loki-mode 9.74.0 → 9.76.0

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: Autonomous spec-driven build system with a built-in trust layer. It does not call work done until it is verified (RARV-C closure loop, 8 quality gates, completion council, verified-completion evidence gate). Triggers on "Loki Mode". Takes a spec (PRD, GitHub issue, OpenAPI doc, etc.) to deployed product with minimal human intervention. Provider-agnostic. Requires --dangerously-skip-permissions flag.
 ---
 
-# Loki Mode v9.74.0
+# Loki Mode v9.76.0
 
 **You are an autonomous agent. You make decisions. You do not ask questions. You do not stop.**
 
@@ -470,4 +470,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v9.74.0 | [Autonomi](https://www.autonomi.dev/) flagship product | ~410 lines core**
+**v9.76.0 | [Autonomi](https://www.autonomi.dev/) flagship product | ~410 lines core**

package/VERSION

@@ -1 +1 @@
-9.74.0
+9.76.0

package/autonomy/completion-council.sh

@@ -4368,19 +4368,34 @@ council_managed_should_stop() {
         return 1
     fi
 
+    # S-196: every reader and the session heredoc run on the resolved -I -S
+    # interpreter (see _loki_snapshot_py_tool); -E still loads user-site .pth
+    # files. None resolvable -> never start the managed session: Bash fallback.
+    # Deliberate consequence: -S hides site-packages, so the anthropic SDK is
+    # never importable and is_enabled() is always False. The managed council
+    # therefore always falls back to Bash voting (warned below). Reviving it
+    # needs a pinned interpreter plus an SDK path that loads no .pth file;
+    # a PATH or venv python3 without -S would let the agent forge the verdict.
+    local _ms_py
+    _ms_py="$(_loki_snapshot_py_tool)" || {
+        log_warn "[Council] Managed completion council unavailable: no isolated -I -S interpreter; falling back to Bash voting"
+        return 1
+    }
+
     local loki_dir="${TARGET_DIR:-.}/.loki"
-    local project_dir="${PROJECT_DIR:-$(pwd)}"
     local round="${ITERATION_COUNT:-0}"
     local verdicts_dir="$COUNCIL_STATE_DIR/verdicts"
     mkdir -p "$verdicts_dir" 2>/dev/null || true
 
     # Build session context: diff_summary, test_summary, pending_tasks.
     # Kept deliberately small so we never choke the session budget.
+    # S-196: diff the target project (same root as loki_dir and
+    # LOKI_TARGET_DIR), never PROJECT_DIR, which is Loki's install tree.
     local diff_summary=""
-    diff_summary=$(cd "$project_dir" 2>/dev/null && git diff --stat 2>/dev/null | tail -20 | tr '\n' ' ' || echo "")
+    diff_summary=$(cd "${TARGET_DIR:-.}" 2>/dev/null && git diff --stat 2>/dev/null | tail -20 | tr '\n' ' ' || echo "")
     local test_summary=""
     if [ -f "$loki_dir/quality/test-results.json" ]; then
-        test_summary=$(_TRF="$loki_dir/quality/test-results.json" python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
+        test_summary=$(_TRF="$loki_dir/quality/test-results.json" "$_ms_py" -I -S -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
 import json, os
 try:
     d = json.load(open(os.environ['_TRF']))
@@ -4391,7 +4406,7 @@ except Exception:
     fi
     local pending_tasks="[]"
     if [ -f "$loki_dir/queue/pending.json" ]; then
-        pending_tasks=$(_QF="$loki_dir/queue/pending.json" python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
+        pending_tasks=$(_QF="$loki_dir/queue/pending.json" "$_ms_py" -I -S -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
 import json, os
 try:
     d = json.load(open(os.environ['_QF']))
@@ -4415,7 +4430,7 @@ except Exception:
     _CC_LOKI_DIR="$loki_dir" \
     LOKI_TARGET_DIR="${TARGET_DIR:-$(pwd)}" \
     PROJECT_DIR="${PROJECT_DIR:-$(cd "$(dirname "${BASH_SOURCE[0]}")/.." 2>/dev/null && pwd)}" \
-    python3 -E - <<'PYEOF' 2>/dev/null || exit_code=$?
+    "$_ms_py" -I -S - <<'PYEOF' 2>/dev/null || exit_code=$?
 import sys; sys.path[:] = [p for p in sys.path if p not in ("", ".")]
 import json, os, sys, pathlib
 
