loki-mode 9.54.0 → 9.55.0

package/docs/v10/SWARM.md

@@ -0,0 +1,237 @@
+# The swarm
+
+Adopted 2026-09-26, superseding the one-cycle-at-a-time loop in `docs/v10/PROGRESS.md`
+for everything after cycle 4. Goal: 10-20x more releases per day than cycles
+1-4 (about 3 releases in 18 hours), without weakening anything in
+`docs/LOKI-10-BUILD-PROMPT.md` sections 2, 5b or 5c, or any global "never do"
+rule. Full text of the founder's prompt: `docs/v10/SWARM-PROMPT.md`.
+
+## Why cycles were slow
+
+Each cycle batched 3-6 slices into one release, reviewed the whole batch in
+serial council rounds (cycle 1 took 9 rounds, cycle 3 took 6, cycle 4's P7
+property was found falsely PROVEN in three consecutive rounds before a fourth
+caught it), then verified every channel before the next cycle started. Every
+release waited on the slowest slice and on every round.
+
+## Changes from the swarm prompt, and why (see DECISIONS.md D12, D13)
+
+- **D12: unanimous APPROVE, not "3 of 4".** The founder's prompt scored
+  HIGH-tier review as "3 of 4 approve". CLAUDE.md's SDLC fleet pattern
+  requires unanimous APPROVE and a full re-run on any CONCERN or REJECT.
+  Cycle-4 round 3 was APPROVE, APPROVE, CONCERN, and the concern was a real
+  false PROVEN; a vote-count rule would have shipped it. A HIGH-tier round may
+  add a fourth adversarial reviewer for extra recall, but any reviewer's
+  blocking finding with a working reproduction blocks the slice regardless of
+  the count, and the whole council re-runs after the fix.
+- **D13: every review or council agent pins its model explicitly.** Round 4
+  of the cycle-4 council was launched with two of three lenses left to
+  inherit the session model; the session model changed between launch and
+  the lenses resolving, so a round meant to run 2 Opus + 1 Sonnet in fact ran
+  3 Sonnet-5 lenses. It was killed and relaunched with every lens pinned.
+  Every council, review or HIGH-tier script from here on sets `model`
+  explicitly; composition is enforced by the script, never assumed from the
+  session.
+- **Section 5c.5 (single writer) still governs.** One agent, the Release
+  Captain, writes `main`, `VERSION`, tags and publishes. Builders are each a
+  single writer on their own declared file set, never on `main`. Parallel
+  reviewers are read-only. This is what the swarm's role split already is;
+  it is restated here because the swarm looks superficially like
+  peer-to-peer and it is not.
+- **`scripts/release.sh` is stale**, covering only `VERSION`,
+  `package.json`, `vscode-extension/package.json`. The Captain does not run
+  it as-is; the Captain follows CLAUDE.md's 14-file release checklist
+  directly (see Captain brief below), and fixing `scripts/release.sh` to
+  match is a queued LOW slice (BOARD).
+- **Budget:** the founder was asked whether to size wave 1 to a conservative
+  estimate or launch at planned scale without a live cost feed, given
+  cycle-5 alone had already run about 3.3M subagent output tokens before the
+  swarm started. Founder chose full scale. METRICS.md still records a
+  labelled *estimate* per wave (subagent token counts from workflow
+  journals, not exact billing) so spend stays visible even though it does
+  not gate wave size. If a wave's estimate would cross a plausible reading of
+  founder-queue item 3, the swarm drops to 3 builders, keeps shipping LOW
+  slices, and adds a founder-queue line asking for a clearer budget signal.
+
+## Roles
+
+All roles are agents spawned through `Workflow`, run in git worktrees for
+isolation except the Product Owner and Release Captain, which touch shared
+state files and must serialize.
+
+### 1. Product Owner (PO)
+
+One agent per wave planning step (re-spawned fresh each time it is needed;
+it writes `BACKLOG.md` and `BOARD.md`, never code). Ranks the backlog per
+build-prompt section 3 (moat and red-main first, then metric-moved / effort).
+Cuts work into release-sized slices:
+
+- under about 300 changed lines;
+- one owner;
+- a declared file set that overlaps no other in-flight slice (hot files and
+  generated bundles are never in a builder's file set: see "Hot files"
+  below);
+- acceptance checks written before building (the Wall, section 5c.1);
+- a risk tier (HIGH / MEDIUM / LOW, see Reviewers).
+
+Keeps roughly twice the builder count of ready slices queued.
+
+### 2. Builders
+
+6-10 in parallel, `isolation: "worktree"`, one slice each, single writer on
+that slice. Each builder:
+
+- runs `git merge --ff-only <captain's current main sha>` first (worktrees
+  cut from origin/main, not local main: see memory
+  `feedback-worktree-agents-base-branch`);
+- implements with red-then-green tests;
+- runs diff-scoped tests plus `bash tests/moat/run.sh` in its own worktree;
+- never touches `main`, `VERSION`, or any hot file or bundle listed below;
+- returns BLOCKED (never guesses past its file set) if the slice needs a
+  file outside its declared set, so the PO can re-slice.
+
+### 3. Reviewers
+
+Read-only, parallel, diff-scoped, tiered by risk. Every finding needs a
+reproduction (file:line, a concrete failing scenario, the fix). Models are
+always pinned explicitly (D13):
+
+- **HIGH** (verifier, Seal, gates, council, exit codes, auth, secrets,
+  `tests/moat`, anything touching the trust core): 3 reviewers with
+  different lenses (correctness, security/bypass, fail-closed) plus 1
+  adversarial reviewer told to find a false pass. All 4 pinned to `opus`
+  except the adversarial slot, which may run `sonnet` for a genuinely
+  different read. **Unanimous APPROVE required (D12).** Any blocking finding
+  with a reproduction blocks regardless of the other votes; after a fix,
+  the whole HIGH council re-runs from round 1.
+- **MEDIUM** (runtime, CLI behavior, dashboard logic without a trust-core
+  path): 2 reviewers, pinned `opus`. Unanimous APPROVE required; one
+  CONCERN re-runs both after the fix.
+- **LOW** (docs, copy, tests-only, UI with no data path, deleting
+  unreachable code): 1 reviewer, may be pinned `sonnet`. APPROVE required;
+  a CONCERN re-runs it after the fix.
+
+After 3 rounds at any tier without unanimous APPROVE, the slice goes back to
+the PO to be cut smaller. It never blocks the line: other slices keep moving
+through the pipeline.
