loki-mode 9.54.2 → 9.55.0

package/autonomy/run.sh

@@ -9180,6 +9180,12 @@ setup_agent_branch() {
         log_warn "Left uncommitted from an earlier unfinished session, now treated as your files: $leftover"
     fi
     rm -f .loki/state/session-created.z 2>/dev/null
+    # BACKLOG 68 rework: a fresh mint starts with no tracked-since anchor and no
+    # in-flight marker (never seed the anchor from session-start-sha -- an
+    # anchor==start would let a later resume's "anchor..HEAD" diff include this
+    # session's OWN commits, pruning them from the next session's union as if
+    # the user had tracked them between sessions).
+    rm -f .loki/state/tracked-since.sha .loki/state/turn-in-flight 2>/dev/null
     if [ "$snap_ok" = 1 ]; then _LOKI_SNAPSHOT_THIS_RUN=1; fi
 
     # Every mint (a refused resume included) records its own base and the
@@ -9213,6 +9219,352 @@ _loki_snapshot_or_fail_closed() {
     return 1
 }
 
+# BACKLOG 70: preexisting-untracked.z and its .sha.z sibling live in
+# .loki/state, which the agent process (and anything it spawns) can write. A
+# co-located adversarial agent can delete .sha.z to blind
+# workspace_diff._preexisting_untracked's mismatch check (silently suppressing
+# every preexisting_modified disclosure), or append/edit .z entries to hide its
+# own new files from the receipt or falsely disown them. Full prevention against
+# a same-UID process is not achievable (it can read and rewrite anything this
+# process can); the realistic bar, and the one BACKLOG 70 asks for, is
+# DISCLOSURE: this process is the only one that can remember what it itself
+# just wrote, so it seals a sha256 of both files in its own memory right after
+# writing them, and re-derives + compares that digest at every later read site.
+# A mismatch (or the sealed file now missing) is reported as tampering and
+# treated as a failed snapshot (fail closed: no session commit), never patched
+# over silently. Cleared whenever the files are deliberately removed (line
+# ~9165) so that path is never reported as tampering.
+_LOKI_SNAPSHOT_SEAL=""
+
+# BACKLOG 129 (follow-up to BACKLOG 70/BACKLOG 70-awk): the DIGEST computation
+# above is hardened (fixed-root-path-first, no awk), but until this function
+# was added the snapshot WRITER (_loki_untracked_merge) and READER
+# (_loki_covered_paths), plus the hash-snapshot helper that produces .sha.z,
+# still ran bare `python3 -E`. -E only blocks PYTHON* env vars; it does NOT
+# stop user (or Homebrew) site-packages from loading, and Python execs every
+# line starting "import " in every .pth file found there on every startup
+# (confirmed empirically: a .pth planted in user site-packages fired and
+# silently rewrote the writer's declared output file after the legitimate
+# write completed). A same-UID agent that plants such a .pth can forge the
+# CONTENT of the snapshot BEFORE the (correctly hardened) seal ever computes a
+# digest over it -- the seal then faithfully approves the forgery. Resolved
+# the same way as _loki_snapshot_hash_tool: fixed root-owned candidate paths
+# first (a materially higher bar than a user-writable site-packages
+# directory), each PROBED with a real run (not just `-x`, which a Command Line
+# Tools-less Mac's /usr/bin shims would still pass while failing to execute
+# and possibly popping an install dialog), then a PATH walk restricted to
+# absolute entries as a last resort. -I -S (isolated mode, and -S also skips
+# `import site` entirely) is used at every call site below: -I alone still
+# loads site-packages (verified: `python3 -I` still lists Homebrew's
+# site-packages on this host), so -S is required to close the .pth vector,
+# not just narrow it. Accepted gap, same shape as _loki_snapshot_hash_tool's:
+# replacing the interpreter binary AT ONE OF THE FIXED PATHS this resolves to
+# first requires root; a host with none of the fixed candidates falls through
+# to the PATH-walk, which still trusts whatever sits first on an absolute PATH
+# entry under that name. A further, host-specific gap: on macOS these fixed
+# paths are typically Command Line Tools / Xcode shims that dispatch into
+# /Applications/Xcode.app -- root-owned on a normal install, but the fixed
+# path is only as trustworthy as that dispatch target on any host where it is
+# not.
+_loki_snapshot_py_tool() {
+    local c
+    for c in /usr/bin/python3 /bin/python3; do
+        [ -x "$c" ] && [ ! -d "$c" ] && "$c" -I -S -c '' >/dev/null 2>&1 && { printf '%s\n' "$c"; return 0; }
+    done
+    local dir
+    local IFS=:
+    for dir in $PATH; do
+        case "$dir" in
+            /*) ;;
+            *) continue ;;
+        esac
+        if [ -x "$dir/python3" ] && [ ! -d "$dir/python3" ] \
+           && "$dir/python3" -I -S -c '' >/dev/null 2>&1; then
+            printf '%s\n' "$dir/python3"
+            return 0
+        fi
+    done
+    return 1
+}
+
+# BACKLOG 129: same rationale and pattern as _loki_snapshot_py_tool above, for
+# `git`. Every call in this snapshot writer/reader chain
+# (_loki_untracked_status, _loki_tracked_by_user_since_anchor,
+# _loki_snapshot_preexisting's own `git rev-parse --show-toplevel`) used a bare
+# `git` -- an unscoped PATH lookup a same-UID attacker can shadow with a fake
+# binary placed in a user-writable directory ahead of the real one, exactly
+# the class of bypass _loki_snapshot_hash_tool's own comment already documents
+# for sha256sum/shasum. Reproduced empirically: a fake `git` ahead on PATH
+# that filters one path out of `git status`'s output caused that path to be
+# completely absent from the sealed snapshot. `_loki_untrack_agent_committed_
+# user_files`'s git calls (feeding the READER path, _loki_covered_paths) and
+# the commit-time `git reset`/`git commit`/`git update-index` calls in
+# commit_session_changes are DELIBERATELY left unresolved here (out of scope
+# for this fix): a fake git on PATH already defeats the commit gate directly
+# at commit time regardless of what the snapshot says, so resolving only the
+# reader's git feed would not change that attacker's outcome. Tracked as a
+# follow-up (process-wide resolved git) rather than folded into this change.
