loki-mode 9.54.2 → 9.56.0

package/autonomy/run.sh

@@ -5338,6 +5338,62 @@ except Exception:
     return 0
 }
 
+#===============================================================================
+# Rule of Two (moat P9): a GitHub token never reaches an agent session.
+#
+# The run reads untrusted issue text and spawns agents that act on it, so a
+# token in the exported environment is one prompt injection away from a push.
+# main() un-exports every GitHub token it inherited (the shell keeps the value).
+# Every provider, reviewer, helper and test the agent writes then starts without
+# it. Loki's own trusted GitHub calls get it back for the one command:
+#   - direct `gh ...` calls, through the gh() wrapper defined below;
+#   - _loki_with_github_tokens <cmd...>, for the post-session push/PR paths.
+# LOKI_ALLOW_AGENT_GITHUB_TOKEN=1 (exact value) restores the old inheritance
+# and prints one stderr warning that the agent holds the token.
+# This is hygiene against a naive injection, not an isolation boundary: code
+# running as the same user can still read the parent's environment block
+# (/proc/<pid>/environ on Linux, sudo on a hosted runner). The boundary is a
+# CI job that holds no write token while the agent runs (see
+# .github/workflows/loki-issue-to-pr.yml).
+#===============================================================================
+_LOKI_WITHHELD_TOKENS=""
+
+_loki_with_github_tokens() {
+    local _v _rc=0
+    for _v in $_LOKI_WITHHELD_TOKENS; do export "${_v?}"; done
+    "$@" || _rc=$?
+    for _v in $_LOKI_WITHHELD_TOKENS; do export -n "${_v?}"; done
+    return "$_rc"
+}
+
+_loki_withhold_github_tokens() {
+    local _v _held=""
+    # Operator opt-out (exact value 1): keep the earlier behavior, where the
+    # agent inherits the token. That is a Rule of Two exposure, so say so.
+    if [ "${LOKI_ALLOW_AGENT_GITHUB_TOKEN:-}" = "1" ]; then
+        for _v in GH_TOKEN GITHUB_TOKEN GH_ENTERPRISE_TOKEN GITHUB_ENTERPRISE_TOKEN; do
+            [ -n "${!_v:-}" ] && _held="${_held:+$_held }$_v"
+        done
+        [ -z "$_held" ] || printf '%s\n' "WARNING: LOKI_ALLOW_AGENT_GITHUB_TOKEN=1: the agent session holds the GitHub token ($_held); an injected prompt can push with it (Rule of Two exposure)." >&2
+        return 0
+    fi
+    for _v in GH_TOKEN GITHUB_TOKEN GH_ENTERPRISE_TOKEN GITHUB_ENTERPRISE_TOKEN; do
+        [ -n "${!_v:-}" ] || continue
+        export -n "${_v?}"
+        case " $_LOKI_WITHHELD_TOKENS " in
+            *" $_v "*) ;;
+            *) _LOKI_WITHHELD_TOKENS="${_LOKI_WITHHELD_TOKENS:+$_LOKI_WITHHELD_TOKENS }$_v" ;;
+        esac
+    done
+    [ -n "$_LOKI_WITHHELD_TOKENS" ] || return 0
+    # Only when the binary exists, so `command -v gh` keeps meaning "gh is
+    # installed" for every caller that checks it.
+    if command -v gh >/dev/null 2>&1; then
+        gh() { _loki_with_github_tokens command gh "$@"; }
+    fi
+    log_info "Withheld from agent sessions (Rule of Two): $_LOKI_WITHHELD_TOKENS. Loki's own push and PR steps still use it."
+}
+
 #===============================================================================
 # on_run_complete  (Slice 3: opt-in local git output on success)
 #
@@ -5403,11 +5459,14 @@ on_run_complete() {
     # timeout is not installed (a local wrapper keeps this set -u safe on bash
     # 3.2, where an empty array expansion would error). Keeps every existing
     # `|| true` non-fatal behavior.
+    # The push and gh calls below are the trusted post-session step, so they
+    # get the withheld GitHub token back (a plain `timeout 30 gh` would exec
+    # the binary and bypass the gh() wrapper).
     _loki_net() {
         if command -v timeout >/dev/null 2>&1; then
-            timeout 30 "$@"
+            _loki_with_github_tokens timeout 30 "$@"
         else
-            "$@"
+            _loki_with_github_tokens "$@"
         fi
     }
     # Require gh + auth.
@@ -9180,6 +9239,18 @@ setup_agent_branch() {
         log_warn "Left uncommitted from an earlier unfinished session, now treated as your files: $leftover"
     fi
     rm -f .loki/state/session-created.z 2>/dev/null
+    # BACKLOG 130(c): seal the now-empty session-created.z record so this
+    # fresh mint's OWN in-process memory of "absent" is what every later
+    # record call and commit_session_changes verify against for the rest of
+    # this run -- not the file's on-disk content, which an agent process could
+    # otherwise repopulate with a planted path before this run ever trusts it.
+    _loki_session_created_seal  # BACKLOG-130C-MINT-SEAL
+    # BACKLOG 68 rework: a fresh mint starts with no tracked-since anchor and no
+    # in-flight marker (never seed the anchor from session-start-sha -- an
+    # anchor==start would let a later resume's "anchor..HEAD" diff include this
+    # session's OWN commits, pruning them from the next session's union as if
+    # the user had tracked them between sessions).
+    rm -f .loki/state/tracked-since.sha .loki/state/turn-in-flight 2>/dev/null
     if [ "$snap_ok" = 1 ]; then _LOKI_SNAPSHOT_THIS_RUN=1; fi
 
     # Every mint (a refused resume included) records its own base and the
@@ -9213,6 +9284,551 @@ _loki_snapshot_or_fail_closed() {
     return 1
 }
 