@@ -4553,7 +4568,10 @@ PYEOF
         return 0
     fi
 
-    log_warn "[Council] Managed completion council unavailable (exit=$exit_code); falling back to Bash voting"
+    case "$exit_code" in
+        2|3) log_warn "[Council] Managed completion council unavailable (exit=$exit_code): SDK not importable under the isolated -I -S interpreter; falling back to Bash voting" ;;
+        *) log_warn "[Council] Managed completion council unavailable (exit=$exit_code); falling back to Bash voting" ;;
+    esac
     return 1
 }
 

package/autonomy/council-v2.sh

@@ -20,15 +20,43 @@
 #   - swarm/calibration.py (reviewer calibration)
 #
 # Inline Python (D7): the council runs with the cwd inside the agent's repo, so
-# every python3 here runs -E and drops '' and '.' from sys.path before any other
-# import (the swarm dir is inserted after that); a committed json.py or
-# sitecustomize.py cannot read the votes. Pinned by
-# tests/test-council-no-fabricated-verdict.sh (D7 section).
+# every python here drops '' and '.' from sys.path before any other import (the
+# swarm dir is inserted after that); a committed json.py or sitecustomize.py
+# cannot read the votes. Pinned by tests/test-council-no-fabricated-verdict.sh
+# (D7 section). S-201: -E alone still loads user site-packages, whose .pth
+# "import" lines run before that scrub and can forge json.load, so every site
+# runs the _loki_snapshot_py_tool interpreter -I -S. Pinned by
+# tests/test-council-v2-no-user-site-pth.sh.
 #
 #===============================================================================
 
 COUNCIL_V2_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 
+# Guarded copy for callers that source this file on its own (tests). In
+# production completion-council.sh (or run.sh) has already defined it. run.sh
+# is the source of truth: keep this copy byte-identical to it.
+declare -F _loki_snapshot_py_tool >/dev/null 2>&1 || \
+_loki_snapshot_py_tool() {
+    local c
+    for c in /usr/bin/python3 /bin/python3; do
+        [ -x "$c" ] && [ ! -d "$c" ] && "$c" -I -S -c '' >/dev/null 2>&1 && { printf '%s\n' "$c"; return 0; }
+    done
+    local dir
+    local IFS=:
+    for dir in $PATH; do
+        case "$dir" in
+            /*) ;;
+            *) continue ;;
+        esac
+        if [ -x "$dir/python3" ] && [ ! -d "$dir/python3" ] \
+           && "$dir/python3" -I -S -c '' >/dev/null 2>&1; then
+            printf '%s\n' "$dir/python3"
+            return 0
+        fi
+    done
+    return 1
+}
+
 #===============================================================================
 # council_v2_vote() -- Main entry point for v2 voting
 #
@@ -48,6 +76,9 @@ council_v2_vote() {
     local iteration="${4:-0}"
 
     local council_size="${COUNCIL_SIZE:-3}"
+    # S-201: none resolvable -> every read below takes its fail-safe fallback.
+    local _c2_py
+    _c2_py="$(_loki_snapshot_py_tool)" || _c2_py=""
 
     log_header "COMPLETION COUNCIL v2 - Iteration $iteration"
     log_info "Convening ${council_size}-member blind review council..."
@@ -103,7 +134,7 @@ council_v2_vote() {
             votes_json="$votes_json$vote_content"
 
             local verdict
-            verdict=$(echo "$vote_content" | python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]; import json; print(json.load(sys.stdin).get('verdict','').upper())" 2>/dev/null || echo "UNKNOWN")
+            verdict=$(echo "$vote_content" | "$_c2_py" -I -S -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]; import json; print(json.load(sys.stdin).get('verdict','').upper())" 2>/dev/null || echo "UNKNOWN")
             # TRUST: a reviewer that could not be REACHED did not vote REJECT.
             #
             # Every provider arm below used to substitute a literal
@@ -141,14 +172,21 @@ council_v2_vote() {
 
     # Step 4: Sycophancy detection
     local sycophancy_score
-    sycophancy_score=$(python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
+    sycophancy_score=$("$_c2_py" -I -S -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
 import sys
 sys.path.insert(0, '${COUNCIL_V2_DIR}/../swarm')
 from sycophancy import detect_sycophancy
 import json
 votes = json.loads(sys.argv[1])
 print('{:.3f}'.format(detect_sycophancy(votes)))
-" "$votes_json" 2>/dev/null || echo "0.000")
+" "$votes_json" 2>/dev/null) || sycophancy_score=""
+    # S-201: a crashed or missing detector did not measure 0.000. Record the
+    # score as unmeasured (null keeps summary.json valid JSON) so Step 5
+    # challenges instead of reading "independent".
+    case "$sycophancy_score" in
+        [0-9]*.[0-9][0-9][0-9]) ;;
+        *) sycophancy_score="null" ;;
+    esac
 
     log_info "Sycophancy score: $sycophancy_score"
 