+
+### 4. Release Captain
+
+Exactly one, never parallelized, serialized by a promise chain within one
+Workflow run (see "Cross-wave exclusion"). The only agent allowed to write
+`main`, bump `VERSION`, tag, or publish. For each approved slice, in order:
+
+1. Rebase the slice onto current `origin/main`.
+2. Apply any hot-file additions the slice requested (below), mechanically.
+3. Rebuild every bundle the slice's file set could affect (below).
+4. Run `bash scripts/local-ci.sh` (fast tier) and `bash tests/moat/run.sh`.
+   The ratchet (`pending.txt` shrink-only, `cases.txt` grow-only, D2) must
+   not regress; a regression refuses the merge and returns the slice to its
+   builder.
+5. Stage by name (never `git add -A`), commit with the repo-local asklokesh
+   identity, push.
+6. Bump `VERSION` and the other 13 files per CLAUDE.md's release checklist
+   (`scripts/release.sh` is stale; do this directly, not through the
+   script), rebuild dashboard and dist, run the full pre-publish validation,
+   commit as the push head, push with `PRE_PUSH_SKIP=1` (D5).
+7. Wait for the previous release's required-ci (Tests, Bun Parity, Security
+   Audit) to go green before bumping `VERSION` again, so releases never
+   cancel each other's CI (the v9.7-v9.9 failure, and
+   `feedback-release-push-cancels-tests`). If several slices are ready
+   while waiting, batch them into the next release rather than idle.
+8. On a code conflict, send the slice back to its builder with the new base.
+   The Captain never resolves a code conflict itself.
+9. After a required-ci failure, rerun the failed job once; if the second
+   run also fails, do a full `gh run rerun` (never `--failed`) on the whole
+   Release run, and wait out the roughly 4-minute npm propagation window
+   before treating a publish as real
+   (`feedback-release-rerun-must-be-full-not-failed`,
+   `feedback-npm-propagation-window-4min`).
+
+**Hot files** (never in any builder's declared file set; the Captain applies
+requested additions mechanically at merge time):
+`tests/moat/cases.txt`, `tests/moat/pending.txt` (merge with
+`scratchpad/union_cases.py`'s approach: union for cases, intersection-aware
+shrink for pending), `CHANGELOG.md`, `docs/v10/BACKLOG.md`,
+`docs/v10/BOARD.md`, `docs/v10/PROGRESS.md`, `docs/v10/METRICS.md`,
+`scripts/local-ci.sh` (`_FAST_KEEP` entries and `run_check` call sites),
+`tests/run-all-tests.sh`.
+
+**Generated bundles** (never edited by hand by a builder; the Captain
+rebuilds all three after every merge that could touch their sources):
+`loki-ts/dist/loki.js` (from `loki-ts/src`), `dashboard/static/index.html`
+and `dashboard-ui/dist` (from `dashboard-ui/scripts/build-standalone.js` and
+components), `web-app/dist` (from `web-app/src`).
+
+**Cross-wave exclusion:** a promise chain only serializes within one
+`Workflow` run. The swarm runs the PO-refill and Captain-queue loop inside a
+single long-running `Workflow` invocation rather than launching a fresh one
+per wave, so there is exactly one Captain at any time. If a script must be
+edited and re-invoked, the previous run is stopped first (`TaskStop`) and its
+in-flight slices are recovered from `BOARD.md` before the new run starts.
+
+### 5. Channel Verifier
+
+One, async, read-only, spawned after each release. Checks npm `latest` and
+`gitHead`, the tag, the GitHub release, Docker amd64/arm64, the Homebrew
+sha256, and a smoke test from a fresh PATH. Never blocks the next merge. A
+failure becomes a HIGH-priority fix-forward slice through the normal PO
+queue. Never unpublishes or deletes a version.
+
+## Orchestration
+
+- Repeated `Workflow` waves inside one long run: the PO produces up to 10
+  ready slices, then `pipeline(slices, build -> verify -> review/fix loop ->
+  captain queue)`. `pipeline`, not `parallel`, so a LOW slice ships while a
+  HIGH slice is still mid-review.
+- The Captain step in the pipeline is itself a promise chain
+  (`captainQueue = captainQueue.then(() => mergeAndRelease(slice))`), so
+  exactly one merge or release runs at a time even though builders and
+  reviewers for other slices run concurrently.
+- BOARD.md (slice id, owner, file set, tier, status, blockers) is the
+  coordination surface between agents; only the PO and the Captain write it.
+- The next wave's PO step starts as soon as ready slices run low; the
+  script never waits on Channel Verifier output before starting more work.
+
+## Speed levers, in priority order
+
+1. One slice, one release.
+2. Risk-tiered review; most slices are LOW or MEDIUM.
+3. Parallel reviewers per slice instead of serial whole-batch rounds.
+4. Asynchronous channel verification.
+5. Diff-scoped tests while building; the full fast tier plus moat run only
+   at merge.
+6. Flaky tests: rerun once, record it in `BACKLOG.md`, open a slice. Never
+   pass a flake silently (BACKLOG 93).
+
+## Guardrails (restated; speed pressure erodes them first)
+
+- Priority when goals conflict: moat > Seal accuracy > delivered accuracy >
+  cost > speed (build prompt 5b).
+- The moat ratchet never regresses on `main`.
+- If two releases in a row fail required-ci, stop releasing, fix `main`,
+  resume only when green.
+- No force push. Never delete versions or tags. Never disable a test or
+  guard to get green.
+- Every "never do" item in build-prompt section 1 still applies without
+  exception, swarm or not.
+- Section 5c.5 (single writer): one agent writes a given change; parallel
+  agents are read-only; parallelize only across independent items under one
+  central coordinator, never peer-to-peer.
+- Section 5c.11 (injection-safe intake): P9's split jobs and token
+  withholding (cycle 5) are the concrete form of this rule; the swarm's own
+  agent-authored slices never combine untrusted input, an agent, and push
+  rights either.
+
+## Metrics (appended to METRICS.md after every wave)
+
+- releases in the last 24h
+- median slice lead time (ready to npm)
+- review rounds per slice, by tier
+- moat proven count
+- required-ci failures
+- spend estimate (subagent output tokens from workflow journals x published
+  per-token price, labelled ESTIMATE, not exact billing)
+
+Target: at least 30 releases per 24h at steady state, moat proven count never
+decreasing.

