loki-mode 9.74.0 → 9.76.0

package/autonomy/loki

@@ -1271,6 +1271,8 @@ loki_remote_verify_receipt() {
         echo "    the JWKS URL is not https -- only loopback is allowed over plain http)."
         echo "    Its integrity hash matches. Provenance is unproven here, not disproven."
         echo "    Install python3 cryptography, or re-run where the build server is reachable."
+        echo "    The verifier runs python3 -E, so cryptography supplied through PYTHONPATH is"
+        echo "    not seen; install it where the base interpreter finds it (site or user site)."
         return 0
     fi
 
@@ -37143,6 +37145,7 @@ print(json.dumps(json.load(open(os.environ['LOKI_PROOF_JSON'])), indent=2))
                         # verifier is a finding and is never softened to 2.
                         echo -e "${YELLOW}attestation: NOT CHECKED -- could not check against ${_pv_jwks} (key set unreadable,${NC}" >&2
                         echo -e "${YELLOW}  verifier dependency missing, or the JWKS URL is not https -- only loopback is allowed over plain http).${NC}" >&2
+                        echo "  The verifier runs python3 -E, so cryptography supplied through PYTHONPATH is not seen (a site or user-site install is)." >&2
                         echo "  This is not a failure of the receipt. Nothing was proven either way (exit 2)." >&2
                         if [ "$_pv_rc" -eq 0 ]; then _pv_rc=2; fi
                         _pv_attestation_field="NOT CHECKED"

package/autonomy/prd-checklist.sh

@@ -19,12 +19,23 @@
 #   LOKI_CHECKLIST_ENABLED      - Enable/disable checklist (default: true)
 #
 # Inline Python (D7): verification runs with the cwd inside the agent's repo,
-# so every python3 here runs -E (an empty PYTHONPATH component would load a
-# committed sitecustomize.py) and every -c / - body drops '' and '.' from
-# sys.path before any other import (a committed json.py would print the
-# verdict). Pinned by tests/moat/p2-honest-verdict.sh
+# so every python3 here ignores PYTHON* env vars (an empty PYTHONPATH component
+# would load a committed sitecustomize.py) and every -c / - body drops '' and
+# '.' from sys.path before any other import (a committed json.py would print
+# the verdict). Pinned by tests/moat/p2-honest-verdict.sh
 # P2.checklist-verify-not-shadowed.
 #
+# S-204 (BACKLOG 53): -E alone still loads the user site-packages, whose .pth
+# "import" lines run at startup and can patch json.dump, so checklist-verify.py
+# wrote failing checks as verified into the results file the council hard gate
+# trusts. Every call site resolves its interpreter through
+# _loki_snapshot_py_tool and runs it -I -S; when none resolves, nothing is
+# verified or summarized (the hard gate then blocks fail-closed). See that
+# function's comment in run.sh for the rationale and accepted gaps. The copy
+# below only serves callers that source this file before or without run.sh
+# (tests); run.sh is the source of truth, keep it byte-identical. Pinned by
+# tests/test-prd-checklist-no-user-site-pth.sh.
+#
 # Data:
 #   .loki/checklist/checklist.json          - Full checklist with verification
 #   .loki/checklist/verification-results.json - Summary of last verification
@@ -37,6 +48,28 @@
 #
 #===============================================================================
 
+declare -F _loki_snapshot_py_tool >/dev/null 2>&1 || \
+_loki_snapshot_py_tool() {
+    local c
+    for c in /usr/bin/python3 /bin/python3; do
+        [ -x "$c" ] && [ ! -d "$c" ] && "$c" -I -S -c '' >/dev/null 2>&1 && { printf '%s\n' "$c"; return 0; }
+    done
+    local dir
+    local IFS=:
+    for dir in $PATH; do
+        case "$dir" in
+            /*) ;;
+            *) continue ;;
+        esac
+        if [ -x "$dir/python3" ] && [ ! -d "$dir/python3" ] \
+           && "$dir/python3" -I -S -c '' >/dev/null 2>&1; then
+            printf '%s\n' "$dir/python3"
+            return 0
+        fi
+    done
+    return 1
+}
+
 # Configuration
 CHECKLIST_ENABLED=${LOKI_CHECKLIST_ENABLED:-true}
 CHECKLIST_INTERVAL=${LOKI_CHECKLIST_INTERVAL:-5}
@@ -200,12 +233,14 @@ checklist_oracle_triangulate() {
     local status_token="NOOP"
     local status_file=""
     local status_tmp_root="${TMPDIR:-/tmp}"
+    local _cl_py
+    _cl_py="$(_loki_snapshot_py_tool)" || return 0
     if status_file="$(mktemp "${status_tmp_root%/}/loki-oracle-status.XXXXXX" 2>/dev/null)"; then
         if _ORACLE_SPEC="$CHECKLIST_PRD_PATH" \
            _ORACLE_OUT="$findings_file" \
            _ORACLE_PROJECT="$project_dir" \
            _ORACLE_INSTALL_DIR="$oracle_install_dir" \
-           python3 -E - > "$status_file" 2>/dev/null <<'ORACLE_PY'
+           "$_cl_py" -I -S - > "$status_file" 2>/dev/null <<'ORACLE_PY'
 import sys; sys.path[:] = [p for p in sys.path if p not in ("", ".")]
 import json, os, re, sys, tempfile, glob
 