@@ -156,10 +194,17 @@ print('{:.3f}'.format(detect_sycophancy(votes)))
     if [ "$approve_count" -eq "$council_size" ]; then
         local threshold="${LOKI_COUNCIL_SYCOPHANCY_THRESHOLD:-0.6}"
         local should_challenge
-        should_challenge=$(python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]; print('yes' if float('$sycophancy_score') >= float('$threshold') else 'no')" 2>/dev/null || echo "no")
+        # S-201: an unmeasured score, or a compare that cannot run, challenges.
+        # Only a measured score below the threshold skips the devil's advocate.
+        if [ "$sycophancy_score" = "null" ]; then
+            should_challenge="yes"
+        else
+            should_challenge=$("$_c2_py" -I -S -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]; print('no' if float(sys.argv[1]) < float(sys.argv[2]) else 'yes')" "$sycophancy_score" "$threshold" 2>/dev/null) || should_challenge="yes"
+            [ "$should_challenge" = "no" ] || should_challenge="yes"
+        fi
 
         if [ "$should_challenge" = "yes" ]; then
-            log_warn "Sycophancy score $sycophancy_score >= $threshold -- adding devil's advocate"
+            log_warn "Sycophancy score $sycophancy_score (threshold $threshold, null = unmeasured) -- adding devil's advocate"
             # Run devil's advocate with fresh evidence (no visibility of other votes)
             local da_dir
             da_dir=$(mktemp -d)
@@ -173,7 +218,7 @@ print('{:.3f}'.format(detect_sycophancy(votes)))
                 # Same trust rule as the main tally: an unparseable devil's
                 # advocate did not vote REJECT. Defaulting to REJECT here would
                 # silently overturn a unanimous APPROVE on a transient failure.
-                da_verdict=$(cat "$da_vote" | python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]; import json; print(json.load(sys.stdin).get('verdict','').upper())" 2>/dev/null || echo "INCONCLUSIVE")
+                da_verdict=$(cat "$da_vote" | "$_c2_py" -I -S -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]; import json; print(json.load(sys.stdin).get('verdict','').upper())" 2>/dev/null || echo "INCONCLUSIVE")
                 if [ "$da_verdict" = "INCONCLUSIVE" ]; then
                     log_warn "Devil's advocate produced no verdict -- unanimous approval left UNCHANGED (not overturned)"
                 elif [ "$da_verdict" = "REJECT" ]; then
@@ -207,7 +252,7 @@ print('{:.3f}'.format(detect_sycophancy(votes)))
         final_decision="reject"
     fi
 
-    python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
+    "$_c2_py" -I -S -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
 import sys
 sys.path.insert(0, '${COUNCIL_V2_DIR}/../swarm')
 from calibration import CalibrationTracker
@@ -271,6 +316,8 @@ council_v2_run_reviewer() {
     local role="$1"
     local review_dir="$2"
     local output_file="$3"
+    local _c2_py
+    _c2_py="$(_loki_snapshot_py_tool)" || _c2_py=""
 
     # Build review prompt based on role
     local prompt
@@ -394,7 +441,7 @@ Respond ONLY with a valid JSON object. No markdown fencing."
                             --json-schema "$_c2_schema_content" --output-format json 2>/dev/null)" || _c2_json=""
                         if [ -n "$_c2_json" ]; then
                             # Pull the schema-validated object out of the envelope.
-                            result="$(printf '%s' "$_c2_json" | python3 -E -c 'import sys; sys.path[:] = [p for p in sys.path if p not in ("", ".")]; import json
+                            result="$(printf '%s' "$_c2_json" | "$_c2_py" -I -S -c 'import sys; sys.path[:] = [p for p in sys.path if p not in ("", ".")]; import json
 try:
     e=json.load(sys.stdin)
     p=e.get("structured_output")
@@ -496,7 +543,7 @@ except Exception:
     # or neither, stays INCONCLUSIVE -- never guessed.
     if [ -z "$extracted" ] && [ -n "${result:-}" ]; then
         local _recovered
-        _recovered="$(printf '%s' "$result" | _LOKI_RAW="$result" python3 -E -c 'import sys; sys.path[:] = [p for p in sys.path if p not in ("", ".")]
+        _recovered="$(printf '%s' "$result" | _LOKI_RAW="$result" "$_c2_py" -I -S -c 'import sys; sys.path[:] = [p for p in sys.path if p not in ("", ".")]
 import os, re, sys, json
 raw = os.environ.get("_LOKI_RAW", "")
 # Standalone words only: "APPROVE" not "approved-by", and not inside a URL.

package/autonomy/lib/done-recognition.sh

@@ -38,9 +38,42 @@
 # No emojis. No em dashes. bash 3.2 safe. Honors `set -uo pipefail`.
 #
 # Inline Python (D7): the gate runs with the cwd inside the agent's repo, so
-# every python3 here runs -E and drops '' and '.' from sys.path before any other
-# import; a committed json.py or sitecustomize.py cannot turn the verdict done.
-# Pinned by tests/test-reuse-done-recognition.sh case (d7).
+# every python3 here drops '' and '.' from sys.path before any other import; a
+# committed json.py or sitecustomize.py cannot turn the verdict done. Pinned by
+# tests/test-reuse-done-recognition.sh case (d7).
+#
+# S-200 (BACKLOG 54): -E alone still loads the user site-packages, whose .pth
+# "import" lines run before that scrub and can forge json.load (a forged verdict
+# read fast-stopped an incomplete project as done). Every call site resolves
+# its interpreter through _loki_snapshot_py_tool and runs it -I -S; when none
+# resolves, nothing reads as done or met (the gate builds, the writers write
+# nothing). See that function's comment in run.sh for the rationale and accepted
+# gaps. run.sh sources this file AFTER it defines _loki_snapshot_py_tool, so in
+# production run.sh's definition is kept; the copy below only serves callers
+# that source this file on its own (tests). run.sh is the source of truth: keep
+# this copy byte-identical to it. Pinned by
+# tests/test-done-recognition-no-user-site-pth.sh.
+declare -F _loki_snapshot_py_tool >/dev/null 2>&1 || \
+_loki_snapshot_py_tool() {
+    local c
+    for c in /usr/bin/python3 /bin/python3; do
+        [ -x "$c" ] && [ ! -d "$c" ] && "$c" -I -S -c '' >/dev/null 2>&1 && { printf '%s\n' "$c"; return 0; }
+    done
+    local dir
+    local IFS=:
+    for dir in $PATH; do
+        case "$dir" in
+            /*) ;;
+            *) continue ;;
+        esac
+        if [ -x "$dir/python3" ] && [ ! -d "$dir/python3" ] \
+           && "$dir/python3" -I -S -c '' >/dev/null 2>&1; then
+            printf '%s\n' "$dir/python3"
+            return 0
+        fi
+    done
+    return 1
+}
 
 # Bound the single model call so a huge PRD or test log cannot run away.
 : "${LOKI_DONE_RECOG_TIMEOUT:=180}"           # seconds for the single model call
@@ -133,8 +166,9 @@ _loki_done_recog_invoke() {
                     claude --dangerously-skip-permissions -p "$prompt" \
                     --json-schema "$_dr_schema_content" --output-format json 2>/dev/null) || _dr_json=""
             fi
-            if [ -n "$_dr_json" ]; then
-                _dr_obj=$(printf '%s' "$_dr_json" | python3 -E -c 'import sys; sys.path[:] = [p for p in sys.path if p not in ("", ".")]; import json
+            local _dr_py
+            if [ -n "$_dr_json" ] && _dr_py="$(_loki_snapshot_py_tool)"; then
+                _dr_obj=$(printf '%s' "$_dr_json" | "$_dr_py" -I -S -c 'import sys; sys.path[:] = [p for p in sys.path if p not in ("", ".")]; import json
 try:
     e=json.load(sys.stdin)
     p=e.get("structured_output")
@@ -206,7 +240,9 @@ _loki_done_recog_prd_sha() {
         sha256sum "$prd_file" 2>/dev/null | awk '{print $1}'
     else
         # Last-resort: a python hash, still deterministic over the same bytes.
-        LOKI_DR_PRD="$prd_file" python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
+        local _dr_py
+        _dr_py="$(_loki_snapshot_py_tool)" || { printf ''; return 0; }
+        LOKI_DR_PRD="$prd_file" "$_dr_py" -I -S -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
 import hashlib, os
 p = os.environ.get('LOKI_DR_PRD','')
 try:
@@ -278,6 +314,13 @@ reuse_done_recognition_gate() {
     fi
     local _test_results="$loki_dir/quality/test-results.json"
 
+    # --- Resolve the -I -S interpreter (S-200); none -> inconclusive -> build.
+    local _dr_py
+    if ! _dr_py="$(_loki_snapshot_py_tool)"; then
+        log_info "Done-recognition: no isolated python3 interpreter resolved; proceeding to build."
+        return 1
+    fi
+
     # --- Build the model prompt payload (python: bounded, defensive) ---------
     local prompt
     prompt=$(LOKI_DR_PRD="$prd_path" \
@@ -287,7 +330,7 @@ reuse_done_recognition_gate() {
              LOKI_DR_CHECKLIST="$loki_dir/checklist/checklist.json" \
              LOKI_DR_MAX_PRD="${LOKI_DONE_RECOG_MAX_PRD_CHARS}" \
              LOKI_DR_MAX_TEST="${LOKI_DONE_RECOG_MAX_TEST_CHARS}" \
-             python3 -E << 'DR_PROMPT_EOF'
+             "$_dr_py" -I -S << 'DR_PROMPT_EOF'
 import sys; sys.path[:] = [p for p in sys.path if p not in ("", ".")]
 import json, os, sys
 
@@ -389,7 +432,7 @@ DR_PROMPT_EOF
              LOKI_DR_TESTS="$_test_results" \
              LOKI_DR_ACTION="$action" \
              LOKI_DR_PRD="$prd_path" \
-             python3 -E << 'DR_PARSE_EOF'
+             "$_dr_py" -I -S << 'DR_PARSE_EOF'
 import sys; sys.path[:] = [p for p in sys.path if p not in ("", ".")]
 import json, os, re, sys
 
@@ -700,11 +743,11 @@ DR_PARSE_EOF
     fi
 
     local verdict
-    verdict=$(printf '%s' "$parsed" | python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]; import json;print(json.load(sys.stdin).get('verdict',''))" 2>/dev/null)
+    verdict=$(printf '%s' "$parsed" | "$_dr_py" -I -S -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]; import json;print(json.load(sys.stdin).get('verdict',''))" 2>/dev/null)
 
     case "$verdict" in
         done)
-            _loki_done_recog_finish "$prd_path" "$parsed"
+            _loki_done_recog_finish "$prd_path" "$parsed" || return 1
             return 0
             ;;
         incomplete)
@@ -713,7 +756,7 @@ DR_PARSE_EOF
             ;;
         *)
             local _reason
-            _reason=$(printf '%s' "$parsed" | python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]; import json;print(json.load(sys.stdin).get('reason','') or 'unverifiable')" 2>/dev/null)
+            _reason=$(printf '%s' "$parsed" | "$_dr_py" -I -S -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]; import json;print(json.load(sys.stdin).get('reason','') or 'unverifiable')" 2>/dev/null)
             log_info "Done-recognition: could not confirm the existing code already satisfies the reused spec (${_reason}). Proceeding to build to be safe."
             return 1
             ;;
@@ -729,6 +772,10 @@ _loki_done_recog_finish() {
     local parsed="$2"
     local loki_dir="${TARGET_DIR:-.}/.loki"
 
+    # S-200: no -I -S interpreter -> write no done record (the gate then builds).
+    local _dr_py
+    _dr_py="$(_loki_snapshot_py_tool)" || return 1
+
     # The gate runs EARLY in run_autonomous, before the run normally mints these
     # run-scoped ids/baselines (run.sh sets them just after this call site). The
     # council-parity finalizers below (and what they transitively call) expect
@@ -749,10 +796,10 @@ _loki_done_recog_finish() {
     mkdir -p "$loki_dir/state" 2>/dev/null || true
 
     local summary met total axis
-    summary=$(printf '%s' "$parsed" | python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]; import json;print(json.load(sys.stdin).get('summary','') or 'Project already satisfies its spec.')" 2>/dev/null)
-    met=$(printf '%s' "$parsed" | python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]; import json;print(json.load(sys.stdin).get('met_count',0))" 2>/dev/null)
-    total=$(printf '%s' "$parsed" | python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]; import json;print(json.load(sys.stdin).get('total_count',0))" 2>/dev/null)
-    axis=$(printf '%s' "$parsed" | python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]; import json;print(json.load(sys.stdin).get('tests_axis','unknown'))" 2>/dev/null)
+    summary=$(printf '%s' "$parsed" | "$_dr_py" -I -S -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]; import json;print(json.load(sys.stdin).get('summary','') or 'Project already satisfies its spec.')" 2>/dev/null)
+    met=$(printf '%s' "$parsed" | "$_dr_py" -I -S -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]; import json;print(json.load(sys.stdin).get('met_count',0))" 2>/dev/null)
+    total=$(printf '%s' "$parsed" | "$_dr_py" -I -S -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]; import json;print(json.load(sys.stdin).get('total_count',0))" 2>/dev/null)
+    axis=$(printf '%s' "$parsed" | "$_dr_py" -I -S -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]; import json;print(json.load(sys.stdin).get('tests_axis','unknown'))" 2>/dev/null)
     [ -n "$met" ] || met=0
     [ -n "$total" ] || total=0
     [ -n "$axis" ] || axis="unknown"
@@ -792,7 +839,7 @@ _loki_done_recog_finish() {
         echo ""
         echo "## Per-requirement evidence"
         echo ""
-        printf '%s' "$parsed" | python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
+        printf '%s' "$parsed" | "$_dr_py" -I -S -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
 import json, sys
 try:
     d = json.load(sys.stdin)
@@ -811,7 +858,7 @@ for t in d.get('satisfied', []):
     LOKI_DR_MET="$met" \
     LOKI_DR_TOTAL="$total" \
     LOKI_DR_TS="$ts" \
-    python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
+    "$_dr_py" -I -S -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
 import json, os, tempfile
 out = os.environ['LOKI_DR_OUT']
 def i(v):
@@ -861,6 +908,7 @@ except Exception:
         log_info "Verified ${met}/${total} requirements met by code inspection (no passing test run was available to confirm). ${summary}"
     fi
     log_info "To rebuild from scratch run 'loki start --fresh-prd'; to extend it, edit the spec or pass a new/changed PRD."
+    return 0
 }
 
 # incomplete path: write the satisfied-requirements manifest so
@@ -871,6 +919,10 @@ _loki_done_recog_write_manifest() {
     local parsed="$2"
     local loki_dir="${TARGET_DIR:-.}/.loki"
 
+    # S-200: no -I -S interpreter -> record nothing as met (full build).
+    local _dr_py
+    _dr_py="$(_loki_snapshot_py_tool)" || return 1
+
     mkdir -p "$loki_dir/state" 2>/dev/null || true
 
     local prd_sha
@@ -882,7 +934,7 @@ _loki_done_recog_write_manifest() {
     LOKI_DR_PARSED="$parsed" \
     LOKI_DR_SHA="$prd_sha" \
     LOKI_DR_TS="$ts" \
-    python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
+    "$_dr_py" -I -S -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
 import json, os, sys, tempfile
 out = os.environ['LOKI_DR_OUT']
 try:
@@ -923,7 +975,7 @@ except Exception:
     if [ -f "$loki_dir/queue/pending.json" ]; then
         # Drop prior PRD-sourced tasks so the incremental pass is the source of
         # truth; non-PRD tasks (if any) are preserved.
-        LOKI_DR_PENDING="$loki_dir/queue/pending.json" python3 -E - <<'RESET_EOF' 2>/dev/null || true
+        LOKI_DR_PENDING="$loki_dir/queue/pending.json" "$_dr_py" -I -S - <<'RESET_EOF' 2>/dev/null || true
 import sys; sys.path[:] = [p for p in sys.path if p not in ("", ".")]
 import json, os, tempfile
 p = os.environ.get("LOKI_DR_PENDING", ".loki/queue/pending.json")
@@ -948,8 +1000,8 @@ RESET_EOF
     fi
 
     local met total
-    met=$(printf '%s' "$parsed" | python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]; import json;print(json.load(sys.stdin).get('met_count',0))" 2>/dev/null)
-    total=$(printf '%s' "$parsed" | python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]; import json;print(json.load(sys.stdin).get('total_count',0))" 2>/dev/null)
+    met=$(printf '%s' "$parsed" | "$_dr_py" -I -S -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]; import json;print(json.load(sys.stdin).get('met_count',0))" 2>/dev/null)
+    total=$(printf '%s' "$parsed" | "$_dr_py" -I -S -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]; import json;print(json.load(sys.stdin).get('total_count',0))" 2>/dev/null)
     local unmet=$(( ${total:-0} - ${met:-0} ))
     log_info "Done-recognition: ${met:-0} of ${total:-0} requirements already satisfied; building only the ${unmet} unmet. Pass --fresh-prd to rebuild from scratch."
 }

package/autonomy/lib/proof-check.sh

@@ -28,9 +28,41 @@
 # guards on LOKI_PROVEN_PR_CHECK=1). It is also safe if called directly.
 #
 # Inline Python (D7): the call site's cwd is the agent's repo, so the proof
-# readers run python3 -E and drop '' and '.' from sys.path first; a committed
-# json.py or sitecustomize.py cannot change the headline. Pinned by
+# readers drop '' and '.' from sys.path first; a committed json.py or
+# sitecustomize.py cannot change the headline. Pinned by
 # tests/test-proven-pr-check.sh (D7 section).
+#
+# BACKLOG 54 / S-203: python3 -E still loaded the user site-packages, where a
+# .pth "import" line runs before any sys.path scrub and could forge json.load
+# (a NOT VERIFIED proof read as VERIFIED). The readers resolve their
+# interpreter through _loki_snapshot_py_tool and run it -I -S; when none
+# resolves they print empty, as they do when python3 is absent. run.sh sources
+# this file before it defines _loki_snapshot_py_tool, and its later definition
+# replaces this copy, so the copy below only serves callers that source this
+# file on its own (tests). run.sh is the source of truth: keep this copy
+# byte-identical to it. Pinned by tests/test-proof-check-no-user-site-pth.sh
+# and tests/test-council-py-tool-identity.sh.
+declare -F _loki_snapshot_py_tool >/dev/null 2>&1 || \
+_loki_snapshot_py_tool() {
+    local c
+    for c in /usr/bin/python3 /bin/python3; do
+        [ -x "$c" ] && [ ! -d "$c" ] && "$c" -I -S -c '' >/dev/null 2>&1 && { printf '%s\n' "$c"; return 0; }
+    done
+    local dir
+    local IFS=:
+    for dir in $PATH; do
+        case "$dir" in
+            /*) ;;
+            *) continue ;;
+        esac
+        if [ -x "$dir/python3" ] && [ ! -d "$dir/python3" ] \
+           && "$dir/python3" -I -S -c '' >/dev/null 2>&1; then
+            printf '%s\n' "$dir/python3"
+            return 0
+        fi
+    done
+    return 1
+}
 
 # Double-source guard.
 [ -n "${_PROOF_CHECK_SH:-}" ] && return 0
@@ -71,10 +103,11 @@ _proof_check_headline() {
     local proof_path="${1:-}"
     [ -n "$proof_path" ] || { printf '%s' ""; return 0; }
     [ -f "$proof_path" ] || { printf '%s' ""; return 0; }
-    command -v python3 >/dev/null 2>&1 || { printf '%s' ""; return 0; }
+    local _pc_py=""
+    _pc_py="$(_loki_snapshot_py_tool)" || { printf '%s' ""; return 0; }
 
     local headline=""
-    headline="$(python3 -E - "$proof_path" <<'PY' 2>/dev/null || true
+    headline="$("$_pc_py" -I -S - "$proof_path" <<'PY' 2>/dev/null || true
 import sys; sys.path[:] = [p for p in sys.path if p not in ("", ".")]
 import json, sys
 try:
@@ -103,10 +136,11 @@ _proof_check_proof_head_sha() {
     local proof_path="${1:-}"
     [ -n "$proof_path" ] || { printf '%s' ""; return 0; }
     [ -f "$proof_path" ] || { printf '%s' ""; return 0; }
-    command -v python3 >/dev/null 2>&1 || { printf '%s' ""; return 0; }
+    local _pc_py=""
+    _pc_py="$(_loki_snapshot_py_tool)" || { printf '%s' ""; return 0; }
 
     local sha=""
-    sha="$(python3 -E - "$proof_path" <<'PY' 2>/dev/null || true
+    sha="$("$_pc_py" -I -S - "$proof_path" <<'PY' 2>/dev/null || true
 import sys; sys.path[:] = [p for p in sys.path if p not in ("", ".")]
 import json, sys
 try:
@@ -138,10 +172,11 @@ _proof_check_run_id() {
     local proof_path="${1:-}"
     [ -n "$proof_path" ] || { printf '%s' ""; return 0; }
     [ -f "$proof_path" ] || { printf '%s' ""; return 0; }
-    command -v python3 >/dev/null 2>&1 || { printf '%s' ""; return 0; }
+    local _pc_py=""
+    _pc_py="$(_loki_snapshot_py_tool)" || { printf '%s' ""; return 0; }
 
     local rid=""
-    rid="$(python3 -E - "$proof_path" <<'PY' 2>/dev/null || true
+    rid="$("$_pc_py" -I -S - "$proof_path" <<'PY' 2>/dev/null || true
 import sys; sys.path[:] = [p for p in sys.path if p not in ("", ".")]
 import json, sys
 try:

package/autonomy/lib/voter-agents.sh

@@ -28,9 +28,18 @@
 #                                             to existing heuristic dispatch).
 #
 # Inline Python (D7): the dispatch runs with the cwd inside the agent's repo, so
-# every python3 here runs -E and drops '' and '.' from sys.path before any other
-# import; a committed json.py or sitecustomize.py cannot read the votes.
+# every python3 here drops '' and '.' from sys.path before any other import; a
+# committed json.py or sitecustomize.py cannot read the votes.
 # Pinned by tests/test-voter-agents-json.sh (Case D).
+#
+# S-202 (BACKLOG 54): -E alone still loads the user site-packages, whose .pth
+# "import" lines run before that scrub and can forge json.loads (3 REJECT
+# findings read as a COMPLETE round). Every call site resolves its interpreter
+# through _loki_snapshot_py_tool and runs it -I -S; when none resolves, the
+# dispatch returns 1 and completion-council's fail-closed path applies. run.sh
+# is the source of truth for the helper; the guarded copy below only serves
+# callers that source this file on its own. Keep it byte-identical to run.sh's.
+# Pinned by tests/test-voter-agents-no-user-site-pth.sh.
 
 # Guard against double-source.
 if [ "${__LOKI_VOTER_AGENTS_SH_LOADED:-0}" = "1" ]; then
@@ -38,6 +47,28 @@ if [ "${__LOKI_VOTER_AGENTS_SH_LOADED:-0}" = "1" ]; then
 fi
 __LOKI_VOTER_AGENTS_SH_LOADED=1
 
+declare -F _loki_snapshot_py_tool >/dev/null 2>&1 || \
+_loki_snapshot_py_tool() {
+    local c
+    for c in /usr/bin/python3 /bin/python3; do
+        [ -x "$c" ] && [ ! -d "$c" ] && "$c" -I -S -c '' >/dev/null 2>&1 && { printf '%s\n' "$c"; return 0; }
+    done
+    local dir
+    local IFS=:
+    for dir in $PATH; do
+        case "$dir" in
+            /*) ;;
+            *) continue ;;
+        esac
+        if [ -x "$dir/python3" ] && [ ! -d "$dir/python3" ] \
+           && "$dir/python3" -I -S -c '' >/dev/null 2>&1; then
+            printf '%s\n' "$dir/python3"
+            return 0
+        fi
+    done
+    return 1
+}
+
 # Resolve repo root once. This file lives at autonomy/lib/voter-agents.sh.
 __LOKI_VA_LIB_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" 2>/dev/null && pwd)"
 __LOKI_VA_REPO_ROOT="$(cd "${__LOKI_VA_LIB_DIR}/../.." 2>/dev/null && pwd)"
@@ -59,12 +90,14 @@ loki_voter_agents_json() {
     fi
     local prd="${LOKI_PRD_PATH:-}"
     local tier="${LOKI_RARV_TIER:-development}"
+    local _va_py
+    _va_py="$(_loki_snapshot_py_tool)" || { printf '%s' '{}'; return 0; }
 
     _VA_ITER="$iter" \
     _VA_PRD="$prd" \
     _VA_TIER="$tier" \
     _VA_COMPLEXITY="${LOKI_COMPLEXITY:-standard}" \
-    python3 -E -c 'import sys; sys.path[:] = [p for p in sys.path if p not in ("", ".")]
+    "$_va_py" -I -S -c 'import sys; sys.path[:] = [p for p in sys.path if p not in ("", ".")]
 import json, os
 iter_n = os.environ.get("_VA_ITER", "0")
 prd = os.environ.get("_VA_PRD", "")
@@ -133,7 +166,9 @@ print(json.dumps(agents, separators=(",", ":")))
 # Arg $1: terse base findings summary used to brief the DA prompt.
 loki_devils_advocate_json() {
     local summary="${1:-}"
-    _VA_SUMMARY="$summary" python3 -E -c 'import sys; sys.path[:] = [p for p in sys.path if p not in ("", ".")]
+    local _va_py
+    _va_py="$(_loki_snapshot_py_tool)" || { printf '%s' '{}'; return 0; }
+    _VA_SUMMARY="$summary" "$_va_py" -I -S -c 'import sys; sys.path[:] = [p for p in sys.path if p not in ("", ".")]
 import json, os
 summary = os.environ.get("_VA_SUMMARY", "")[:1000]
 agents = {
@@ -355,13 +390,15 @@ loki_council_dispatch_agents() {
     local verdicts_dir="$COUNCIL_STATE_DIR/verdicts"
     local votes_dir="$COUNCIL_STATE_DIR/votes"
     mkdir -p "$verdicts_dir" "$votes_dir" 2>/dev/null || return 1
+    local _va_py
+    _va_py="$(_loki_snapshot_py_tool)" || return 1
 
     _VA_RESP="$response" \
     _VA_ITER="$iteration" \
     _VA_VDIR="$verdicts_dir" \
     _VA_RFILE="$votes_dir/round-${iteration}.json" \
     _VA_EXPECTED="${COUNCIL_SIZE:-3}" \
-    python3 -E -c 'import sys; sys.path[:] = [p for p in sys.path if p not in ("", ".")]
+    "$_va_py" -I -S -c 'import sys; sys.path[:] = [p for p in sys.path if p not in ("", ".")]
 import json, os, sys
 from datetime import datetime, timezone