+# BACKLOG 70: preexisting-untracked.z and its .sha.z sibling live in
+# .loki/state, which the agent process (and anything it spawns) can write. A
+# co-located adversarial agent can delete .sha.z to blind
+# workspace_diff._preexisting_untracked's mismatch check (silently suppressing
+# every preexisting_modified disclosure), or append/edit .z entries to hide its
+# own new files from the receipt or falsely disown them. Full prevention against
+# a same-UID process is not achievable (it can read and rewrite anything this
+# process can); the realistic bar, and the one BACKLOG 70 asks for, is
+# DISCLOSURE: this process is the only one that can remember what it itself
+# just wrote, so it seals a sha256 of both files in its own memory right after
+# writing them, and re-derives + compares that digest at every later read site.
+# A mismatch (or the sealed file now missing) is reported as tampering and
+# treated as a failed snapshot (fail closed: no session commit), never patched
+# over silently. Cleared whenever the files are deliberately removed (line
+# ~9165) so that path is never reported as tampering.
+_LOKI_SNAPSHOT_SEAL=""
+
+# BACKLOG 130(c): .loki/state/session-created.z is NOT one of the two files
+# _LOKI_SNAPSHOT_SEAL above covers. It records the paths THIS session created
+# (unioned after every provider turn by _loki_record_session_created), and
+# _loki_snapshot_preexisting's resume union (line ~9683) trusts its content
+# directly: any path it lists is EXCLUDED from the new preexisting-untracked.z
+# snapshot, i.e. treated as "the session's own, never the user's". An agent
+# that plants a user's file path into session-created.z therefore gets that
+# exact path permanently exempted from pre-existing-file protection on the
+# next resume -- the file is swept into `git add -A` and the session commit as
+# if the session had created it. A separate seal, sibling to
+# _LOKI_SNAPSHOT_SEAL, closes this WITHIN one process's lifetime: sealed right
+# after every legitimate write this process makes (a successful record, the
+# fresh-mint delete, and this process's first look at the file on resume),
+# verified before any LATER point in the SAME process trusts the content,
+# fail-closed (delete the file, clear the seal) on a mismatch. Kept SEPARATE
+# from _LOKI_SNAPSHOT_SEAL rather than folded into one combined digest: this
+# file legitimately changes every provider turn, so a shared digest would
+# falsely flag tampering on every normal turn, and the fresh-mint `rm` (line
+# ~9241) runs after preexisting-untracked.z is sealed, which would falsely
+# flag every fresh mint too.
+# ACCEPTED GAP (disclosure, not prevention, same bar as BACKLOG 70's own): a
+# seal lives only in this process's memory, so it cannot verify content a
+# PRIOR process wrote before this one starts (setup_agent_branch's resume path
+# seals its own first read of the file rather than verifying it, since no
+# prior seal survives to check against) -- tampering already on disk before
+# this process begins is trusted at that one read, same as
+# _LOKI_SNAPSHOT_SEAL's own resume-time trust of preexisting-untracked.z's
+# prior content. What this DOES close: an agent process co-located with THIS
+# run can no longer plant a path into session-created.z between this run's own
+# writes and its own later reads (the resume union's exclude use, the next
+# record's merge, or the commit-time gate) without it being caught before that
+# content is trusted.
+_LOKI_SESSION_CREATED_SEAL=""
+
+# BACKLOG 129 (follow-up to BACKLOG 70/BACKLOG 70-awk): the DIGEST computation
+# above is hardened (fixed-root-path-first, no awk), but until this function
+# was added the snapshot WRITER (_loki_untracked_merge) and READER
+# (_loki_covered_paths), plus the hash-snapshot helper that produces .sha.z,
+# still ran bare `python3 -E`. -E only blocks PYTHON* env vars; it does NOT
+# stop user (or Homebrew) site-packages from loading, and Python execs every
+# line starting "import " in every .pth file found there on every startup
+# (confirmed empirically: a .pth planted in user site-packages fired and
+# silently rewrote the writer's declared output file after the legitimate
+# write completed). A same-UID agent that plants such a .pth can forge the
+# CONTENT of the snapshot BEFORE the (correctly hardened) seal ever computes a
+# digest over it -- the seal then faithfully approves the forgery. Resolved
+# the same way as _loki_snapshot_hash_tool: fixed root-owned candidate paths
+# first (a materially higher bar than a user-writable site-packages
+# directory), each PROBED with a real run (not just `-x`, which a Command Line
+# Tools-less Mac's /usr/bin shims would still pass while failing to execute
+# and possibly popping an install dialog), then a PATH walk restricted to
+# absolute entries as a last resort. -I -S (isolated mode, and -S also skips
+# `import site` entirely) is used at every call site below: -I alone still
+# loads site-packages (verified: `python3 -I` still lists Homebrew's
+# site-packages on this host), so -S is required to close the .pth vector,
+# not just narrow it. Accepted gap, same shape as _loki_snapshot_hash_tool's:
+# replacing the interpreter binary AT ONE OF THE FIXED PATHS this resolves to
+# first requires root; a host with none of the fixed candidates falls through
+# to the PATH-walk, which still trusts whatever sits first on an absolute PATH
+# entry under that name. A further, host-specific gap: on macOS these fixed
+# paths are typically Command Line Tools / Xcode shims that dispatch into
+# /Applications/Xcode.app -- root-owned on a normal install, but the fixed
+# path is only as trustworthy as that dispatch target on any host where it is
+# not.
+_loki_snapshot_py_tool() {
+    local c
+    for c in /usr/bin/python3 /bin/python3; do
+        [ -x "$c" ] && [ ! -d "$c" ] && "$c" -I -S -c '' >/dev/null 2>&1 && { printf '%s\n' "$c"; return 0; }
+    done
+    local dir
+    local IFS=:
+    for dir in $PATH; do
+        case "$dir" in
+            /*) ;;
+            *) continue ;;
+        esac
+        if [ -x "$dir/python3" ] && [ ! -d "$dir/python3" ] \
+           && "$dir/python3" -I -S -c '' >/dev/null 2>&1; then
+            printf '%s\n' "$dir/python3"
+            return 0
+        fi
+    done
+    return 1
+}
+
+# BACKLOG 129: same rationale and pattern as _loki_snapshot_py_tool above, for
+# `git`. Every call in this snapshot writer/reader chain
+# (_loki_untracked_status, _loki_tracked_by_user_since_anchor,
+# _loki_snapshot_preexisting's own `git rev-parse --show-toplevel`) used a bare
+# `git` -- an unscoped PATH lookup a same-UID attacker can shadow with a fake
+# binary placed in a user-writable directory ahead of the real one, exactly
+# the class of bypass _loki_snapshot_hash_tool's own comment already documents
+# for sha256sum/shasum. Reproduced empirically: a fake `git` ahead on PATH
+# that filters one path out of `git status`'s output caused that path to be
+# completely absent from the sealed snapshot. `_loki_untrack_agent_committed_
+# user_files`'s git calls (feeding the READER path, _loki_covered_paths) and
+# the commit-time `git reset`/`git commit`/`git update-index` calls in
+# commit_session_changes are DELIBERATELY left unresolved here (out of scope
+# for this fix): a fake git on PATH already defeats the commit gate directly
+# at commit time regardless of what the snapshot says, so resolving only the
+# reader's git feed would not change that attacker's outcome. Tracked as a
+# follow-up (process-wide resolved git) rather than folded into this change.
+_loki_snapshot_git_tool() {
+    local c
+    for c in /usr/bin/git /bin/git; do
+        [ -x "$c" ] && [ ! -d "$c" ] && "$c" --version >/dev/null 2>&1 && { printf '%s\n' "$c"; return 0; }
+    done
+    local dir
+    local IFS=:
+    for dir in $PATH; do
+        case "$dir" in
+            /*) ;;
+            *) continue ;;
+        esac
+        if [ -x "$dir/git" ] && [ ! -d "$dir/git" ] && "$dir/git" --version >/dev/null 2>&1; then
+            printf '%s\n' "$dir/git"
+            return 0
+        fi
+    done
+    return 1
+}
+
+# _loki_snapshot_hash_tool: resolve an absolute path to sha256sum or shasum.
+# Fixed, root-owned candidate paths are tried FIRST, before any PATH walk: a
+# same-UID agent that can write to a user-writable directory ahead of the real
+# tool on PATH (Homebrew's prefix, e.g. /opt/homebrew/bin, is user-writable by
+# default on macOS and typically precedes /usr/bin) could otherwise drop its
+# own sha256sum/shasum there that reads the two snapshot files and echoes back
+# whatever hash it wants -- the same class of bypass as the .pth hijack this
+# whole function exists to close, just with a fake binary as the carrier
+# instead of a fake module. Trying the standard system locations first closes
+# that: they require root to write to, a materially higher bar than a
+# user-writable site-packages directory or a user-writable PATH entry.
+# A PATH walk (D7: never trust a bare command name -- restricted to absolute
+# entries, matching autonomy/loki's loki_verify_tool_path) is kept only as a
+# last resort for a host that keeps sha256sum/shasum somewhere nonstandard;
+# document there that this fallback still trusts whatever is first on an
+# absolute PATH entry, which a user-writable directory ahead of the system
+# dirs can still shadow. Prints nothing (caller then falls back) when no tool
+# is found anywhere.
+_loki_snapshot_hash_tool() {
+    local c
+    for c in /usr/bin/sha256sum /bin/sha256sum /sbin/sha256sum \
+             /usr/bin/shasum /bin/shasum; do
+        [ -x "$c" ] && [ ! -d "$c" ] && { printf '%s\n' "$c"; return 0; }
+    done
+    # Last resort: PATH walk, absolute entries only. Still trusts whatever
+    # sits first on PATH under that name; see comment above.
+    local name dir
+    local IFS=:
+    for name in sha256sum shasum; do
+        for dir in $PATH; do
+            case "$dir" in
+                /*) ;;
+                *) continue ;;
+            esac
+            if [ -x "$dir/$name" ] && [ ! -d "$dir/$name" ]; then
+                printf '%s\n' "$dir/$name"
+                return 0
+            fi
+        done
+    done
+    return 1
+}
+
+# _loki_snapshot_digest: sha256 of preexisting-untracked.z + .sha.z content
+# (each independently, "-" standing in for "file absent" so a delete is part
+# of the digest, not indistinguishable from an empty file; "?" standing in for
+# "file present but the hash tool failed to produce a real digest" -- a
+# nonzero exit, empty output, or output that fails validation below -- so a
+# transient read error never seals or compares as an empty string).
+#
+# HIGH-severity reviewer finding on the original python3 -E version: -E only
+# ignores PYTHON* env vars, it does NOT stop Python from loading user (or, on
+# macOS with Homebrew, system) site-packages, and Python executes every .pth
+# file found there on every startup. A same-UID agent process can plant a .pth
+# file there that hijacks this script's own print() to emit a cached, stale
+# (pre-tamper) digest -- fully defeating the seal while `git`/file state show
+# real tampering happened. Fixed by computing the digest with sha256sum/shasum
+# instead: neither has a .pth-style module-loading path for that hijack to
+# attach to. shasum is a Perl script on macOS (not a compiled binary), but its
+# @INC search path is root-owned system Perl library directories, not a user
+# site-packages directory, so the .pth carrier does not transfer to it.
+#
+# SECOND reviewer finding, on the shasum/sha256sum version that first closed
+# the .pth hole: the digest was piped through a bare `awk '{print $1}')`
+# resolved via an unscoped PATH lookup (`awk '{...}'` runs whatever `awk`
+# comes first on PATH). A fake `awk` placed in a user-writable directory ahead
+# of the real one (the same Homebrew-prefix-precedes-/usr/bin shape as the
+# hash-tool bypass above) can intercept the pipe and print a cached, stale
+# digest, defeating the seal exactly as before -- the fix reintroduced the
+# same bypass class it was written to close, just moved one command over.
+# Fixed by dropping awk entirely: the first whitespace-delimited field is
+# taken with the shell builtin `${h%% *}` (parameter expansion, no external
+# process, nothing on PATH to hijack), and the result is validated as exactly
+# 64 lowercase hex characters before being trusted as a real sha256 digest --
+# anything else (empty, wrong length, non-hex, a hand-rolled fake tool that
+# does not bother to format like sha256sum/shasum) becomes "?". The hash
+# tool's own exit status is also checked explicitly now: a piped
+# `cmd | awk ...` hid a nonzero exit from the hash tool behind awk's exit
+# status; capturing to a plain variable surfaces it.
+#
+# Resolved via _loki_snapshot_hash_tool above (fixed root-owned paths first,
+# PATH walk restricted to absolute entries only as a last resort), not a bare
+# `command -v`, so this also closes the sibling D7-pattern gap: an unscoped
+# lookup could otherwise resolve to a same-named binary planted in a
+# user-writable directory ahead of the real tool on PATH.
+#
+# Accepted gaps (disclosure, not prevention, per BACKLOG 70's own bar, same as
+# documented at _LOKI_SNAPSHOT_SEAL above): a same-UID ptrace attack on this
+# process or on the sha256sum/shasum child process itself; replacing the
+# sha256sum/shasum binary AT ONE OF THE FIXED SYSTEM PATHS this resolves to
+# first (requires root, a materially higher bar than a user-writable
+# site-packages .pth or a user-writable PATH entry); on a host with none of
+# the fixed candidates, the PATH-walk fallback inside _loki_snapshot_hash_tool
+# still trusts whatever sits first on an absolute PATH entry under that name,
+# which a user-writable directory ahead of the system dirs (e.g. Homebrew's
+# prefix on macOS) can shadow -- not fully closed, only narrowed to hosts
+# lacking the standard tool paths; the python3 fallback below, kept only for
+# the extremely rare host with neither tool anywhere, is resolved via
+# _loki_snapshot_py_tool and run with -I -S (BACKLOG 131(b) -- see the comment
+# at that fallback for why -S, not just -I, is required to close the .pth
+# class), so it carries the same fixed-root-path-first resolution and
+# site-packages exclusion as the other hardened call sites in this file. It
+# still inherits _loki_snapshot_py_tool's own accepted gaps (documented at
+# that function): replacing the interpreter AT ONE OF ITS FIXED PATHS requires
+# root, and its own PATH-walk fallback still trusts whatever sits first on an
+# absolute PATH entry on a host lacking those fixed paths.
+_loki_snapshot_digest() {
+    local tool
+    tool="$(_loki_snapshot_hash_tool)" || tool=""
+    if [ -n "$tool" ]; then
+        local out="" path h
+        for path in ".loki/state/preexisting-untracked.z" ".loki/state/preexisting-untracked.sha.z"; do
+            if [ -f "$path" ]; then
+                h=""
+                case "${tool##*/}" in
+                    shasum) h="$("$tool" -a 256 -- "$path" 2>/dev/null)" || h="" ;;
+                    *)      h="$("$tool" -- "$path" 2>/dev/null)" || h="" ;;
+                esac
+                # No awk: take the first whitespace-delimited field with a
+                # shell builtin (nothing on PATH to hijack), then require
+                # exactly 64 lowercase hex characters. Anything else -- empty
+                # output, a nonzero exit already caught above, an unexpected
+                # format, a hand-rolled fake tool -- becomes "?" rather than
+                # being trusted as a real digest. "?" is distinct from "-"
+                # (file absent) and from any real hex digest, so a later
+                # successful read of the same file mismatches it and is still
+                # disclosed as tampering.
+                h="${h%% *}"
+                if [ "${#h}" -eq 64 ]; then
+                    case "$h" in
+                        *[!0123456789abcdef]*) h="?" ;;
+                    esac
+                else
+                    h="?"
+                fi
+                out="$out $h"
+            else
+                out="$out -"
+            fi
+        done
+        printf '%s\n' "${out# }"
+        return 0
+    fi
+    # Fallback: neither sha256sum nor shasum found anywhere checked above
+    # (extremely rare on macOS/Linux). Resolved via _loki_snapshot_py_tool
+    # (fixed root-owned path first) and run with -I -S, the same BACKLOG 129
+    # pattern used at _loki_untracked_merge / _loki_covered_paths: -I alone is
+    # NOT enough -- a reviewer reproduced, on a sibling function in this same
+    # tamper-detection system, that a .pth file planted in Homebrew python3's
+    # own (user-writable) site-packages directory still fires under `python3
+    # -I` alone, since -I implies -s (skip user site-packages) but does not
+    # skip the resolved interpreter's OWN site-packages. Only -S (skip ALL
+    # site-packages, including the interpreter's own) closes that. A resolve
+    # failure degrades this fallback to printing nothing, same as any other
+    # failure path here (caller treats empty as "could not seal"). Additional
+    # accepted gap specific to this fallback (not present on the tool-based
+    # path above, which distinguishes "-" from "?"): OSError covers BOTH
+    # "file does not exist" and "file exists but is unreadable" here, so an
+    # unreadable file on this path is indistinguishable from an absent one --
+    # both print "-". The tool-based path above tells them apart ("-" for
+    # absent, "?" for present-but-unreadable, caught by the seal-time
+    # fail-closed check). Narrowing this further (os.path.lexists to emit "?"
+    # for present-but-unreadable) is straightforward but left undone here: this
+    # fallback only runs on a host with neither sha256sum nor shasum anywhere,
+    # already the rare case this whole function treats as a residual gap.
+    local pytool=""
+    pytool="$(_loki_snapshot_py_tool)" || return 1
+    "$pytool" -I -S -c 'import sys, hashlib
+sys.path[:] = [p for p in sys.path if p not in ("", ".")]
+out = []
+for path in sys.argv[1:]:
+    try:
+        with open(path, "rb") as fh:
+            out.append(hashlib.sha256(fh.read()).hexdigest())
+    except OSError:
+        out.append("-")
+print(" ".join(out))' \
+        ".loki/state/preexisting-untracked.z" ".loki/state/preexisting-untracked.sha.z" 2>/dev/null
+}
+
+# _loki_session_created_digest: sha256 of session-created.z alone ("-" for
+# absent, "?" for present-but-unreadable/unhashable, same sentinel contract as
+# _loki_snapshot_digest above). Deliberately a thin sibling, not a parameterized
+# reuse of _loki_snapshot_digest: that function's exact text (the `for path in
+# ...` line and the python fallback's trailing argv line) is matched by
+# tests/test-branch-lifecycle.sh's RED mutation harness, so leaving it
+# untouched keeps that harness's anchors valid. Resolved via the SAME hardened
+# tool resolvers (_loki_snapshot_hash_tool, _loki_snapshot_py_tool) as the
+# sibling above -- no fresh/unhardened python3 or shasum call site.
+_loki_session_created_digest() {
+    local tool
+    tool="$(_loki_snapshot_hash_tool)" || tool=""
+    local path=".loki/state/session-created.z"
+    # A FIFO or ANY symlink at $path (dangling or not -- [ -L ] rejects both,
+    # deliberately broader than just the dangling case: the only way this
+    # file is ever legitimately written is _loki_untracked_merge's own
+    # write-to-.tmp-then-`mv -f`, which always leaves a plain regular file at
+    # $path, never a symlink, so a symlink here is never this session's own
+    # legitimate output) is neither absent ([ -f ] is false for both) nor a
+    # hashable regular file -- falling through to the absent-file branch below
+    # would print the same "-" sentinel every fresh mint already seals as its
+    # normal starting state, silently trusting an agent-planted FIFO (whose
+    # blocked writer feeds content into the merge's later open() call) or a
+    # dangling symlink (whose target read fails and is treated as "-" too).
+    # Caught here, before either digest branch, with a sentinel ("?") that can
+    # never equal "-", a real hex digest, or empty.
+    if [ -L "$path" ] || { [ -e "$path" ] && [ ! -f "$path" ]; }; then printf '%s\n' "?"; return 0; fi  # BACKLOG-130C-NONREG-CHECK
+    if [ -n "$tool" ]; then
+        local h=""
+        if [ -f "$path" ]; then
+            case "${tool##*/}" in
+                shasum) h="$("$tool" -a 256 -- "$path" 2>/dev/null)" || h="" ;;
+                *)      h="$("$tool" -- "$path" 2>/dev/null)" || h="" ;;
+            esac
+            h="${h%% *}"
+            if [ "${#h}" -eq 64 ]; then
+                case "$h" in
+                    *[!0123456789abcdef]*) h="?" ;;
+                esac
+            else
+                h="?"
+            fi
+            printf '%s\n' "$h"
+        else
+            printf '%s\n' "-"
+        fi
+        return 0
+    fi
+    # Fallback: neither sha256sum nor shasum found anywhere (same rare-host
+    # case _loki_snapshot_digest's own fallback documents). Resolved via
+    # _loki_snapshot_py_tool, run with -I -S (see that function's comment for
+    # why -S, not just -I, is required to close the .pth vector).
+    local pytool=""
+    pytool="$(_loki_snapshot_py_tool)" || return 1
+    "$pytool" -I -S -c 'import sys, hashlib
+sys.path[:] = [p for p in sys.path if p not in ("", ".")]
+try:
+    with open(sys.argv[1], "rb") as fh:
+        print(hashlib.sha256(fh.read()).hexdigest())
+except OSError:
+    print("-")' \
+        "$path" 2>/dev/null
+}
+
+# _loki_session_created_seal: record this process's own memory of the current
+# session-created.z content, right after every point that legitimately changes
+# it (a successful union in _loki_record_session_created, the fresh-mint
+# delete, a resume, and the post-commit/no-op delete in
+# commit_session_changes). Same fail-closed shape as _loki_snapshot_seal: an
+# empty or "?" digest at seal time is itself suspicious (a legitimate write or
+# delete should never immediately be unreadable), so it is rejected rather
+# than sealed, which would let seal and a later verify silently agree on the
+# sentinel and disarm the guard for the rest of the session.
+_loki_session_created_seal() {
+    local d
+    d="$(_loki_session_created_digest)"
+    case "$d" in
+        ""|*'?'*)
+            # Fail closed, not just "untrusted": an empty seal makes
+            # _loki_session_created_verify's `[ -n "$_LOKI_SESSION_CREATED_SEAL" ]
+            # || return 0` skip every later check for the rest of this
+            # process's life. Leaving the file on disk here would fail OPEN --
+            # unreadable-but-present content would then be silently trusted by
+            # every later read site with no seal ever able to catch it. Delete
+            # it instead, matching _loki_session_created_verify's own
+            # fail-closed action on a real mismatch -- and, like that function's
+            # own re-seal after its delete, set the seal to the digest's real
+            # "absent" sentinel ("-"), not empty: an EMPTY seal here re-arms
+            # nothing (the guard above short-circuits as "never sealed" on
+            # every later check for the rest of this process), so an agent that
+            # recreates the file with a planted path in this window would get
+            # it silently merged in as trusted on the next successful record.
+            # "-" is a real, non-empty seal value that the next verify's live
+            # digest of a freshly-recreated file cannot match, keeping the
+            # guard armed against exactly that recreation.
+            rm -f .loki/state/session-created.z 2>/dev/null
+            _LOKI_SESSION_CREATED_SEAL="-"
+            log_warn "Could not seal the session-created record (hash tool failed or produced no readable digest); discarding it (its files are treated as yours, left uncommitted)"
+            audit_log "SESSION_CREATED_SEAL_FAILED" "_loki_session_created_digest returned empty or an unreadable-file sentinel at seal time"
+            ;;
+        *)
+            _LOKI_SESSION_CREATED_SEAL="$d"
+            ;;
+    esac
+}
+
+# _loki_session_created_verify: compare the live session-created.z digest
+# against the sealed one. No seal recorded (never sealed this process, or
+# deliberately cleared) is not tampering: returns success, does nothing --
+# EVERY caller that trusts session-created.z's content must therefore have
+# sealed it first (mint, resume, and after each successful record all do). A
+# seal that no longer matches IS tampering: logs and discloses it (same
+# DISCLOSURE bar as BACKLOG 70, not prevention against a same-UID process), and
+# fails closed by deleting the untrusted file outright -- its entries then
+# become "the user's, not recorded as this session's", the safe direction,
+# since a false claim of user ownership only leaves a file uncommitted on disk,
+# never deletes it, while a false claim of session ownership can get a user's
+# file swept into a commit and removed from disk on a later checkout of the
+# base. Called BEFORE any later point in the SAME process treats the file's
+# content as trustworthy (verify-before-trust, not verify-after-use):
+# _loki_record_session_created verifies at its very top, before its own
+# self-referential merge (base="$out"), and unconditionally -- not gated on
+# _LOKI_SNAPSHOT_THIS_RUN, since an interrupt/cleanup call can still fire after
+# that flag was cleared mid-session; commit_session_changes verifies at its
+# very top, before every one of its several early returns (the untrack
+# failure, the git 2.25 unstage failure, a secret-scan abort, a failed `git
+# commit`) that would otherwise skip its own rm -f cleanup and leave a
+# tampered file on disk for the next resume. _loki_resume_snapshot does NOT
+# call this function: it is this process's FIRST read of a file the PREVIOUS
+# (dead) process wrote, so there is no seal from that process to verify
+# against here; it instead calls _loki_session_created_seal directly to
+# establish THIS process's own baseline before anything (including
+# _loki_snapshot_preexisting's resume-union exclude use, right after) reads
+# the file. See the ACCEPTED GAP note at _LOKI_SESSION_CREATED_SEAL above.
+_loki_session_created_verify() {
+    local live="" path=".loki/state/session-created.z"
+    [ -n "$_LOKI_SESSION_CREATED_SEAL" ] || return 0
+    live="$(_loki_session_created_digest)"
+    if [ "$live" = "$_LOKI_SESSION_CREATED_SEAL" ]; then
+        return 0
+    fi
+    log_warn "session-created.z changed after this session recorded it (possible tampering by an agent process); discarding the record (its files are treated as yours, left uncommitted)"
+    audit_log "SESSION_CREATED_TAMPERED" "session-created.z changed after being sealed: live=$live,sealed=$_LOKI_SESSION_CREATED_SEAL"
+    rm -f "$path" 2>/dev/null
+    _LOKI_SESSION_CREATED_SEAL=""
+    _loki_session_created_seal
+    return 1
+}
+
+# _loki_snapshot_seal: record this process's own memory of what it just wrote.
+# Called only right after a successful _loki_snapshot_preexisting. Minor
+# reviewer note: a legitimate snapshot write should never hit an unreadable-
+# file condition immediately after writing it, so a "?" in the digest AT SEAL
+# TIME (as opposed to at a later verify) is itself suspicious -- both seal and
+# a later verify could then read "?", compare equal, and silently disarm the
+# guard for the rest of the session (the same failure mode
+# _loki_snapshot_verify's mismatch path exists to catch, just never triggered
+# because both sides agree on the sentinel). Closed cheaply: reject an empty
+# or "?"-containing digest at seal time the same way _loki_snapshot_verify
+# rejects a mismatch -- log and disclose it, write the .failed marker, AND
+# clear _LOKI_SNAPSHOT_THIS_RUN directly here (belt-and-braces: the actual
+# gate that stops a commit). The call site right after `_loki_snapshot_seal`
+# in _loki_snapshot_preexisting also checks `_LOKI_SNAPSHOT_SEAL` and returns
+# non-zero on failure, which is what actually propagates to
+# _loki_snapshot_or_fail_closed / _loki_resume_snapshot and keeps their
+# existing callers from ever setting _LOKI_SNAPSHOT_THIS_RUN=1 in the first
+# place (see the comment there) -- so the in-function clear here is redundant
+# with that, not the sole mechanism, kept only as defense in depth in case a
+# future caller invokes this function directly. The call site above is
+# intentionally left as a bare `_loki_snapshot_seal` (no `|| return`):
+# tests/test-branch-lifecycle.sh's RED harness matches that exact line to
+# strip the guard; the propagation check right after it carries its own
+# trailing-comment marker the RED harness also strips (see the comment at
+# that check, in _loki_snapshot_preexisting, for the exact text -- not
+# repeated here so a grep for it does not also match this sentence), so
+# removing either half of the guard is enough to reproduce the pre-fix
+# silent-degrade behavior in that test.
+_loki_snapshot_seal() {
+    local d
+    d="$(_loki_snapshot_digest)"
+    case "$d" in
+        ""|*'?'*)
+            _LOKI_SNAPSHOT_SEAL=""
+            _LOKI_SNAPSHOT_THIS_RUN=0
+            log_warn "Could not seal the pre-existing-file snapshot (hash tool failed or produced no readable digest); treating this session as unsnapshotted (nothing will be committed)"
+            audit_log "SNAPSHOT_SEAL_FAILED" "_loki_snapshot_digest returned empty or an unreadable-file sentinel at seal time"
+            mkdir -p .loki/state 2>/dev/null
+            : > .loki/state/preexisting-untracked.failed 2>/dev/null
+            ;;
+        *)
+            _LOKI_SNAPSHOT_SEAL="$d"
+            ;;
+    esac
+}
+
+# _loki_snapshot_verify: compare the live files against the sealed digest.
+# No seal recorded yet (never snapshotted this process, or deliberately
+# cleared) is not tampering: returns success and does nothing. A seal that no
+# longer matches IS tampering: logs it (disclosure is the bar BACKLOG 70 asks
+# for; a same-UID process can rewrite anything else this one could check), and
+# forces every fail-closed path a missing/failed snapshot already takes --
+# clears the seal so a caller cannot re-check a stale value, clears
+# _LOKI_SNAPSHOT_THIS_RUN so commit_session_changes and
+# _loki_record_session_created both treat this as an unsnapshotted session, and
+# (re)writes preexisting-untracked.failed so BACKLOG 90's existing message
+# fires. Every consumer of the snapshot/hash files calls this first and treats
+# non-zero as "no snapshot".
+_loki_snapshot_verify() {
+    local live=""
+    [ -n "$_LOKI_SNAPSHOT_SEAL" ] || return 0
+    live="$(_loki_snapshot_digest)"
+    if [ "$live" = "$_LOKI_SNAPSHOT_SEAL" ]; then
+        return 0
+    fi
+    log_warn "Pre-existing-file snapshot or its hash file changed after this session recorded it (possible tampering by an agent process); treating this session as unsnapshotted (nothing will be committed)"
+    # Record both digests (before clearing the seal below) so an operator
+    # reading the audit log can tell a genuine content tamper apart from a
+    # transient hash-tool failure that just produced a different digest.
+    audit_log "SNAPSHOT_TAMPERED" "preexisting-untracked.z or .sha.z changed after being sealed: live=$live,sealed=$_LOKI_SNAPSHOT_SEAL"
+    _LOKI_SNAPSHOT_SEAL=""
+    _LOKI_SNAPSHOT_THIS_RUN=0
+    mkdir -p .loki/state 2>/dev/null
+    : > .loki/state/preexisting-untracked.failed 2>/dev/null
+    return 1
+}
+
 # _loki_snapshot_preexisting [union]
 # Write .loki/state/preexisting-untracked.z: every path git does not track,
 # untracked and gitignored, repo-wide, NUL-delimited, relative to the repo top.
@@ -9221,33 +9837,90 @@ _loki_snapshot_or_fail_closed() {
 # a directory only when an ignore pattern matches it, so node_modules/ is one
 # "dir/" entry covering its subtree, while logs/ holding only *.log files is
 # listed file by file (a new logs/app.json is still the agent's). "union" keeps
-# the paths already recorded. The sibling .sha.z (content hash per file entry)
-# lets the receipt list a pre-existing file the run changed; it is removed
-# first, so a failed hash step means no detection, never stale hashes. Returns
-# non-zero, leaving any earlier list in place, when git cannot list.
+# the paths already recorded, minus any that became tracked because the USER
+# committed them between sessions (BACKLOG 68 rework). Distinguishing that from
+# "the AGENT itself committed or staged this pre-existing file during THIS
+# session, then got killed" is the entire point of the anchor below: only a
+# path git ADDED strictly after the last point this run itself could reach is
+# ever pruned. A path the agent tracked before that point is left IN the union
+# so it still flows into _loki_untrack_agent_committed_user_files's disclosure
+# (warn, remove from the branch tip, keep on disk) -- never silently swept in.
+#
+# The anchor is .loki/state/tracked-since.sha, a commit SHA written by
+# _loki_record_session_created (after each provider turn) and by
+# commit_session_changes (at session end): the newest point this run itself
+# recorded. .loki/state/turn-in-flight marks a provider turn as currently
+# running (set right before invocation, cleared by the same record call that
+# advances the anchor); its presence means a turn may have committed something
+# since the last anchor write, so pruning is skipped entirely rather than risk
+# treating an agent's mid-turn commit as the user's. Any anchor-resolution
+# failure (missing anchor, anchor not an ancestor of HEAD, merge-base failure)
+# also skips pruning: the safe direction is the old behavior (false blame, file
+# kept on disk), never silent adoption.
+#
+# The sibling .sha.z (content hash per file entry) lets the receipt list a
+# pre-existing file the run changed; it is removed first, so a failed hash step
+# means no detection, never stale hashes. Returns non-zero, leaving any earlier
+# list in place, when git cannot list. Seals a digest of both files on success
+# (BACKLOG 70) so later reads can detect tampering.
 _loki_snapshot_preexisting() {
-    local snap=".loki/state/preexisting-untracked.z" top="" base="" exclude=""
+    local snap=".loki/state/preexisting-untracked.z" top="" base="" exclude="" tracked="" gittool="" pytool=""
     rm -f "${snap%.z}.sha.z" 2>/dev/null
-    top="$(git rev-parse --show-toplevel 2>/dev/null)" || return 1
+    gittool="$(_loki_snapshot_git_tool)" || return 1
+    top="$("$gittool" rev-parse --show-toplevel 2>/dev/null)" || return 1
     mkdir -p .loki/state 2>/dev/null || return 1
     # "union" never adds a path listed in session-created.z: those files were
     # made by a session that did not finish (interrupt, pod loss), so the
     # session that finishes the work commits them. If the user edits one of
     # them between sessions it is still the session's file and is committed
-    # with the edit. Recorded entries only block additions; they never remove
-    # a path already in the list.
+    # with the edit. Recorded entries only block additions; a path this run can
+    # prove the USER tracked between sessions is the one case they DO remove
+    # (see _loki_tracked_by_user_since_anchor below).
     if [ "${1:-}" = union ]; then
         base="$snap"
         exclude=".loki/state/session-created.z"
+        tracked="$snap.tracked"
+        if ! _loki_tracked_by_user_since_anchor "$top" "$tracked"; then
+            rm -f "$tracked"
+            tracked=""
+        fi
     fi
     if ! _loki_untracked_status "$snap.status" \
-       || ! _loki_untracked_merge "$snap.status" "$base" "$exclude" exact "$snap"; then
-        rm -f "$snap.status" "$snap.tmp"
+       || ! _loki_untracked_merge "$snap.status" "$base" "$exclude" exact "$snap" "$tracked"; then
+        rm -f "$tracked" "$snap.status" "$snap.tmp"
         return 1
     fi
-    rm -f "$snap.status"
-    python3 -E "$SCRIPT_DIR/lib/workspace_diff.py" hash-snapshot "$top" "$snap" >/dev/null 2>&1 \
+    rm -f "$tracked" "$snap.status"
+    # BACKLOG 129: write_snapshot_hashes (the only code path "hash-snapshot"
+    # reaches) does pure file I/O (open/os.path/hashlib), no sibling import
+    # from autonomy/lib and no subprocess/git call, so -I -S is safe here: it
+    # never needs the script's own directory on sys.path or anything from
+    # site-packages. This writes .sha.z, one of the two files the seal above
+    # digests, so it is in scope of the same forgery class as the merge/covered
+    # sites below. A failed resolve here degrades to the existing log_warn path
+    # (receipt loses preexisting_modified detection) rather than blocking the
+    # snapshot -- matching this call's pre-existing non-fatal-on-failure shape.
+    pytool="$(_loki_snapshot_py_tool)" && "$pytool" -I -S "$SCRIPT_DIR/lib/workspace_diff.py" hash-snapshot "$top" "$snap" >/dev/null 2>&1 \
         || log_warn "Could not hash your pre-existing untracked files; the receipt cannot list the ones this run changes"
+    _loki_snapshot_seal
+    # A seal failure (empty digest or an unreadable-file "?", see the comment
+    # at _loki_snapshot_seal) leaves _LOKI_SNAPSHOT_SEAL empty; propagate that
+    # as a failure of this function too, so both callers'
+    # (_loki_snapshot_or_fail_closed and _loki_resume_snapshot) existing
+    # fail-closed handling applies, instead of silently reporting success on a
+    # session this process could not actually seal. This is the line that
+    # actually makes a seal failure fail closed (_loki_snapshot_seal's own
+    # in-function clear is defense in depth, not the mechanism -- see the
+    # comment there). This line is deliberately also stripped by
+    # tests/test-branch-lifecycle.sh's BACKLOG-70 RED mutation, by its trailing
+    # comment marker (kept off this sentence on purpose, so a grep for the
+    # marker text matches only the one real code line below, not this prose),
+    # same as the guard calls above it: without it, on a mutated copy that
+    # also strips `_loki_snapshot_seal`, _LOKI_SNAPSHOT_SEAL stays at its
+    # global initial value ("") and this check alone would still return 1 and
+    # fail closed, masking the RED reproduction the test relies on to prove
+    # the mutation of the ACTUAL guard calls is non-vacuous.
+    [ -n "$_LOKI_SNAPSHOT_SEAL" ] || return 1  # BACKLOG-70-SEAL-CHECK
     return 0
 }
 
@@ -9255,32 +9928,57 @@ _loki_snapshot_preexisting() {
 # and the session-created record, so the two always agree: raw
 # `git status --porcelain -z` records for the whole repo, .loki excluded.
 # Non-zero, writing nothing, when git cannot list.
+# BACKLOG 129: resolved via _loki_snapshot_git_tool (fixed root-owned path
+# first, PATH walk restricted to absolute entries as a last resort), not a
+# bare `git`, which a same-UID attacker can shadow with a fake binary on a
+# user-writable PATH entry ahead of the real one -- reproduced empirically: a
+# fake git filtering one path out of its `status` output made that path
+# entirely absent from the sealed snapshot this function ultimately feeds.
 _loki_untracked_status() {
-    local top="" prefix=""
-    top="$(git rev-parse --show-toplevel 2>/dev/null)" || return 1
-    prefix="$(git rev-parse --show-prefix 2>/dev/null)" || return 1
-    git -C "$top" --no-optional-locks status --porcelain -z --no-renames -uall \
+    local top="" prefix="" gittool=""
+    gittool="$(_loki_snapshot_git_tool)" || return 1
+    top="$("$gittool" rev-parse --show-toplevel 2>/dev/null)" || return 1
+    prefix="$("$gittool" rev-parse --show-prefix 2>/dev/null)" || return 1
+    "$gittool" -C "$top" --no-optional-locks status --porcelain -z --no-renames -uall \
         --ignored=matching --ignore-submodules=all -- ":(exclude,literal)${prefix}.loki" \
         > "$1" 2>/dev/null && return 0
     rm -f "$1"
     return 1
 }
 
-# _loki_untracked_merge <status> <base> <exclude> exact|cover <out>
-# Atomically write <out>: the NUL-delimited paths of <base>, plus every
-# untracked ("??") or ignored ("!!") path in <status> that <exclude> does not
-# hold. With "cover", an <exclude> entry ending in "/" also holds every path
-# below it (workspace_diff._covered). An empty or missing <base> or <exclude>
-# is an empty list; any other read or write failure is non-zero and leaves
-# <out> as it was. Sorted bytewise, like `LC_ALL=C sort -z -u`. One python
-# process: bash 3.2 has no associative arrays, and a bash loop cost 300ms per
-# 6,000 entries on /bin/bash. -E and no cwd on sys.path (D7): the cwd is the
-# agent's repo.
+# _loki_untracked_merge <status> <base> <exclude> exact|cover <out> [tracked]
+# Atomically write <out>: the NUL-delimited paths of <base> minus any path
+# <tracked> lists (BACKLOG 68: entries the USER tracked between sessions, as
+# resolved by _loki_tracked_by_user_since_anchor -- never the whole index),
+# plus every untracked ("??") or ignored ("!!") path in <status> that <exclude>
+# does not hold. With "cover", an <exclude> entry ending in "/" also holds
+# every path below it (workspace_diff._covered). An empty or missing <base> or
+# <exclude> is an empty list; any other read or write failure is non-zero and
+# leaves <out> as it was. Sorted bytewise, like `LC_ALL=C sort -z -u`. One
+# python process: bash 3.2 has no associative arrays, and a bash loop cost
+# 300ms per 6,000 entries on /bin/bash. -I -S and no cwd on sys.path (D7): the
+# cwd is the agent's repo.
+# BACKLOG 129: this is the snapshot WRITER -- its <out> becomes
+# preexisting-untracked.z, one of the two files the seal above digests. A bare
+# `python3 -E` here still loads user site-packages (-E only blocks PYTHON* env
+# vars), so a same-UID .pth planted there can run arbitrary code during this
+# call and rewrite <out> after the legitimate write, forging exactly the bytes
+# the seal is about to trust -- reproduced empirically (a .pth that stripped
+# an entry from the just-written output). Resolved via _loki_snapshot_py_tool
+# (fixed root-owned path first) and run with -I -S: -I alone is not enough
+# (verified: `python3 -I` alone still lists Homebrew's user-writable
+# site-packages on this host), -S additionally skips `import site` so no .pth
+# anywhere is ever processed. A resolve failure fails this function closed
+# (return 1, same as any other read/write failure here) rather than silently
+# falling back to a bare, unresolved `python3`.
 _loki_untracked_merge() {
-    python3 -E -c 'import sys
+    local pytool=""
+    pytool="$(_loki_snapshot_py_tool)" || return 1
+    "$pytool" -I -S -c 'import sys
 sys.path[:] = [p for p in sys.path if p not in ("", ".")]
 import os
 status, base, exclude, mode, out = sys.argv[1:6]
+tracked = sys.argv[6] if len(sys.argv) > 6 else ""
 def entries(path, missing_ok=True):
     try:
         with open(path, "rb") as fh:
@@ -9300,6 +9998,11 @@ def covered(path):
         cut = path.find(b"/", cut + 1)
     return False
 paths = set(entries(base)) if base else set()
+if tracked:
+    # Exact match only: a "dir/" entry is never dropped even if a file under it
+    # is now tracked, so an ignored directory (node_modules/) never re-exposes
+    # the rest of its subtree (BACKLOG 66/78 territory).
+    paths -= set(entries(tracked))
 for rec in entries(status, missing_ok=False):
     # The session-created record ("cover" mode) never holds a directory entry:
     # a whole-directory entry (logs/, out/) would stop the resume union from
@@ -9315,6 +10018,80 @@ with open(out + ".tmp", "wb") as fh:
 os.replace(out + ".tmp", out)' "$@" 2>/dev/null
 }
 
+# _loki_tracked_by_user_since_anchor <top> <out> (BACKLOG 68 rework)
+# Write <out>: the NUL-delimited paths git added to the index between the
+# recorded "tracked-since" anchor and HEAD -- i.e. what a resume union may
+# safely treat as "the USER tracked this between sessions" and prune. Returns
+# non-zero (writing nothing) whenever that inference is not safe, which leaves
+# the caller pruning nothing (the old, safe-by-default behavior):
+#   - no anchor recorded yet (an older session, or nothing survived a turn)
+#   - a provider turn is marked in-flight (.loki/state/turn-in-flight): a turn
+#     can commit or stage a file and then be SIGKILLed before the next record
+#     call advances the anchor, so anything since the LAST anchor is unproven
+#   - the anchor does not resolve, or is not an ancestor of HEAD (branch
+#     switched, history rewritten, anchor stale)
+# --diff-filter=A, --no-renames: only additions, matching
+# _loki_untrack_agent_committed_user_files's own diff so the two never
+# disagree about which paths are "added since X".
+# BACKLOG 129: <out> here is subtracted from the snapshot base inside
+# _loki_untracked_merge (the "tracked" argument) before that WRITER seals its
+# result -- a fake git that lists an extra path here can prune a real
+# untracked path (e.g. a secret) out of the sealed snapshot, the same attack
+# as a forged `git status`, just one function over. Resolved via
+# _loki_snapshot_git_tool like the other git calls in this writer chain.
+_loki_tracked_by_user_since_anchor() {
+    local top="$1" out="$2" anchor_file=".loki/state/tracked-since.sha" anchor="" gittool=""
+    [ -f .loki/state/turn-in-flight ] && return 1
+    [ -s "$anchor_file" ] || return 1
+    anchor="$(cat "$anchor_file" 2>/dev/null)"
+    [ -n "$anchor" ] || return 1
+    gittool="$(_loki_snapshot_git_tool)" || return 1
+    "$gittool" rev-parse --verify -q "$anchor" >/dev/null 2>&1 || return 1
+    "$gittool" merge-base --is-ancestor "$anchor" HEAD 2>/dev/null || return 1
+    "$gittool" -C "$top" diff --name-only -z --no-renames --diff-filter=A "$anchor" HEAD > "$out.tmp" 2>/dev/null \
+        || { rm -f "$out.tmp"; return 1; }
+    mv -f "$out.tmp" "$out"
+    return 0
+}
+
+# _loki_advance_tracked_since_anchor
+# Move .loki/state/tracked-since.sha to the current HEAD and clear
+# .loki/state/turn-in-flight, but ONLY once the anchor write is confirmed on
+# disk. Called after every provider turn (_loki_record_session_created) and at
+# normal session end (commit_session_changes), i.e. at every point this run
+# can prove no provider turn is currently running -- PROVIDED the anchor write
+# itself lands, since _loki_tracked_by_user_since_anchor trusts both signals
+# together (anchor position + in-flight marker) to prove a commit happened
+# strictly after the anchor with no turn running. Clearing the marker on a
+# failed write would decouple them: a stale anchor stays on disk while the
+# marker falsely reports "no turn was in flight", so a later resume could
+# prove something it can't actually prove and prune an agent's own commit with
+# no disclosure (this is BACKLOG 68's failure mode, reintroduced). A HEAD that
+# does not resolve (unborn branch) is not a write failure -- there is nothing
+# to anchor yet -- so the marker still clears; the anchor stays "not set" as
+# before. Always returns 0 (both call sites are bare, unchecked calls): the
+# in-flight marker, not the return code, is the safety signal on a failed
+# write.
+_loki_advance_tracked_since_anchor() {
+    local sha=""
+    sha="$(git rev-parse --verify -q HEAD 2>/dev/null)" || true
+    if [ -n "$sha" ]; then
+        if ! { printf '%s\n' "$sha" > .loki/state/tracked-since.sha.tmp 2>/dev/null \
+               && mv -f .loki/state/tracked-since.sha.tmp .loki/state/tracked-since.sha 2>/dev/null; }; then
+            # Anchor write failed (disk full, a stray .tmp collision, a
+            # concurrent writer). Deliberately leave turn-in-flight SET and
+            # return here, before the unconditional clear below: the safe
+            # direction is to keep the old fallback-to-no-pruning path active
+            # for one more check, never to clear a marker the anchor write did
+            # not earn.
+            rm -f .loki/state/tracked-since.sha.tmp 2>/dev/null
+            return 0
+        fi
+    fi
+    rm -f .loki/state/turn-in-flight 2>/dev/null
+    return 0
+}
+
 # _loki_record_session_created
 # Union into .loki/state/session-created.z (NUL-delimited, repo-top-relative,
 # atomic) the paths git does not track now that the pre-existing snapshot does
@@ -9331,10 +10108,54 @@ os.replace(out + ".tmp", out)' "$@" 2>/dev/null
 # disk, not committed).
 _loki_record_session_created() {
     local snap=".loki/state/preexisting-untracked.z" out=".loki/state/session-created.z"
+    # BACKLOG 130(c): verify session-created.z BEFORE this run's THIS_RUN gate
+    # or its own merge trust the file -- verify-before-trust, not verify-after-
+    # use. Runs unconditionally (not gated on THIS_RUN=1): an interrupt/cleanup
+    # call can still fire after THIS_RUN was cleared mid-session (e.g. by
+    # _loki_snapshot_verify below on an earlier turn), and that call must not
+    # skip this check just because the gate below is about to return early. On
+    # a mismatch the file is already deleted by the time this returns (fail
+    # closed inside _loki_session_created_verify itself, not via this return
+    # value alone -- every call site of this function ignores its return with
+    # `|| true`, same as _loki_snapshot_verify above); the merge below then
+    # recomputes cleanly from a clean slate (base="$out" is now absent), so a
+    # legitimate record right after a caught tamper still records this turn's
+    # real files instead of hard-failing the whole call.
+    # ACCEPTED GAP (verify-to-use window, disclosed here since ordering is the
+    # whole point of this fix): this verify call and the merge's own read of
+    # "$out" as `base` (inside _loki_untracked_merge, below) are not atomic --
+    # _loki_advance_tracked_since_anchor, a git rev-parse, and a whole-repo
+    # `git status` all run in between. A same-UID write landing in that window
+    # is merged, then sealed as trusted by the seal call after a successful
+    # merge. This is the SAME shape of gap _LOKI_SNAPSHOT_SEAL's own
+    # verify/merge pair already accepts for preexisting-untracked.z (see
+    # _loki_untracked_merge's own BACKLOG 129 comment). Closing it would mean
+    # re-verifying again immediately before _loki_untracked_merge's read, inside
+    # that function -- deliberately not done here: _loki_untracked_merge's exact
+    # text is what tests/test-branch-lifecycle.sh's RED mutation harness matches
+    # by name-anchor, and threading a second, narrower verify through its
+    # shared codepath (also called with mode=exact for the OTHER snapshot) risks
+    # that anchor for a gap this narrow. Disclosure, not full prevention, is the
+    # same bar BACKLOG 70 itself accepts.
+    _loki_session_created_verify || true
     [ "${_LOKI_SNAPSHOT_THIS_RUN:-0}" = 1 ] || return 0
+    # BACKLOG 70: detect tampering with the sealed snapshot as early as
+    # possible (this runs after every provider turn, not just at commit time).
+    _loki_snapshot_verify || return 1
+    # BACKLOG 68 rework: this call is the point right after a provider turn
+    # ends, so it also advances the tracked-since anchor and clears the
+    # in-flight marker -- whatever the agent committed or staged during the
+    # turn that just finished is now provably NOT mid-turn, so a later resume's
+    # anchor..HEAD diff may safely be checked against it.
+    _loki_advance_tracked_since_anchor
     if [ -f "$snap" ] && _loki_untracked_status "$out.status" \
        && _loki_untracked_merge "$out.status" "$out" "$snap" cover "$out"; then
         rm -f "$out.status"
+        # BACKLOG 130(c): seal this process's own memory of the record it just
+        # wrote, so the NEXT call to this function (or commit_session_changes)
+        # verifies against what THIS process actually wrote, not whatever an
+        # agent process may write to the file in between.
+        _loki_session_created_seal
         return 0
     fi
     rm -f "$out.status" "$out.tmp" 2>/dev/null
@@ -9346,6 +10167,19 @@ _loki_record_session_created() {
 # from an unfinished previous session (this session's commit includes them).
 _loki_resume_snapshot() {
     local carried=""
+    # BACKLOG 130(c): seal THIS process's own first look at session-created.z
+    # before anything below reads or trusts it (verify-before-trust). This is
+    # a resuming process picking up a file the PREVIOUS (now-dead) process
+    # wrote; there is no seal from that process to verify against here (a
+    # seal never survives past the process that set it) -- sealing now is what
+    # lets THIS process detect an agent tampering with the file for the rest
+    # of ITS OWN lifetime (every subsequent record call, and the commit-time
+    # check), the same disclosure bar BACKLOG 70 already accepts for the
+    # sibling snapshot: tampering already on disk before this process starts
+    # is an accepted gap, never silently trusted forever after. Unconditional
+    # (not gated on the union below succeeding): the union does not modify
+    # session-created.z, so this process's view of it is stable either way.
+    _loki_session_created_seal
     if ! _loki_snapshot_or_fail_closed union; then
         log_warn "Could not add your current untracked files to the pre-existing list; this session will commit nothing (review and commit manually)"
         return 0
@@ -9389,10 +10223,21 @@ if ! type _commit_path_looks_secret >/dev/null 2>&1; then _commit_path_looks_sec
 # _loki_covered_paths <paths> <snapshot> <top> <out>
 # Atomically write <out>: the NUL-delimited entries of <paths> that <snapshot>
 # covers (the entry itself or a parent "dir/" entry, as workspace_diff._covered)
-# and that still exist under <top>. Non-zero on a read or write failure. -E and
-# no cwd on sys.path (D7): the cwd is the agent's repo.
+# and that still exist under <top>. Non-zero on a read or write failure. -I -S
+# and no cwd on sys.path (D7): the cwd is the agent's repo.
+# BACKLOG 129: this is the snapshot READER -- it reads <snapshot>
+# (preexisting-untracked.z, sealed content) and decides which of the agent's
+# newly-added paths are actually the user's pre-existing files (to be removed
+# from the branch tip, see _loki_untrack_agent_committed_user_files). A bare
+# `python3 -E` here has the same .pth exposure as the writer above: a same-UID
+# .pth can run arbitrary code during this call, including rewriting <out>
+# after the legitimate write. Resolved via _loki_snapshot_py_tool, run with
+# -I -S (see _loki_untracked_merge's comment for why -S, not just -I, is
+# required to close it). A resolve failure fails this function closed.
 _loki_covered_paths() {
-    python3 -E -c 'import sys
+    local pytool=""
+    pytool="$(_loki_snapshot_py_tool)" || return 1
+    "$pytool" -I -S -c 'import sys
 sys.path[:] = [p for p in sys.path if p not in ("", ".")]
 import os
 paths, snap, top, out = sys.argv[1:5]
@@ -9437,6 +10282,13 @@ _loki_untrack_agent_committed_user_files() {
     local snap=".loki/state/preexisting-untracked.z" rec=".loki/state/agent-committed-user-files.z"
     local base="" fork="" start="" top="" names=""
     local unchecked="Before switching branches, run git rm --cached on each of your files the agent committed and commit, or a checkout of the base deletes them. Left uncommitted: no session commit."
+    # BACKLOG 70: a tampered snapshot cannot be trusted to say which paths were
+    # pre-existing, so treat it the same as "no snapshot" -- fail closed via the
+    # caller, which then skips the session commit entirely.
+    if ! _loki_snapshot_verify; then
+        log_warn "Could not check whether the agent committed your pre-existing untracked files on $1 (snapshot tampered). ${unchecked}"
+        return 1
+    fi
     [ -s "$snap" ] || return 0
     # No commit on the branch yet: the agent committed nothing.
     git rev-parse --verify -q HEAD >/dev/null 2>&1 || return 0
@@ -9488,6 +10340,18 @@ commit_session_changes() {
     command -v git >/dev/null 2>&1 || return 0
     git rev-parse --is-inside-work-tree >/dev/null 2>&1 || return 0
 
+    # BACKLOG 130(c): verify session-created.z BEFORE any of this function's
+    # several early returns below (the untrack failure, the git 2.25 unstage
+    # failure, the secret-scan abort, a failed `git commit`) -- every one of
+    # them skips the two rm -f .loki/state/session-created.z cleanup sites
+    # further down, so a tampered file left on disk by any of those paths
+    # would otherwise survive untouched into the next session's resume union.
+    # Placed at the very top, before even the branch-protection/PARALLEL_MODE/
+    # branch-name checks below, so no early return in this function can skip
+    # it. On a mismatch the file is deleted here already; nothing downstream
+    # needs its own check.
+    _loki_session_created_verify || true  # BACKLOG-130C-COMMIT-TOP-VERIFY
+
     # Only act when a session feature branch was set up. This preserves the
     # LOCK A1 opt-out contract (LOKI_BRANCH_PROTECTION=false -> no agent-branch.txt
     # -> we never commit on the user's own branch), and also no-ops the detached
@@ -9515,6 +10379,15 @@ commit_session_changes() {
             ;;
     esac
 
+    # BACKLOG 70: a snapshot tampered with since this session sealed it (an
+    # agent process deleting the hash file to suppress preexisting_modified
+    # disclosure, or editing either file to hide or falsely disown paths) is
+    # treated as no snapshot at all: on a mismatch, _loki_snapshot_verify
+    # clears _LOKI_SNAPSHOT_THIS_RUN and writes the same .failed marker a
+    # snapshot failure writes, so the existing fail-closed check below
+    # (BACKLOG 90) also catches tampering, with its own warning.
+    _loki_snapshot_verify || true
+
     # Commit nothing unless THIS run took a current snapshot (BACKLOG 90). The
     # LOCK A1 opt-out takes none, so it never commits, even on a leftover
     # loki/session-* branch whose agent-branch.txt and snapshot belong to an
@@ -9532,6 +10405,15 @@ commit_session_changes() {
         return 0
     fi
 
+    # BACKLOG 68 rework: session end is also a point this run can prove no
+    # provider turn is in flight, so advance the tracked-since anchor here too
+    # (not only after each provider turn). Without this, a session that never
+    # calls _loki_record_session_created between its last turn and a normal
+    # end (e.g. a single-iteration run) would leave the anchor stale, and the
+    # NEXT session's resume union would then have nothing to safely prune even
+    # for a genuine user commit made between sessions.
+    _loki_advance_tracked_since_anchor
+
     _loki_untrack_agent_committed_user_files "$cur" || return 0
 
     # Stage everything except .loki/ runtime state and a secret-path denylist.
@@ -12725,14 +13607,26 @@ TREOF
     # summary the old best-effort parse of the tail still applies (null when it
     # finds nothing). Either way a recorded count above zero is a failure: the
     # council evidence gate and the Bun gate both read failed_count > 0 as one.
+    # BACKLOG 111: pytest's summary line also reports a distinct "error" outcome
+    # for a fixture/collection/setup error ("1 passed, 1 error in 0.5s"), which
+    # is neither "passed" nor "failed" text, so the [0-9]+ failed match alone
+    # found nothing and printed n=0 even though seen=1 -- a real error gated
+    # PASS. pytest pluralizes it ("2 errors"), so match errors? and ADD it to
+    # the failed count on that line ("2 failed, 3 errors" is 5 distinct broken
+    # tests, not 3 -- failed and error are independent outcomes within one
+    # summary line, unlike the separate cross-line max below, which exists to
+    # stop a later green summary from hiding an earlier failed run).
     # LC_ALL=C: bytes, so any runner output parses; [ \t] not [[:space:]] for
     # old mawk.
     local _tr_passed_n _tr_failed_n _tr_summary_red=false
     _tr_failed_n=$(printf '%s\n' "${output:-}" | LC_ALL=C sed "s/$(printf '\033')\[[0-9;]*[A-Za-z]//g" | LC_ALL=C awk '
         function upd(n) { if (n > f) f = n; seen = 1 }
         /^Tests:[ \t]/ || /^[ \t]*Tests[ \t]+[0-9]/ ||
-        /^=+ .*[0-9]+ (passed|failed)/ || /^[0-9]+ (passed|failed).* in [0-9.]+s/ {
-            n = 0; if (match($0, /[0-9]+ failed/)) n = substr($0, RSTART, RLENGTH) + 0; upd(n) }
+        /^=+ .*[0-9]+ (passed|failed|errors?)/ || /^[0-9]+ (passed|failed|errors?).* in [0-9.]+s/ {
+            n = 0
+            if (match($0, /[0-9]+ failed/)) n = substr($0, RSTART, RLENGTH) + 0
+            if (match($0, /[0-9]+ errors?/)) n += substr($0, RSTART, RLENGTH) + 0
+            upd(n) }
         /^[^ A-Za-z0-9]+ fail [0-9]+[ \t]*$/ { if (prev ~ /^[^ A-Za-z0-9]+ pass [0-9]+[ \t]*$/) upd($3 + 0) }
         /^[ \t]*[0-9]+ passing \(/ { upd(0) }
         /^[ \t]*[0-9]+ failing[ \t]*$/ { upd($1 + 0) }
@@ -13085,8 +13979,8 @@ if not isinstance(d, dict):
 verdict = d.get('verdict', 'unknown')
 diff = d.get('diff', {}) if isinstance(d.get('diff'), dict) else {}
 tests = d.get('tests', {}) if isinstance(d.get('tests'), dict) else {}
-diff_ok = diff.get('ok')
-tests_ok = tests.get('ok')
+diff_ok = 'inconclusive' if diff.get('inconclusive') else diff.get('ok')
+tests_ok = 'inconclusive' if tests.get('inconclusive') else tests.get('ok')
 runner = tests.get('runner', 'none')
 parts = ['verdict=%s' % verdict]
 parts.append('diff_ok=%s' % diff_ok)
@@ -19331,6 +20225,12 @@ PYEOF
 _intelligent_usage_regen() {
     local target_dir="${TARGET_DIR:-.}"
     local usage_path="$target_dir/USAGE.md"
+    # Only the provider the operator chose may see a prompt (V10 P5): on any
+    # other provider keep the agent-written USAGE.md. Policy (and the
+    # LOKI_ALLOW_CLAUDE_SIDECALLS=1 opt-in) lives in providers/loader.sh,
+    # sourced at the top of this file.
+    # ponytail: upgrade path is routing this call through provider_invoke_argv.
+    loki_claude_sidecall_allowed 2>/dev/null || return 0
     # Find a working `claude` binary; if absent, bail silently.
     if ! command -v claude >/dev/null 2>&1; then
         return 0
@@ -23560,6 +24460,17 @@ except Exception as exc:
         local exit_code=0
         # v7.5.12: Mark provider pipeline as active so SIGINT trap can kill it.
         LOKI_PROVIDER_ACTIVE=1
+        # BACKLOG 68 rework: mark a turn in-flight so a SIGKILL mid-turn (pod
+        # loss: no trap runs) leaves the tracked-since anchor stale rather than
+        # advanced -- a resume must not prune anything the agent may have
+        # tracked during this still-unrecorded turn. Cleared only by
+        # _loki_record_session_created, right after this turn's own call to it
+        # below. Gated the same way as the anchor itself (this run has a live
+        # snapshot); an older/opted-out run writes no marker, matching its
+        # pre-existing no-anchor ("skip pruning") behavior.
+        if [ "${_LOKI_SNAPSHOT_THIS_RUN:-0}" = 1 ]; then
+            mkdir -p .loki/state 2>/dev/null && : > .loki/state/turn-in-flight 2>/dev/null
+        fi
         # v7.7.31: authorize autonomous operation at the system-prompt tier so
         # the spawned agent does not read the user's global ~/.claude/CLAUDE.md,
         # judge it to conflict with the loki_system prompt, call AskUserQuestion,
@@ -26853,6 +27764,8 @@ except (json.JSONDecodeError, OSError): pass
 main() {
     _loki_install_signal_traps
     SESSION_START_EPOCH=$(date +%s)
+    # Before anything can spawn a provider (capability probes included).
+    _loki_withhold_github_tokens
 
     # First-run disclosure (shown once, before any work; best-effort).
     if type loki_show_disclosure_once &>/dev/null; then
@@ -27021,6 +27934,10 @@ main() {
 
     # Handle background mode
     if [ "$BACKGROUND_MODE" = "true" ]; then
+        # The relaunched runner withholds the tokens itself; it needs them in
+        # its environment to do so. This process exits right after launching.
+        local _bg_tok
+        for _bg_tok in $_LOKI_WITHHELD_TOKENS; do export "${_bg_tok?}"; done
         # Initialize .loki directory first
         mkdir -p .loki/logs
 
@@ -27656,7 +28573,9 @@ main() {
     # then advise the user how to open a PR. Both are no-ops when no agent branch
     # was set up (LOKI_BRANCH_PROTECTION=false) or nothing changed.
     commit_session_changes
-    create_session_pr
+    # Trusted post-session step: it gets the GitHub token main() withheld from
+    # agent sessions (its push may authenticate through the env token).
+    _loki_with_github_tokens create_session_pr
     audit_agent_action "session_stop" "Session ended" "result=$result,iterations=$ITERATION_COUNT"
 
     # The first terminal summary is written before session changes are committed.