loki-mode 9.54.2 → 9.55.0

package/README.md

@@ -748,7 +748,7 @@ env vars. See [Enterprise Identity Roadmap](docs/ENTERPRISE-IDENTITY-ROADMAP.md)
 | 8 quality gates | Yes | No | No | No |
 | Blind code review | Yes | No | No | No |
 | Enterprise auth (OIDC token + scoped RBAC) | Yes | No | Yes | No |
-| Air-gapped deployment | Yes | No | No | No |
+| Air-gapped deployment | Verification and the build pipeline, yes; builds need a model you host ([details](docs/air-gapped.md)) | No | No | No |
 | Docker + CI/CD generation | Yes | No | Yes | No |
 | Source-available (BUSL-1.1) | Yes | No | No | No |
 | Free tier | Source-available | Yes | Yes | Yes |

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: Autonomous spec-driven build system with a built-in trust layer. It does not call work done until it is verified (RARV-C closure loop, 8 quality gates, completion council, verified-completion evidence gate). Triggers on "Loki Mode". Takes a spec (PRD, GitHub issue, OpenAPI doc, etc.) to deployed product with minimal human intervention. Provider-agnostic. Requires --dangerously-skip-permissions flag.
 ---
 
-# Loki Mode v9.54.2
+# Loki Mode v9.55.0
 
 **You are an autonomous agent. You make decisions. You do not ask questions. You do not stop.**
 
@@ -470,4 +470,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v9.54.2 | [Autonomi](https://www.autonomi.dev/) flagship product | ~410 lines core**
+**v9.55.0 | [Autonomi](https://www.autonomi.dev/) flagship product | ~410 lines core**