package/loki-ts/dist/loki.js

@@ -1,5 +1,5 @@
 // @bun
-var dt=Object.create;var{getPrototypeOf:pt,defineProperty:jG,getOwnPropertyNames:ct}=Object;var lt=Object.prototype.hasOwnProperty;function it($){return this[$]}var at,ot,st=($,X,Q)=>{var z=$!=null&&typeof $==="object";if(z){var Z=X?at??=new WeakMap:ot??=new WeakMap,K=Z.get($);if(K)return K}Q=$!=null?dt(pt($)):{};let J=X||!$||!$.__esModule?jG(Q,"default",{value:$,enumerable:!0}):Q;for(let q of ct($))if(!lt.call(J,q))jG(J,q,{get:it.bind($,q),enumerable:!0});if(z)Z.set($,J);return J};var Zq=($,X)=>()=>(X||$((X={exports:{}}).exports,X),X.exports);var nt=($)=>$;function rt($,X){this[$]=nt.bind(null,X)}var B1=($,X)=>{for(var Q in X)jG($,Q,{get:X[Q],enumerable:!0,configurable:!0,set:rt.bind(X,Q)})};var s=($,X)=>()=>($&&(X=$($=0)),X);var w5=import.meta.require;var WR={};B1(WR,{lokiDir:()=>h0,homeLokiDir:()=>GQ,findRepoRootForVersion:()=>AG,REPO_ROOT:()=>O1});import{resolve as h2,dirname as LG}from"path";import{fileURLToPath as tt}from"url";import{existsSync as Kq}from"fs";import{homedir as et}from"os";function $e(){let $=HR;for(let X=0;X<6;X++){if(Kq(h2($,"VERSION"))&&Kq(h2($,"autonomy/run.sh")))return $;let Q=LG($);if(Q===$)break;$=Q}return h2(HR,"..","..","..")}function AG($){let X=$;for(let Q=0;Q<6;Q++){if(Kq(h2(X,"VERSION"))&&Kq(h2(X,"autonomy/run.sh")))return X;let z=LG(X);if(z===X)break;X=z}return h2($,"..","..","..")}function h0(){return process.env.LOKI_DIR??h2(process.cwd(),".loki")}function GQ(){return h2(et(),".loki")}var HR,O1;var k1=s(()=>{HR=LG(tt(import.meta.url));O1=$e()});import{readFileSync as Xe}from"fs";import{resolve as Qe,dirname as ze}from"path";import{fileURLToPath as Ze}from"url";function L9(){if(t3!==null)return t3;let $="9.54.0";if(typeof $==="string"&&$.length>0)return t3=$,t3;try{let X=ze(Ze(import.meta.url)),Q=AG(X);t3=Xe(Qe(Q,"VERSION"),"utf-8").trim()}catch{t3="unknown"}return t3}var t3=null;var Jq=s(()=>{k1()});var LR={};B1(LR,{runOrThrow:()=>Ae,run:()=>X1,readStreamCapped:()=>qq,commandVersion:()=>Te,commandExists:()=>g5,ShellError:()=>TG,MAX_STDOUT_BYTES:()=>jR});async function qq($,X=jR){let Q=$.getReader(),z=new TextDecoder,Z="",K=0;try{while(K<X){let{done:J,value:q}=await Q.read();if(J)break;if(!q)continue;if(K+=q.byteLength,K>X){let V=q.byteLength-(K-X);Z+=z.decode(q.subarray(0,V),{stream:!0});break}Z+=z.decode(q,{stream:!0})}Z+=z.decode()}finally{try{await Q.cancel()}catch{}Q.releaseLock()}return Z}async function X1($,X={}){let Q=Bun.spawn({cmd:[...$],stdout:"pipe",stderr:"pipe",env:X.env?{...process.env,...X.env}:process.env,cwd:X.cwd}),z,Z;if(X.timeoutMs&&X.timeoutMs>0)z=setTimeout(()=>{try{Q.kill("SIGTERM")}catch{}Z=setTimeout(()=>{try{Q.kill("SIGKILL")}catch{}},2000)},X.timeoutMs);try{let[K,J,q]=await Promise.all([qq(Q.stdout),new Response(Q.stderr).text(),Q.exited]);return{stdout:K,stderr:J,exitCode:q}}finally{if(z)clearTimeout(z);if(Z)clearTimeout(Z)}}async function Ae($,X={}){let Q=await X1($,X);if(Q.exitCode!==0)throw new TG(`command failed (${Q.exitCode}): ${$.join(" ")}`,Q.exitCode,Q.stdout,Q.stderr);return Q}async function g5($){let X=Ce($),Q=await X1(["sh","-c",`command -v ${X}`],{timeoutMs:5000});if(Q.exitCode===0)return Q.stdout.trim()||null;return null}function Ce($){if(!/^[A-Za-z0-9._/-]+$/.test($))throw Error(`refused to shell-escape suspect token: ${$}`);return $}async function Te($,X="--version"){if(!await g5($))return null;let z=await X1([$,X],{timeoutMs:5000});if(z.exitCode!==0)return null;return((z.stdout||z.stderr).split(/\r?\n/)[0]?.trim()??"")||null}var jR=16777216,TG;var y8=s(()=>{TG=class TG extends Error{message;exitCode;stdout;stderr;constructor($,X,Q,z){super($);this.message=$;this.exitCode=X;this.stdout=Q;this.stderr=z;this.name="ShellError"}}});function g2($){return De?"":$}var De,p0,$5,Z1,E61,A1,f1,m5,n;var e7=s(()=>{De=(process.env.NO_COLOR??"").length>0;p0=g2("\x1B[0;31m"),$5=g2("\x1B[0;32m"),Z1=g2("\x1B[1;33m"),E61=g2("\x1B[0;34m"),A1=g2("\x1B[0;36m"),f1=g2("\x1B[1m"),m5=g2("\x1B[2m"),n=g2("\x1B[0m")});import{existsSync as ye}from"fs";async function Z2(){if(BQ!==void 0)return BQ;let $="/opt/homebrew/bin/python3.12";if(ye($))return BQ=$,$;let X=await g5("python3.12");if(X)return BQ=X,X;let Q=await g5("python3");return BQ=Q,Q}async function I4($,X={}){let Q=await Z2();if(!Q)return{stdout:"",stderr:"python3 not found",exitCode:127};return X1([Q,"-c",$],X)}var BQ;var m2=s(()=>{y8()});var gR={};B1(gR,{runStatus:()=>Z00});import{existsSync as u5,readFileSync as T9,readdirSync as kR,statSync as SR}from"fs";import{resolve as A5,basename as se}from"path";import{homedir as ne}from"os";function yR($){let X=Math.trunc($);if(X>=1e6)return`${(Math.trunc(X/1e6*10)/10).toFixed(1)}M`;if(X>=1000)return`${(Math.trunc(X/1000*10)/10).toFixed(1)}K`;return String(X)}function bR($,X,Q){if(X===0)return null;let z=Math.trunc($*100/X),Z=Math.trunc($*Yq/X);if(Z>Yq)Z=Yq;let K=Yq-Z,J=$5;if(z>=80)J=p0;else if(z>=50)J=Z1;let q="=".repeat(Math.max(0,Z))+" ".repeat(Math.max(0,K)),V=yR($),Y=yR(X);return`  ${f1}${Q}${n} ${J}[${q}]${n} ${z}% (${V} / ${Y})`}async function te(){if(await g5("jq"))return!0;return process.stdout.write(`${p0}Error: jq is required but not installed.${n}
+var dt=Object.create;var{getPrototypeOf:pt,defineProperty:jG,getOwnPropertyNames:ct}=Object;var lt=Object.prototype.hasOwnProperty;function it($){return this[$]}var at,ot,st=($,X,Q)=>{var z=$!=null&&typeof $==="object";if(z){var Z=X?at??=new WeakMap:ot??=new WeakMap,K=Z.get($);if(K)return K}Q=$!=null?dt(pt($)):{};let J=X||!$||!$.__esModule?jG(Q,"default",{value:$,enumerable:!0}):Q;for(let q of ct($))if(!lt.call(J,q))jG(J,q,{get:it.bind($,q),enumerable:!0});if(z)Z.set($,J);return J};var Zq=($,X)=>()=>(X||$((X={exports:{}}).exports,X),X.exports);var nt=($)=>$;function rt($,X){this[$]=nt.bind(null,X)}var B1=($,X)=>{for(var Q in X)jG($,Q,{get:X[Q],enumerable:!0,configurable:!0,set:rt.bind(X,Q)})};var s=($,X)=>()=>($&&(X=$($=0)),X);var w5=import.meta.require;var WR={};B1(WR,{lokiDir:()=>h0,homeLokiDir:()=>GQ,findRepoRootForVersion:()=>AG,REPO_ROOT:()=>O1});import{resolve as h2,dirname as LG}from"path";import{fileURLToPath as tt}from"url";import{existsSync as Kq}from"fs";import{homedir as et}from"os";function $e(){let $=HR;for(let X=0;X<6;X++){if(Kq(h2($,"VERSION"))&&Kq(h2($,"autonomy/run.sh")))return $;let Q=LG($);if(Q===$)break;$=Q}return h2(HR,"..","..","..")}function AG($){let X=$;for(let Q=0;Q<6;Q++){if(Kq(h2(X,"VERSION"))&&Kq(h2(X,"autonomy/run.sh")))return X;let z=LG(X);if(z===X)break;X=z}return h2($,"..","..","..")}function h0(){return process.env.LOKI_DIR??h2(process.cwd(),".loki")}function GQ(){return h2(et(),".loki")}var HR,O1;var k1=s(()=>{HR=LG(tt(import.meta.url));O1=$e()});import{readFileSync as Xe}from"fs";import{resolve as Qe,dirname as ze}from"path";import{fileURLToPath as Ze}from"url";function L9(){if(t3!==null)return t3;let $="9.55.0";if(typeof $==="string"&&$.length>0)return t3=$,t3;try{let X=ze(Ze(import.meta.url)),Q=AG(X);t3=Xe(Qe(Q,"VERSION"),"utf-8").trim()}catch{t3="unknown"}return t3}var t3=null;var Jq=s(()=>{k1()});var LR={};B1(LR,{runOrThrow:()=>Ae,run:()=>X1,readStreamCapped:()=>qq,commandVersion:()=>Te,commandExists:()=>g5,ShellError:()=>TG,MAX_STDOUT_BYTES:()=>jR});async function qq($,X=jR){let Q=$.getReader(),z=new TextDecoder,Z="",K=0;try{while(K<X){let{done:J,value:q}=await Q.read();if(J)break;if(!q)continue;if(K+=q.byteLength,K>X){let V=q.byteLength-(K-X);Z+=z.decode(q.subarray(0,V),{stream:!0});break}Z+=z.decode(q,{stream:!0})}Z+=z.decode()}finally{try{await Q.cancel()}catch{}Q.releaseLock()}return Z}async function X1($,X={}){let Q=Bun.spawn({cmd:[...$],stdout:"pipe",stderr:"pipe",env:X.env?{...process.env,...X.env}:process.env,cwd:X.cwd}),z,Z;if(X.timeoutMs&&X.timeoutMs>0)z=setTimeout(()=>{try{Q.kill("SIGTERM")}catch{}Z=setTimeout(()=>{try{Q.kill("SIGKILL")}catch{}},2000)},X.timeoutMs);try{let[K,J,q]=await Promise.all([qq(Q.stdout),new Response(Q.stderr).text(),Q.exited]);return{stdout:K,stderr:J,exitCode:q}}finally{if(z)clearTimeout(z);if(Z)clearTimeout(Z)}}async function Ae($,X={}){let Q=await X1($,X);if(Q.exitCode!==0)throw new TG(`command failed (${Q.exitCode}): ${$.join(" ")}`,Q.exitCode,Q.stdout,Q.stderr);return Q}async function g5($){let X=Ce($),Q=await X1(["sh","-c",`command -v ${X}`],{timeoutMs:5000});if(Q.exitCode===0)return Q.stdout.trim()||null;return null}function Ce($){if(!/^[A-Za-z0-9._/-]+$/.test($))throw Error(`refused to shell-escape suspect token: ${$}`);return $}async function Te($,X="--version"){if(!await g5($))return null;let z=await X1([$,X],{timeoutMs:5000});if(z.exitCode!==0)return null;return((z.stdout||z.stderr).split(/\r?\n/)[0]?.trim()??"")||null}var jR=16777216,TG;var y8=s(()=>{TG=class TG extends Error{message;exitCode;stdout;stderr;constructor($,X,Q,z){super($);this.message=$;this.exitCode=X;this.stdout=Q;this.stderr=z;this.name="ShellError"}}});function g2($){return De?"":$}var De,p0,$5,Z1,E61,A1,f1,m5,n;var e7=s(()=>{De=(process.env.NO_COLOR??"").length>0;p0=g2("\x1B[0;31m"),$5=g2("\x1B[0;32m"),Z1=g2("\x1B[1;33m"),E61=g2("\x1B[0;34m"),A1=g2("\x1B[0;36m"),f1=g2("\x1B[1m"),m5=g2("\x1B[2m"),n=g2("\x1B[0m")});import{existsSync as ye}from"fs";async function Z2(){if(BQ!==void 0)return BQ;let $="/opt/homebrew/bin/python3.12";if(ye($))return BQ=$,$;let X=await g5("python3.12");if(X)return BQ=X,X;let Q=await g5("python3");return BQ=Q,Q}async function I4($,X={}){let Q=await Z2();if(!Q)return{stdout:"",stderr:"python3 not found",exitCode:127};return X1([Q,"-c",$],X)}var BQ;var m2=s(()=>{y8()});var gR={};B1(gR,{runStatus:()=>Z00});import{existsSync as u5,readFileSync as T9,readdirSync as kR,statSync as SR}from"fs";import{resolve as A5,basename as se}from"path";import{homedir as ne}from"os";function yR($){let X=Math.trunc($);if(X>=1e6)return`${(Math.trunc(X/1e6*10)/10).toFixed(1)}M`;if(X>=1000)return`${(Math.trunc(X/1000*10)/10).toFixed(1)}K`;return String(X)}function bR($,X,Q){if(X===0)return null;let z=Math.trunc($*100/X),Z=Math.trunc($*Yq/X);if(Z>Yq)Z=Yq;let K=Yq-Z,J=$5;if(z>=80)J=p0;else if(z>=50)J=Z1;let q="=".repeat(Math.max(0,Z))+" ".repeat(Math.max(0,K)),V=yR($),Y=yR(X);return`  ${f1}${Q}${n} ${J}[${q}]${n} ${z}% (${V} / ${Y})`}async function te(){if(await g5("jq"))return!0;return process.stdout.write(`${p0}Error: jq is required but not installed.${n}
 `),process.stdout.write(`Install with:
 `),process.stdout.write(`  brew install jq    (macOS)
 `),process.stdout.write(`  apt install jq     (Debian/Ubuntu)
@@ -335,10 +335,13 @@ print(json.dumps(result, indent=2))
 Start a session with: loki start <prd>`}}let Z=Y00(z);return{exitCode:0,stdout:X?U00(Z,Q):H00(Z,Q)}}async function W00($){let{emitDeprecatedAlias:X}=await Promise.resolve().then(() => (IG(),dR));X("stats","report session",$);let Q=lR($);return console.log(Q.stdout),Q.exitCode}var aR=s(()=>{k1();e7()});var ZI={};B1(ZI,{skillsForJson:()=>eR,runDoctor:()=>E00,renderProviderAvailability:()=>QI,readProviderAvailability:()=>XI,readEffectiveProvider:()=>tR,pythonImportOk:()=>SG,httpReachable:()=>xG,describeCatalogFreshness:()=>fG,checkTool:()=>rR,checkSkills:()=>yG,checkDisk:()=>kG,buildDoctorJson:()=>zI,_setPythonImportOkForTest:()=>j00});import{existsSync as MQ,lstatSync as G00,readFileSync as oR,readlinkSync as B00,statfsSync as N00}from"fs";import{spawnSync as I9}from"child_process";import{homedir as OQ}from"os";import{resolve as e3}from"path";function O00($){let X=$.match(M00);return X?X[1]:null}async function sR($){try{let X=await X1([$,"--version"],{timeoutMs:5000}),Q=(X.stdout||X.stderr||"").trim();return O00(Q)}catch{return null}}function nR($,X){let Q=$.split(".").map((Z)=>parseInt(Z,10)),z=X.split(".").map((Z)=>parseInt(Z,10));while(Q.length<2)Q.push(0);while(z.length<2)z.push(0);for(let Z=0;Z<2;Z++){let K=Q[Z]??0,J=z[Z]??0;if(Number.isNaN(K)||Number.isNaN(J))return 0;if(K!==J)return K-J}return 0}async function rR($,X,Q,z=null){let Z=await g5(X),K=Z!==null,J=K?await sR(X):null,q="pass";if(!K)q=Q==="required"?"fail":"warn";else if(z&&J){if(nR(J,z)<0)q=Q==="required"?"fail":"warn"}return{name:$,command:X,found:K,version:J,required:Q,min_version:z,status:q,path:Z}}function kG(){let $=null;try{let Q=N00(OQ()),z=Number(Q.bavail)*Number(Q.bsize);$=Math.round(z/1073741824*10)/10}catch{$=null}let X="pass";if($!==null){if($<1)X="fail";else if($<5)X="warn"}return{available_gb:$,status:X}}async function xG($,X=2000){try{return(await fetch($,{signal:AbortSignal.timeout(X)})).ok}catch{return!1}}async function SG($,X=!1){let Q=`import ${$}`,z=X?30000:5000;if(!X)return(await I4(Q,{timeoutMs:z})).exitCode===0;let Z=await Z2();if(!Z)return!1;return(await X1([Z,"-c",Q],{timeoutMs:z})).exitCode===0}function j00($){Bq.fn=$??SG}function tR(){let $=bG();if(!$)return null;try{let X=I9("bash",[$,"effective-provider"],{encoding:"utf8"});if(X.status!==0||!X.stdout)return null;let Q=X.stdout.trim();return Q===""?null:Q}catch{return null}}function yG($){let X=$===void 0?tR():$,Q=OQ();return L00.map(({name:z,dir:Z,id:K})=>{let J=e3(Q,Z),q=J,V=e3(J,"SKILL.md");if(MQ(V))return{name:z,path:q,status:"pass",detail:"",dangling:!1};try{if(G00(J).isSymbolicLink()){let U="unknown";try{U=B00(J)}catch{}return{name:z,path:q,status:"fail",detail:`(broken symlink -> ${U})`,dangling:!0}}}catch{}return{name:z,path:q,status:"warn",detail:"(not found - run 'loki setup-skill')",dangling:!1}})}function eR(){return yG().map(($)=>({name:$.name,path:$.path.startsWith(`${OQ()}/`)?`~/${$.path.slice(OQ().length+1)}`:$.path,status:$.status,detail:$.status==="pass"?null:$.status==="fail"?"broken symlink. Fix: loki setup-skill":"not found - run loki setup-skill",required:"required"}))}async function $I(){return Promise.all(A00.map(async($)=>{return{...await rR($.jsonName,$.cmd,$.required,$.min??null),displayName:$.displayName}}))}function bG(){let $=e3(O1,"autonomy/provider-offer.sh");return MQ($)?$:null}function XI(){let $=bG();if(!$)return null;try{let X=I9("bash",[$,"providers-json"],{encoding:"utf8"});if(X.status!==0||!X.stdout)return null;let Q=JSON.parse(X.stdout);if(!Q||!Array.isArray(Q.providers))return null;return Q}catch{return null}}function QI(){let $=bG();if(!$)return"";try{let X=I9("bash",[$,"providers"],{encoding:"utf8"});if(X.status!==0||!X.stdout)return"";return X.stdout}catch{return""}}async function C00(){let X=await g5("sentrux")!==null,Q=X?await sR("sentrux"):null;return{found:X,version:Q,status:X?"pass":"warn",required:"optional"}}async function T00(){let $=(process.env.LOKI_PROOF_GPG_KEY??"").trim()!=="",X=await g5("gpg")!==null,Q=$&&X;return{enabled:Q,key_configured:$,gpg_available:X,status:Q?"pass":"warn",required:"optional"}}async function D00(){let{openSync:$,statSync:X,readSync:Q,closeSync:z,existsSync:Z}=await import("fs"),{join:K}=await import("path"),J=65536,q=process.env.LOKI_DIR??".loki",V=K(q,"memory",".errors.log"),Y=[],U=!1;try{if(Z(V)){U=!0;let H=X(V).size,W=Math.max(0,H-65536),G=H-W,N=Buffer.alloc(G),M=$(V,"r");try{Q(M,N,0,G,W)}finally{z(M)}let j=N.toString("utf-8").split(`
 `);if(W>0&&j.length>0)j=j.slice(1);j=j.map((B)=>B.trim()).filter((B)=>B.length>0),Y=j.slice(-5)}}catch{Y=[]}return{errors_log_path:U?V:null,recent_errors:Y,recent_error_count:Y.length,status:Y.length===0?"pass":"warn"}}function fG(){let $=process.env.LOKI_MODEL_CATALOG||e3(O1,"providers/model_catalog.json"),X,Q;try{X=JSON.parse(oR($,"utf-8")).updated;let z=Date.parse(`${X}T00:00:00Z`),Z=Date.parse(`${new Date().toISOString().slice(0,10)}T00:00:00Z`);if(Number.isNaN(z))throw Error("bad date");Q=Math.round((Z-z)/86400000)}catch{return{status:"warn",updated:null,age_days:null,detail:'Catalog unreadable or missing an ISO "updated" date -- cannot determine age'}}return Q>F00?{status:"warn",updated:X,age_days:Q,detail:`Last updated ${X} (${Q} days ago) -- may be missing newer models`}:{status:"pass",updated:X,age_days:Q,detail:`Last updated ${X} (${Q} days ago)`}}async function zI(){let X=(await $I()).map(({displayName:W,...G})=>G),Q=kG(),z=await C00(),Z=await T00(),K=await D00(),J=0,q=0,V=0;for(let W of X)if(W.status==="pass")J++;else if(W.status==="fail")q++;else V++;if(Q.status==="pass")J++;else if(Q.status==="fail")q++;else V++;let Y=["claude","codex","cline","aider","opencode"].some((W)=>X.find((G)=>G.command===W)?.found===!0),U={found:Y,status:Y?"pass":"fail",required:"required",detail:Y?null:"No AI provider CLI. Fix: npm install -g @anthropic-ai/claude-code"};if(Y)J++;else q++;let H=eR();for(let W of H)if(W.status==="pass")J++;else if(W.status==="fail")q++;else V++;return{loki_mode_version:L9(),checks:X,provider_availability:XI(),disk:Q,ai_provider:U,skills:H,sentrux:z,receipt_signing:Z,memory:K,model_catalog:fG(),summary:{passed:J,failed:q,warnings:V,ok:q===0}}}function R00(){try{let $=process.env.CLAUDE_CONFIG_DIR||`${OQ()}/.claude`,X=oR(`${$}/.credentials.json`,"utf8");if(!X)return!1;let Q=JSON.parse(X)?.claudeAiOauth?.expiresAt;return typeof Q==="number"&&Q>0&&Q/1000<=Date.now()/1000+60}catch{return!1}}function I00(){try{let X=(I9("claude",["auth","status"],{encoding:"utf8",timeout:5000}).stdout||"").trim();if(!X)return"";let Q=JSON.parse(X);if(Q?.loggedIn===!0)return"yes";if(Q?.loggedIn===!1)return"no";return""}catch{return""}}function a0($){switch($){case"pass":return`${$5}PASS${n}`;case"fail":return`${p0}FAIL${n}`;case"warn":return`${Z1}WARN${n}`}}function Wq($){let X=$.version?` (v${$.version})`:"",Q=$.displayName;if(!$.found){let z=$.required==="required"?"not found":$.required==="recommended"?"not found (recommended)":"not found (optional)";return`  ${a0($.status)}  ${Q} - ${z}`}if($.min_version&&$.version&&nR($.version,$.min_version)<0){let z=$.required==="required"?"requires":"recommended";return`  ${a0($.status)}  ${Q}${X} - ${z} >= ${$.min_version}`}return`  ${a0($.status)}  ${Q}${X}`}function Gq($,X){if(X==="pass")$.pass++;else if(X==="fail")$.fail++;else $.warn++}function w00(){process.stdout.write(`${f1}loki doctor${n} - Check system prerequisites
 
-`),process.stdout.write(`Usage: loki doctor [--json]
+`),process.stdout.write(`Usage: loki doctor [--json] [--airgap]
 
 `),process.stdout.write(`Options:
 `),process.stdout.write(`  --json    Output machine-readable JSON
+`),process.stdout.write(`  --airgap  Audit network egress: model inference, telemetry and the
+`),process.stdout.write(`            update check, REQUIRED or optional, and how to disable
+`),process.stdout.write(`            each. Exits non-zero while a required egress remains.
 
 `),process.stdout.write(`Checks: node, python3, jq, git, curl, bash version,
 `),process.stdout.write(`        claude/codex CLIs, and disk space.
@@ -441,7 +444,7 @@ Start a session with: loki start <prd>`}}let Z=Y00(z);return{exitCode:0,stdout:X
 `),process.stdout.write(`Next: loki quickstart (guided first build from your idea, no PRD needed)
 `),process.stdout.write(`      or loki demo (builds a sample todo app end to end) or loki start ./prd.md
 `),0}async function E00($){let X=!1;for(let Q of $)if(Q==="--json")X=!0;else if(Q==="--help"||Q==="-h")return w00(),0;else return process.stderr.write(`${p0}Unknown option: ${Q}${n}
-`),process.stderr.write(`Usage: loki doctor [--json]
+`),process.stderr.write(`Usage: loki doctor [--json] [--airgap]
 `),1;if(X){let Q=await zI();return process.stdout.write(JSON.stringify(Q,null,2)+`
 `),Q.summary.ok?0:1}return P00()}var M00,Bq,L00,A00,F00=90;var KI=s(()=>{k1();y8();m2();e7();Jq();M00=/(\d+\.\d+(?:\.\d+)*)/;Bq={fn:SG};L00=[{name:"Claude Code",dir:".claude/skills/loki-mode",id:"claude"},{name:"Codex CLI",dir:".codex/skills/loki-mode",id:"codex"},{name:"Cline CLI",dir:".cline/skills/loki-mode",id:"cline"},{name:"Aider CLI",dir:".aider/skills/loki-mode",id:"aider"}];A00=[{displayName:"Node.js (>= 18)",jsonName:"Node.js",cmd:"node",required:"required",min:"18.0"},{displayName:"Python 3 (>= 3.8)",jsonName:"Python 3",cmd:"python3",required:"required",min:"3.8"},{displayName:"jq",jsonName:"jq",cmd:"jq",required:"required"},{displayName:"git",jsonName:"git",cmd:"git",required:"required"},{displayName:"curl",jsonName:"curl",cmd:"curl",required:"required"},{displayName:"bash (>= 4.0)",jsonName:"bash",cmd:"bash",required:"recommended",min:"4.0"},{displayName:"Bun (>= 1.3)",jsonName:"Bun",cmd:"bun",required:"recommended",min:"1.3"},{displayName:"Claude CLI",jsonName:"Claude CLI",cmd:"claude",required:"optional"},{displayName:"Codex CLI",jsonName:"Codex CLI",cmd:"codex",required:"optional"},{displayName:"Cline CLI",jsonName:"Cline CLI",cmd:"cline",required:"optional"},{displayName:"Aider CLI",jsonName:"Aider CLI",cmd:"aider",required:"optional"},{displayName:"opencode CLI",jsonName:"opencode CLI",cmd:"opencode",required:"optional"}]});var UI={};B1(UI,{writeBudgetState:()=>mG,readEfficiencyDir:()=>Mq,readBudgetState:()=>g00,parseRetryAfter:()=>c00,isRateLimited:()=>p00,checkBudgetLimitForRunner:()=>i00,checkBudgetLimit:()=>YI,calculateRateLimitBackoff:()=>l00,calculateCostFromRecords:()=>Nq,PRICING:()=>gG});import{existsSync as uG,mkdirSync as vG,readdirSync as x00,readFileSync as dG,renameSync as k00,writeFileSync as hG}from"fs";import{dirname as pG,join as p2,resolve as S00}from"path";import{fileURLToPath as y00}from"url";function b00(){try{let $=pG(y00(import.meta.url)),X=S00($,"..","..","data","model-pricing.json");if(!uG(X))return jQ;let z=JSON.parse(dG(X,"utf8")).pricing;if(!z||typeof z!=="object")return jQ;let Z={};for(let[K,J]of Object.entries(z))if(J!==null&&typeof J==="object"&&typeof J.input==="number"&&typeof J.output==="number"){let q=J;Z[K]={input:q.input,output:q.output,...typeof q.cache_read==="number"?{cache_read:q.cache_read}:{},...typeof q.cache_write==="number"?{cache_write:q.cache_write}:{}}}for(let K of Object.keys(jQ))if(!(K in Z))return jQ;return Z}catch{return jQ}}function _00($){return Math.round(($+Number.EPSILON)*1e4)/1e4}function v00($){let X=($??JI).toLowerCase();return gG[X]??gG[JI]}function Nq($){let X=0;for(let Q of $){if(typeof Q.cost_usd==="number"&&Number.isFinite(Q.cost_usd)){X+=Q.cost_usd;continue}let z=v00(Q.model),Z=typeof Q.input_tokens==="number"?Q.input_tokens:0,K=typeof Q.output_tokens==="number"?Q.output_tokens:0,J=typeof Q.cache_read_tokens==="number"?Q.cache_read_tokens:0,q=typeof Q.cache_creation_tokens==="number"?Q.cache_creation_tokens:0,V=z.cache_read??z.input,Y=z.cache_write??z.input;X+=Z/1e6*z.input+K/1e6*z.output+J/1e6*V+q/1e6*Y}return _00(X)}function Mq($){if(!uG($))return[];let X=[],Q;try{Q=x00($)}catch{return[]}for(let z of Q){if(!z.endsWith(".json"))continue;let Z=p2($,z);try{let K=dG(Z,"utf8"),J=JSON.parse(K);if(J&&typeof J==="object")X.push(J)}catch{}}return X}function h00($){if($===null||typeof $!=="object"||Array.isArray($))return!1;let X=$;if(typeof X.limit!=="number"||!Number.isFinite(X.limit))return!1;if(typeof X.budget_limit!=="number"||!Number.isFinite(X.budget_limit))return!1;if(typeof X.budget_used!=="number"||!Number.isFinite(X.budget_used))return!1;if(typeof X.exceeded!=="boolean")return!1;if(X.exceeded_at!==void 0&&typeof X.exceeded_at!=="string")return!1;if(X.created_at!==void 0&&typeof X.created_at!=="string")return!1;return!0}function g00($){let X=$??p2(h0(),"metrics","budget.json");if(!uG(X))return null;try{let Q=dG(X,"utf8"),z=JSON.parse(Q);if(!h00(z))return console.warn(`[budget] discarding malformed budget state at ${X}`),null;return z}catch{return null}}function mG($,X){let Q=X??p2(h0(),"metrics","budget.json");vG(pG(Q),{recursive:!0});let z=[];if(z.push("{"),z.push(`  "limit": ${_G($.limit)},`),z.push(`  "budget_limit": ${_G($.budget_limit)},`),z.push(`  "budget_used": ${_G($.budget_used)},`),$.exceeded){z.push('  "exceeded": true,');let J=$.exceeded_at??VI();z.push(`  "exceeded_at": "${J}"`)}else z.push('  "exceeded": false');z.push("}");let Z=z.join(`
 `)+`
@@ -1345,4 +1348,4 @@ Set LOKI_LEGACY_BASH=1 to force the bash CLI for every command.
 `),2}case"start":{let{runStart:z}=await Promise.resolve().then(() => (gt(),ht));return z(Q)}default:return process.stderr.write(`Unknown command: ${X}
 `),process.stderr.write(mt),2}}ER();process.on("SIGINT",()=>process.exit(130));process.on("SIGTERM",()=>process.exit(143));var H61=await U61(Bun.argv.slice(2));process.exit(H61);
 
-//# debugId=F9072E566EE545D0EBA53BA934122C29
+//# debugId=581D4F54CF5D0BFAC2AEC3492BD2352A

package/mcp/__init__.py

@@ -75,4 +75,4 @@ try:
 except ImportError:
     __all__ = ['mcp']
 
-__version__ = '9.54.0'
+__version__ = '9.55.0'

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "loki-mode",
   "mcpName": "io.github.asklokesh/loki-mode",
-  "version": "9.54.0",
+  "version": "9.55.0",
   "description": "Loki Mode by Autonomi. Autonomous spec-to-product system: takes a PRD, GitHub issue, OpenAPI/JSON/YAML, or one-line brief to a deployed app via the RARV-C closure loop with 8 quality gates. Provider-agnostic (Claude Code, OpenAI Codex, Cline, Aider, opencode).",
   "keywords": [
     "agent",

package/plugins/loki-mode/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "loki-mode",
   "displayName": "Loki Mode",
-  "version": "9.54.0",
+  "version": "9.55.0",
   "description": "Autonomous spec-to-product build system with a built-in trust layer (RARV-C closure loop, 8 quality gates, completion council). Ships Loki's spec-hardening, drift-detection, and deterministic PR verification commands plus the Loki MCP server.",
   "author": {
     "name": "Autonomi",

package/providers/aider.sh

@@ -109,6 +109,12 @@ provider_version() {
     aider --version 2>/dev/null | head -1
 }
 
+# Commit hygiene, the sentence providers/claude.sh (and the Bun
+# AUTONOMY_OVERRIDE_TEXT) puts in Claude's system prompt. Aider takes no
+# system prompt here, so it leads every prompt the functions below send
+# (BACKLOG 74: an agent's own `git add -A` commits the user's files).
+PROVIDER_COMMIT_HYGIENE='Commit hygiene still applies: git checkpoints are LOCAL only. Never push or force-push. Stage files by explicit path, never `git add -A` or `git add .`, and never commit secrets, credentials, .env files, or untracked files you did not author this session.'
+
 # Invocation function
 # --message: single instruction mode (process and exit)
 # --yes-always: auto-approve all prompts
@@ -116,6 +122,7 @@ provider_version() {
 provider_invoke() {
     local prompt="$1"
     shift
+    prompt="$PROVIDER_COMMIT_HYGIENE"$'\n\n'"$prompt"
     local model="$AIDER_DEFAULT_MODEL"
     local extra_flags="${LOKI_AIDER_FLAGS:-}"
     # shellcheck disable=SC2086
@@ -150,6 +157,7 @@ resolve_model_for_tier() {
 provider_invoke_argv() {
     local tier="${1:-development}"
     local prompt="${2:-}"
+    prompt="$PROVIDER_COMMIT_HYGIENE"$'\n\n'"$prompt"
     local model
     model="$(provider_get_tier_param "$tier" 2>/dev/null || printf '%s' "")"
     _LOKI_INVOKE_ARGV=(aider --yes-always --no-auto-commits)

package/providers/cline.sh

@@ -107,6 +107,12 @@ provider_version() {
     cline --version 2>/dev/null | head -1
 }
 
+# Commit hygiene, the sentence providers/claude.sh (and the Bun
+# AUTONOMY_OVERRIDE_TEXT) puts in Claude's system prompt. Cline takes no
+# system prompt here, so it leads every prompt the functions below send
+# (BACKLOG 74: an agent's own `git add -A` commits the user's files).
+PROVIDER_COMMIT_HYGIENE='Commit hygiene still applies: git checkpoints are LOCAL only. Never push or force-push. Stage files by explicit path, never `git add -A` or `git add .`, and never commit secrets, credentials, .env files, or untracked files you did not author this session.'
+
 # Invocation function
 # Uses -y (YOLO) for autonomous mode, positional prompt
 # BUG-PROV-009 fix: build model flag as array to prevent word-splitting on model
@@ -114,6 +120,7 @@ provider_version() {
 provider_invoke() {
     local prompt="$1"
     shift
+    prompt="$PROVIDER_COMMIT_HYGIENE"$'\n\n'"$prompt"
     local model="${LOKI_CLINE_MODEL:-}"
     local model_args=()
     [[ -n "$model" ]] && model_args=("-m" "$model")
@@ -148,6 +155,7 @@ resolve_model_for_tier() {
 provider_invoke_argv() {
     local tier="${1:-development}"
     local prompt="${2:-}"
+    prompt="$PROVIDER_COMMIT_HYGIENE"$'\n\n'"$prompt"
     local model
     model="$(provider_get_tier_param "$tier" 2>/dev/null || printf '%s' "")"
     _LOKI_INVOKE_ARGV=(cline -y)

package/providers/codex.sh

@@ -209,9 +209,16 @@ _codex_model_flag() {
     return 0
 }
 
+# Commit hygiene, the sentence providers/claude.sh (and the Bun
+# AUTONOMY_OVERRIDE_TEXT) puts in Claude's system prompt. Codex takes no
+# system prompt here, so it leads every prompt the functions below send
+# (BACKLOG 74: an agent's own `git add -A` commits the user's files).
+PROVIDER_COMMIT_HYGIENE='Commit hygiene still applies: git checkpoints are LOCAL only. Never push or force-push. Stage files by explicit path, never `git add -A` or `git add .`, and never commit secrets, credentials, .env files, or untracked files you did not author this session.'
+
 provider_invoke() {
     local prompt="$1"
     shift
+    prompt="$PROVIDER_COMMIT_HYGIENE"$'\n\n'"$prompt"
     local model_flag=()
     while IFS= read -r _mf; do
         [ -n "$_mf" ] && model_flag+=("$_mf")
@@ -302,6 +309,7 @@ provider_invoke_with_tier() {
     local tier="$1"
     local prompt="$2"
     shift 2
+    prompt="$PROVIDER_COMMIT_HYGIENE"$'\n\n'"$prompt"
     local effort
     effort=$(resolve_model_for_tier "$tier")
 
@@ -360,6 +368,7 @@ provider_invoke_with_tier() {
 provider_invoke_argv() {
     local tier="${1:-development}"
     local prompt="${2:-}"
+    prompt="$PROVIDER_COMMIT_HYGIENE"$'\n\n'"$prompt"
 
     # DO NOT pass provider_get_tier_param to --model. For Codex that function
     # returns an EFFORT LEVEL (xhigh/high/low), not a model name -- the note at

package/providers/loader.sh

@@ -197,3 +197,13 @@ auto_detect_provider() {
     echo ""
     return 1
 }
+
+# loki_claude_sidecall_allowed [provider] -- 0 when an engine side-call (PRD
+# enrichment, done recognition, council voters, USAGE.md refresh, quickstart
+# intent) may prompt the claude CLI. Only the provider the operator chose sees
+# prompts (V10 P5): allowed when that provider is claude, or on the explicit
+# opt-in LOKI_ALLOW_CLAUDE_SIDECALLS=1 (exact value), which
+# `loki doctor --airgap` reports as required egress to Anthropic.
+loki_claude_sidecall_allowed() {
+    [ "${1:-${LOKI_PROVIDER:-claude}}" = "claude" ] || [ "${LOKI_ALLOW_CLAUDE_SIDECALLS:-}" = "1" ]
+}

package/providers/opencode.sh

@@ -117,6 +117,12 @@ provider_get_tier_param() {
     esac
 }
 
+# Commit hygiene, the sentence providers/claude.sh (and the Bun
+# AUTONOMY_OVERRIDE_TEXT) puts in Claude's system prompt. opencode takes no
+# system prompt here, so it leads every prompt the functions below send
+# (BACKLOG 74: an agent's own `git add -A` commits the user's files).
+PROVIDER_COMMIT_HYGIENE='Commit hygiene still applies: git checkpoints are LOCAL only. Never push or force-push. Stage files by explicit path, never `git add -A` or `git add .`, and never commit secrets, credentials, .env files, or untracked files you did not author this session.'
+
 # provider_invoke <prompt> -- run one non-interactive turn.
 provider_invoke() {
     # CONTRACT: prompt is $1, and EXTRA ARGS MUST PASS THROUGH. The first cut of
@@ -130,6 +136,7 @@ provider_invoke() {
     local prompt="$1"
     shift
     [ -n "$prompt" ] || return 1
+    prompt="$PROVIDER_COMMIT_HYGIENE"$'\n\n'"$prompt"
     command -v opencode >/dev/null 2>&1 || return 127
     opencode run --auto --model "$PROVIDER_MODEL_DEVELOPMENT" "$prompt" "$@"
 }
@@ -143,6 +150,7 @@ provider_invoke_with_tier() {
     shift 2
     [ -n "$tier" ] || tier="development"
     [ -n "$prompt" ] || return 1
+    prompt="$PROVIDER_COMMIT_HYGIENE"$'\n\n'"$prompt"
     command -v opencode >/dev/null 2>&1 || return 127
     local model
     model="$(provider_get_tier_param "$tier")"
@@ -153,6 +161,7 @@ provider_invoke_with_tier() {
 provider_invoke_argv() {
     local tier="${1:-development}"
     local prompt="${2:-}"
+    prompt="$PROVIDER_COMMIT_HYGIENE"$'\n\n'"$prompt"
     local model
     model="$(provider_get_tier_param "$tier")"
     _LOKI_INVOKE_ARGV=(opencode run --auto --model "$model" "$prompt")

package/tools/receipt-attest.py

@@ -197,7 +197,7 @@ def attest(proof_path, repo_dir="."):
     axes["drift"] = _tri(
         result.get("diff_drift") is False if result.get("diff_drift") is not None
         else None,
-        _pick(reasons, "drift unverifiable") or
+        _pick(reasons, "could not check drift", "drift unverifiable") or
         "the recorded diff could not be re-derived here",
     )
     if result.get("diff_drift") is True: