loki-mode 9.53.0 → 9.54.0

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: Autonomous spec-driven build system with a built-in trust layer. It does not call work done until it is verified (RARV-C closure loop, 8 quality gates, completion council, verified-completion evidence gate). Triggers on "Loki Mode". Takes a spec (PRD, GitHub issue, OpenAPI doc, etc.) to deployed product with minimal human intervention. Provider-agnostic. Requires --dangerously-skip-permissions flag.
 ---
 
-# Loki Mode v9.53.0
+# Loki Mode v9.54.0
 
 **You are an autonomous agent. You make decisions. You do not ask questions. You do not stop.**
 
@@ -470,4 +470,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v9.53.0 | [Autonomi](https://www.autonomi.dev/) flagship product | ~410 lines core**
+**v9.54.0 | [Autonomi](https://www.autonomi.dev/) flagship product | ~410 lines core**

package/VERSION

@@ -1 +1 @@
-9.53.0
+9.54.0

package/autonomy/completion-council.sh

@@ -2116,6 +2116,16 @@ INCONCLUSIVE_EOF
         local _diff_ok _tests_ok
         if [ "$diff_fails" = "true" ]; then _diff_ok="false"; else _diff_ok="true"; fi
         if [ "$test_fails" = "true" ]; then _tests_ok="false"; else _tests_ok="true"; fi
+        # BACKLOG 55: tests.pass is true only for affirmative evidence (a real
+        # runner recorded a boolean pass and nothing downgraded it). $test_pass
+        # itself is "true" for every inconclusive outcome (no runner, no results,
+        # zero tests, no pass recorded, tautological), so it is not written raw.
+        local _tests_pass_json='"inconclusive"'
+        if [ "$test_fails" = "true" ]; then
+            _tests_pass_json="false"
+        elif [ "$test_inconclusive" != "true" ] && [ "$test_runner" != "none" ] && [ "$test_pass" = "true" ]; then
+            _tests_pass_json="true"
+        fi
         # Proof-of-Function axes (nomock/persistence/auth) are declared later in
         # the gate; default to "true"/"" when this helper runs before they are
         # set (it never does in practice, but keep the write robust).
@@ -2139,7 +2149,7 @@ INCONCLUSIVE_EOF
     "tests": {
         "ok": $_tests_ok,
         "runner": "$test_runner",
-        "pass": $test_pass,
+        "pass": $_tests_pass_json,
         "inconclusive": $test_inconclusive,
         "inconclusive_reason": "$test_inconclusive_reason"
     },
@@ -4227,13 +4237,17 @@ except Exception:
     _CC_VERDICTS_DIR="$verdicts_dir" \
     _CC_LOKI_DIR="$loki_dir" \
     LOKI_TARGET_DIR="${TARGET_DIR:-$(pwd)}" \
+    PROJECT_DIR="${PROJECT_DIR:-$(cd "$(dirname "${BASH_SOURCE[0]}")/.." 2>/dev/null && pwd)}" \
     python3 -E - <<'PYEOF' 2>/dev/null || exit_code=$?
 import sys; sys.path[:] = [p for p in sys.path if p not in ("", ".")]
 import json, os, sys, pathlib
 
-# Path setup: prefer project_dir so providers.managed resolves from main tree.
-project_dir = os.environ.get("PROJECT_DIR") or os.getcwd()
-sys.path.insert(0, project_dir)
+# Path setup: import providers.managed only from an explicit PROJECT_DIR. Never
+# fall back to the cwd (D7): it is the agent's repo, which could ship its own
+# providers/managed.py. Unset -> ImportError -> the Bash voting path.
+project_dir = os.environ.get("PROJECT_DIR", "")
+if project_dir:
+    sys.path.insert(0, project_dir)
 
 try:
     from providers.managed import (

package/autonomy/council-v2.sh

@@ -19,6 +19,12 @@
 #   - swarm/sycophancy.py (sycophancy detection)
 #   - swarm/calibration.py (reviewer calibration)
 #
+# Inline Python (D7): the council runs with the cwd inside the agent's repo, so
+# every python3 here runs -E and drops '' and '.' from sys.path before any other
+# import (the swarm dir is inserted after that); a committed json.py or
+# sitecustomize.py cannot read the votes. Pinned by
+# tests/test-council-no-fabricated-verdict.sh (D7 section).
+#
 #===============================================================================
 
 COUNCIL_V2_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
@@ -97,7 +103,7 @@ council_v2_vote() {
             votes_json="$votes_json$vote_content"
 
             local verdict
-            verdict=$(echo "$vote_content" | python3 -c "import sys,json; print(json.load(sys.stdin).get('verdict','').upper())" 2>/dev/null || echo "UNKNOWN")
+            verdict=$(echo "$vote_content" | python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]; import json; print(json.load(sys.stdin).get('verdict','').upper())" 2>/dev/null || echo "UNKNOWN")
             # TRUST: a reviewer that could not be REACHED did not vote REJECT.
             #
             # Every provider arm below used to substitute a literal
@@ -135,7 +141,7 @@ council_v2_vote() {
 
     # Step 4: Sycophancy detection
     local sycophancy_score
-    sycophancy_score=$(python3 -c "
+    sycophancy_score=$(python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
 import sys
 sys.path.insert(0, '${COUNCIL_V2_DIR}/../swarm')
 from sycophancy import detect_sycophancy
@@ -150,7 +156,7 @@ print('{:.3f}'.format(detect_sycophancy(votes)))
     if [ "$approve_count" -eq "$council_size" ]; then
         local threshold="${LOKI_COUNCIL_SYCOPHANCY_THRESHOLD:-0.6}"
         local should_challenge
-        should_challenge=$(python3 -c "print('yes' if float('$sycophancy_score') >= float('$threshold') else 'no')" 2>/dev/null || echo "no")
+        should_challenge=$(python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]; print('yes' if float('$sycophancy_score') >= float('$threshold') else 'no')" 2>/dev/null || echo "no")
 
         if [ "$should_challenge" = "yes" ]; then
             log_warn "Sycophancy score $sycophancy_score >= $threshold -- adding devil's advocate"
@@ -167,7 +173,7 @@ print('{:.3f}'.format(detect_sycophancy(votes)))
                 # Same trust rule as the main tally: an unparseable devil's
                 # advocate did not vote REJECT. Defaulting to REJECT here would
                 # silently overturn a unanimous APPROVE on a transient failure.
-                da_verdict=$(cat "$da_vote" | python3 -c "import sys,json; print(json.load(sys.stdin).get('verdict','').upper())" 2>/dev/null || echo "INCONCLUSIVE")
+                da_verdict=$(cat "$da_vote" | python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]; import json; print(json.load(sys.stdin).get('verdict','').upper())" 2>/dev/null || echo "INCONCLUSIVE")
                 if [ "$da_verdict" = "INCONCLUSIVE" ]; then
                     log_warn "Devil's advocate produced no verdict -- unanimous approval left UNCHANGED (not overturned)"
                 elif [ "$da_verdict" = "REJECT" ]; then
@@ -201,7 +207,7 @@ print('{:.3f}'.format(detect_sycophancy(votes)))
         final_decision="reject"
     fi
 
-    python3 -c "
+    python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
 import sys
 sys.path.insert(0, '${COUNCIL_V2_DIR}/../swarm')
 from calibration import CalibrationTracker
@@ -388,7 +394,7 @@ Respond ONLY with a valid JSON object. No markdown fencing."
                             --json-schema "$_c2_schema_content" --output-format json 2>/dev/null)" || _c2_json=""
                         if [ -n "$_c2_json" ]; then
                             # Pull the schema-validated object out of the envelope.
-                            result="$(printf '%s' "$_c2_json" | python3 -c 'import sys,json
+                            result="$(printf '%s' "$_c2_json" | python3 -E -c 'import sys; sys.path[:] = [p for p in sys.path if p not in ("", ".")]; import json
 try:
     e=json.load(sys.stdin)
     p=e.get("structured_output")
@@ -490,7 +496,7 @@ except Exception:
     # or neither, stays INCONCLUSIVE -- never guessed.
     if [ -z "$extracted" ] && [ -n "${result:-}" ]; then
         local _recovered
-        _recovered="$(printf '%s' "$result" | _LOKI_RAW="$result" python3 -c '
+        _recovered="$(printf '%s' "$result" | _LOKI_RAW="$result" python3 -E -c 'import sys; sys.path[:] = [p for p in sys.path if p not in ("", ".")]
 import os, re, sys, json
 raw = os.environ.get("_LOKI_RAW", "")
 # Standalone words only: "APPROVE" not "approved-by", and not inside a URL.