+_loki_snapshot_git_tool() {
+    local c
+    for c in /usr/bin/git /bin/git; do
+        [ -x "$c" ] && [ ! -d "$c" ] && "$c" --version >/dev/null 2>&1 && { printf '%s\n' "$c"; return 0; }
+    done
+    local dir
+    local IFS=:
+    for dir in $PATH; do
+        case "$dir" in
+            /*) ;;
+            *) continue ;;
+        esac
+        if [ -x "$dir/git" ] && [ ! -d "$dir/git" ] && "$dir/git" --version >/dev/null 2>&1; then
+            printf '%s\n' "$dir/git"
+            return 0
+        fi
+    done
+    return 1
+}
+
+# _loki_snapshot_hash_tool: resolve an absolute path to sha256sum or shasum.
+# Fixed, root-owned candidate paths are tried FIRST, before any PATH walk: a
+# same-UID agent that can write to a user-writable directory ahead of the real
+# tool on PATH (Homebrew's prefix, e.g. /opt/homebrew/bin, is user-writable by
+# default on macOS and typically precedes /usr/bin) could otherwise drop its
+# own sha256sum/shasum there that reads the two snapshot files and echoes back
+# whatever hash it wants -- the same class of bypass as the .pth hijack this
+# whole function exists to close, just with a fake binary as the carrier
+# instead of a fake module. Trying the standard system locations first closes
+# that: they require root to write to, a materially higher bar than a
+# user-writable site-packages directory or a user-writable PATH entry.
+# A PATH walk (D7: never trust a bare command name -- restricted to absolute
+# entries, matching autonomy/loki's loki_verify_tool_path) is kept only as a
+# last resort for a host that keeps sha256sum/shasum somewhere nonstandard;
+# document there that this fallback still trusts whatever is first on an
+# absolute PATH entry, which a user-writable directory ahead of the system
+# dirs can still shadow. Prints nothing (caller then falls back) when no tool
+# is found anywhere.
+_loki_snapshot_hash_tool() {
+    local c
+    for c in /usr/bin/sha256sum /bin/sha256sum /sbin/sha256sum \
+             /usr/bin/shasum /bin/shasum; do
+        [ -x "$c" ] && [ ! -d "$c" ] && { printf '%s\n' "$c"; return 0; }
+    done
+    # Last resort: PATH walk, absolute entries only. Still trusts whatever
+    # sits first on PATH under that name; see comment above.
+    local name dir
+    local IFS=:
+    for name in sha256sum shasum; do
+        for dir in $PATH; do
+            case "$dir" in
+                /*) ;;
+                *) continue ;;
+            esac
+            if [ -x "$dir/$name" ] && [ ! -d "$dir/$name" ]; then
+                printf '%s\n' "$dir/$name"
+                return 0
+            fi
+        done
+    done
+    return 1
+}
+
+# _loki_snapshot_digest: sha256 of preexisting-untracked.z + .sha.z content
+# (each independently, "-" standing in for "file absent" so a delete is part
+# of the digest, not indistinguishable from an empty file; "?" standing in for
+# "file present but the hash tool failed to produce a real digest" -- a
+# nonzero exit, empty output, or output that fails validation below -- so a
+# transient read error never seals or compares as an empty string).
+#
+# HIGH-severity reviewer finding on the original python3 -E version: -E only
+# ignores PYTHON* env vars, it does NOT stop Python from loading user (or, on
+# macOS with Homebrew, system) site-packages, and Python executes every .pth
+# file found there on every startup. A same-UID agent process can plant a .pth
+# file there that hijacks this script's own print() to emit a cached, stale
+# (pre-tamper) digest -- fully defeating the seal while `git`/file state show
+# real tampering happened. Fixed by computing the digest with sha256sum/shasum
+# instead: neither has a .pth-style module-loading path for that hijack to
+# attach to. shasum is a Perl script on macOS (not a compiled binary), but its
+# @INC search path is root-owned system Perl library directories, not a user
+# site-packages directory, so the .pth carrier does not transfer to it.
+#
+# SECOND reviewer finding, on the shasum/sha256sum version that first closed
+# the .pth hole: the digest was piped through a bare `awk '{print $1}')`
+# resolved via an unscoped PATH lookup (`awk '{...}'` runs whatever `awk`
+# comes first on PATH). A fake `awk` placed in a user-writable directory ahead
+# of the real one (the same Homebrew-prefix-precedes-/usr/bin shape as the
+# hash-tool bypass above) can intercept the pipe and print a cached, stale
+# digest, defeating the seal exactly as before -- the fix reintroduced the
+# same bypass class it was written to close, just moved one command over.
+# Fixed by dropping awk entirely: the first whitespace-delimited field is
+# taken with the shell builtin `${h%% *}` (parameter expansion, no external
+# process, nothing on PATH to hijack), and the result is validated as exactly
+# 64 lowercase hex characters before being trusted as a real sha256 digest --
+# anything else (empty, wrong length, non-hex, a hand-rolled fake tool that
+# does not bother to format like sha256sum/shasum) becomes "?". The hash
+# tool's own exit status is also checked explicitly now: a piped
+# `cmd | awk ...` hid a nonzero exit from the hash tool behind awk's exit
+# status; capturing to a plain variable surfaces it.
+#
+# Resolved via _loki_snapshot_hash_tool above (fixed root-owned paths first,
+# PATH walk restricted to absolute entries only as a last resort), not a bare
+# `command -v`, so this also closes the sibling D7-pattern gap: an unscoped
+# lookup could otherwise resolve to a same-named binary planted in a
+# user-writable directory ahead of the real tool on PATH.
+#
+# Accepted gaps (disclosure, not prevention, per BACKLOG 70's own bar, same as
+# documented at _LOKI_SNAPSHOT_SEAL above): a same-UID ptrace attack on this
+# process or on the sha256sum/shasum child process itself; replacing the
+# sha256sum/shasum binary AT ONE OF THE FIXED SYSTEM PATHS this resolves to
+# first (requires root, a materially higher bar than a user-writable
+# site-packages .pth or a user-writable PATH entry); on a host with none of
+# the fixed candidates, the PATH-walk fallback inside _loki_snapshot_hash_tool
+# still trusts whatever sits first on an absolute PATH entry under that name,
+# which a user-writable directory ahead of the system dirs (e.g. Homebrew's
+# prefix on macOS) can shadow -- not fully closed, only narrowed to hosts
+# lacking the standard tool paths; the python3 fallback below, kept only for
+# the extremely rare host with neither tool anywhere, is not proof against the
+# .pth class this function exists to close -- that path additionally hardens
+# with -I (isolated mode: also disables user site-packages, stronger than -E)
+# but remains narrower than the shasum/sha256sum path on a host where
+# Homebrew's system site-packages is itself user-writable.
+_loki_snapshot_digest() {
+    local tool
+    tool="$(_loki_snapshot_hash_tool)" || tool=""
+    if [ -n "$tool" ]; then
+        local out="" path h
+        for path in ".loki/state/preexisting-untracked.z" ".loki/state/preexisting-untracked.sha.z"; do
+            if [ -f "$path" ]; then
+                h=""
+                case "${tool##*/}" in
+                    shasum) h="$("$tool" -a 256 -- "$path" 2>/dev/null)" || h="" ;;
+                    *)      h="$("$tool" -- "$path" 2>/dev/null)" || h="" ;;
+                esac
+                # No awk: take the first whitespace-delimited field with a
+                # shell builtin (nothing on PATH to hijack), then require
+                # exactly 64 lowercase hex characters. Anything else -- empty
+                # output, a nonzero exit already caught above, an unexpected
+                # format, a hand-rolled fake tool -- becomes "?" rather than
+                # being trusted as a real digest. "?" is distinct from "-"
+                # (file absent) and from any real hex digest, so a later
+                # successful read of the same file mismatches it and is still
+                # disclosed as tampering.
+                h="${h%% *}"
+                if [ "${#h}" -eq 64 ]; then
+                    case "$h" in
+                        *[!0123456789abcdef]*) h="?" ;;
+                    esac
+                else
+                    h="?"
+                fi
+                out="$out $h"
+            else
+                out="$out -"
+            fi
+        done
+        printf '%s\n' "${out# }"
+        return 0
+    fi
+    # Fallback: neither sha256sum nor shasum found anywhere checked above
+    # (extremely rare on macOS/Linux). -I is isolated mode: stronger than -E,
+    # also disables user site-packages, but this remains narrower than the
+    # tool-based path above on a host whose Python ships a hijackable system
+    # site-packages outside the user's control (see comment above). Additional
+    # accepted gap specific to this fallback (not present on the tool-based
+    # path above, which distinguishes "-" from "?"): OSError covers BOTH
+    # "file does not exist" and "file exists but is unreadable" here, so an
+    # unreadable file on this path is indistinguishable from an absent one --
+    # both print "-". The tool-based path above tells them apart ("-" for
+    # absent, "?" for present-but-unreadable, caught by the seal-time
+    # fail-closed check). Narrowing this further (os.path.lexists to emit "?"
+    # for present-but-unreadable) is straightforward but left undone here: this
+    # fallback only runs on a host with neither sha256sum nor shasum anywhere,
+    # already the rare case this whole function treats as a residual gap.
+    python3 -I -c 'import sys, hashlib, os
+sys.path[:] = [p for p in sys.path if p not in ("", ".")]
+out = []
+for path in sys.argv[1:]:
+    try:
+        with open(path, "rb") as fh:
+            out.append(hashlib.sha256(fh.read()).hexdigest())
+    except OSError:
+        out.append("-")
+print(" ".join(out))' \
+        ".loki/state/preexisting-untracked.z" ".loki/state/preexisting-untracked.sha.z" 2>/dev/null
+}
+
+# _loki_snapshot_seal: record this process's own memory of what it just wrote.
+# Called only right after a successful _loki_snapshot_preexisting. Minor
+# reviewer note: a legitimate snapshot write should never hit an unreadable-
+# file condition immediately after writing it, so a "?" in the digest AT SEAL
+# TIME (as opposed to at a later verify) is itself suspicious -- both seal and
+# a later verify could then read "?", compare equal, and silently disarm the
+# guard for the rest of the session (the same failure mode
+# _loki_snapshot_verify's mismatch path exists to catch, just never triggered
+# because both sides agree on the sentinel). Closed cheaply: reject an empty
+# or "?"-containing digest at seal time the same way _loki_snapshot_verify
+# rejects a mismatch -- log and disclose it, write the .failed marker, AND
+# clear _LOKI_SNAPSHOT_THIS_RUN directly here (belt-and-braces: the actual
+# gate that stops a commit). The call site right after `_loki_snapshot_seal`
+# in _loki_snapshot_preexisting also checks `_LOKI_SNAPSHOT_SEAL` and returns
+# non-zero on failure, which is what actually propagates to
+# _loki_snapshot_or_fail_closed / _loki_resume_snapshot and keeps their
+# existing callers from ever setting _LOKI_SNAPSHOT_THIS_RUN=1 in the first
+# place (see the comment there) -- so the in-function clear here is redundant
+# with that, not the sole mechanism, kept only as defense in depth in case a
+# future caller invokes this function directly. The call site above is
+# intentionally left as a bare `_loki_snapshot_seal` (no `|| return`):
+# tests/test-branch-lifecycle.sh's RED harness matches that exact line to
+# strip the guard; the propagation check right after it carries its own
+# trailing-comment marker the RED harness also strips (see the comment at
+# that check, in _loki_snapshot_preexisting, for the exact text -- not
+# repeated here so a grep for it does not also match this sentence), so
+# removing either half of the guard is enough to reproduce the pre-fix
+# silent-degrade behavior in that test.
+_loki_snapshot_seal() {
+    local d
+    d="$(_loki_snapshot_digest)"
+    case "$d" in
+        ""|*'?'*)
+            _LOKI_SNAPSHOT_SEAL=""
+            _LOKI_SNAPSHOT_THIS_RUN=0
+            log_warn "Could not seal the pre-existing-file snapshot (hash tool failed or produced no readable digest); treating this session as unsnapshotted (nothing will be committed)"
+            audit_log "SNAPSHOT_SEAL_FAILED" "_loki_snapshot_digest returned empty or an unreadable-file sentinel at seal time"
+            mkdir -p .loki/state 2>/dev/null
+            : > .loki/state/preexisting-untracked.failed 2>/dev/null
+            ;;
+        *)
+            _LOKI_SNAPSHOT_SEAL="$d"
+            ;;
+    esac
+}
+
+# _loki_snapshot_verify: compare the live files against the sealed digest.
+# No seal recorded yet (never snapshotted this process, or deliberately
+# cleared) is not tampering: returns success and does nothing. A seal that no
+# longer matches IS tampering: logs it (disclosure is the bar BACKLOG 70 asks
+# for; a same-UID process can rewrite anything else this one could check), and
+# forces every fail-closed path a missing/failed snapshot already takes --
+# clears the seal so a caller cannot re-check a stale value, clears
+# _LOKI_SNAPSHOT_THIS_RUN so commit_session_changes and
+# _loki_record_session_created both treat this as an unsnapshotted session, and
+# (re)writes preexisting-untracked.failed so BACKLOG 90's existing message
+# fires. Every consumer of the snapshot/hash files calls this first and treats
+# non-zero as "no snapshot".
+_loki_snapshot_verify() {
+    local live=""
+    [ -n "$_LOKI_SNAPSHOT_SEAL" ] || return 0
+    live="$(_loki_snapshot_digest)"
+    if [ "$live" = "$_LOKI_SNAPSHOT_SEAL" ]; then
+        return 0
+    fi
+    _LOKI_SNAPSHOT_SEAL=""
+    _LOKI_SNAPSHOT_THIS_RUN=0
+    log_warn "Pre-existing-file snapshot or its hash file changed after this session recorded it (possible tampering by an agent process); treating this session as unsnapshotted (nothing will be committed)"
+    audit_log "SNAPSHOT_TAMPERED" "preexisting-untracked.z or .sha.z changed after being sealed"
+    mkdir -p .loki/state 2>/dev/null
+    : > .loki/state/preexisting-untracked.failed 2>/dev/null
+    return 1
+}
+
 # _loki_snapshot_preexisting [union]
 # Write .loki/state/preexisting-untracked.z: every path git does not track,
 # untracked and gitignored, repo-wide, NUL-delimited, relative to the repo top.
@@ -9221,33 +9573,90 @@ _loki_snapshot_or_fail_closed() {
 # a directory only when an ignore pattern matches it, so node_modules/ is one
 # "dir/" entry covering its subtree, while logs/ holding only *.log files is
 # listed file by file (a new logs/app.json is still the agent's). "union" keeps
-# the paths already recorded. The sibling .sha.z (content hash per file entry)
-# lets the receipt list a pre-existing file the run changed; it is removed
-# first, so a failed hash step means no detection, never stale hashes. Returns
-# non-zero, leaving any earlier list in place, when git cannot list.
+# the paths already recorded, minus any that became tracked because the USER
+# committed them between sessions (BACKLOG 68 rework). Distinguishing that from
+# "the AGENT itself committed or staged this pre-existing file during THIS
+# session, then got killed" is the entire point of the anchor below: only a
+# path git ADDED strictly after the last point this run itself could reach is
+# ever pruned. A path the agent tracked before that point is left IN the union
+# so it still flows into _loki_untrack_agent_committed_user_files's disclosure
+# (warn, remove from the branch tip, keep on disk) -- never silently swept in.
+#
+# The anchor is .loki/state/tracked-since.sha, a commit SHA written by
+# _loki_record_session_created (after each provider turn) and by
+# commit_session_changes (at session end): the newest point this run itself
+# recorded. .loki/state/turn-in-flight marks a provider turn as currently
+# running (set right before invocation, cleared by the same record call that
+# advances the anchor); its presence means a turn may have committed something
+# since the last anchor write, so pruning is skipped entirely rather than risk
+# treating an agent's mid-turn commit as the user's. Any anchor-resolution
+# failure (missing anchor, anchor not an ancestor of HEAD, merge-base failure)
+# also skips pruning: the safe direction is the old behavior (false blame, file
+# kept on disk), never silent adoption.
+#
+# The sibling .sha.z (content hash per file entry) lets the receipt list a
+# pre-existing file the run changed; it is removed first, so a failed hash step
+# means no detection, never stale hashes. Returns non-zero, leaving any earlier
+# list in place, when git cannot list. Seals a digest of both files on success
+# (BACKLOG 70) so later reads can detect tampering.
 _loki_snapshot_preexisting() {
-    local snap=".loki/state/preexisting-untracked.z" top="" base="" exclude=""
+    local snap=".loki/state/preexisting-untracked.z" top="" base="" exclude="" tracked="" gittool="" pytool=""
     rm -f "${snap%.z}.sha.z" 2>/dev/null
-    top="$(git rev-parse --show-toplevel 2>/dev/null)" || return 1
+    gittool="$(_loki_snapshot_git_tool)" || return 1
+    top="$("$gittool" rev-parse --show-toplevel 2>/dev/null)" || return 1
     mkdir -p .loki/state 2>/dev/null || return 1
     # "union" never adds a path listed in session-created.z: those files were
     # made by a session that did not finish (interrupt, pod loss), so the
     # session that finishes the work commits them. If the user edits one of
     # them between sessions it is still the session's file and is committed
-    # with the edit. Recorded entries only block additions; they never remove
-    # a path already in the list.
+    # with the edit. Recorded entries only block additions; a path this run can
+    # prove the USER tracked between sessions is the one case they DO remove
+    # (see _loki_tracked_by_user_since_anchor below).
     if [ "${1:-}" = union ]; then
         base="$snap"
         exclude=".loki/state/session-created.z"
+        tracked="$snap.tracked"
+        if ! _loki_tracked_by_user_since_anchor "$top" "$tracked"; then
+            rm -f "$tracked"
+            tracked=""
+        fi
     fi
     if ! _loki_untracked_status "$snap.status" \
-       || ! _loki_untracked_merge "$snap.status" "$base" "$exclude" exact "$snap"; then
-        rm -f "$snap.status" "$snap.tmp"
+       || ! _loki_untracked_merge "$snap.status" "$base" "$exclude" exact "$snap" "$tracked"; then
+        rm -f "$tracked" "$snap.status" "$snap.tmp"
         return 1
     fi
-    rm -f "$snap.status"
-    python3 -E "$SCRIPT_DIR/lib/workspace_diff.py" hash-snapshot "$top" "$snap" >/dev/null 2>&1 \
+    rm -f "$tracked" "$snap.status"
+    # BACKLOG 129: write_snapshot_hashes (the only code path "hash-snapshot"
+    # reaches) does pure file I/O (open/os.path/hashlib), no sibling import
+    # from autonomy/lib and no subprocess/git call, so -I -S is safe here: it
+    # never needs the script's own directory on sys.path or anything from
+    # site-packages. This writes .sha.z, one of the two files the seal above
+    # digests, so it is in scope of the same forgery class as the merge/covered
+    # sites below. A failed resolve here degrades to the existing log_warn path
+    # (receipt loses preexisting_modified detection) rather than blocking the
+    # snapshot -- matching this call's pre-existing non-fatal-on-failure shape.
+    pytool="$(_loki_snapshot_py_tool)" && "$pytool" -I -S "$SCRIPT_DIR/lib/workspace_diff.py" hash-snapshot "$top" "$snap" >/dev/null 2>&1 \
         || log_warn "Could not hash your pre-existing untracked files; the receipt cannot list the ones this run changes"
+    _loki_snapshot_seal
+    # A seal failure (empty digest or an unreadable-file "?", see the comment
+    # at _loki_snapshot_seal) leaves _LOKI_SNAPSHOT_SEAL empty; propagate that
+    # as a failure of this function too, so both callers'
+    # (_loki_snapshot_or_fail_closed and _loki_resume_snapshot) existing
+    # fail-closed handling applies, instead of silently reporting success on a
+    # session this process could not actually seal. This is the line that
+    # actually makes a seal failure fail closed (_loki_snapshot_seal's own
+    # in-function clear is defense in depth, not the mechanism -- see the
+    # comment there). This line is deliberately also stripped by
+    # tests/test-branch-lifecycle.sh's BACKLOG-70 RED mutation, by its trailing
+    # comment marker (kept off this sentence on purpose, so a grep for the
+    # marker text matches only the one real code line below, not this prose),
+    # same as the guard calls above it: without it, on a mutated copy that
+    # also strips `_loki_snapshot_seal`, _LOKI_SNAPSHOT_SEAL stays at its
+    # global initial value ("") and this check alone would still return 1 and
+    # fail closed, masking the RED reproduction the test relies on to prove
+    # the mutation of the ACTUAL guard calls is non-vacuous.
+    [ -n "$_LOKI_SNAPSHOT_SEAL" ] || return 1  # BACKLOG-70-SEAL-CHECK
     return 0
 }
 
@@ -9255,32 +9664,57 @@ _loki_snapshot_preexisting() {
 # and the session-created record, so the two always agree: raw
 # `git status --porcelain -z` records for the whole repo, .loki excluded.
 # Non-zero, writing nothing, when git cannot list.
+# BACKLOG 129: resolved via _loki_snapshot_git_tool (fixed root-owned path
+# first, PATH walk restricted to absolute entries as a last resort), not a
+# bare `git`, which a same-UID attacker can shadow with a fake binary on a
+# user-writable PATH entry ahead of the real one -- reproduced empirically: a
+# fake git filtering one path out of its `status` output made that path
+# entirely absent from the sealed snapshot this function ultimately feeds.
 _loki_untracked_status() {
-    local top="" prefix=""
-    top="$(git rev-parse --show-toplevel 2>/dev/null)" || return 1
-    prefix="$(git rev-parse --show-prefix 2>/dev/null)" || return 1
-    git -C "$top" --no-optional-locks status --porcelain -z --no-renames -uall \
+    local top="" prefix="" gittool=""
+    gittool="$(_loki_snapshot_git_tool)" || return 1
+    top="$("$gittool" rev-parse --show-toplevel 2>/dev/null)" || return 1
+    prefix="$("$gittool" rev-parse --show-prefix 2>/dev/null)" || return 1
+    "$gittool" -C "$top" --no-optional-locks status --porcelain -z --no-renames -uall \
         --ignored=matching --ignore-submodules=all -- ":(exclude,literal)${prefix}.loki" \
         > "$1" 2>/dev/null && return 0
     rm -f "$1"
     return 1
 }
 
-# _loki_untracked_merge <status> <base> <exclude> exact|cover <out>
-# Atomically write <out>: the NUL-delimited paths of <base>, plus every
-# untracked ("??") or ignored ("!!") path in <status> that <exclude> does not
-# hold. With "cover", an <exclude> entry ending in "/" also holds every path
-# below it (workspace_diff._covered). An empty or missing <base> or <exclude>
-# is an empty list; any other read or write failure is non-zero and leaves
-# <out> as it was. Sorted bytewise, like `LC_ALL=C sort -z -u`. One python
-# process: bash 3.2 has no associative arrays, and a bash loop cost 300ms per
-# 6,000 entries on /bin/bash. -E and no cwd on sys.path (D7): the cwd is the
-# agent's repo.
+# _loki_untracked_merge <status> <base> <exclude> exact|cover <out> [tracked]
+# Atomically write <out>: the NUL-delimited paths of <base> minus any path
+# <tracked> lists (BACKLOG 68: entries the USER tracked between sessions, as
+# resolved by _loki_tracked_by_user_since_anchor -- never the whole index),
+# plus every untracked ("??") or ignored ("!!") path in <status> that <exclude>
+# does not hold. With "cover", an <exclude> entry ending in "/" also holds
+# every path below it (workspace_diff._covered). An empty or missing <base> or
+# <exclude> is an empty list; any other read or write failure is non-zero and
+# leaves <out> as it was. Sorted bytewise, like `LC_ALL=C sort -z -u`. One
+# python process: bash 3.2 has no associative arrays, and a bash loop cost
+# 300ms per 6,000 entries on /bin/bash. -I -S and no cwd on sys.path (D7): the
+# cwd is the agent's repo.
+# BACKLOG 129: this is the snapshot WRITER -- its <out> becomes
+# preexisting-untracked.z, one of the two files the seal above digests. A bare
+# `python3 -E` here still loads user site-packages (-E only blocks PYTHON* env
+# vars), so a same-UID .pth planted there can run arbitrary code during this
+# call and rewrite <out> after the legitimate write, forging exactly the bytes
+# the seal is about to trust -- reproduced empirically (a .pth that stripped
+# an entry from the just-written output). Resolved via _loki_snapshot_py_tool
+# (fixed root-owned path first) and run with -I -S: -I alone is not enough
+# (verified: `python3 -I` alone still lists Homebrew's user-writable
+# site-packages on this host), -S additionally skips `import site` so no .pth
+# anywhere is ever processed. A resolve failure fails this function closed
+# (return 1, same as any other read/write failure here) rather than silently
+# falling back to a bare, unresolved `python3`.
 _loki_untracked_merge() {
-    python3 -E -c 'import sys
+    local pytool=""
+    pytool="$(_loki_snapshot_py_tool)" || return 1
+    "$pytool" -I -S -c 'import sys
 sys.path[:] = [p for p in sys.path if p not in ("", ".")]
 import os
 status, base, exclude, mode, out = sys.argv[1:6]
+tracked = sys.argv[6] if len(sys.argv) > 6 else ""
 def entries(path, missing_ok=True):
     try:
         with open(path, "rb") as fh:
@@ -9300,6 +9734,11 @@ def covered(path):
         cut = path.find(b"/", cut + 1)
     return False
 paths = set(entries(base)) if base else set()
+if tracked:
+    # Exact match only: a "dir/" entry is never dropped even if a file under it
+    # is now tracked, so an ignored directory (node_modules/) never re-exposes
+    # the rest of its subtree (BACKLOG 66/78 territory).
+    paths -= set(entries(tracked))
 for rec in entries(status, missing_ok=False):
     # The session-created record ("cover" mode) never holds a directory entry:
     # a whole-directory entry (logs/, out/) would stop the resume union from
@@ -9315,6 +9754,80 @@ with open(out + ".tmp", "wb") as fh:
 os.replace(out + ".tmp", out)' "$@" 2>/dev/null
 }
 
+# _loki_tracked_by_user_since_anchor <top> <out> (BACKLOG 68 rework)
+# Write <out>: the NUL-delimited paths git added to the index between the
+# recorded "tracked-since" anchor and HEAD -- i.e. what a resume union may
+# safely treat as "the USER tracked this between sessions" and prune. Returns
+# non-zero (writing nothing) whenever that inference is not safe, which leaves
+# the caller pruning nothing (the old, safe-by-default behavior):
+#   - no anchor recorded yet (an older session, or nothing survived a turn)
+#   - a provider turn is marked in-flight (.loki/state/turn-in-flight): a turn
+#     can commit or stage a file and then be SIGKILLed before the next record
+#     call advances the anchor, so anything since the LAST anchor is unproven
+#   - the anchor does not resolve, or is not an ancestor of HEAD (branch
+#     switched, history rewritten, anchor stale)
+# --diff-filter=A, --no-renames: only additions, matching
+# _loki_untrack_agent_committed_user_files's own diff so the two never
+# disagree about which paths are "added since X".
+# BACKLOG 129: <out> here is subtracted from the snapshot base inside
+# _loki_untracked_merge (the "tracked" argument) before that WRITER seals its
+# result -- a fake git that lists an extra path here can prune a real
+# untracked path (e.g. a secret) out of the sealed snapshot, the same attack
+# as a forged `git status`, just one function over. Resolved via
+# _loki_snapshot_git_tool like the other git calls in this writer chain.
+_loki_tracked_by_user_since_anchor() {
+    local top="$1" out="$2" anchor_file=".loki/state/tracked-since.sha" anchor="" gittool=""
+    [ -f .loki/state/turn-in-flight ] && return 1
+    [ -s "$anchor_file" ] || return 1
+    anchor="$(cat "$anchor_file" 2>/dev/null)"
+    [ -n "$anchor" ] || return 1
+    gittool="$(_loki_snapshot_git_tool)" || return 1
+    "$gittool" rev-parse --verify -q "$anchor" >/dev/null 2>&1 || return 1
+    "$gittool" merge-base --is-ancestor "$anchor" HEAD 2>/dev/null || return 1
+    "$gittool" -C "$top" diff --name-only -z --no-renames --diff-filter=A "$anchor" HEAD > "$out.tmp" 2>/dev/null \
+        || { rm -f "$out.tmp"; return 1; }
+    mv -f "$out.tmp" "$out"
+    return 0
+}
+
+# _loki_advance_tracked_since_anchor
+# Move .loki/state/tracked-since.sha to the current HEAD and clear
+# .loki/state/turn-in-flight, but ONLY once the anchor write is confirmed on
+# disk. Called after every provider turn (_loki_record_session_created) and at
+# normal session end (commit_session_changes), i.e. at every point this run
+# can prove no provider turn is currently running -- PROVIDED the anchor write
+# itself lands, since _loki_tracked_by_user_since_anchor trusts both signals
+# together (anchor position + in-flight marker) to prove a commit happened
+# strictly after the anchor with no turn running. Clearing the marker on a
+# failed write would decouple them: a stale anchor stays on disk while the
+# marker falsely reports "no turn was in flight", so a later resume could
+# prove something it can't actually prove and prune an agent's own commit with
+# no disclosure (this is BACKLOG 68's failure mode, reintroduced). A HEAD that
+# does not resolve (unborn branch) is not a write failure -- there is nothing
+# to anchor yet -- so the marker still clears; the anchor stays "not set" as
+# before. Always returns 0 (both call sites are bare, unchecked calls): the
+# in-flight marker, not the return code, is the safety signal on a failed
+# write.
+_loki_advance_tracked_since_anchor() {
+    local sha=""
+    sha="$(git rev-parse --verify -q HEAD 2>/dev/null)" || true
+    if [ -n "$sha" ]; then
+        if ! { printf '%s\n' "$sha" > .loki/state/tracked-since.sha.tmp 2>/dev/null \
+               && mv -f .loki/state/tracked-since.sha.tmp .loki/state/tracked-since.sha 2>/dev/null; }; then
+            # Anchor write failed (disk full, a stray .tmp collision, a
+            # concurrent writer). Deliberately leave turn-in-flight SET and
+            # return here, before the unconditional clear below: the safe
+            # direction is to keep the old fallback-to-no-pruning path active
+            # for one more check, never to clear a marker the anchor write did
+            # not earn.
+            rm -f .loki/state/tracked-since.sha.tmp 2>/dev/null
+            return 0
+        fi
+    fi
+    rm -f .loki/state/turn-in-flight 2>/dev/null
+    return 0
+}
+
 # _loki_record_session_created
 # Union into .loki/state/session-created.z (NUL-delimited, repo-top-relative,
 # atomic) the paths git does not track now that the pre-existing snapshot does
@@ -9332,6 +9845,15 @@ os.replace(out + ".tmp", out)' "$@" 2>/dev/null
 _loki_record_session_created() {
     local snap=".loki/state/preexisting-untracked.z" out=".loki/state/session-created.z"
     [ "${_LOKI_SNAPSHOT_THIS_RUN:-0}" = 1 ] || return 0
+    # BACKLOG 70: detect tampering with the sealed snapshot as early as
+    # possible (this runs after every provider turn, not just at commit time).
+    _loki_snapshot_verify || return 1
+    # BACKLOG 68 rework: this call is the point right after a provider turn
+    # ends, so it also advances the tracked-since anchor and clears the
+    # in-flight marker -- whatever the agent committed or staged during the
+    # turn that just finished is now provably NOT mid-turn, so a later resume's
+    # anchor..HEAD diff may safely be checked against it.
+    _loki_advance_tracked_since_anchor
     if [ -f "$snap" ] && _loki_untracked_status "$out.status" \
        && _loki_untracked_merge "$out.status" "$out" "$snap" cover "$out"; then
         rm -f "$out.status"
@@ -9389,10 +9911,21 @@ if ! type _commit_path_looks_secret >/dev/null 2>&1; then _commit_path_looks_sec
 # _loki_covered_paths <paths> <snapshot> <top> <out>
 # Atomically write <out>: the NUL-delimited entries of <paths> that <snapshot>
 # covers (the entry itself or a parent "dir/" entry, as workspace_diff._covered)
-# and that still exist under <top>. Non-zero on a read or write failure. -E and
-# no cwd on sys.path (D7): the cwd is the agent's repo.
+# and that still exist under <top>. Non-zero on a read or write failure. -I -S
+# and no cwd on sys.path (D7): the cwd is the agent's repo.
+# BACKLOG 129: this is the snapshot READER -- it reads <snapshot>
+# (preexisting-untracked.z, sealed content) and decides which of the agent's
+# newly-added paths are actually the user's pre-existing files (to be removed
+# from the branch tip, see _loki_untrack_agent_committed_user_files). A bare
+# `python3 -E` here has the same .pth exposure as the writer above: a same-UID
+# .pth can run arbitrary code during this call, including rewriting <out>
+# after the legitimate write. Resolved via _loki_snapshot_py_tool, run with
+# -I -S (see _loki_untracked_merge's comment for why -S, not just -I, is
+# required to close it). A resolve failure fails this function closed.
 _loki_covered_paths() {
-    python3 -E -c 'import sys
+    local pytool=""
+    pytool="$(_loki_snapshot_py_tool)" || return 1
+    "$pytool" -I -S -c 'import sys
 sys.path[:] = [p for p in sys.path if p not in ("", ".")]
 import os
 paths, snap, top, out = sys.argv[1:5]
@@ -9437,6 +9970,13 @@ _loki_untrack_agent_committed_user_files() {
     local snap=".loki/state/preexisting-untracked.z" rec=".loki/state/agent-committed-user-files.z"
     local base="" fork="" start="" top="" names=""
     local unchecked="Before switching branches, run git rm --cached on each of your files the agent committed and commit, or a checkout of the base deletes them. Left uncommitted: no session commit."
+    # BACKLOG 70: a tampered snapshot cannot be trusted to say which paths were
+    # pre-existing, so treat it the same as "no snapshot" -- fail closed via the
+    # caller, which then skips the session commit entirely.
+    if ! _loki_snapshot_verify; then
+        log_warn "Could not check whether the agent committed your pre-existing untracked files on $1 (snapshot tampered). ${unchecked}"
+        return 1
+    fi
     [ -s "$snap" ] || return 0
     # No commit on the branch yet: the agent committed nothing.
     git rev-parse --verify -q HEAD >/dev/null 2>&1 || return 0
@@ -9515,6 +10055,15 @@ commit_session_changes() {
             ;;
     esac
 
+    # BACKLOG 70: a snapshot tampered with since this session sealed it (an
+    # agent process deleting the hash file to suppress preexisting_modified
+    # disclosure, or editing either file to hide or falsely disown paths) is
+    # treated as no snapshot at all: on a mismatch, _loki_snapshot_verify
+    # clears _LOKI_SNAPSHOT_THIS_RUN and writes the same .failed marker a
+    # snapshot failure writes, so the existing fail-closed check below
+    # (BACKLOG 90) also catches tampering, with its own warning.
+    _loki_snapshot_verify || true
+
     # Commit nothing unless THIS run took a current snapshot (BACKLOG 90). The
     # LOCK A1 opt-out takes none, so it never commits, even on a leftover
     # loki/session-* branch whose agent-branch.txt and snapshot belong to an
@@ -9532,6 +10081,15 @@ commit_session_changes() {
         return 0
     fi
 
+    # BACKLOG 68 rework: session end is also a point this run can prove no
+    # provider turn is in flight, so advance the tracked-since anchor here too
+    # (not only after each provider turn). Without this, a session that never
+    # calls _loki_record_session_created between its last turn and a normal
+    # end (e.g. a single-iteration run) would leave the anchor stale, and the
+    # NEXT session's resume union would then have nothing to safely prune even
+    # for a genuine user commit made between sessions.
+    _loki_advance_tracked_since_anchor
+
     _loki_untrack_agent_committed_user_files "$cur" || return 0
 
     # Stage everything except .loki/ runtime state and a secret-path denylist.
@@ -19331,6 +19889,12 @@ PYEOF
 _intelligent_usage_regen() {
     local target_dir="${TARGET_DIR:-.}"
     local usage_path="$target_dir/USAGE.md"
+    # Only the provider the operator chose may see a prompt (V10 P5): on any
+    # other provider keep the agent-written USAGE.md. Policy (and the
+    # LOKI_ALLOW_CLAUDE_SIDECALLS=1 opt-in) lives in providers/loader.sh,
+    # sourced at the top of this file.
+    # ponytail: upgrade path is routing this call through provider_invoke_argv.
+    loki_claude_sidecall_allowed 2>/dev/null || return 0
     # Find a working `claude` binary; if absent, bail silently.
     if ! command -v claude >/dev/null 2>&1; then
         return 0
@@ -23560,6 +24124,17 @@ except Exception as exc:
         local exit_code=0
         # v7.5.12: Mark provider pipeline as active so SIGINT trap can kill it.
         LOKI_PROVIDER_ACTIVE=1
+        # BACKLOG 68 rework: mark a turn in-flight so a SIGKILL mid-turn (pod
+        # loss: no trap runs) leaves the tracked-since anchor stale rather than
+        # advanced -- a resume must not prune anything the agent may have
+        # tracked during this still-unrecorded turn. Cleared only by
+        # _loki_record_session_created, right after this turn's own call to it
+        # below. Gated the same way as the anchor itself (this run has a live
+        # snapshot); an older/opted-out run writes no marker, matching its
+        # pre-existing no-anchor ("skip pruning") behavior.
+        if [ "${_LOKI_SNAPSHOT_THIS_RUN:-0}" = 1 ]; then
+            mkdir -p .loki/state 2>/dev/null && : > .loki/state/turn-in-flight 2>/dev/null
+        fi
         # v7.7.31: authorize autonomous operation at the system-prompt tier so
         # the spawned agent does not read the user's global ~/.claude/CLAUDE.md,
         # judge it to conflict with the loki_system prompt, call AskUserQuestion,