loki-mode 9.54.0 → 9.54.2

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: Autonomous spec-driven build system with a built-in trust layer. It does not call work done until it is verified (RARV-C closure loop, 8 quality gates, completion council, verified-completion evidence gate). Triggers on "Loki Mode". Takes a spec (PRD, GitHub issue, OpenAPI doc, etc.) to deployed product with minimal human intervention. Provider-agnostic. Requires --dangerously-skip-permissions flag.
 ---
 
-# Loki Mode v9.54.0
+# Loki Mode v9.54.2
 
 **You are an autonomous agent. You make decisions. You do not ask questions. You do not stop.**
 
@@ -470,4 +470,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v9.54.0 | [Autonomi](https://www.autonomi.dev/) flagship product | ~410 lines core**
+**v9.54.2 | [Autonomi](https://www.autonomi.dev/) flagship product | ~410 lines core**

package/VERSION

@@ -1 +1 @@
-9.54.0
+9.54.2

package/autonomy/completion-council.sh

@@ -1948,6 +1948,15 @@ runner = d.get('runner', 'none')
 # an unrecorded outcome is not a pass. None falls to INCONCLUSIVE below.
 passed = d.get('pass')
 status = d.get('status', '')
+# BACKLOG 89: a recorded failure count above zero is a failure whatever "pass"
+# says, as the Bun gate reads it (quality_gates.ts artifactCount): a numeric
+# failed_count wins, the legacy numeric failed is the fallback, and anything
+# else (null, missing, a bool) is unmeasured, never a failure and never 0.
+def _count(v):
+    return v if isinstance(v, (int, float)) and not isinstance(v, bool) else None
+failed_n = _count(d.get('failed_count'))
+if failed_n is None:
+    failed_n = _count(d.get('failed'))
 #82 (zero-test-file hardening): a runner that ran but executed ZERO real tests
 # (node --test on a *.test.js with no test() calls; jest --passWithNoTests with
 # no suites) records pass:"inconclusive" + status:"no_tests_run" -- a mini
@@ -1958,7 +1967,7 @@ status = d.get('status', '')
 # Only the boolean True passes as affirmative; only the boolean False blocks.
 if runner == 'none':
     print('PASS:none:true')
-elif passed is False:
+elif passed is False or (failed_n or 0) > 0:
     print('FAIL:%s:false' % runner)
 elif status == 'no_tests_run' or passed is not True:
     # Both are INCONCLUSIVE; NO_PASS names the second: no boolean pass was

package/autonomy/lib/proof-generator.py

@@ -319,6 +319,32 @@ def _is_exogenous(gate):
     return _gate_provenance(gate.get("name")) == "exogenous"
 
 
+def _test_results_fresh(quality_dir):
+    """BACKLOG 82: the gates' freshness rule (ensure_completion_test_evidence,
+    Bun testResultsFresh). enforce_test_coverage writes unit-tests.pass and
+    test-results.json together with .test-results.iter; they are this
+    iteration's evidence only when that marker holds this iteration's number.
+    Both loop callers always pass the iteration as ITERATION_COUNT (run.sh
+    generate_proof_of_run, Bun runner/proof.ts); a set but empty value is not
+    fresh.
+    ponytail: ITERATION_COUNT absent altogether means a hand run outside any
+    loop, with no iteration to compare against, so the pre-82 reading applies
+    there (Bun's gate calls that stale). Tighten when a caller exists that
+    omits it."""
+    raw = os.environ.get("ITERATION_COUNT")
+    if raw is None:
+        return True
+    iteration = raw.strip()
+    if not iteration:
+        return False
+    try:
+        with open(os.path.join(quality_dir, ".test-results.iter"), "r",
+                  encoding="utf-8") as handle:
+            return handle.read(64).strip() == iteration
+    except OSError:
+        return False
+
+
 def _collect_quality_gates(loki_dir):
     gates_raw = _read_json(
         os.path.join(loki_dir, "state", "quality-gates.json"), default=None
@@ -351,6 +377,8 @@ def _collect_quality_gates(loki_dir):
     # never an LLM opinion. Only fills gates the aggregate did not already cover.
     if not gates:
         quality_dir = os.path.join(loki_dir, "quality")
+        tests_json = os.path.join(quality_dir, "test-results.json")
+        tests_fresh = _test_results_fresh(quality_dir)
         seen = set()
         # (gate name in proof, marker/result filename stem under quality/)
         markers = [
@@ -361,7 +389,12 @@ def _collect_quality_gates(loki_dir):
             pass_marker = os.path.join(quality_dir, stem + ".pass")
             result_json = os.path.join(quality_dir, stem + ".json")
             status = None
-            if os.path.exists(pass_marker):
+            if gate_name == "unit_tests" and not tests_fresh:
+                # BACKLOG 82: a test result another iteration wrote is not
+                # this iteration's evidence, pass or fail. Name the gap.
+                if any(os.path.exists(p) for p in (pass_marker, result_json, tests_json)):
+                    status = "not_run"
+            elif os.path.exists(pass_marker):
                 status = "passed"
             elif os.path.exists(result_json):
                 rj = _read_json(result_json, default=None)
@@ -390,10 +423,8 @@ def _collect_quality_gates(loki_dir):
                     passed += 1
         # test-results.json carries the suite outcome even when no .pass marker
         # (e.g. {status:"verified"} = tests ran and passed).
-        if "unit_tests" not in seen:
-            tr = _read_json(
-                os.path.join(quality_dir, "test-results.json"), default=None
-            )
+        if "unit_tests" not in seen and tests_fresh:
+            tr = _read_json(tests_json, default=None)
             if isinstance(tr, dict):
                 st = str(tr.get("status") or "")
                 if st in ("verified", "pass", "passed"):

package/autonomy/run.sh

@@ -8765,10 +8765,20 @@ start_resource_monitor() {
     # Initial check
     check_system_resources
 
-    # Background monitoring loop
+    # Background monitoring loop. BACKLOG 22: a bare `sleep N` inside this
+    # subshell survives a TERM to the subshell -- caught traps do not carry
+    # into a foreground child, so the sleep reparents to init and outlives the
+    # run for up to RESOURCE_CHECK_INTERVAL seconds. Backgrounding the sleep
+    # and recording its PID lets a TERM trap kill it directly; `wait` returns
+    # immediately once the trap fires, so shutdown is not delayed either.
     (
+        _loki_rm_sleep_pid=""
+        trap '[ -n "$_loki_rm_sleep_pid" ] && kill "$_loki_rm_sleep_pid" 2>/dev/null; exit 0' TERM
         while true; do
-            sleep "$RESOURCE_CHECK_INTERVAL"
+            sleep "$RESOURCE_CHECK_INTERVAL" &
+            _loki_rm_sleep_pid=$!
+            wait "$_loki_rm_sleep_pid"
+            _loki_rm_sleep_pid=""
             check_system_resources
         done
     ) &
@@ -9091,8 +9101,10 @@ setup_agent_branch() {
     [ -f .loki/.gitignore ] || printf '*\n' > .loki/.gitignore 2>/dev/null || true
 
     # Capture the ref Loki was run from. Detached HEAD yields the literal "HEAD".
+    # symbolic-ref also names an unborn branch (fresh `git init`), where
+    # rev-parse printed "HEAD" and failed, recording "HEAD" twice as the base.
     local cur=""
-    cur="$(git rev-parse --abbrev-ref HEAD 2>/dev/null || echo HEAD)"
+    cur="$(git symbolic-ref --short -q HEAD 2>/dev/null || echo HEAD)"
 
     # Detached HEAD: do NOT branch, do NOT fabricate a base (LOCK A2/A6).
     if [ "$cur" = "HEAD" ]; then
@@ -9135,15 +9147,13 @@ setup_agent_branch() {
         fi
     fi
 
-    # Fresh run: persist the base branch (fresh-run-only) BEFORE branching, then
-    # mint and check out the feature branch (LOCK A2).
+    # Fresh run: mint and check out the feature branch, then persist its base
+    # (fresh-run-only, LOCK A2).
     local timestamp
     timestamp=$(date +%s)
     local branch_name="loki/session-${timestamp}-$$"
 
     mkdir -p .loki/state 2>/dev/null || true
-    # Persist the base only once per run tree; never overwrite an existing base.
-    [ ! -s .loki/state/base-branch.txt ] && printf '%s\n' "$cur" > .loki/state/base-branch.txt 2>/dev/null
 
     log_info "Branch protection enabled - creating agent branch: $branch_name (base: $cur)"
 
@@ -9172,6 +9182,15 @@ setup_agent_branch() {
     rm -f .loki/state/session-created.z 2>/dev/null
     if [ "$snap_ok" = 1 ]; then _LOKI_SNAPSHOT_THIS_RUN=1; fi
 