package/autonomy/lib/done-recognition.sh

@@ -36,6 +36,11 @@
 # the single injection seam, mirroring autonomy/lib/prd-enrich.sh.
 #
 # No emojis. No em dashes. bash 3.2 safe. Honors `set -uo pipefail`.
+#
+# Inline Python (D7): the gate runs with the cwd inside the agent's repo, so
+# every python3 here runs -E and drops '' and '.' from sys.path before any other
+# import; a committed json.py or sitecustomize.py cannot turn the verdict done.
+# Pinned by tests/test-reuse-done-recognition.sh case (d7).
 
 # Bound the single model call so a huge PRD or test log cannot run away.
 : "${LOKI_DONE_RECOG_TIMEOUT:=180}"           # seconds for the single model call
@@ -122,7 +127,7 @@ _loki_done_recog_invoke() {
                     --json-schema "$_dr_schema_content" --output-format json 2>/dev/null) || _dr_json=""
             fi
             if [ -n "$_dr_json" ]; then
-                _dr_obj=$(printf '%s' "$_dr_json" | python3 -c 'import sys,json
+                _dr_obj=$(printf '%s' "$_dr_json" | python3 -E -c 'import sys; sys.path[:] = [p for p in sys.path if p not in ("", ".")]; import json
 try:
     e=json.load(sys.stdin)
     p=e.get("structured_output")
@@ -194,7 +199,7 @@ _loki_done_recog_prd_sha() {
         sha256sum "$prd_file" 2>/dev/null | awk '{print $1}'
     else
         # Last-resort: a python hash, still deterministic over the same bytes.
-        LOKI_DR_PRD="$prd_file" python3 -c "
+        LOKI_DR_PRD="$prd_file" python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
 import hashlib, os
 p = os.environ.get('LOKI_DR_PRD','')
 try:
@@ -275,7 +280,8 @@ reuse_done_recognition_gate() {
              LOKI_DR_CHECKLIST="$loki_dir/checklist/checklist.json" \
              LOKI_DR_MAX_PRD="${LOKI_DONE_RECOG_MAX_PRD_CHARS}" \
              LOKI_DR_MAX_TEST="${LOKI_DONE_RECOG_MAX_TEST_CHARS}" \
-             python3 << 'DR_PROMPT_EOF'
+             python3 -E << 'DR_PROMPT_EOF'
+import sys; sys.path[:] = [p for p in sys.path if p not in ("", ".")]
 import json, os, sys
 
 def read_capped(path, cap):
@@ -376,7 +382,8 @@ DR_PROMPT_EOF
              LOKI_DR_TESTS="$_test_results" \
              LOKI_DR_ACTION="$action" \
              LOKI_DR_PRD="$prd_path" \
-             python3 << 'DR_PARSE_EOF'
+             python3 -E << 'DR_PARSE_EOF'
+import sys; sys.path[:] = [p for p in sys.path if p not in ("", ".")]
 import json, os, re, sys
 
 resp = os.environ.get("LOKI_DR_RESP", "")
@@ -674,7 +681,7 @@ DR_PARSE_EOF
     fi
 
     local verdict
-    verdict=$(printf '%s' "$parsed" | python3 -c "import json,sys;print(json.load(sys.stdin).get('verdict',''))" 2>/dev/null)
+    verdict=$(printf '%s' "$parsed" | python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]; import json;print(json.load(sys.stdin).get('verdict',''))" 2>/dev/null)
 
     case "$verdict" in
         done)
@@ -687,7 +694,7 @@ DR_PARSE_EOF
             ;;
         *)
             local _reason
-            _reason=$(printf '%s' "$parsed" | python3 -c "import json,sys;print(json.load(sys.stdin).get('reason','') or 'unverifiable')" 2>/dev/null)
+            _reason=$(printf '%s' "$parsed" | python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]; import json;print(json.load(sys.stdin).get('reason','') or 'unverifiable')" 2>/dev/null)
             log_info "Done-recognition: could not confirm the existing code already satisfies the reused spec (${_reason}). Proceeding to build to be safe."
             return 1
             ;;
@@ -723,10 +730,10 @@ _loki_done_recog_finish() {
     mkdir -p "$loki_dir/state" 2>/dev/null || true
 
     local summary met total axis
-    summary=$(printf '%s' "$parsed" | python3 -c "import json,sys;print(json.load(sys.stdin).get('summary','') or 'Project already satisfies its spec.')" 2>/dev/null)
-    met=$(printf '%s' "$parsed" | python3 -c "import json,sys;print(json.load(sys.stdin).get('met_count',0))" 2>/dev/null)
-    total=$(printf '%s' "$parsed" | python3 -c "import json,sys;print(json.load(sys.stdin).get('total_count',0))" 2>/dev/null)
-    axis=$(printf '%s' "$parsed" | python3 -c "import json,sys;print(json.load(sys.stdin).get('tests_axis','unknown'))" 2>/dev/null)
+    summary=$(printf '%s' "$parsed" | python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]; import json;print(json.load(sys.stdin).get('summary','') or 'Project already satisfies its spec.')" 2>/dev/null)
+    met=$(printf '%s' "$parsed" | python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]; import json;print(json.load(sys.stdin).get('met_count',0))" 2>/dev/null)
+    total=$(printf '%s' "$parsed" | python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]; import json;print(json.load(sys.stdin).get('total_count',0))" 2>/dev/null)
+    axis=$(printf '%s' "$parsed" | python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]; import json;print(json.load(sys.stdin).get('tests_axis','unknown'))" 2>/dev/null)
     [ -n "$met" ] || met=0
     [ -n "$total" ] || total=0
     [ -n "$axis" ] || axis="unknown"
@@ -766,7 +773,7 @@ _loki_done_recog_finish() {
         echo ""
         echo "## Per-requirement evidence"
         echo ""
-        printf '%s' "$parsed" | python3 -c "
+        printf '%s' "$parsed" | python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
 import json, sys
 try:
     d = json.load(sys.stdin)
@@ -785,7 +792,7 @@ for t in d.get('satisfied', []):
     LOKI_DR_MET="$met" \
     LOKI_DR_TOTAL="$total" \
     LOKI_DR_TS="$ts" \
-    python3 -c "
+    python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
 import json, os, tempfile
 out = os.environ['LOKI_DR_OUT']
 def i(v):
@@ -856,7 +863,7 @@ _loki_done_recog_write_manifest() {
     LOKI_DR_PARSED="$parsed" \
     LOKI_DR_SHA="$prd_sha" \
     LOKI_DR_TS="$ts" \
-    python3 -c "
+    python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
 import json, os, sys, tempfile
 out = os.environ['LOKI_DR_OUT']
 try:
@@ -897,7 +904,8 @@ except Exception:
     if [ -f "$loki_dir/queue/pending.json" ]; then
         # Drop prior PRD-sourced tasks so the incremental pass is the source of
         # truth; non-PRD tasks (if any) are preserved.
-        LOKI_DR_PENDING="$loki_dir/queue/pending.json" python3 - <<'RESET_EOF' 2>/dev/null || true
+        LOKI_DR_PENDING="$loki_dir/queue/pending.json" python3 -E - <<'RESET_EOF' 2>/dev/null || true
+import sys; sys.path[:] = [p for p in sys.path if p not in ("", ".")]
 import json, os, tempfile
 p = os.environ.get("LOKI_DR_PENDING", ".loki/queue/pending.json")
 try:
@@ -921,8 +929,8 @@ RESET_EOF
     fi
 
     local met total
-    met=$(printf '%s' "$parsed" | python3 -c "import json,sys;print(json.load(sys.stdin).get('met_count',0))" 2>/dev/null)
-    total=$(printf '%s' "$parsed" | python3 -c "import json,sys;print(json.load(sys.stdin).get('total_count',0))" 2>/dev/null)
+    met=$(printf '%s' "$parsed" | python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]; import json;print(json.load(sys.stdin).get('met_count',0))" 2>/dev/null)
+    total=$(printf '%s' "$parsed" | python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]; import json;print(json.load(sys.stdin).get('total_count',0))" 2>/dev/null)
     local unmet=$(( ${total:-0} - ${met:-0} ))
     log_info "Done-recognition: ${met:-0} of ${total:-0} requirements already satisfied; building only the ${unmet} unmet. Pass --fresh-prd to rebuild from scratch."
 }

package/autonomy/lib/proof-check.sh

@@ -26,6 +26,11 @@
 #
 # This function is only ever called when the operator opted in (the call site
 # guards on LOKI_PROVEN_PR_CHECK=1). It is also safe if called directly.
+#
+# Inline Python (D7): the call site's cwd is the agent's repo, so the proof
+# readers run python3 -E and drop '' and '.' from sys.path first; a committed
+# json.py or sitecustomize.py cannot change the headline. Pinned by
+# tests/test-proven-pr-check.sh (D7 section).
 
 # Double-source guard.
 [ -n "${_PROOF_CHECK_SH:-}" ] && return 0
@@ -53,7 +58,8 @@ _proof_check_headline() {
     command -v python3 >/dev/null 2>&1 || { printf '%s' ""; return 0; }
 
     local headline=""
-    headline="$(python3 - "$proof_path" <<'PY' 2>/dev/null || true
+    headline="$(python3 -E - "$proof_path" <<'PY' 2>/dev/null || true
+import sys; sys.path[:] = [p for p in sys.path if p not in ("", ".")]
 import json, sys
 try:
     with open(sys.argv[1], "r", encoding="utf-8") as fh:
@@ -84,7 +90,8 @@ _proof_check_proof_head_sha() {
     command -v python3 >/dev/null 2>&1 || { printf '%s' ""; return 0; }
 
     local sha=""
-    sha="$(python3 - "$proof_path" <<'PY' 2>/dev/null || true
+    sha="$(python3 -E - "$proof_path" <<'PY' 2>/dev/null || true
+import sys; sys.path[:] = [p for p in sys.path if p not in ("", ".")]
 import json, sys
 try:
     with open(sys.argv[1], "r", encoding="utf-8") as fh:
@@ -118,7 +125,8 @@ _proof_check_run_id() {
     command -v python3 >/dev/null 2>&1 || { printf '%s' ""; return 0; }
 
     local rid=""
-    rid="$(python3 - "$proof_path" <<'PY' 2>/dev/null || true
+    rid="$(python3 -E - "$proof_path" <<'PY' 2>/dev/null || true
+import sys; sys.path[:] = [p for p in sys.path if p not in ("", ".")]
 import json, sys
 try:
     with open(sys.argv[1], "r", encoding="utf-8") as fh:

package/autonomy/lib/voter-agents.sh

@@ -26,6 +26,11 @@
 #                                             on success, 1 on any fallback
 #                                             condition (caller falls through
 #                                             to existing heuristic dispatch).
+#
+# Inline Python (D7): the dispatch runs with the cwd inside the agent's repo, so
+# every python3 here runs -E and drops '' and '.' from sys.path before any other
+# import; a committed json.py or sitecustomize.py cannot read the votes.
+# Pinned by tests/test-voter-agents-json.sh (Case D).
 
 # Guard against double-source.
 if [ "${__LOKI_VOTER_AGENTS_SH_LOADED:-0}" = "1" ]; then
@@ -59,7 +64,7 @@ loki_voter_agents_json() {
     _VA_PRD="$prd" \
     _VA_TIER="$tier" \
     _VA_COMPLEXITY="${LOKI_COMPLEXITY:-standard}" \
-    python3 -c '
+    python3 -E -c 'import sys; sys.path[:] = [p for p in sys.path if p not in ("", ".")]
 import json, os
 iter_n = os.environ.get("_VA_ITER", "0")
 prd = os.environ.get("_VA_PRD", "")
@@ -128,7 +133,7 @@ print(json.dumps(agents, separators=(",", ":")))
 # Arg $1: terse base findings summary used to brief the DA prompt.
 loki_devils_advocate_json() {
     local summary="${1:-}"
-    _VA_SUMMARY="$summary" python3 -c '
+    _VA_SUMMARY="$summary" python3 -E -c 'import sys; sys.path[:] = [p for p in sys.path if p not in ("", ".")]
 import json, os
 summary = os.environ.get("_VA_SUMMARY", "")[:1000]
 agents = {
@@ -349,7 +354,7 @@ loki_council_dispatch_agents() {
     _VA_VDIR="$verdicts_dir" \
     _VA_RFILE="$votes_dir/round-${iteration}.json" \
     _VA_EXPECTED="${COUNCIL_SIZE:-3}" \
-    python3 -c '
+    python3 -E -c 'import sys; sys.path[:] = [p for p in sys.path if p not in ("", ".")]
 import json, os, sys
 from datetime import datetime, timezone
 

package/autonomy/lib/workspace_diff.py

@@ -3,8 +3,11 @@
 
 from __future__ import annotations
 
+import hashlib
 import os
+import stat as _stat
 import subprocess
+import sys
 
 
 _EMPTY = {"count": 0, "insertions": 0, "deletions": 0, "files": []}
@@ -29,19 +32,93 @@ def _excluded(path):
     return path == ".loki" or path.startswith(".loki/")
 
 
+# Written by run.sh setup_agent_branch (_loki_snapshot_preexisting): the paths
+# git did not track when the session started, untracked and gitignored,
+# NUL-delimited and relative to the repo top. An entry ending in "/" is an
+# ignored directory and covers its subtree. The sibling holds "<sha256> <path>"
+# records, one per file entry, written by write_snapshot_hashes below.
+_SNAPSHOT = "preexisting-untracked.z"
+_SNAPSHOT_HASHES = "preexisting-untracked.sha.z"
+
+
+def _content_hash(path):
+    """sha256 of a regular file's bytes or a symlink's target, else None.
+
+    The snapshot writer and the receipt reader both call this, so the two sides
+    always agree (git hash-object varies with filters and object format).
+    """
+    try:
+        st = os.lstat(path)
+        digest = hashlib.sha256()
+        if _stat.S_ISLNK(st.st_mode):
+            digest.update(b"link\0" + os.fsencode(os.readlink(path)))
+        elif _stat.S_ISREG(st.st_mode):
+            with open(path, "rb") as fh:
+                for chunk in iter(lambda: fh.read(1 << 20), b""):
+                    digest.update(chunk)
+        else:
+            return None
+        return digest.hexdigest()
+    except OSError:
+        return None
+
+
+def write_snapshot_hashes(top, snapshot):
+    """Record a content hash for every file entry of ``snapshot`` that exists
+    now (a directory entry or a missing path gets none), atomically, into the
+    sibling hashes file."""
+    with open(snapshot, "rb") as fh:
+        raw = fh.read()
+    top_b = os.fsencode(top)
+    records = []
+    for path in raw.split(b"\0"):
+        if not path or path.endswith(b"/"):
+            continue
+        digest = _content_hash(os.path.join(top_b, path))
+        if digest:
+            records.append(digest.encode("ascii") + b" " + path + b"\0")
+    dest = os.path.join(os.path.dirname(snapshot), _SNAPSHOT_HASHES)
+    with open(dest + ".tmp", "wb") as fh:
+        fh.write(b"".join(records))
+    os.replace(dest + ".tmp", dest)
+
+
 def _preexisting_untracked(repo_dir):
-    """Paths the user already had untracked when the Loki session branch was
-    minted (run.sh setup_agent_branch writes .loki/state/preexisting-untracked.z,
-    NUL-delimited, relative to the repo top). They are not this run's work, so
-    the receipt does not list them; tree_sha256 still binds their bytes. Returns
-    (prefix of repo_dir inside the repo, set of paths); empty when absent."""
+    """The session-start snapshot: (prefix of repo_dir inside the repo, set of
+    repo-top-relative paths, {path: content hash}). Those paths are not this
+    run's work, so the receipt lists one only when its content changed;
+    tree_sha256 still binds their bytes. Empty when absent."""
+    state = os.path.join(repo_dir, ".loki", "state")
     try:
-        with open(os.path.join(repo_dir, ".loki", "state", "preexisting-untracked.z"), "rb") as fh:
+        with open(os.path.join(state, _SNAPSHOT), "rb") as fh:
             raw = fh.read()
     except OSError:
-        return "", frozenset()
+        return "", frozenset(), {}
     paths = frozenset(p.decode("utf-8", "surrogateescape") for p in raw.split(b"\0") if p)
-    return (_git(repo_dir, ["rev-parse", "--show-prefix"]) or "").strip(), paths
+    hashes = {}
+    try:
+        with open(os.path.join(state, _SNAPSHOT_HASHES), "rb") as fh:
+            raw = fh.read()
+    except OSError:
+        raw = b""
+    for record in raw.split(b"\0"):
+        digest, sep, path = record.partition(b" ")
+        if sep:
+            hashes[path.decode("utf-8", "surrogateescape")] = digest.decode("ascii", "replace")
+    return (_git(repo_dir, ["rev-parse", "--show-prefix"]) or "").strip(), paths, hashes
+
+
+def _covered(key, paths):
+    """True when ``key`` or one of its parent directories ("a/", "a/b/") is in
+    ``paths``: an ignored directory entry covers everything below it."""
+    if key in paths:
+        return True
+    cut = key.find("/")
+    while cut != -1:
+        if key[:cut + 1] in paths:
+            return True
+        cut = key.find("/", cut + 1)
+    return False
 
 
 def _parse_numstat(raw):
@@ -122,9 +199,19 @@ def collect_workspace_diff(repo_dir, base, include_diffs=False):
                 diffs.append({"path": path, "patch": chunk})
 
     untracked = _git(repo_dir, ["ls-files", "--others", "--exclude-standard", "-z"])
-    prefix, preexisting = _preexisting_untracked(repo_dir)
-    for path in sorted(p for p in (untracked or "").split("\0")
-                       if p and not _excluded(p) and prefix + p not in preexisting):
+    prefix, preexisting, hashes = _preexisting_untracked(repo_dir)
+    for path in sorted(p for p in (untracked or "").split("\0") if p and not _excluded(p)):
+        key = prefix + path
+        if _covered(key, preexisting):
+            # The user's file, never committed. Listed only when the run changed
+            # it, with no counts and no patch: the old bytes were never stored,
+            # and its content (a config.local.json the agent un-ignored) must
+            # not land in the receipt.
+            recorded = hashes.get(key)
+            if recorded and _content_hash(os.path.join(repo_dir, path)) != recorded:
+                files.append({"path": path, "insertions": 0, "deletions": 0,
+                              "status": "preexisting_modified"})
+            continue
         stat = _git(
             repo_dir,
             ["diff", "--no-index", "--no-renames", "--numstat", "-z", "--", "/dev/null", path],
@@ -155,4 +242,11 @@ def collect_workspace_diff(repo_dir, base, include_diffs=False):
     }, diffs
 
 
-__all__ = ["collect_workspace_diff"]
+__all__ = ["collect_workspace_diff", "write_snapshot_hashes"]
+
+
+if __name__ == "__main__":
+    # run.sh: python3 -E workspace_diff.py hash-snapshot <repo top> <snapshot>
+    if len(sys.argv) != 4 or sys.argv[1] != "hash-snapshot":
+        sys.exit("usage: workspace_diff.py hash-snapshot <repo top> <snapshot>")
+    write_snapshot_hashes(sys.argv[2], sys.argv[3])

package/autonomy/prd-checklist.sh

@@ -18,6 +18,13 @@
 #   LOKI_CHECKLIST_TIMEOUT      - Timeout per check in seconds (default: 30)
 #   LOKI_CHECKLIST_ENABLED      - Enable/disable checklist (default: true)
 #
+# Inline Python (D7): verification runs with the cwd inside the agent's repo,
+# so every python3 here runs -E (an empty PYTHONPATH component would load a
+# committed sitecustomize.py) and every -c / - body drops '' and '.' from
+# sys.path before any other import (a committed json.py would print the
+# verdict). Pinned by tests/moat/p2-honest-verdict.sh
+# P2.checklist-verify-not-shadowed.
+#
 # Data:
 #   .loki/checklist/checklist.json          - Full checklist with verification
 #   .loki/checklist/verification-results.json - Summary of last verification
@@ -198,7 +205,8 @@ checklist_oracle_triangulate() {
            _ORACLE_OUT="$findings_file" \
            _ORACLE_PROJECT="$project_dir" \
            _ORACLE_INSTALL_DIR="$oracle_install_dir" \
-           python3 - > "$status_file" 2>/dev/null <<'ORACLE_PY'
+           python3 -E - > "$status_file" 2>/dev/null <<'ORACLE_PY'
+import sys; sys.path[:] = [p for p in sys.path if p not in ("", ".")]
 import json, os, re, sys, tempfile, glob
 
 spec_path = os.environ["_ORACLE_SPEC"]
@@ -693,7 +701,7 @@ checklist_oracle_evidence() {
     if [ ! -f "$findings_file" ]; then
         return 0
     fi
-    _ORACLE_OUT="$findings_file" python3 -c '
+    _ORACLE_OUT="$findings_file" python3 -E -c 'import sys; sys.path[:] = [p for p in sys.path if p not in ("", ".")]
 import json, os
 try:
     with open(os.environ["_ORACLE_OUT"]) as f:
@@ -797,7 +805,7 @@ checklist_select_heldout() {
     # items the build loop already saw in earlier prompts (the hidden-from-loop
     # guarantee is best-effort once the checklist ids change mid-run).
     local status_token
-    status_token=$(_CHECKLIST_FILE="$CHECKLIST_FILE" _HELDOUT_FILE="$heldout_file" python3 -c "
+    status_token=$(_CHECKLIST_FILE="$CHECKLIST_FILE" _HELDOUT_FILE="$heldout_file" python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
 import json, os, sys, hashlib, tempfile
 
 cl_path = os.environ['_CHECKLIST_FILE']
@@ -945,7 +953,7 @@ checklist_heldout_ids() {
     if [ ! -f "$heldout_file" ]; then
         return 0
     fi
-    _HELDOUT_FILE="$heldout_file" python3 -c "
+    _HELDOUT_FILE="$heldout_file" python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
 import json, os
 try:
     with open(os.environ['_HELDOUT_FILE']) as f:
@@ -991,7 +999,7 @@ checklist_verify() {
 
     log_step "Running PRD checklist verification..."
 
-    python3 "$verify_script" \
+    python3 -E "$verify_script" \
         --checklist "$CHECKLIST_FILE" \
         --timeout "$CHECKLIST_TIMEOUT" 2>/dev/null || true
 
@@ -1023,7 +1031,7 @@ checklist_summary() {
     _CHECKLIST_RESULTS="$CHECKLIST_RESULTS_FILE" \
     _CHECKLIST_WAIVERS="${CHECKLIST_DIR:-".loki/checklist"}/waivers.json" \
     _CHECKLIST_HELDOUT="${CHECKLIST_DIR:-".loki/checklist"}/held-out.json" \
-    python3 -c "
+    python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
 import json, sys, os
 try:
     fpath = os.environ.get('_CHECKLIST_RESULTS', '')
@@ -1126,7 +1134,7 @@ checklist_as_evidence() {
         echo "## PRD Checklist Verification"
         echo ""
 
-        _CHECKLIST_RESULTS="$CHECKLIST_RESULTS_FILE" python3 -c "
+        _CHECKLIST_RESULTS="$CHECKLIST_RESULTS_FILE" python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
 import json, os
 try:
     data = json.load(open(os.environ['_CHECKLIST_RESULTS']))
@@ -1162,7 +1170,7 @@ checklist_waiver_load() {
     if [ ! -f "$waivers_file" ]; then
         return 0
     fi
-    _WAIVERS_FILE="$waivers_file" python3 -c "
+    _WAIVERS_FILE="$waivers_file" python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
 import json, sys, os
 try:
     waivers_file = os.environ['_WAIVERS_FILE']
@@ -1186,7 +1194,7 @@ checklist_waiver_add() {
     local timestamp
     timestamp=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
 
-    _WAIVERS_FILE="$waivers_file" python3 -c "
+    _WAIVERS_FILE="$waivers_file" python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
 import json, os, sys
 
 waivers_file = os.environ['_WAIVERS_FILE']
@@ -1239,7 +1247,7 @@ checklist_waiver_remove() {
         return 1
     fi
 
-    _WAIVERS_FILE="$waivers_file" python3 -c "
+    _WAIVERS_FILE="$waivers_file" python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
 import json, os, sys
 
 waivers_file = os.environ['_WAIVERS_FILE']
@@ -1275,7 +1283,7 @@ checklist_waiver_list() {
         return 0
     fi
 
-    _WAIVERS_FILE="$waivers_file" python3 -c "
+    _WAIVERS_FILE="$waivers_file" python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
 import json, os
 waivers_file = os.environ['_WAIVERS_FILE']
 with open(waivers_file) as f: