     sys.exit(1)                      # "" : cannot check
 try:
     proof = json.load(open(sys.argv[1]))
 except Exception:
     sys.exit(1)
-tok = (proof.get("verification") or {}).get("attestation") or ""
-if not tok:
+tok = (proof.get("verification") or {}).get("attestation")
+if tok is None or tok == "":
     print("none"); sys.exit(0)       # a FACT about the receipt, not an error
 src = sys.argv[2]
 try:
@@ -907,7 +946,30 @@ try:
             jwks = json.loads(r.read())
 except Exception:
     sys.exit(1)                      # "" : unreachable/unreadable, no verdict
-ok, claims = verify_attestation(tok, jwks)
+# A key set that is not {"keys": [{...}, ...]} is a key-set problem: NOT
+# CHECKED, never an accusation. Checked BEFORE anything below can print "bad",
+# so a bad key set can never read as FAILED. Same order in
+# loki_remote_attestation_status above -- change both.
+_keys = jwks.get("keys") if isinstance(jwks, dict) else None
+if not isinstance(_keys, list) or not all(isinstance(k, dict) for k in _keys):
+    sys.exit(1)                      # "" : cannot check
+# The receipt's builder controls the token. An attestation that is not a JWT
+# string is a malformed receipt: FAILED, decided without any crypto.
+if not isinstance(tok, str):
+    print("bad"); sys.exit(0)
+# receipt_jwt imports without `cryptography`, and verify_attestation then
+# returns False, which would print "bad": a FAILED verdict for a check that
+# never ran. A missing verifier dependency is NOT CHECKED. Same guard in
+# loki_remote_attestation_status above -- change both.
+if not _CRYPTO_AVAILABLE:
+    sys.exit(1)                      # "" : cannot check
+# The key set is known-good here, so any crash inside verification comes from
+# the token: refuse it. Letting it propagate read as NOT CHECKED (exit 2), which
+# let a forger turn FAILED into "could not check".
+try:
+    ok, claims = verify_attestation(tok, jwks)
+except Exception:
+    print("bad"); sys.exit(0)
 if not ok:
     print("bad"); sys.exit(0)
 # A verifying signature is not enough: it must attest to THESE bytes. Recompute
@@ -951,7 +1013,7 @@ loki_remote_verify_receipt() {
     # empty for a local receipt, which simply means no attestation is checked.
     local _attest_url="${2:-}" _attest=""
     _attest="$(loki_remote_attestation_status "$pj" "$_attest_url")"
-    out="$(python3 "$verifier" "$pj" "${TARGET_DIR:-.}" 2>/dev/null)"
+    out="$(python3 -E "$verifier" "$pj" "${TARGET_DIR:-.}" 2>/dev/null)"
     hash_ok="$(printf '%s' "$out" | jq -r '.hash_ok // false' 2>/dev/null)"
     gpg_ok="$(printf '%s' "$out" | jq -r '.gpg_ok | tostring' 2>/dev/null)"
 
@@ -1057,6 +1119,18 @@ loki_remote_verify_receipt() {
         return 0
     fi
 
+    # The receipt carries an attestation that could not be checked here (JWKS
+    # unreachable, or python cryptography missing). Calling it UNSIGNED would
+    # mislabel a signed receipt and point at the wrong fix. Same policy as the
+    # gpg-unavailable branch above: NOT CHECKED, return 0, provenance unproven.
+    if [ -z "$_attest" ] && jq -e '.verification.attestation // empty' "$pj" >/dev/null 2>&1; then
+        echo -e "  ${YELLOW}NOT CHECKED${NC}: the receipt carries an attestation, but it could not be checked"
+        echo "    against ${_attest_url:-<no url>} (JWKS unreachable, or python cryptography missing)."
+        echo "    Its integrity hash matches. Provenance is unproven here, not disproven."
+        echo "    Install python3 cryptography, or re-run where the build server is reachable."
+        return 0
+    fi
+
     echo -e "  ${YELLOW}UNSIGNED${NC}: integrity hash matches. This is NOT proof of provenance."
     echo "    Proven: the receipt is internally consistent with its own hash."
     echo "    NOT proven: who produced it. An unsigned receipt is forgeable -- whoever"
@@ -9019,7 +9093,7 @@ _deploy_receipt_verdict() {
     fi
 
     local out hash_ok gpg_ok signed=0
-    out="$(python3 "$verifier" "$pj" "${TARGET_DIR:-.}" 2>/dev/null || true)"
+    out="$(python3 -E "$verifier" "$pj" "${TARGET_DIR:-.}" 2>/dev/null || true)"
 
     # "The verifier did not RUN" and "the verifier says the hash is bad" are
     # different facts and must not collapse. If they do, a broken python3
@@ -13097,12 +13171,25 @@ _loki_airgap_audit() {
             ;;
         opencode|cline|aider)
             model_host="${OPENAI_BASE_URL:-${OPENROUTER_API_KEY:+https://openrouter.ai}}"
-            if [ -z "$model_host" ] || printf '%s' "${LOKI_OPENCODE_MODEL:-}${LOKI_AIDER_MODEL:-}" | grep -qiE 'ollama|localhost|127\.0\.0\.1|lmstudio'; then
+            # Local ONLY on positive evidence: a model id naming a local runtime.
+            # An unset endpoint is not that evidence -- the opencode catalog
+            # default is an openrouter/ model, so inference still leaves the host.
+            # Judge only the ACTIVE provider's model variable (the one
+            # providers/<provider>.sh reads): another provider's local model
+            # says nothing about where this provider sends inference.
+            local model_var model_id
+            case "$provider" in
+                opencode) model_var="LOKI_OPENCODE_MODEL" model_id="${LOKI_OPENCODE_MODEL:-}" ;;
+                cline)    model_var="LOKI_CLINE_MODEL"    model_id="${LOKI_CLINE_MODEL:-}" ;;
+                aider)    model_var="LOKI_AIDER_MODEL"    model_id="${LOKI_AIDER_MODEL:-}" ;;
+            esac
+            if printf '%s' "$model_id" | grep -qiE 'ollama|localhost|127\.0\.0\.1|lmstudio'; then
                 model_host="local weights"
                 model_required="no"
                 model_note="Local model runtime (Ollama / LM Studio / llama.cpp). No inference egress."
             else
-                model_note="Remote model gateway. Use an ollama/ model id for zero-egress inference."
+                [ -n "$model_host" ] || model_host="remote model provider (no local model configured)"
+                model_note="Remote model gateway. Set $model_var to an ollama/ model id for zero-egress inference."
             fi
             ;;
         *)
@@ -36193,8 +36280,11 @@ cmd_proof() {
             echo "  phases [--json]      Measured phase history from real phase_change"
             echo "                       events; unrecorded boundaries read UNKNOWN"
             echo "  show <id>            Pretty-print .loki/proofs/<id>/proof.json"
-            echo "  verify <id>          Re-check a receipt against the repo (tamper + drift);"
-            echo "                       exit 0 clean, 1 tamper/drift. Verify it yourself."
+            echo "  verify <id>          Re-check a receipt against the repo (tamper + drift)."
+            echo "                       Exit 0 clean, 1 tamper/drift, 2 could not check,"
+            echo "                       64 usage (no id, more than one id, unknown option,"
+            echo "                       -h/--help: verify never exits 0 without a verdict),"
+            echo "                       66 unknown id. Verify it yourself."
             echo "  passport <contract> <id|proof.json> <output.json>"
             echo "                       Bind work from any agent to a portable Outcome Contract"
             echo "                       and independently rechecked Evidence Receipt"
@@ -36204,9 +36294,15 @@ cmd_proof() {
             echo "  --jwks <url|file>    Also check the receipt's attestation against a published"
             echo "                       key set. Accepts a server URL or a local jwks.json, so a"
             echo "                       third party can check WHO produced a receipt with no API"
-            echo "                       token, no gpg key import, and no network."
-            echo "  md <id>              Paste-able Markdown for a PR comment or Slack
-  open <id>            Open .loki/proofs/<id>/index.html in a browser"
+            echo "                       token, no gpg key import, and no network. Exit 1 if the"
+            echo "                       token FAILED or the receipt is unsigned (ABSENT); 2 if"
+            echo "                       NOT CHECKED (key set unreadable or verifier dependency"
+            echo "                       missing); 64 if --jwks has no value or an empty one."
+            echo "                       A 1 is never softened to 2."
+            echo ""
+            echo "More subcommands:"
+            echo "  md <id>              Paste-able Markdown for a PR comment or Slack"
+            echo "  open <id>            Open .loki/proofs/<id>/index.html in a browser"
             echo "  share <id>           Publish the proof page as a GitHub Gist (opt-in)"
             echo ""
             echo "Options for 'share':"
@@ -36412,7 +36508,7 @@ PYEOF
                 echo -e "${RED}Proof Passport tool not found: ${passport_tool}${NC}" >&2
                 exit 3
             fi
-            python3 "$passport_tool" "$contract" "$receipt_path" "$output" "$@"
+            python3 -E "$passport_tool" "$contract" "$receipt_path" "$output" "$@"
             exit $?
             ;;
         chain)
@@ -36435,10 +36531,27 @@ PYEOF
                 echo -e "${RED}python3 unavailable: the chain could not be verified (UNAVAILABLE, not a pass)${NC}" >&2
                 exit 2
             fi
+            # A verifier never exits 0 without a verdict: -h/--help (before any
+            # "--") shows usage on stderr and exits 64, where argparse would
+            # exit 0 with nothing checked. The tool itself keeps its exit-0
+            # --help for direct use (tests/test_tool_exit_contract.py).
+            local _ca
+            for _ca in "$@"; do
+                [ "$_ca" = "--" ] && break
+                # argparse also treats --h/--he/--hel and any short-option
+                # cluster containing h (-hq) as help.
+                case "$_ca" in
+                    -h*|--h|--he|--hel|--help|-[!-]*h*)
+                        python3 -E "$chain_tool" --help >&2 || true
+                        echo "Nothing was checked (exit 64). Full help: loki proof help" >&2
+                        exit 64
+                        ;;
+                esac
+            done
             # `set -e` is active (loki:22) and a FAILED verdict is a NORMAL
             # result here, so a bare call would abort before the status is read.
             local _chain_rc=0
-            python3 "$chain_tool" "$@" || _chain_rc=$?
+            python3 -E "$chain_tool" "$@" || _chain_rc=$?
             exit $_chain_rc
             ;;
         md)
@@ -36495,35 +36608,84 @@ PYEOF
             # so an air-gapped reviewer, handed the receipt and the key set on
             # disk, can still verify -- requiring the network would exclude
             # exactly the reviewer who most needs this.
-            local _pv_human=0 _pv_jwks="" _pv_args=()
-            local _pv_a _pv_want_jwks=0
+            # An EMPTY --jwks value ("--jwks ''", "--jwks=") is a usage error,
+            # sticky across every occurrence. It used to skip the attestation
+            # check and exit 0 on an unsigned receipt, and a later empty
+            # --jwks cancelled an earlier real one.
+            # An UNKNOWN option, or a second positional, is a usage error too:
+            # "--jwk keys.json" and "-jwks keys.json" used to be kept as extra
+            # positionals and ignored, so an unsigned receipt exited 0 as if a
+            # signature had been checked.
+            local _pv_human=0 _pv_jwks="" _pv_jwks_empty=0 _pv_args=()
+            local _pv_a _pv_want_jwks=0 _pv_npos=0 _pv_end_opts=0
             for _pv_a in "$@"; do
+                # After "--" everything is a proof id, so a caller can pass an
+                # id that begins with "-" without it being read as an option.
+                if [ "$_pv_end_opts" -eq 1 ]; then
+                    _pv_args+=("$_pv_a"); _pv_npos=$((_pv_npos + 1)); continue
+                fi
                 if [ "$_pv_want_jwks" -eq 1 ]; then
-                    _pv_jwks="$_pv_a"; _pv_want_jwks=0; continue
+                    _pv_jwks="$_pv_a"; _pv_want_jwks=0
+                    [ -n "$_pv_jwks" ] || _pv_jwks_empty=1
+                    continue
                 fi
                 case "$_pv_a" in
                     --human) _pv_human=1 ;;
+                    --) _pv_end_opts=1 ;;
+                    -h|--help)
+                        # verify never exits 0 without a verdict. The documented
+                        # call is "loki proof verify <id>", so an id taken from
+                        # untrusted content could be "-h"; an exit-0 help would
+                        # turn a provenance gate into a pass. Usage goes to
+                        # stderr with 64; full exit-0 help is "loki proof help".
+                        {
+                            echo "Usage: loki proof verify [--human] [--jwks <url|file>] [--] <id>"
+                            echo "  Exit 0 clean, 1 tamper/drift (or --jwks FAILED/ABSENT), 2 could not check,"
+                            echo "  64 usage (no id, more than one id, unknown option, empty --jwks, -h/--help),"
+                            echo "  66 unknown id. '--' ends options, for an id that starts with '-'."
+                            echo "  Nothing was checked. Full help: loki proof help"
+                        } >&2
+                        exit 64  # usage (docs/exit-codes.md)
+                        ;;
                     --jwks) _pv_want_jwks=1 ;;
-                    --jwks=*) _pv_jwks="${_pv_a#--jwks=}" ;;
-                    *) _pv_args+=("$_pv_a") ;;
+                    --jwks=*)
+                        _pv_jwks="${_pv_a#--jwks=}"
+                        [ -n "$_pv_jwks" ] || _pv_jwks_empty=1
+                        ;;
+                    -*)
+                        echo -e "${RED}Unknown option for 'loki proof verify': '${_pv_a}'.${NC}" >&2
+                        echo "  Valid options: --human, --jwks <url|file>. Nothing was checked." >&2
+                        exit 64  # usage (docs/exit-codes.md)
+                        ;;
+                    *) _pv_args+=("$_pv_a"); _pv_npos=$((_pv_npos + 1)) ;;
                 esac
             done
+            if [ "$_pv_npos" -gt 1 ]; then
+                echo -e "${RED}'loki proof verify' takes one proof id; got ${_pv_npos}: ${_pv_args[*]}${NC}" >&2
+                echo "  Nothing was checked." >&2
+                exit 64  # usage (docs/exit-codes.md)
+            fi
             if [ "$_pv_want_jwks" -eq 1 ]; then
                 echo -e "${RED}--jwks needs a URL or file path.${NC}" >&2
-                exit 2
+                exit 64  # usage (docs/exit-codes.md)
+            fi
+            if [ "$_pv_jwks_empty" -eq 1 ]; then
+                echo -e "${RED}--jwks was given an empty value; pass a URL or file path.${NC}" >&2
+                echo "  Nothing was checked: an empty key set must not read as a skipped check." >&2
+                exit 64  # usage (docs/exit-codes.md)
             fi
             set -- "${_pv_args[@]+"${_pv_args[@]}"}"
 