+    # Every mint (a refused resume included) records its own base and the
+    # commit it starts at (the empty tree when unborn); the resume paths above
+    # keep both. A base left by an earlier session can name a branch deleted
+    # since, and _loki_untrack_agent_committed_user_files then could not find
+    # the user files the agent commits.
+    printf '%s\n' "$cur" > .loki/state/base-branch.txt 2>/dev/null
+    { git rev-parse --verify -q HEAD || git hash-object -t tree /dev/null; } \
+        > .loki/state/session-start-sha 2>/dev/null
+
     # Store the branch name for later use (PR creation, cleanup)
     printf '%s\n' "$branch_name" > .loki/state/agent-branch.txt 2>/dev/null
 
@@ -9367,6 +9386,101 @@ fi
 if ! type _commit_scan_secret_file >/dev/null 2>&1; then _commit_scan_secret_file() { return 1; }; fi
 if ! type _commit_path_looks_secret >/dev/null 2>&1; then _commit_path_looks_secret() { return 1; }; fi
 
+# _loki_covered_paths <paths> <snapshot> <top> <out>
+# Atomically write <out>: the NUL-delimited entries of <paths> that <snapshot>
+# covers (the entry itself or a parent "dir/" entry, as workspace_diff._covered)
+# and that still exist under <top>. Non-zero on a read or write failure. -E and
+# no cwd on sys.path (D7): the cwd is the agent's repo.
+_loki_covered_paths() {
+    python3 -E -c 'import sys
+sys.path[:] = [p for p in sys.path if p not in ("", ".")]
+import os
+paths, snap, top, out = sys.argv[1:5]
+def entries(path):
+    with open(path, "rb") as fh:
+        return [p for p in fh.read().split(b"\0") if p]
+held = set(entries(snap))
+def covered(path):
+    if path in held:
+        return True
+    cut = path.find(b"/")
+    while cut != -1:
+        if path[:cut + 1] in held:
+            return True
+        cut = path.find(b"/", cut + 1)
+    return False
+# A file gone from disk stays tracked: untracking it would leave its bytes
+# only in history.
+top = os.fsencode(top)
+hits = [p for p in entries(paths) if covered(p) and os.path.lexists(os.path.join(top, p))]
+with open(out + ".tmp", "wb") as fh:
+    fh.write(b"".join(p + b"\0" for p in hits))
+os.replace(out + ".tmp", out)' "$@" 2>/dev/null
+}
+
+# _loki_untrack_agent_committed_user_files <branch> (BACKLOG 74)
+# An agent that rewrites .gitignore and runs `git add -A && git commit` itself
+# puts the user's untracked or ignored files on the session branch, and a
+# checkout of the base then deletes them from disk. Files ADDED on the branch
+# since it forked from the recorded base that the pre-existing snapshot covers
+# are removed from the index (they stay on disk) and that removal is committed
+# on its own, before the session commit: it adds no content, and no later exit
+# (a secret abort, a failed unstage) can put the files back on the branch tip.
+# Records this session's removals in .loki/state/agent-committed-user-files.z
+# and warns that the branch history still holds them. The fork is the merge
+# base with the recorded base branch, else the session's recorded start commit
+# (.loki/state/session-start-sha). Non-zero when the removal could not be
+# committed, or when neither fork resolves or the check fails (the tip may hold
+# user files): the caller then makes no session commit, whose `git add -A`
+# would stage the files again.
+_loki_untrack_agent_committed_user_files() {
+    local snap=".loki/state/preexisting-untracked.z" rec=".loki/state/agent-committed-user-files.z"
+    local base="" fork="" start="" top="" names=""
+    local unchecked="Before switching branches, run git rm --cached on each of your files the agent committed and commit, or a checkout of the base deletes them. Left uncommitted: no session commit."
+    [ -s "$snap" ] || return 0
+    # No commit on the branch yet: the agent committed nothing.
+    git rev-parse --verify -q HEAD >/dev/null 2>&1 || return 0
+    [ -s .loki/state/base-branch.txt ] && base="$(cat .loki/state/base-branch.txt 2>/dev/null)"
+    if [ -n "$base" ]; then fork="$(git merge-base HEAD "$base" 2>/dev/null)" || fork=""; fi
+    if [ -z "$fork" ] && [ -s .loki/state/session-start-sha ]; then
+        start="$(cat .loki/state/session-start-sha 2>/dev/null)"
+        # A commit on this branch, or the empty tree of an unborn mint.
+        if git merge-base --is-ancestor "$start" HEAD 2>/dev/null \
+           || [ "$(git cat-file -t "$start" 2>/dev/null)" = tree ]; then
+            fork="$start"
+        fi
+    fi
+    if [ -z "$fork" ]; then
+        log_warn "Could not check whether the agent committed your pre-existing untracked files on $1: base branch '${base:-unknown}' not found and the recorded session start commit is missing or not on this branch. ${unchecked}"
+        return 1
+    fi
+    # --no-renames: a user file swept in beside a deleted tracked file must
+    # read as added, not as a rename of that file.
+    if ! top="$(git rev-parse --show-toplevel 2>/dev/null)" \
+       || ! git -C "$top" diff --name-only -z --no-renames --diff-filter=A "$fork" HEAD > "$rec.added" 2>/dev/null \
+       || ! _loki_covered_paths "$rec.added" "$snap" "$top" "$rec.new"; then
+        rm -f "$rec.added" "$rec.new" "$rec.new.tmp"
+        log_warn "Could not check whether the agent committed your pre-existing untracked files on $1. ${unchecked}"
+        return 1
+    fi
+    rm -f "$rec.added"
+    if [ ! -s "$rec.new" ]; then
+        rm -f "$rec.new"
+        return 0
+    fi
+    mv -f "$rec.new" "$rec"
+    names="$(_loki_nul_names "$rec")"
+    git reset -q >/dev/null 2>&1 || true
+    if ! git -C "$top" update-index -z --force-remove --stdin < "$rec" >/dev/null 2>&1 \
+       || ! git commit -q -m "Loki Mode: untrack pre-existing user files the agent committed" >/dev/null 2>&1; then
+        log_warn "The agent committed your pre-existing files on $1 and Loki could not remove them from the branch: ${names}. They are on disk. Before switching branches, run git rm --cached on each and commit, or a checkout of the base deletes them. Left uncommitted: no session commit."
+        return 1
+    fi
+    log_warn "The agent committed your pre-existing untracked or ignored files on $1: ${names}. Loki removed them from the branch tip; they stay on disk, untracked. The branch history still holds them: do not push $1 as-is. To drop them from its history: git reset --soft ${fork} && git commit"
+    audit_agent_action "git_untrack_user_files" "Removed pre-existing user files the agent committed" "files=${names}" || true
+    return 0
+}
+
 commit_session_changes() {
     # Squash the session's work into one honest session-end commit on the agent
     # branch (LOCK A3/A4/A8). Commit-always (incl. failed runs) so the user is
@@ -9401,6 +9515,25 @@ commit_session_changes() {
             ;;
     esac
 
+    # Commit nothing unless THIS run took a current snapshot (BACKLOG 90). The
+    # LOCK A1 opt-out takes none, so it never commits, even on a leftover
+    # loki/session-* branch whose agent-branch.txt and snapshot belong to an
+    # earlier session: that stale snapshot would sweep in a file the user made
+    # since, and a checkout of the base would delete it. Checked before any
+    # staging, so the opt-out leaves the user's index alone.
+    if [ "${_LOKI_SNAPSHOT_THIS_RUN:-0}" != 1 ]; then
+        if [ "${LOKI_BRANCH_PROTECTION:-true}" != "true" ]; then
+            log_info "Branch protection off (LOKI_BRANCH_PROTECTION=${LOKI_BRANCH_PROTECTION}): no session commit; the work stays uncommitted on ${cur}"
+        elif [ -f "$PWD/.loki/state/preexisting-untracked.failed" ]; then
+            log_warn "Left uncommitted: could not record your pre-existing untracked files at session start (the snapshot needs git 2.18+, excluding them needs 2.25+). Review and commit manually."
+        else
+            log_warn "Left uncommitted: this run recorded no snapshot of your pre-existing untracked files, so it makes no session commit. Review and commit manually."
+        fi
+        return 0
+    fi
+
+    _loki_untrack_agent_committed_user_files "$cur" || return 0
+
     # Stage everything except .loki/ runtime state and a secret-path denylist.
     # These excludes are defense-in-depth ONLY for the top-level cases git
     # pathspec handles cleanly. We deliberately do NOT add nested globs like
@@ -9426,12 +9559,8 @@ commit_session_changes() {
     # Agent-created files stay staged. Skip an empty snapshot: an
     # empty --pathspec-from-file resets the WHOLE index. No snapshot (older
     # session): behave as before. If the unstage fails (git < 2.25), commit
-    # nothing rather than sweep the user's files in.
-    if [ -f "$PWD/.loki/state/preexisting-untracked.failed" ]; then
-        git reset -q >/dev/null 2>&1 || true
-        log_warn "Left uncommitted: could not record your pre-existing untracked files at session start (the snapshot needs git 2.18+, excluding them needs 2.25+). Review and commit manually."
-        return 0
-    fi
+    # nothing rather than sweep the user's files in. A failed snapshot never
+    # gets here (the snapshot guard above returns first).
     local preexisting="$PWD/.loki/state/preexisting-untracked.z" top=""
     if [ -s "$preexisting" ]; then
         if ! { top="$(git rev-parse --show-toplevel 2>/dev/null)" \
@@ -12089,6 +12218,12 @@ ZT_MATCHES_EOF
 }
 
 enforce_test_coverage() {
+    # Every suite this gate launches (pytest, unittest, the coverage pass, a
+    # package script that runs Python) runs inside the user's repo: no
+    # __pycache__/*.pyc there, so none can land in the session commit when the
+    # repo does not ignore them (BACKLOG 85). Bytecode caching only; the same
+    # tests run. Scoped to this call.
+    local -x PYTHONDONTWRITEBYTECODE=1
     local loki_dir="${TARGET_DIR:-.}/.loki"
     local quality_dir="$loki_dir/quality"
     mkdir -p "$quality_dir" "$loki_dir/signals"
@@ -12118,7 +12253,9 @@ enforce_test_coverage() {
         # that is the legitimate case they were written for (a package that ships
         # a runner but no npm script).
         local _declared_test_script=""
-        _declared_test_script=$(_LOKI_PKG="${TARGET_DIR:-.}/package.json" python3 -c "
+        # BACKLOG 81 (D7): -E plus the sys.path filter, so the agent's repo (the
+        # cwd) cannot supply json or sitecustomize to this reader.
+        _declared_test_script=$(_LOKI_PKG="${TARGET_DIR:-.}/package.json" python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
 import json, os, sys
 try:
     with open(os.environ['_LOKI_PKG']) as f:
@@ -12238,7 +12375,8 @@ sys.stdout.write(t.strip())
                     # npm test), so the grep only ever picked the LABEL, never
                     # what ran. This corrects the evidence, not the execution.
                     local _ws_script
-                    _ws_script=$(_LOKI_PKG="$pkg_json" python3 -c "
+                    # BACKLOG 81 (D7): same guard as the root reader above.
+                    _ws_script=$(_LOKI_PKG="$pkg_json" python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
 import json, os, sys
 try:
     with open(os.environ['_LOKI_PKG']) as f:
@@ -12558,6 +12696,9 @@ TREOF
         # run instead of re-running the suite. Single source of truth for "tests
         # ran this iteration", set on every return path that writes results.
         printf '%s\n' "${ITERATION_COUNT:-0}" > "$quality_dir/.test-results.iter" 2>/dev/null || true
+        # BACKLOG 91: non-blocking, but nothing was measured: the loop's
+        # stage_complete event reads this and says not_run, not pass.
+        _LOKI_TEST_SUITE_STATUS=not_run
         return 0
     fi
 
@@ -12569,6 +12710,49 @@ TREOF
     # first, then delete every remaining control char (\000-\037, incl. ESC).
     details=$(echo "$details" | tr '"' "'" | tr '\n' ' ' | tr -d '\000-\037' | head -c 500)
 
+    # BACKLOG 73: a runner that exits 0 while its own summary reports failures
+    # (`jest || true`, a script that swallows the status) failed. The failure
+    # count comes from the runner's summary lines in the FULL output (the details
+    # tail can drop them: the jest branch keeps 3 lines). The highest count
+    # across summaries wins, so output that concatenates several runs (npm test
+    # --workspaces, `jest; vitest`) cannot hide a failed run behind a later
+    # green one. Shapes: jest "Tests: 1 failed, ...", vitest "Tests  1 failed |
+    # ...", pytest "=== 1 failed, 2 passed in 0.1s ===" (or its -q line), node
+    # TAP "# fail 1" and the spec reporter's "<info sign> fail 1", counted only
+    # right after the matching pass line (node TAP echoes a test's own stdout
+    # as "# ..." lines, which must not count), mocha "1 failing", go "--- FAIL:"
+    # lines. A read summary with no failures is a measured 0. With no recognised
+    # summary the old best-effort parse of the tail still applies (null when it
+    # finds nothing). Either way a recorded count above zero is a failure: the
+    # council evidence gate and the Bun gate both read failed_count > 0 as one.
+    # LC_ALL=C: bytes, so any runner output parses; [ \t] not [[:space:]] for
+    # old mawk.
+    local _tr_passed_n _tr_failed_n _tr_summary_red=false
+    _tr_failed_n=$(printf '%s\n' "${output:-}" | LC_ALL=C sed "s/$(printf '\033')\[[0-9;]*[A-Za-z]//g" | LC_ALL=C awk '
+        function upd(n) { if (n > f) f = n; seen = 1 }
+        /^Tests:[ \t]/ || /^[ \t]*Tests[ \t]+[0-9]/ ||
+        /^=+ .*[0-9]+ (passed|failed)/ || /^[0-9]+ (passed|failed).* in [0-9.]+s/ {
+            n = 0; if (match($0, /[0-9]+ failed/)) n = substr($0, RSTART, RLENGTH) + 0; upd(n) }
+        /^[^ A-Za-z0-9]+ fail [0-9]+[ \t]*$/ { if (prev ~ /^[^ A-Za-z0-9]+ pass [0-9]+[ \t]*$/) upd($3 + 0) }
+        /^[ \t]*[0-9]+ passing \(/ { upd(0) }
+        /^[ \t]*[0-9]+ failing[ \t]*$/ { upd($1 + 0) }
+        /^--- FAIL: / { go++ }
+        { prev = $0 }
+        END { if (go > f) { f = go; seen = 1 } if (seen) print f + 0 }')
+    _tr_passed_n=$(printf '%s' "$details" | grep -oE '[0-9]+ passed' | grep -oE '[0-9]+' | head -1)
+    [ -n "$_tr_failed_n" ] || _tr_failed_n=$(printf '%s' "$details" | grep -oE '[0-9]+ failed' | grep -oE '[0-9]+' | head -1)
+    # node --test emits TAP-ish "# pass N" / "# fail N" summary lines, which the
+    # "N passed"/"N failed" pattern above does not match. Fall back to those.
+    [ -n "$_tr_passed_n" ] || _tr_passed_n=$(printf '%s' "$details" | grep -oE '# pass [0-9]+' | grep -oE '[0-9]+' | head -1)
+    [ -n "$_tr_failed_n" ] || _tr_failed_n=$(printf '%s' "$details" | grep -oE '# fail [0-9]+' | grep -oE '[0-9]+' | head -1)
+    [ -n "$_tr_passed_n" ] || _tr_passed_n=null
+    [ -n "$_tr_failed_n" ] || _tr_failed_n=null
+    if [ "$test_passed" = "true" ] && [ "$_tr_failed_n" != "null" ] && [ "$_tr_failed_n" -gt 0 ] 2>/dev/null; then
+        test_passed=false
+        _tr_summary_red=true
+        log_warn "Test suite gate: $test_runner exited 0 but its summary reports $_tr_failed_n failed -- recording a failure"
+    fi
+
     # Evidence Receipt provenance (v7.85.0): record the deterministic FACTS a
     # non-forgeable receipt needs -- the command that ran, its exit code, and a
     # status enum -- alongside the legacy pass/runner/min_coverage keys the
@@ -12586,6 +12770,8 @@ TREOF
         *)           _tr_cmd="$test_runner" ;;
     esac
     if [ "$test_passed" = "true" ]; then _tr_exit=0; _tr_status="verified"; else _tr_exit=1; _tr_status="failed"; fi
+    # BACKLOG 73: the runner itself exited 0; record that fact, not a made-up 1.
+    if [ "$_tr_summary_red" = "true" ]; then _tr_exit=0; fi
 
     # #82 (zero-test-file hardening): a runner that EXITED 0 but executed ZERO
     # real tests is a mini fake-green -- it records "verified" while proving
@@ -12607,17 +12793,6 @@ TREOF
         log_warn "Verification gap: $test_runner exited 0 but ran ZERO tests -- recording inconclusive (no_tests_run), not verified"
     fi
 
-    # Best-effort pass/fail counts from the summary text (null when not found).
-    local _tr_passed_n _tr_failed_n
-    _tr_passed_n=$(printf '%s' "$details" | grep -oE '[0-9]+ passed' | grep -oE '[0-9]+' | head -1)
-    _tr_failed_n=$(printf '%s' "$details" | grep -oE '[0-9]+ failed' | grep -oE '[0-9]+' | head -1)
-    # node --test emits TAP-ish "# pass N" / "# fail N" summary lines, which the
-    # "N passed"/"N failed" pattern above does not match. Fall back to those.
-    [ -n "$_tr_passed_n" ] || _tr_passed_n=$(printf '%s' "$details" | grep -oE '# pass [0-9]+' | grep -oE '[0-9]+' | head -1)
-    [ -n "$_tr_failed_n" ] || _tr_failed_n=$(printf '%s' "$details" | grep -oE '# fail [0-9]+' | grep -oE '[0-9]+' | head -1)
-    [ -n "$_tr_passed_n" ] || _tr_passed_n=null
-    [ -n "$_tr_failed_n" ] || _tr_failed_n=null
-
     # verification_gap is "none" whenever a real runner executed AND ran tests:
     # the suite ran, so there is no docs-without-execution / source-without-tests
     # gap. The #82 zero-test case is the exception -- a runner ran but executed
@@ -12787,9 +12962,11 @@ os.replace(tmp, out)
         if [ "$_tr_zero_tests" = "true" ]; then
             rm -f "$quality_dir/unit-tests.pass" 2>/dev/null || true
             log_warn "Test suite gate: $test_runner ran zero tests -- inconclusive (not passed, not failed)"
+            _LOKI_TEST_SUITE_STATUS=not_run  # BACKLOG 91, see the no-runner return
         else
             touch "$quality_dir/unit-tests.pass"
             log_info "Test suite gate: $test_runner passed"
+            _LOKI_TEST_SUITE_STATUS=pass
         fi
         # Coverage block is distinct from tests-red: tests passed, but enforced
         # coverage is below threshold. Return nonzero to gate WITHOUT writing the
@@ -24587,8 +24764,12 @@ EOF
                 local _stg_t0=$(date +%s 2>/dev/null); local _stg_ok=pass
                 # F49: isolate HOME so the project's suite cannot pollute the
                 # user's real home when it execs the generated app.
+                _LOKI_TEST_SUITE_STATUS=""
                 if _loki_with_app_sandbox enforce_test_coverage; then
                     clear_gate_failure "test_coverage"
+                    # BACKLOG 91: a zero-test or no-runner run returns 0 without
+                    # measuring anything; its stage status is not_run, not pass.
+                    if [ "$_LOKI_TEST_SUITE_STATUS" = "not_run" ]; then _stg_ok=not_run; fi
                 else
                     _stg_ok=fail
                     local tc_count
@@ -25688,11 +25869,33 @@ kill_provider_child() {
         fi
         kill -TERM "$child_pid" 2>/dev/null && killed=1
     done
-    # Also kill provider leaf processes by name in case they were reparented.
-    local proc
-    for proc in claude codex aider cline; do
-        pkill -TERM -f "^${proc}( |$)" 2>/dev/null && killed=1
-    done
+    # Also kill provider leaf processes in case they were reparented (to init,
+    # once their immediate parent -- a shell or the provider CLI itself --
+    # exited). A reparented process changes PARENT, not PROCESS GROUP: unless
+    # a process explicitly calls setpgid/setsid, it keeps the pgid it was
+    # launched into, which for every invoke_* call above is this shell's own
+    # pgid ($$). Scope the sweep to that pgid, matched by process name, rather
+    # than a bare `pkill -f "^claude( |$)"` -- that matched the FULL COMMAND
+    # LINE of every "claude", "codex", "aider" or "cline" process on the whole
+    # machine, with no scoping at all, and killed unrelated Claude Code
+    # sessions in other terminals the moment ANY loki-mode run finished,
+    # double-Ctrl-C'd, or Ctrl-C'd in perpetual mode (build prompt D14 and
+    # `feedback-pkill-f-substring-killed-the-session`). Reproduced: a decoy
+    # `claude` process in a DIFFERENT process group survived; one launched
+    # inside this shell's job (matching how a real reparented leaf would sit)
+    # was still caught.
+    local proc my_pgid
+    my_pgid="$(ps -o pgid= -p $$ 2>/dev/null | tr -d ' ')"
+    if [ -n "$my_pgid" ]; then
+        for proc in claude codex aider cline; do
+            local leaf_pid leaf_pgid
+            for leaf_pid in $(pgrep -f "^${proc}( |$)" 2>/dev/null); do
+                leaf_pgid="$(ps -o pgid= -p "$leaf_pid" 2>/dev/null | tr -d ' ')"
+                [ -n "$leaf_pgid" ] && [ "$leaf_pgid" = "$my_pgid" ] || continue
+                kill -TERM "$leaf_pid" 2>/dev/null && killed=1
+            done
+        done
+    fi
 