package/VERSION

@@ -1 +1 @@
-9.54.2
+9.55.0

package/autonomy/completion-council.sh

@@ -219,13 +219,22 @@ council_augment_from_managed_memory() {
         return 0
     fi
     local target_dir="${TARGET_DIR:-.}"
-    local project_dir="${PROJECT_DIR:-$(pwd)}"
+    # D7: never fall back to the cwd. The council runs with cwd inside the
+    # agent's own repo, which can ship its own memory/managed_memory package
+    # that shadows the real one -- `${PROJECT_DIR:-$(pwd)}` would `cd` into
+    # that repo and `python3 -m memory.managed_memory.retrieve` would import
+    # the agent's module (BACKLOG 63). PROJECT_DIR must be explicit; unset ->
+    # skip augmentation (silent no-op, same as the flags-off path above).
+    if [ -z "${PROJECT_DIR:-}" ]; then
+        return 0
+    fi
+    local project_dir="$PROJECT_DIR"
     local out_file="$target_dir/.loki/managed/council-augment.txt"
     mkdir -p "$target_dir/.loki/managed" 2>/dev/null || true
     (
         cd "$project_dir" 2>/dev/null && \
         LOKI_TARGET_DIR="$target_dir" \
-        timeout 5 python3 -m memory.managed_memory.retrieve \
+        timeout 5 python3 -E -m memory.managed_memory.retrieve \
             --query "completion-council verdict context" --top-k 3 \
             > "$out_file" 2>/dev/null || true
     ) || true
@@ -1961,19 +1970,44 @@ if failed_n is None:
 # (node --test on a *.test.js with no test() calls; jest --passWithNoTests with
 # no suites) records pass:"inconclusive" + status:"no_tests_run" -- a mini
 # fake-green when read as affirmative. The pass value is then the STRING
-# "inconclusive" (not the bool True/False), so the old else-branch (PASS) would
-# have counted it as green. Route it to INCONCLUSIVE (pass-through, never a
-# block): a real runner ran but proved nothing, exactly like runner=="none".
-# Only the boolean True passes as affirmative; only the boolean False blocks.
-if runner == 'none':
+# "inconclusive" (not the bool True/False), so an else-branch of plain PASS
+# would have counted it as green.
+#
+# BACKLOG 33 rework (S-07, take 2): status=='no_tests_run' MUST be checked
+# BEFORE the runner=='none' sentinel below. A zero-test record can carry
+# runner=='none' (explicit or omitted/defaulted), and the old order let
+# runner=='none' short-circuit first, printing PASS -- a real runner having
+# run and found nothing is a WORSE signal than no test tooling applying here
+# at all, and must never read as equal-or-better. ZEROTESTS is a distinct
+# verdict token (not reused INCONCLUSIVE) so the shell dispatch below can
+# route it to reason=no_tests_executed for EVERY runner value, without
+# colliding with the parse-failure sentinel INCONCLUSIVE:none:true above or
+# the generic NO_PASS case.
+#
+# runner=='none' below is now UNCONDITIONAL again (this is the fix for the
+# prior rework's regression): the ONLY real writer of runner:"none" is
+# run.sh's enforce_test_coverage's no-test-tooling branch, which always
+# writes pass:"inconclusive" (the STRING) with status:"not_run" -- never a
+# boolean pass:true. Narrowing this branch to require passed is True (as the
+# prior, unmerged rework did) therefore caught the ENTIRE real no-test-tooling
+# population and routed it to NO_PASS/no_pass_recorded instead of
+# PASS/no_test_runner, silently defeating LOKI_EVIDENCE_NO_TESTS_AFFIRMATIVE=1
+# for the real shape and dropping the heuristic council's vote on genuine
+# no-test-tooling projects. runner=='none' is a distinct dimension (no
+# suite applies here) from status=='no_tests_run' (a suite ran and executed
+# nothing); checking status first is what keeps the two separate, not a
+# pass-value narrowing on top of it.
+if status == 'no_tests_run':
+    print('ZEROTESTS:%s:true' % runner)
+elif runner == 'none':
     print('PASS:none:true')
 elif passed is False or (failed_n or 0) > 0:
     print('FAIL:%s:false' % runner)
-elif status == 'no_tests_run' or passed is not True:
-    # Both are INCONCLUSIVE; NO_PASS names the second: no boolean pass was
-    # recorded at all (missing, null, or a non-boolean value), which is not a
-    # zero-test run.
-    print('%s:%s:true' % ('INCONCLUSIVE' if status == 'no_tests_run' else 'NO_PASS', runner))
+elif passed is not True:
+    # No boolean pass was recorded at all (missing, null, or a non-boolean
+    # value): not a zero-test run (status check above already excluded that),
+    # just an unrecorded outcome.
+    print('NO_PASS:%s:true' % runner)
 else:
     print('PASS:%s:true' % runner)
 PYEOF
@@ -1987,20 +2021,25 @@ PYEOF
         fi
         # INCONCLUSIVE => test_fails stays "false" => pass-through.