             local id="${1:-}"
             if [ -z "$id" ]; then
                 echo -e "${RED}Missing proof id.${NC} Use 'loki proof list'."
-                exit 2
+                exit 64  # usage (docs/exit-codes.md); 2 means "could not check"
             fi
             local pj="${proofs_dir}/${id}/proof.json"
             if [ ! -f "$pj" ]; then
                 echo -e "${RED}Proof not found: ${id}${NC}"
                 echo "Use 'loki proof list' to see available proofs."
-                exit 1
+                exit 66  # input missing; 1 is reserved for tamper/drift
             fi
             # The verifier ships beside the generator under autonomy/lib/ (same
             # dir resolution run.sh uses for proof-generator.py).
@@ -36537,11 +36699,17 @@ PYEOF
             # its NORMAL result -- aborts the whole command before the exit
             # status can be read. Without the guard the attestation block below
             # is unreachable on exactly the receipts it exists to check.
+            # No python3 means the verifier cannot run: could not check (2),
+            # never a shell's 127 and never a pass.
+            if ! command -v python3 >/dev/null 2>&1; then
+                echo -e "${YELLOW}NOT CHECKED${NC}: python3 is not on PATH, so the verifier could not run (exit 2)." >&2
+                exit 2
+            fi
             local _pv_rc=0
             if [ "$_pv_human" -eq 1 ]; then
-                python3 "$verifier" --human "$pj" "${TARGET_DIR:-.}" || _pv_rc=$?
+                python3 -E "$verifier" --human "$pj" "${TARGET_DIR:-.}" || _pv_rc=$?
             else
-                python3 "$verifier" "$pj" "${TARGET_DIR:-.}" || _pv_rc=$?
+                python3 -E "$verifier" "$pj" "${TARGET_DIR:-.}" || _pv_rc=$?
             fi
 
             # The attestation check runs AFTER, and can only make the verdict
@@ -36565,16 +36733,25 @@ PYEOF
                         _pv_rc=1
                         ;;
                     none)
+                        # Exit 1: the caller supplied a key set and asked who
+                        # signed this receipt; it is unsigned, so it is NOT
+                        # verified. Exiting 0 here let a stripped signature pass
+                        # any CI step that asked for provenance.
                         echo -e "${YELLOW}attestation: ABSENT -- this receipt carries no attestation.${NC}" >&2
                         echo "  Nothing was checked against ${_pv_jwks}. The receipt may still be" >&2
                         echo "  gpg-signed; this says only that it has no JWKS attestation." >&2
+                        echo "  Not verified: a key set was supplied, but the receipt is unsigned (exit 1)." >&2
+                        _pv_rc=1
                         ;;
                     *)
                         # Unreachable key set, unreadable file, missing python
                         # deps. NOT a verdict: an absent measurement must never
-                        # read as either a pass or an accusation.
-                        echo -e "${YELLOW}attestation: NOT CHECKED -- could not read a key set from ${_pv_jwks}.${NC}" >&2
-                        echo "  This is not a failure of the receipt. Nothing was proven either way." >&2
+                        # read as either a pass or an accusation, so it exits 2
+                        # (could not check). A tamper/drift 1 from the base
+                        # verifier is a finding and is never softened to 2.
+                        echo -e "${YELLOW}attestation: NOT CHECKED -- could not check against ${_pv_jwks} (key set unreadable, or verifier dependency missing).${NC}" >&2
+                        echo "  This is not a failure of the receipt. Nothing was proven either way (exit 2)." >&2
+                        if [ "$_pv_rc" -eq 0 ]; then _pv_rc=2; fi
                         ;;
                 esac
             fi

package/autonomy/receipt_jwt.py

@@ -277,6 +277,11 @@ def verify_attestation(token: str, jwks: dict):
     """
     if not _CRYPTO_AVAILABLE:
         return False, "cryptography is not installed"
+    # The token comes from the receipt, which its builder controls. Anything
+    # that is not the expected shape is REFUSED here rather than raising, so a
+    # caller can never mistake a crash for "could not check".
+    if not isinstance(token, str):
+        return False, "token is not a string"
     parts = token.split(".")
     if len(parts) != 3:
         return False, "malformed token"
@@ -286,6 +291,8 @@ def verify_attestation(token: str, jwks: dict):
         sig = _b64url_decode(parts[2])
     except (ValueError, json.JSONDecodeError):
         return False, "malformed token"
+    if not isinstance(header, dict) or not isinstance(payload, dict):
+        return False, "malformed token: header and payload must be JSON objects"
     if header.get("alg") != "EdDSA":
         # Refusing an unexpected alg is what blocks the classic "alg: none" and
         # algorithm-substitution attacks.

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "9.50.4"
+__version__ = "9.52.0"
 
 # Expose the control app for easy import
 try: