loki-mode 9.52.0 → 9.54.0

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: Autonomous spec-driven build system with a built-in trust layer. It does not call work done until it is verified (RARV-C closure loop, 8 quality gates, completion council, verified-completion evidence gate). Triggers on "Loki Mode". Takes a spec (PRD, GitHub issue, OpenAPI doc, etc.) to deployed product with minimal human intervention. Provider-agnostic. Requires --dangerously-skip-permissions flag.
 ---
 
-# Loki Mode v9.52.0
+# Loki Mode v9.54.0
 
 **You are an autonomous agent. You make decisions. You do not ask questions. You do not stop.**
 
@@ -470,4 +470,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v9.52.0 | [Autonomi](https://www.autonomi.dev/) flagship product | ~410 lines core**
+**v9.54.0 | [Autonomi](https://www.autonomi.dev/) flagship product | ~410 lines core**

package/VERSION

@@ -1 +1 @@
-9.52.0
+9.54.0

package/autonomy/completion-council.sh

@@ -19,6 +19,12 @@
 #   - Multi-agent debate: Voting beats unanimous (+13.2%), KS adaptive stopping
 #   - NVIDIA ToolOrchestra: Efficiency metrics for agent tool use
 #
+# Inline Python (D7): the council runs with the cwd inside the agent's repo, so
+# every "python3 -c" / "python3 -" here runs -E (a PYTHONPATH empty component
+# would load a committed sitecustomize.py) and drops '' and '.' from sys.path
+# before any other import (a committed json.py would print the verdict).
+# Pinned by tests/moat/p2-honest-verdict.sh P2.council-readers-not-shadowed.
+#
 # Environment Variables:
 #   LOKI_COUNCIL_ENABLED          - Enable completion council (default: true)
 #   LOKI_COUNCIL_SIZE             - Number of council members (default: 3)
@@ -371,7 +377,7 @@ council_track_iteration() {
     _COUNCIL_ITERATION="${ITERATION_COUNT:-0}" \
     _COUNCIL_FILES_CHANGED="$files_changed" \
     _COUNCIL_DIFF_HASH="$combined_hash" \
-    python3 -c "
+    python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
 import json, os
 state_file = os.environ['_COUNCIL_STATE_FILE']
 try:
@@ -453,7 +459,7 @@ _uncertainty_state_path() {
 # Read uncertainty.json (or emit a default object if missing/corrupt) to stdout.
 _uncertainty_read_state() {
     local file="$1"
-    _UNC_FILE="$file" python3 -c "
+    _UNC_FILE="$file" python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
 import json, os
 f = os.environ['_UNC_FILE']
 default = {
@@ -487,7 +493,7 @@ _uncertainty_write_state() {
     dir="$(dirname "$file")"
     mkdir -p "$dir" 2>/dev/null || true
     tmp="${file}.tmp.$$"
-    if _UNC_PAYLOAD="$payload" _UNC_TMP="$tmp" python3 -c "
+    if _UNC_PAYLOAD="$payload" _UNC_TMP="$tmp" python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
 import json, os
 payload = os.environ['_UNC_PAYLOAD']
 tmp = os.environ['_UNC_TMP']
@@ -539,7 +545,7 @@ uncertainty_should_escalate() {
              _UNC_SPLIT_ROUNDS="$split_rounds" \
              _UNC_NOCHANGE_MIN="$nochange_min" \
              _UNC_RING_SIZE="$ring_size" \
-             python3 -c "
+             python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
 import json, os
 
 prior = json.loads(os.environ['_UNC_PRIOR'])
@@ -826,7 +832,7 @@ council_vote() {
                 local budget_exceeded=false
                 if [ "$total_issue_count" -gt 0 ] && [ "$COUNCIL_ERROR_BUDGET" != "0.0" ] && [ "$COUNCIL_ERROR_BUDGET" != "0" ]; then
                     # Check if non-blocking issue ratio exceeds the error budget
-                    budget_exceeded=$(_NB="$non_blocking_count" _TOTAL="$total_issue_count" _BUDGET="$COUNCIL_ERROR_BUDGET" python3 -c "
+                    budget_exceeded=$(_NB="$non_blocking_count" _TOTAL="$total_issue_count" _BUDGET="$COUNCIL_ERROR_BUDGET" python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
 import os
 nb = int(os.environ['_NB'])
 total = int(os.environ['_TOTAL'])
@@ -918,7 +924,7 @@ print('true' if ratio > budget else 'false')
     _COUNCIL_REJECT="$reject_count" \
     _COUNCIL_ITERATION="${ITERATION_COUNT:-0}" \
     _COUNCIL_THRESHOLD="$effective_threshold" \
-    python3 -c "
+    python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
 import json, os
 from datetime import datetime, timezone
 state_file = os.environ['_COUNCIL_STATE_FILE']
@@ -1036,7 +1042,7 @@ council_write_transcript() {
     _MEMBERS_DIR="$COUNCIL_STATE_DIR/votes/iteration-${iteration}" \
     _THRESHOLD="$effective_threshold" \
     _OUT="$transcript_file" \
-    python3 -c "
+    python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
 import json, os, pathlib, re
 
 iteration_id = os.environ['_IID']
@@ -1214,7 +1220,7 @@ EVIDENCE_SECTION
         local queue_file=".loki/queue/${queue}.json"
         if [ -f "$queue_file" ]; then
             local count
-            count=$(_QUEUE_FILE="$queue_file" python3 -c "import json, os; print(len(json.load(open(os.environ['_QUEUE_FILE']))))" 2>/dev/null || echo "?")
+            count=$(_QUEUE_FILE="$queue_file" python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]; import json, os; print(len(json.load(open(os.environ['_QUEUE_FILE']))))" 2>/dev/null || echo "?")
             echo "- ${queue}: $count tasks" >> "$evidence_file"
         fi
     done
@@ -1287,7 +1293,7 @@ EVIDENCE_SECTION
     elif [ -f ".loki/verification/playwright-results.json" ]; then
         echo "" >> "$evidence_file"
         echo "## Playwright Smoke Test Results" >> "$evidence_file"
-        _PW_RESULTS=".loki/verification/playwright-results.json" python3 -c "
+        _PW_RESULTS=".loki/verification/playwright-results.json" python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
 import json, os
 try:
     d = json.load(open(os.environ['_PW_RESULTS']))
@@ -1375,7 +1381,7 @@ council_checklist_gate() {
     # council_heldout_gate at the ship gate, and surfacing them in this gate's
     # block report would leak their identity back into the build loop.
     local gate_result
-    gate_result=$(_RESULTS_FILE="$results_file" _WAIVERS_FILE="$waivers_file" _HELDOUT_FILE="$heldout_file" python3 -c "
+    gate_result=$(_RESULTS_FILE="$results_file" _WAIVERS_FILE="$waivers_file" _HELDOUT_FILE="$heldout_file" python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
 import json, sys, os
 
 results_file = os.environ['_RESULTS_FILE']
@@ -1438,13 +1444,13 @@ else:
         local timestamp
         timestamp=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
         local failures_json
-        failures_json=$(_FAILURES="$failures" python3 -c "
+        failures_json=$(_FAILURES="$failures" python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
 import json, os
 items = os.environ['_FAILURES'].split('|')
 print(json.dumps(items))
 " 2>/dev/null || echo '[]')
         local critical_count
-        critical_count=$(_FAILURES="$failures" python3 -c "
+        critical_count=$(_FAILURES="$failures" python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
 import os
 print(len(os.environ['_FAILURES'].split('|')))
 " 2>/dev/null || echo '0')
@@ -1514,7 +1520,7 @@ council_heldout_gate() {
     # contain ':' or '|'); they are read separately from the held-out JSON block
     # below in the BLOCK branch.
     local gate_result
-    gate_result=$(_RESULTS_FILE="$results_file" _HELDOUT_FILE="$heldout_file" _WAIVERS_FILE="$waivers_file" python3 -c "
+    gate_result=$(_RESULTS_FILE="$results_file" _HELDOUT_FILE="$heldout_file" _WAIVERS_FILE="$waivers_file" python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
 import json, sys, os
 
 results_file = os.environ['_RESULTS_FILE']
@@ -1634,7 +1640,7 @@ print('%s %d %d' % (verdict, passed, failed))
     if [ "$verdict" = "BLOCK" ]; then
         # Read failing held-out titles directly from the data (colon/pipe-safe).
         local titles_json titles_display
-        titles_json=$(_RESULTS_FILE="$results_file" _HELDOUT_FILE="$heldout_file" _WAIVERS_FILE="$waivers_file" python3 -c "
+        titles_json=$(_RESULTS_FILE="$results_file" _HELDOUT_FILE="$heldout_file" _WAIVERS_FILE="$waivers_file" python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
 import json, os
 results = json.load(open(os.environ['_RESULTS_FILE']))
 heldout_ids = set(json.load(open(os.environ['_HELDOUT_FILE'])).get('held_out', []))
@@ -1653,7 +1659,7 @@ for cat in results.get('categories', []):
             titles.append(item.get('title', iid))
 print(json.dumps(titles[:5]))
 " 2>/dev/null || echo '[]')
-        titles_display=$(_T="$titles_json" python3 -c "
+        titles_display=$(_T="$titles_json" python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
 import json, os
 try:
     print(', '.join(json.loads(os.environ['_T'])))
@@ -1927,7 +1933,8 @@ council_evidence_gate() {
     local test_inconclusive_reason=""
     if [ -f "$tr_file" ]; then
         local test_status
-        test_status=$(_TR_FILE="$tr_file" python3 <<'PYEOF' 2>/dev/null || echo "INCONCLUSIVE:none:true"
+        test_status=$(_TR_FILE="$tr_file" python3 -E -s - <<'PYEOF' 2>/dev/null || echo "INCONCLUSIVE:none:true"
+import sys; sys.path[:] = [p for p in sys.path if p not in ("", ".")]
 import json, os, sys
 tr_file = os.environ['_TR_FILE']
 try:
@@ -1954,7 +1961,10 @@ if runner == 'none':
 elif passed is False:
     print('FAIL:%s:false' % runner)
 elif status == 'no_tests_run' or passed is not True:
-    print('INCONCLUSIVE:%s:true' % runner)
+    # Both are INCONCLUSIVE; NO_PASS names the second: no boolean pass was
+    # recorded at all (missing, null, or a non-boolean value), which is not a
+    # zero-test run.
+    print('%s:%s:true' % ('INCONCLUSIVE' if status == 'no_tests_run' else 'NO_PASS', runner))
 else:
     print('PASS:%s:true' % runner)
 PYEOF
@@ -1985,6 +1995,13 @@ PYEOF
             test_inconclusive="true"
             test_inconclusive_reason="no_tests_executed"
         fi
+        # A real runner label but no boolean pass recorded: the same
+        # pass-through INCONCLUSIVE, named for what it is. Not gated by the
+        # opt-out either: an unrecorded outcome is never affirmative.
+        if [ "$_verdict" = "NO_PASS" ]; then
+            test_inconclusive="true"
+            test_inconclusive_reason="no_pass_recorded"
+        fi
     else
         # Missing test-results.json: no suite was recorded at all. Like the
         # runner=="none" case this is not affirmative evidence, so classify it
@@ -2099,6 +2116,16 @@ INCONCLUSIVE_EOF
         local _diff_ok _tests_ok
         if [ "$diff_fails" = "true" ]; then _diff_ok="false"; else _diff_ok="true"; fi
         if [ "$test_fails" = "true" ]; then _tests_ok="false"; else _tests_ok="true"; fi
+        # BACKLOG 55: tests.pass is true only for affirmative evidence (a real
+        # runner recorded a boolean pass and nothing downgraded it). $test_pass
+        # itself is "true" for every inconclusive outcome (no runner, no results,
+        # zero tests, no pass recorded, tautological), so it is not written raw.
+        local _tests_pass_json='"inconclusive"'
+        if [ "$test_fails" = "true" ]; then
+            _tests_pass_json="false"
+        elif [ "$test_inconclusive" != "true" ] && [ "$test_runner" != "none" ] && [ "$test_pass" = "true" ]; then
+            _tests_pass_json="true"
+        fi
         # Proof-of-Function axes (nomock/persistence/auth) are declared later in
         # the gate; default to "true"/"" when this helper runs before they are
         # set (it never does in practice, but keep the write robust).
@@ -2122,7 +2149,7 @@ INCONCLUSIVE_EOF
     "tests": {
         "ok": $_tests_ok,
         "runner": "$test_runner",
-        "pass": $test_pass,
+        "pass": $_tests_pass_json,
         "inconclusive": $test_inconclusive,
         "inconclusive_reason": "$test_inconclusive_reason"
     },
@@ -2175,7 +2202,8 @@ DETAILS_EOF
         boot_inconclusive_reason="no_app_runner"
     elif command -v python3 >/dev/null 2>&1; then
         local _boot_status
-        _boot_status=$(_HEALTH="$_health_file" _STATE="$_state_file" python3 <<'PYEOF' 2>/dev/null || echo "INCONCLUSIVE:parse_error"
+        _boot_status=$(_HEALTH="$_health_file" _STATE="$_state_file" python3 -E -s - <<'PYEOF' 2>/dev/null || echo "INCONCLUSIVE:parse_error"
+import sys; sys.path[:] = [p for p in sys.path if p not in ("", ".")]
 import json, os
 health_file = os.environ.get('_HEALTH', '')
 state_file = os.environ.get('_STATE', '')
@@ -2338,7 +2366,8 @@ PYEOF
         persist_inconclusive="true"; persist_inconclusive_reason="not_serveable"
     elif command -v python3 >/dev/null 2>&1; then
         local _p_status
-        _p_status=$(_PF="$_proof_file" _ITER="${ITERATION_COUNT:-0}" python3 <<'PYEOF' 2>/dev/null || echo "MISSING"
+        _p_status=$(_PF="$_proof_file" _ITER="${ITERATION_COUNT:-0}" python3 -E -s - <<'PYEOF' 2>/dev/null || echo "MISSING"
+import sys; sys.path[:] = [p for p in sys.path if p not in ("", ".")]
 import json, os
 p = os.environ['_PF']
 if not os.path.isfile(p):
@@ -2401,7 +2430,8 @@ PYEOF
         auth_inconclusive="true"; auth_inconclusive_reason="not_serveable"
     elif command -v python3 >/dev/null 2>&1; then
         local _a_status
-        _a_status=$(_PF="$_proof_file" _STRICT="${LOKI_PROOF_AUTH_STRICT:-1}" _ITER="${ITERATION_COUNT:-0}" python3 <<'PYEOF' 2>/dev/null || echo "MISSING"
+        _a_status=$(_PF="$_proof_file" _STRICT="${LOKI_PROOF_AUTH_STRICT:-1}" _ITER="${ITERATION_COUNT:-0}" python3 -E -s - <<'PYEOF' 2>/dev/null || echo "MISSING"
+import sys; sys.path[:] = [p for p in sys.path if p not in ("", ".")]
 import json, os
 p = os.environ['_PF']
 strict = os.environ.get('_STRICT', '1') != '0'
@@ -2479,7 +2509,8 @@ PYEOF
         authz_inconclusive="true"; authz_inconclusive_reason="not_serveable"
     elif command -v python3 >/dev/null 2>&1; then
         local _authz_status
-        _authz_status=$(_PF="$_proof_file" _ITER="${ITERATION_COUNT:-0}" python3 <<'PYEOF' 2>/dev/null || echo "MISSING"
+        _authz_status=$(_PF="$_proof_file" _ITER="${ITERATION_COUNT:-0}" python3 -E -s - <<'PYEOF' 2>/dev/null || echo "MISSING"
+import sys; sys.path[:] = [p for p in sys.path if p not in ("", ".")]
 import json, os
 p = os.environ['_PF']
 if not os.path.isfile(p):
@@ -2736,7 +2767,7 @@ PYEOF
     local timestamp
     timestamp=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
     local failures_json diff_ok tests_ok base_for_json
-    failures_json=$(_FAILURES="$failures" python3 -c "
+    failures_json=$(_FAILURES="$failures" python3 -E -s -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
 import json, os
 items = [s for s in os.environ['_FAILURES'].split('|') if s]
 print(json.dumps(items[:5]))
@@ -2753,11 +2784,11 @@ print(json.dumps(items[:5]))
     if [ "$authz_fails" = "true" ]; then authz_ok="false"; else authz_ok="true"; fi
     # Record WHY boot was inconclusive (no_app_runner / not_serveable / etc.) so a
     # consumer of the block report can tell a genuine boot pass from a pass-through.
-    boot_reason_json=$(_R="${boot_inconclusive_reason:-}" python3 -c "import json,os; print(json.dumps(os.environ['_R']))" 2>/dev/null || echo '""')
-    nomock_reason_json=$(_R="${nomock_inconclusive_reason:-}" python3 -c "import json,os; print(json.dumps(os.environ['_R']))" 2>/dev/null || echo '""')
-    persist_reason_json=$(_R="${persist_inconclusive_reason:-}" python3 -c "import json,os; print(json.dumps(os.environ['_R']))" 2>/dev/null || echo '""')
-    auth_reason_json=$(_R="${auth_inconclusive_reason:-}" python3 -c "import json,os; print(json.dumps(os.environ['_R']))" 2>/dev/null || echo '""')
-    authz_reason_json=$(_R="${authz_inconclusive_reason:-}" python3 -c "import json,os; print(json.dumps(os.environ['_R']))" 2>/dev/null || echo '""')
+    boot_reason_json=$(_R="${boot_inconclusive_reason:-}" python3 -E -s -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]; import json,os; print(json.dumps(os.environ['_R']))" 2>/dev/null || echo '""')
+    nomock_reason_json=$(_R="${nomock_inconclusive_reason:-}" python3 -E -s -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]; import json,os; print(json.dumps(os.environ['_R']))" 2>/dev/null || echo '""')
+    persist_reason_json=$(_R="${persist_inconclusive_reason:-}" python3 -E -s -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]; import json,os; print(json.dumps(os.environ['_R']))" 2>/dev/null || echo '""')
+    auth_reason_json=$(_R="${auth_inconclusive_reason:-}" python3 -E -s -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]; import json,os; print(json.dumps(os.environ['_R']))" 2>/dev/null || echo '""')
+    authz_reason_json=$(_R="${authz_inconclusive_reason:-}" python3 -E -s -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]; import json,os; print(json.dumps(os.environ['_R']))" 2>/dev/null || echo '""')
     base_for_json="${base_sha:-}"
     cat > "$ev_tmp" << EVIDENCE_EOF
 {
@@ -3395,7 +3426,7 @@ council_heuristic_review() {
             local _tr_file=".loki/quality/test-results.json"
             local _tests_ok=0
             if [ -f "$_tr_file" ] && command -v python3 >/dev/null 2>&1; then
-                _tests_ok=$(_TR="$_tr_file" python3 -c "
+                _tests_ok=$(_TR="$_tr_file" python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
 import json, os
 try:
     with open(os.environ['_TR']) as f:
@@ -3568,7 +3599,7 @@ council_evaluate_member() {
     local test_runner_seen="none"
     if [ -f "$tr_file" ]; then
         local _tr_status
-        _tr_status=$(_TR_FILE="$tr_file" python3 -c "
+        _tr_status=$(_TR_FILE="$tr_file" python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
 import json, os, sys
 try:
     with open(os.environ['_TR_FILE']) as f:
@@ -3625,7 +3656,7 @@ else:
             local _q _qcount
             for _q in pending in-progress blocked; do
                 [ -f "$loki_dir/queue/${_q}.json" ] || continue
-                _qcount=$(_QUEUE_FILE="$loki_dir/queue/${_q}.json" python3 -c "import json, os
+                _qcount=$(_QUEUE_FILE="$loki_dir/queue/${_q}.json" python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]; import json, os
 d = json.load(open(os.environ['_QUEUE_FILE']))
 print(len(d.get('tasks', d) if isinstance(d, dict) else d))" 2>/dev/null || echo "0")
                 # Guard against a non-numeric read (malformed file, python absent).
@@ -3762,7 +3793,7 @@ council_aggregate_votes() {
     # Serialize the votes array with json.dumps so backslashes/control chars are
     # escaped correctly (BUG fix: sed-only escaping produced invalid JSON).
     local votes_json
-    votes_json=$(_MEMBERS="$_members" _ROLES="$_roles" _VOTEVALS="$_vote_values" _REASONS="$_reasons" python3 -c "
+    votes_json=$(_MEMBERS="$_members" _ROLES="$_roles" _VOTEVALS="$_vote_values" _REASONS="$_reasons" python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
 import json, os
 def lines(name):
     v = os.environ.get(name, '')
@@ -3805,7 +3836,7 @@ print(json.dumps(out))
     _VERDICT="$verdict" \
     _VOTES="$votes_json" \
     _ROUND_FILE="$round_file" \
-    python3 -c "
+    python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
 import json, os
 from datetime import datetime, timezone
 round_data = {
@@ -3866,7 +3897,7 @@ council_devils_advocate_review() {
     local tr_file="$loki_dir/quality/test-results.json"
     if [ -f "$tr_file" ]; then
         local _tr_status
-        _tr_status=$(_TR_FILE="$tr_file" python3 -c "
+        _tr_status=$(_TR_FILE="$tr_file" python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
 import json, os, sys
 try:
     with open(os.environ['_TR_FILE']) as f:
@@ -3904,7 +3935,7 @@ else:
     # Skeptical check 2: Are there still failing tasks in the queue?
     if [ -f "$loki_dir/queue/failed.json" ]; then
         local failed_count
-        failed_count=$(_QUEUE_FILE="$loki_dir/queue/failed.json" python3 -c "import json, os; print(len(json.load(open(os.environ['_QUEUE_FILE']))))" 2>/dev/null || echo "0")
+        failed_count=$(_QUEUE_FILE="$loki_dir/queue/failed.json" python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]; import json, os; print(len(json.load(open(os.environ['_QUEUE_FILE']))))" 2>/dev/null || echo "0")
         if [ "$failed_count" -gt 0 ]; then
             ((issues_found++))
             issue_details="${issue_details}$failed_count tasks in failed queue; "
@@ -3950,7 +3981,7 @@ else:
     _ISSUES="$issues_found" \
     _DETAILS="${issue_details:-none}" \
     _DA_FILE="$da_file" \
-    python3 -c "
+    python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
 import json, os
 from datetime import datetime, timezone
 da_result = {
@@ -4046,7 +4077,7 @@ council_evaluate() {
             if loki_council_dispatch_agents "$ITERATION_COUNT" "${COUNCIL_PRD_PATH:-}"; then
                 local _va_round_file="$COUNCIL_STATE_DIR/votes/round-${ITERATION_COUNT}.json"
                 if [ -f "$_va_round_file" ]; then
-                    aggregate_result=$(_RF="$_va_round_file" python3 -c "import json, os; print(json.load(open(os.environ['_RF'])).get('verdict', 'CONTINUE'))" 2>/dev/null || echo "")
+                    aggregate_result=$(_RF="$_va_round_file" python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]; import json, os; print(json.load(open(os.environ['_RF'])).get('verdict', 'CONTINUE'))" 2>/dev/null || echo "")
                 fi
             fi
         fi
@@ -4068,7 +4099,7 @@ council_evaluate() {
         local complete_count=0
         local members_present=0
         if [ -f "$round_file" ]; then
-            complete_count=$(_RF="$round_file" python3 -c "import json, os; print(json.load(open(os.environ['_RF'])).get('complete_votes', 0))" 2>/dev/null || echo "0")
+            complete_count=$(_RF="$round_file" python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]; import json, os; print(json.load(open(os.environ['_RF'])).get('complete_votes', 0))" 2>/dev/null || echo "0")
             # WAVE13 CRITICAL quorum gate: how many voters actually responded
             # (total_members records the ACTUAL returned count -- see
             # voter-agents.sh). A degraded/partial dispatch response must never
@@ -4076,7 +4107,7 @@ council_evaluate() {
             # somehow read COMPLETE. This is defense-in-depth: the parser
             # already forces CONTINUE on undercount, but the completion-detection
             # trust core must independently assert full quorum before stopping.
-            members_present=$(_RF="$round_file" python3 -c "import json, os; print(json.load(open(os.environ['_RF'])).get('total_members', 0))" 2>/dev/null || echo "0")
+            members_present=$(_RF="$round_file" python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]; import json, os; print(json.load(open(os.environ['_RF'])).get('total_members', 0))" 2>/dev/null || echo "0")
         fi
         # Normalize to integers (guard against empty/non-numeric on read failure)
         case "$complete_count" in (''|*[!0-9]*) complete_count=0 ;; esac
@@ -4172,7 +4203,7 @@ council_managed_should_stop() {
     diff_summary=$(cd "$project_dir" 2>/dev/null && git diff --stat 2>/dev/null | tail -20 | tr '\n' ' ' || echo "")
     local test_summary=""
     if [ -f "$loki_dir/quality/test-results.json" ]; then
-        test_summary=$(_TRF="$loki_dir/quality/test-results.json" python3 -c "
+        test_summary=$(_TRF="$loki_dir/quality/test-results.json" python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
 import json, os
 try:
     d = json.load(open(os.environ['_TRF']))
@@ -4183,7 +4214,7 @@ except Exception:
     fi
     local pending_tasks="[]"
     if [ -f "$loki_dir/queue/pending.json" ]; then
-        pending_tasks=$(_QF="$loki_dir/queue/pending.json" python3 -c "
+        pending_tasks=$(_QF="$loki_dir/queue/pending.json" python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
 import json, os
 try:
     d = json.load(open(os.environ['_QF']))
@@ -4206,12 +4237,17 @@ except Exception:
     _CC_VERDICTS_DIR="$verdicts_dir" \
     _CC_LOKI_DIR="$loki_dir" \
     LOKI_TARGET_DIR="${TARGET_DIR:-$(pwd)}" \
-    python3 - <<'PYEOF' 2>/dev/null || exit_code=$?
+    PROJECT_DIR="${PROJECT_DIR:-$(cd "$(dirname "${BASH_SOURCE[0]}")/.." 2>/dev/null && pwd)}" \
+    python3 -E - <<'PYEOF' 2>/dev/null || exit_code=$?
+import sys; sys.path[:] = [p for p in sys.path if p not in ("", ".")]
 import json, os, sys, pathlib
 
-# Path setup: prefer project_dir so providers.managed resolves from main tree.
-project_dir = os.environ.get("PROJECT_DIR") or os.getcwd()
-sys.path.insert(0, project_dir)
+# Path setup: import providers.managed only from an explicit PROJECT_DIR. Never
+# fall back to the cwd (D7): it is the agent's repo, which could ship its own
+# providers/managed.py. Unset -> ImportError -> the Bash voting path.
+project_dir = os.environ.get("PROJECT_DIR", "")
+if project_dir:
+    sys.path.insert(0, project_dir)
 
 try:
     from providers.managed import (
@@ -4383,7 +4419,7 @@ _council_convergence_evidence_green() {
     # file or runner=="none" (no suite) is NOT affirmative evidence -> not green.
     [ -f "$tr_file" ] || return 1
     local tr_state
-    tr_state=$(_TR_FILE="$tr_file" python3 -c "
+    tr_state=$(_TR_FILE="$tr_file" python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
 import json, os, sys
 try:
     with open(os.environ['_TR_FILE']) as f:
@@ -4406,7 +4442,7 @@ print('yes' if (runner != 'none' and passed is True
     local results_file="${TARGET_DIR:-.}/.loki/checklist/verification-results.json"
     if [ -f "$results_file" ]; then
         local cl_state
-        cl_state=$(_RESULTS_FILE="$results_file" python3 -c "
+        cl_state=$(_RESULTS_FILE="$results_file" python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
 import json, os, sys
 try:
     with open(os.environ['_RESULTS_FILE']) as f:
@@ -4655,7 +4691,7 @@ council_write_report() {
 REPORT_HEADER
 
     # Append vote history from state
-    _COUNCIL_STATE_FILE="$COUNCIL_STATE_DIR/state.json" python3 -c "
+    _COUNCIL_STATE_FILE="$COUNCIL_STATE_DIR/state.json" python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
 import json, os
 try:
     with open(os.environ['_COUNCIL_STATE_FILE']) as f:

package/autonomy/council-v2.sh

@@ -19,6 +19,12 @@
 #   - swarm/sycophancy.py (sycophancy detection)
 #   - swarm/calibration.py (reviewer calibration)
 #
+# Inline Python (D7): the council runs with the cwd inside the agent's repo, so
+# every python3 here runs -E and drops '' and '.' from sys.path before any other
+# import (the swarm dir is inserted after that); a committed json.py or
+# sitecustomize.py cannot read the votes. Pinned by
+# tests/test-council-no-fabricated-verdict.sh (D7 section).
+#
 #===============================================================================
 
 COUNCIL_V2_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
@@ -97,7 +103,7 @@ council_v2_vote() {
             votes_json="$votes_json$vote_content"
 
             local verdict
-            verdict=$(echo "$vote_content" | python3 -c "import sys,json; print(json.load(sys.stdin).get('verdict','').upper())" 2>/dev/null || echo "UNKNOWN")
+            verdict=$(echo "$vote_content" | python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]; import json; print(json.load(sys.stdin).get('verdict','').upper())" 2>/dev/null || echo "UNKNOWN")
             # TRUST: a reviewer that could not be REACHED did not vote REJECT.
             #
             # Every provider arm below used to substitute a literal
@@ -135,7 +141,7 @@ council_v2_vote() {
 
     # Step 4: Sycophancy detection
     local sycophancy_score
-    sycophancy_score=$(python3 -c "
+    sycophancy_score=$(python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
 import sys
 sys.path.insert(0, '${COUNCIL_V2_DIR}/../swarm')
 from sycophancy import detect_sycophancy
@@ -150,7 +156,7 @@ print('{:.3f}'.format(detect_sycophancy(votes)))
     if [ "$approve_count" -eq "$council_size" ]; then
         local threshold="${LOKI_COUNCIL_SYCOPHANCY_THRESHOLD:-0.6}"
         local should_challenge
-        should_challenge=$(python3 -c "print('yes' if float('$sycophancy_score') >= float('$threshold') else 'no')" 2>/dev/null || echo "no")
+        should_challenge=$(python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]; print('yes' if float('$sycophancy_score') >= float('$threshold') else 'no')" 2>/dev/null || echo "no")
 
         if [ "$should_challenge" = "yes" ]; then
             log_warn "Sycophancy score $sycophancy_score >= $threshold -- adding devil's advocate"
@@ -167,7 +173,7 @@ print('{:.3f}'.format(detect_sycophancy(votes)))
                 # Same trust rule as the main tally: an unparseable devil's
                 # advocate did not vote REJECT. Defaulting to REJECT here would
                 # silently overturn a unanimous APPROVE on a transient failure.
-                da_verdict=$(cat "$da_vote" | python3 -c "import sys,json; print(json.load(sys.stdin).get('verdict','').upper())" 2>/dev/null || echo "INCONCLUSIVE")
+                da_verdict=$(cat "$da_vote" | python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]; import json; print(json.load(sys.stdin).get('verdict','').upper())" 2>/dev/null || echo "INCONCLUSIVE")
                 if [ "$da_verdict" = "INCONCLUSIVE" ]; then
                     log_warn "Devil's advocate produced no verdict -- unanimous approval left UNCHANGED (not overturned)"
                 elif [ "$da_verdict" = "REJECT" ]; then
@@ -201,7 +207,7 @@ print('{:.3f}'.format(detect_sycophancy(votes)))
         final_decision="reject"
     fi
 
-    python3 -c "
+    python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
 import sys
 sys.path.insert(0, '${COUNCIL_V2_DIR}/../swarm')
 from calibration import CalibrationTracker
@@ -388,7 +394,7 @@ Respond ONLY with a valid JSON object. No markdown fencing."
                             --json-schema "$_c2_schema_content" --output-format json 2>/dev/null)" || _c2_json=""
                         if [ -n "$_c2_json" ]; then
                             # Pull the schema-validated object out of the envelope.
-                            result="$(printf '%s' "$_c2_json" | python3 -c 'import sys,json
+                            result="$(printf '%s' "$_c2_json" | python3 -E -c 'import sys; sys.path[:] = [p for p in sys.path if p not in ("", ".")]; import json
 try:
     e=json.load(sys.stdin)
     p=e.get("structured_output")
@@ -490,7 +496,7 @@ except Exception:
     # or neither, stays INCONCLUSIVE -- never guessed.
     if [ -z "$extracted" ] && [ -n "${result:-}" ]; then
         local _recovered
-        _recovered="$(printf '%s' "$result" | _LOKI_RAW="$result" python3 -c '
+        _recovered="$(printf '%s' "$result" | _LOKI_RAW="$result" python3 -E -c 'import sys; sys.path[:] = [p for p in sys.path if p not in ("", ".")]
 import os, re, sys, json
 raw = os.environ.get("_LOKI_RAW", "")
 # Standalone words only: "APPROVE" not "approved-by", and not inside a URL.