         # No test suite ran: a present results file that records runner=="none"
-        # is not affirmative evidence. Route to council (inconclusive), not a
-        # silent diff-alone pass. Default-on; LOKI_EVIDENCE_NO_TESTS_AFFIRMATIVE=1
-        # restores the old affirmative-PASS behavior.
-        if [ "$test_runner" = "none" ] && [ "${LOKI_EVIDENCE_NO_TESTS_AFFIRMATIVE:-0}" != "1" ]; then
+        # is not affirmative evidence UNLESS it is also the ZEROTESTS shape
+        # (excluded below; that reason is more specific: a suite ran and found
+        # nothing, distinct from no test tooling existing at all). Route to
+        # council (inconclusive), not a silent diff-alone pass. Default-on;
+        # LOKI_EVIDENCE_NO_TESTS_AFFIRMATIVE=1 restores the old affirmative-PASS
+        # behavior for this branch only -- never for ZEROTESTS below.
+        if [ "$test_runner" = "none" ] && [ "$_verdict" != "ZEROTESTS" ] && [ "${LOKI_EVIDENCE_NO_TESTS_AFFIRMATIVE:-0}" != "1" ]; then
             test_inconclusive="true"
             test_inconclusive_reason="no_test_runner"
         fi
-        # #82: a real runner that executed ZERO tests (pass:"inconclusive" +
-        # status:"no_tests_run") is INCONCLUSIVE, not affirmative. Mirror the
-        # runner=="none" pass-through so it routes to the council instead of
-        # reading as green. Honest (not a block): test_fails stays "false".
+        # #82: ZERO tests executed (pass:"inconclusive" + status:"no_tests_run")
+        # is INCONCLUSIVE, not affirmative, for EVERY runner value including
+        # none/omitted (BACKLOG 33 rework, take 2: the ZEROTESTS token from the
+        # parser above already isolates this case from the runner=="none"
+        # no-test-tooling sentinel, so this branch no longer needs to exclude
+        # runner=="none" -- doing so was the take-1 bug this rework fixes).
         # Not gated by LOKI_EVIDENCE_NO_TESTS_AFFIRMATIVE -- a zero-test run is
         # never affirmative evidence regardless of that opt-out.
-        if [ "$_verdict" = "INCONCLUSIVE" ] && [ "$test_runner" != "none" ]; then
+        if [ "$_verdict" = "ZEROTESTS" ]; then
             test_inconclusive="true"
             test_inconclusive_reason="no_tests_executed"
         fi
@@ -2791,6 +2830,17 @@ print(json.dumps(items[:5]))
     if [ "$persist_fails" = "true" ]; then persist_ok="false"; else persist_ok="true"; fi
     if [ "$auth_fails" = "true" ]; then auth_ok="false"; else auth_ok="true"; fi
     if [ "$authz_fails" = "true" ]; then authz_ok="false"; else authz_ok="true"; fi
+    # BACKLOG 61: mirror the _write_evidence_details (BACKLOG 55) fix here.
+    # $test_pass defaults to "true" and stays "true" for every inconclusive
+    # outcome (no runner, no results file, zero tests, no pass recorded), so
+    # writing it raw lets tests.pass read true when this block was triggered
+    # by a DIFFERENT axis (e.g. empty_diff) while tests never actually ran.
+    local tests_pass_json='"inconclusive"'
+    if [ "$test_fails" = "true" ]; then
+        tests_pass_json="false"
+    elif [ "$test_inconclusive" != "true" ] && [ "$test_runner" != "none" ] && [ "$test_pass" = "true" ]; then
+        tests_pass_json="true"
+    fi
     # Record WHY boot was inconclusive (no_app_runner / not_serveable / etc.) so a
     # consumer of the block report can tell a genuine boot pass from a pass-through.
     boot_reason_json=$(_R="${boot_inconclusive_reason:-}" python3 -E -s -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]; import json,os; print(json.dumps(os.environ['_R']))" 2>/dev/null || echo '""')
@@ -2808,7 +2858,7 @@ print(json.dumps(items[:5]))
     "reason": "$reason",
     "checks": {
         "diff": {"ok": $diff_ok, "base_sha": "$base_for_json", "files_changed": $diff_files, "sources": "committed|unstaged|staged|untracked union"},
-        "tests": {"ok": $tests_ok, "runner": "$test_runner", "pass": $test_pass},
+        "tests": {"ok": $tests_ok, "runner": "$test_runner", "pass": $tests_pass_json},
         "boot": {"ok": $boot_ok, "inconclusive": $boot_inconclusive, "reason": $boot_reason_json},
         "secret": {"ok": $secret_ok},
         "nomock": {"ok": $nomock_ok, "inconclusive": $nomock_inconclusive, "reason": $nomock_reason_json},
@@ -3595,14 +3645,26 @@ council_evaluate_member() {
     # fragile log grep. The completion route guarantees this file is written
     # before the council votes via ensure_completion_test_evidence()
     # (autonomy/run.sh): a project with a real runner records its true PASS/FAIL,
-    # and a project with no runner records {"runner":"none","pass":true}. A
-    # greenfield run with an empty .loki/ has NO such file -> no positive base ->
-    # the member stays CONTINUE.
+    # and a project with no test tooling records the shape run.sh's
+    # enforce_test_coverage's no-runner branch actually writes:
+    # {"runner":"none","pass":"inconclusive","status":"not_run",...} -- the pass
+    # value is the STRING "inconclusive", never the boolean true. A greenfield
+    # run with an empty .loki/ has NO such file -> no positive base -> the
+    # member stays CONTINUE.
     #
-    # Parse verdict mirrors council_evidence_gate: runner=="none" => PASS,
-    # pass is False => FAIL, only a boolean True (and not status no_tests_run)
-    # => PASS; a missing, null or non-boolean pass key recorded no outcome =>
-    # INCONCLUSIVE (not red, not positive). Unparseable/missing file => absent.
+    # Parse verdict mirrors council_evidence_gate (BACKLOG 33 rework, take 2):
+    # status=='no_tests_run' is checked FIRST (a real runner ran and executed
+    # ZERO tests, #82) and is always inconclusive, whatever the runner field --
+    # this must be decided before runner=='none' below, or a zero-test record
+    # with runner omitted/'none' would short-circuit into the no-tooling
+    # sentinel and print an affirmative pass, exactly the ordering bug already
+    # fixed in council_evidence_gate. runner=='none' is UNCONDITIONALLY pass
+    # (the no-test-tooling sentinel: no suite applies here at all, a distinct
+    # and BETTER signal than a suite that ran and found nothing) -- it is not
+    # narrowed to a boolean pass:true, because the real writer never produces
+    # that shape. passed is False => FAIL; a missing, null or non-boolean pass
+    # key recorded no outcome => INCONCLUSIVE (not red, not positive).
+    # Unparseable/missing file => absent.
     local tr_file="$loki_dir/quality/test-results.json"
     local test_evidence="absent"   # absent | pass | fail | inconclusive
     local test_runner_seen="none"
@@ -3618,11 +3680,14 @@ except (json.JSONDecodeError, IOError, KeyError, ValueError):
     sys.exit(0)
 runner = d.get('runner', 'none')
 passed = d.get('pass')
-if runner == 'none':
+status = d.get('status', '')
+if status == 'no_tests_run':
+    print('inconclusive:%s' % runner)
+elif runner == 'none':
     print('pass:none')
 elif passed is False:
     print('fail:%s' % runner)
-elif passed is not True or d.get('status') == 'no_tests_run':
+elif passed is not True:
     print('inconclusive:%s' % runner)
 else:
     print('pass:%s' % runner)
@@ -4623,8 +4688,19 @@ council_should_stop() {
         # v6.83.0 Phase 1: shadow-write the final council verdict to the
         # managed memory store. Backgrounded + silent; flags gate the work
         # inside the Python module so no-op when off.
+        #
+        # D7: never fall back to the cwd. Identical threat model to
+        # council_augment_from_managed_memory (BACKLOG 63) but more severe:
+        # this call EXECUTES memory.managed_memory.shadow_write as a module,
+        # not just imports one for reading, so `cd "${PROJECT_DIR:-$(pwd)}"`
+        # with PROJECT_DIR unset runs the agent's own repo's shadow_write.py
+        # (if it ships one) with the council's privileges -- arbitrary code
+        # execution, not just data poisoning. PROJECT_DIR must be explicit;
+        # unset -> skip the shadow-write entirely (silent no-op, same as the
+        # flags-off path above; STOP still returns 0 unchanged).
         if [ "${LOKI_MANAGED_AGENTS:-false}" = "true" ] && \
-           [ "${LOKI_MANAGED_MEMORY:-false}" = "true" ]; then
+           [ "${LOKI_MANAGED_MEMORY:-false}" = "true" ] && \
+           [ -n "${PROJECT_DIR:-}" ]; then
             local _verdict_file="$loki_dir/council/verdicts/iteration-$ITERATION_COUNT.json"
             if [ ! -f "$_verdict_file" ]; then
                 # Fall back to the round vote file as the verdict payload.
@@ -4632,9 +4708,9 @@ council_should_stop() {
             fi
             if [ -f "$_verdict_file" ]; then
                 (
-                    cd "${PROJECT_DIR:-$(pwd)}" 2>/dev/null && \
+                    cd "$PROJECT_DIR" 2>/dev/null && \
                     LOKI_TARGET_DIR="$loki_dir/.." \
-                    timeout 15 python3 -m memory.managed_memory.shadow_write \
+                    timeout 15 python3 -E -m memory.managed_memory.shadow_write \
                         --verdict "$_verdict_file" >/dev/null 2>&1 || true
                 ) &
                 disown 2>/dev/null || true

package/autonomy/crash.sh

@@ -5,11 +5,11 @@
 # controls BOTH PostHog usage telemetry and local crash capture. It is
 # sourceable for helpers only; it executes nothing on source.
 #
-# Collection is OPT-IN and OFF by default. Nothing is collected, written, or
-# sent unless the user explicitly opts in. A default install cannot phone home,
-# which makes air-gapped, GDPR, and FedRAMP deployments safe out of the box.
+# Collection is ON by default for an individual interactive install and
+# auto-off in CI, non-interactive, LOKI_ENTERPRISE=true and LOKI_AIRGAP=true
+# contexts (see loki_collection_enabled below and docs/PRIVACY.md).
 #
-# Opt-in (collection is enabled ONLY when one of these is present):
+# Explicit opt-in (forces collection on, even where it would auto-off):
 #   - LOKI_TELEMETRY=on             (case-insensitive, exact word "on")
 #   - ~/.loki/config line: TELEMETRY_ENABLED=true   (written by: loki telemetry on)
 #
@@ -20,8 +20,8 @@
 #   - ~/.loki/config line: TELEMETRY_DISABLED=true
 #
 # All capture is best-effort: it never blocks the parent and always returns 0.
-# Phase 0 has zero network egress; local capture is also gated by opt-in so a
-# default install writes nothing at all.
+# Phase 0 crash capture has zero network egress; local capture uses the same
+# gate as telemetry.
 
 # Double-source guard.
 if [ -n "${_LOKI_CRASH_SH_SOURCED:-}" ]; then

package/autonomy/lib/done-recognition.sh

@@ -100,6 +100,13 @@ _loki_done_recog_invoke() {
         # fall through to the claude/deterministic paths (fail-closed)
     fi
 
+    # Only the provider the operator chose may see a prompt (V10 P5). The gate
+    # above admits any provider with an argv seam, but this call is claude-only.
+    # Policy (and the LOKI_ALLOW_CLAUDE_SIDECALLS=1 opt-in) lives in loader.sh.
+    # ponytail: upgrade path is routing this call through provider_invoke_argv.
+    type loki_claude_sidecall_allowed >/dev/null 2>&1 \
+        || . "$(dirname "${BASH_SOURCE[0]}")/../../providers/loader.sh" 2>/dev/null
+    loki_claude_sidecall_allowed 2>/dev/null || return 1
     command -v claude >/dev/null 2>&1 || return 1
 
     # STRUCTURED VERDICT (v8.x): when the CLI supports --json-schema, force valid

package/autonomy/lib/prd-enrich.sh

@@ -76,6 +76,13 @@ _loki_prd_enrich_invoke() {
         fi
         # fall through to the claude path (fail-closed)
     fi
+    # Only the provider the operator chose may see a prompt (V10 P5). The gate
+    # above admits any provider with an argv seam, but this call is claude-only.
+    # Policy (and the LOKI_ALLOW_CLAUDE_SIDECALLS=1 opt-in) lives in loader.sh.
+    # ponytail: upgrade path is routing this call through provider_invoke_argv.
+    type loki_claude_sidecall_allowed >/dev/null 2>&1 \
+        || . "$(dirname "${BASH_SOURCE[0]}")/../../providers/loader.sh" 2>/dev/null
+    loki_claude_sidecall_allowed 2>/dev/null || return 1
     command -v claude >/dev/null 2>&1 || return 1
     local rc=0
     local out=""

package/autonomy/lib/proof-verify.py

@@ -59,7 +59,10 @@ Schema compatibility:
 CLI:
     python3 autonomy/lib/proof-verify.py <proof.json> [repo_dir]
   Prints the JSON result. Exit 0 if ok, 1 on tamper / drift / bad signature,
-  2 on a usage / load error (missing file, malformed JSON).
+  2 on a usage / load error (missing file, malformed JSON) OR when every check
+  that ran passed but drift could not be re-derived (not a git tree, no
+  base_sha, an unresolvable base ref) -- an inability to measure drift is not
+  evidence of tampering, so it must not share exit 1 with a genuine failure.
 """
 
 import hashlib
@@ -791,9 +794,10 @@ def verify(proof_path, repo_dir="."):
     if not _is_git_repo(repo_dir):
         result["diff_drift"] = None
         if not result["reason"]:
-            result["reason"] = "repo_dir is not a git work tree; drift unverifiable"
+            result["reason"] = ("could not check drift: repo_dir is not a git "
+                                "work tree; drift unverifiable")
         result["reasons"].append(
-            "drift unverifiable: %r is not a git work tree, so the recorded "
+            "could not check drift: %r is not a git work tree, so the recorded "
             "diff cannot be re-derived (re-run from the repository the receipt "
             "was generated in)" % repo_dir)
     elif not base_sha:
@@ -801,19 +805,22 @@ def verify(proof_path, repo_dir="."):
         # so the diff cannot be re-derived. Report honestly, do NOT pass.
         result["diff_drift"] = None
         if not result["reason"]:
-            result["reason"] = "base ref unresolvable (no recorded base_sha; drift unverifiable)"
+            result["reason"] = ("could not check drift: base ref unresolvable "
+                                "(no recorded base_sha; drift unverifiable)")
         result["reasons"].append(
-            "drift unverifiable: the receipt records no base_sha, so there is "
-            "no starting point to re-derive the diff from (schema v1.0 receipt)")
+            "could not check drift: the receipt records no base_sha, so there "
+            "is no starting point to re-derive the diff from (schema v1.0 "
+            "receipt)")
     elif not _rev_resolvable(repo_dir, base_sha):
         result["diff_drift"] = None
         if not result["reason"]:
-            result["reason"] = ("base ref unresolvable (%s not found in repo; "
-                                "drift unverifiable)" % base_sha)
+            result["reason"] = ("could not check drift: base ref unresolvable "
+                                "(%s not found in repo; drift unverifiable)"
+                                % base_sha)
         result["reasons"].append(
-            "drift unverifiable: recorded base ref %s is not present in this "
-            "repository (fetch the branch, or verify against the repo the "
-            "receipt was generated in)" % base_sha)
+            "could not check drift: recorded base ref %s is not present in "
+            "this repository (fetch the branch, or verify against the repo "
+            "the receipt was generated in)" % base_sha)
     else:
         # Drift answers "does this receipt still describe the CURRENT branch
         # state". A receipt is for verifying the work as it stands now, so we
@@ -829,10 +836,11 @@ def verify(proof_path, repo_dir="."):
         if current_stat is None:
             result["diff_drift"] = None
             if not result["reason"]:
-                result["reason"] = "git diff could not be computed; drift unverifiable"
+                result["reason"] = ("could not check drift: git diff could not "
+                                    "be computed; drift unverifiable")
             result["reasons"].append(
-                "drift unverifiable: git diff %s..HEAD could not be computed"
-                % base_sha)
+                "could not check drift: git diff %s..HEAD could not be "
+                "computed" % base_sha)
         else:
             drift = False
             if recorded_stat is not None:
@@ -846,12 +854,13 @@ def verify(proof_path, repo_dir="."):
                 # compare against -- cannot confirm the facts match.
                 result["diff_drift"] = None
                 if not result["reason"]:
-                    result["reason"] = ("no recorded diff stat to compare; "
-                                        "drift unverifiable")
+                    result["reason"] = ("could not check drift: no recorded "
+                                        "diff stat to compare; drift "
+                                        "unverifiable")
                 result["reasons"].append(
-                    "drift unverifiable: the repository diff was re-derived, "
-                    "but the receipt recorded no diff stat to compare it "
-                    "against")
+                    "could not check drift: the repository diff was "
+                    "re-derived, but the receipt recorded no diff stat to "
+                    "compare it against")
 
             # diff_sha256: a stronger content check than the counts. Only when
             # the receipt recorded one (v1.1).
@@ -945,13 +954,70 @@ def verify(proof_path, repo_dir="."):
 # CLI shim (mirrors dashboard/audit.py _unified_cli style)
 # ---------------------------------------------------------------------------
 
+def drift_unverifiable(result):
+    """True iff every check that ran passed and drift alone could not be
+    re-derived (not a git tree, no base_sha, an unresolvable base ref, or the
+    diff/tree could not be recomputed) -- the exit-2 "could not check" case
+    from docs/exit-codes.md, distinct from a genuine tamper/drift failure.
+
+    Fail-safe direction: this is an ALLOWLIST, not a check on `diff_drift is
+    None` alone. `diff_drift` (and `tree_drift`) can be None for reasons OTHER
+    than "unmeasurable" -- e.g. an early return on a missing/mismatched
+    integrity hash never reaches the drift block at all, leaving diff_drift at
+    its initial None while the receipt is genuinely tampered. Requiring every
+    OTHER check to have passed before honoring a None here keeps a real
+    failure from being laundered into "could not check". Any check added
+    later that is not explicitly listed here defaults to exit 1, never 2.
+
+    Known ceiling (not a new regression): this allowlist only covers a
+    genuinely unmeasurable check. A forger who re-hashes the receipt after
+    stripping base_sha, tree_sha256, and the diff stat produces a receipt
+    that passes hash_ok and every other listed check, then reaches this
+    function with the same unresolvable-drift signature as an honest
+    outside-the-repo verification -- so it also exits 2 ("could not check"),
+    not 1 ("failed"). `ok` stays False either way, so nothing here reports
+    VERIFIED; the ceiling is only that a deliberately stripped receipt and an
+    honestly unverifiable one are not distinguished from each other.
+    """
+    if result.get("ok"):
+        return False
+    if not result.get("hash_ok"):
+        return False
+    if result.get("gpg_ok") not in (True, "n/a"):
+        return False
+    if result.get("headline_consistent") is False:
+        return False
+    if result.get("cost_coherent") is False:
+        return False
+    if result.get("schema_supported") is not True:
+        return False
+    if result.get("diff_drift") is True:
+        return False
+    if result.get("tree_drift") is True:
+        return False
+    # tree_drift is None also means "no tree was recorded to check" (not
+    # applicable), which is not itself a reason to report exit 2 -- only count
+    # it as unmeasured when a tree digest was actually recorded.
+    tree_unmeasured = (
+        bool(result.get("tree_recheck", {}).get("recorded"))
+        and result.get("tree_drift") is None
+    )
+    return result.get("diff_drift") is None or tree_unmeasured
+
+
 def render_reasons(result):
     """Render a verdict as human-readable lines.
 
     The JSON report is the machine surface; this is the one a person reads.
     A passing receipt renders the verdict alone -- never a fabricated reason.
     """
-    lines = ["VERIFIED" if result.get("ok") else "FAILED"]
+    if result.get("ok"):
+        header = "VERIFIED"
+    elif drift_unverifiable(result):
+        header = "COULD NOT CHECK"
+    else:
+        header = "FAILED"
+    lines = [header]
     for reason in (result.get("reasons") or []):
         lines.append("  - %s" % reason)
     return "\n".join(lines)
@@ -984,7 +1050,13 @@ def _cli(argv=None):
         print(json.dumps({"ok": False, "error": "verify failed: %s" % exc}))
         return 2
     print(render_reasons(result) if human else json.dumps(result, indent=2))
-    return 0 if result.get("ok") else 1
+    if result.get("ok"):
+        return 0
+    if drift_unverifiable(result):
+        # An inability to measure drift is not evidence of tampering (BACKLOG
+        # 31 / docs/exit-codes.md: 2 = could not check, never 1 = failed).
+        return 2
+    return 1
 
 
 if __name__ == "__main__":

package/autonomy/lib/voter-agents.sh

@@ -309,6 +309,13 @@ loki_council_dispatch_agents() {
     # 3. Invoke claude (only when the SDK path did not already produce a response).
     # Guard against absent binary or non-zero exit.
     if [ "$_va_sdk_done" != "1" ]; then
+    # Only the provider the operator chose may see a prompt (V10 P5): with any
+    # other provider this falls back to the heuristic council. Policy (and the
+    # LOKI_ALLOW_CLAUDE_SIDECALLS=1 opt-in) lives in providers/loader.sh.
+    # ponytail: upgrade path is a provider-neutral structured dispatch.
+    type loki_claude_sidecall_allowed >/dev/null 2>&1 \
+        || . "${__LOKI_VA_REPO_ROOT}/providers/loader.sh" 2>/dev/null
+    loki_claude_sidecall_allowed 2>/dev/null || return 1
     command -v claude >/dev/null 2>&1 || return 1
 
     # caveman HARD-SUPPRESS (parsed output, v7.41.0): the response is parsed for