     # Brief wait for graceful exit (max ~2s).
     local i=0

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "9.54.0"
+__version__ = "9.54.2"
 
 # Expose the control app for easy import
 try:

package/dashboard/api_v2.py

@@ -894,6 +894,10 @@ async def verify_audit_integrity():
 
     return {
         "valid": aggregate["valid"],
+        # verified/status: whether anything was checked (valid stays True for
+        # an empty chain); see audit.verify_all_logs_in_dir.
+        "verified": aggregate["verified"],
+        "status": aggregate["status"],
         "files_checked": aggregate["files_checked"],
         "files_skipped": aggregate.get("files_skipped", 0),
         "entries_checked": aggregate.get("entries_checked", 0),

package/dashboard/audit.py

@@ -657,7 +657,8 @@ def verify_all_logs_in_dir(audit_dir) -> dict:
     if not audit_dir.exists():
         return {"valid": True, "files_checked": 0, "files_skipped": 0,
                 "entries_checked": 0, "first_tampered_file": None,
-                "first_tampered_line": None, "genesis_file": None}
+                "first_tampered_line": None, "genesis_file": None,
+                "verified": False, "status": "nothing_checked"}
     # v7.7.15 council fix (Opus 2): rotated files have name shape
     # `audit-YYYY-MM-DD.HHMMSS.jsonl` (from `_rotate_logs_if_needed` at
     # line 167). Lexicographic sort puts `audit-2026-05-04.123456.jsonl`
@@ -689,8 +690,13 @@ def verify_all_logs_in_dir(audit_dir) -> dict:
                 "first_tampered_file": str(log_file),
                 "first_tampered_line": result.get("first_tampered_line"),
                 "genesis_file": genesis_file,
+                "verified": False,
+                "status": "tampered",
             }
         prev_hash = result.get("last_hash", prev_hash)
+    # `valid` means "no break found" and stays True for an empty chain (the
+    # cross-chain verifier reads it). `verified` and `status` say whether
+    # anything was actually checked: zero files checked is not a verified chain.
     return {
         "valid": True,
         "files_checked": files_checked,
@@ -699,6 +705,8 @@ def verify_all_logs_in_dir(audit_dir) -> dict:
         "first_tampered_file": None,
         "first_tampered_line": None,
         "genesis_file": genesis_file,
+        "verified": files_checked > 0,
+        "status": "verified" if files_checked > 0 else "nothing_checked",
     }
 
 

package/dashboard/auth.py

@@ -343,6 +343,18 @@ def list_tokens(include_revoked: bool = False) -> list[dict]:
     return result
 
 
+def _deadline_passed(value) -> bool:
+    """True when an ISO-8601 deadline is in the past, or cannot be read.
+
+    Fails closed: an unparseable value, or a naive timestamp that cannot be
+    ordered against an aware "now", is treated as passed.
+    """
+    try:
+        return datetime.now(timezone.utc) > datetime.fromisoformat(str(value))
+    except (TypeError, ValueError):
+        return True
+
+
 def validate_token(raw_token: str) -> Optional[dict]:
     """
     Validate a raw token.
@@ -372,10 +384,10 @@ def validate_token(raw_token: str) -> Optional[dict]:
         if matched_token.get("revoked"):
             return None
 
-        # Check expiration
-        if matched_token.get("expires_at"):
-            expires = datetime.fromisoformat(matched_token["expires_at"])
-            if datetime.now(timezone.utc) > expires:
+        # Check expiration, and the grace period of a rotated-out key
+        # (api_keys.rotate_key sets rotation_expires_at on the old key).
+        for field in ("expires_at", "rotation_expires_at"):
+            if matched_token.get(field) and _deadline_passed(matched_token[field]):
                 return None
 
         # Update last used