@@ -701,7 +736,9 @@ checklist_oracle_evidence() {
     if [ ! -f "$findings_file" ]; then
         return 0
     fi
-    _ORACLE_OUT="$findings_file" python3 -E -c 'import sys; sys.path[:] = [p for p in sys.path if p not in ("", ".")]
+    local _cl_py
+    _cl_py="$(_loki_snapshot_py_tool)" || return 0
+    _ORACLE_OUT="$findings_file" "$_cl_py" -I -S -c 'import sys; sys.path[:] = [p for p in sys.path if p not in ("", ".")]
 import json, os
 try:
     with open(os.environ["_ORACLE_OUT"]) as f:
@@ -804,8 +841,9 @@ checklist_select_heldout() {
     # Honest caveat: re-selection or partial-survival after a regen can reserve
     # items the build loop already saw in earlier prompts (the hidden-from-loop
     # guarantee is best-effort once the checklist ids change mid-run).
-    local status_token
-    status_token=$(_CHECKLIST_FILE="$CHECKLIST_FILE" _HELDOUT_FILE="$heldout_file" python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
+    local status_token _cl_py
+    _cl_py="$(_loki_snapshot_py_tool)" || return 0
+    status_token=$(_CHECKLIST_FILE="$CHECKLIST_FILE" _HELDOUT_FILE="$heldout_file" "$_cl_py" -I -S -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
 import json, os, sys, hashlib, tempfile
 
 cl_path = os.environ['_CHECKLIST_FILE']
@@ -953,7 +991,9 @@ checklist_heldout_ids() {
     if [ ! -f "$heldout_file" ]; then
         return 0
     fi
-    _HELDOUT_FILE="$heldout_file" python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
+    local _cl_py
+    _cl_py="$(_loki_snapshot_py_tool)" || return 0
+    _HELDOUT_FILE="$heldout_file" "$_cl_py" -I -S -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
 import json, os
 try:
     with open(os.environ['_HELDOUT_FILE']) as f:
@@ -997,9 +1037,17 @@ checklist_verify() {
         return 0
     fi
 
+    # Non-zero so council_reverify_checklist replaces any stale green results
+    # with its fail-closed sentinel (run.sh's interval call ignores the status).
+    local _cl_py
+    if ! _cl_py="$(_loki_snapshot_py_tool)"; then
+        log_warn "checklist verification skipped: no isolated python3 interpreter resolved"
+        return 1
+    fi
+
     log_step "Running PRD checklist verification..."
 
-    python3 -E "$verify_script" \
+    "$_cl_py" -I -S "$verify_script" \
         --checklist "$CHECKLIST_FILE" \
         --timeout "$CHECKLIST_TIMEOUT" 2>/dev/null || true
 
@@ -1027,11 +1075,13 @@ checklist_summary() {
         echo ""
         return 0
     fi
+    local _cl_py
+    _cl_py="$(_loki_snapshot_py_tool)" || { echo ""; return 0; }
 
     _CHECKLIST_RESULTS="$CHECKLIST_RESULTS_FILE" \
     _CHECKLIST_WAIVERS="${CHECKLIST_DIR:-".loki/checklist"}/waivers.json" \
     _CHECKLIST_HELDOUT="${CHECKLIST_DIR:-".loki/checklist"}/held-out.json" \
-    python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
+    "$_cl_py" -I -S -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
 import json, sys, os
 try:
     fpath = os.environ.get('_CHECKLIST_RESULTS', '')
@@ -1128,13 +1178,16 @@ checklist_as_evidence() {
     if [ ! -f "$CHECKLIST_RESULTS_FILE" ]; then
         return 0
     fi
+    local _cl_py
+    # No interpreter: the failed exec falls to "Checklist data unavailable" below.
+    _cl_py="$(_loki_snapshot_py_tool)" || _cl_py="/nonexistent/python3"
 
     {
         echo ""
         echo "## PRD Checklist Verification"
         echo ""
 
-        _CHECKLIST_RESULTS="$CHECKLIST_RESULTS_FILE" python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
+        _CHECKLIST_RESULTS="$CHECKLIST_RESULTS_FILE" "$_cl_py" -I -S -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
 import json, os
 try:
     data = json.load(open(os.environ['_CHECKLIST_RESULTS']))
@@ -1170,7 +1223,9 @@ checklist_waiver_load() {
     if [ ! -f "$waivers_file" ]; then
         return 0
     fi
-    _WAIVERS_FILE="$waivers_file" python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
+    local _cl_py
+    _cl_py="$(_loki_snapshot_py_tool)" || return 0
+    _WAIVERS_FILE="$waivers_file" "$_cl_py" -I -S -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
 import json, sys, os
 try:
     waivers_file = os.environ['_WAIVERS_FILE']
@@ -1193,8 +1248,10 @@ checklist_waiver_add() {
     local waivers_file="${CHECKLIST_DIR:-".loki/checklist"}/waivers.json"
     local timestamp
     timestamp=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
+    local _cl_py
+    _cl_py="$(_loki_snapshot_py_tool)" || return 1
 
-    _WAIVERS_FILE="$waivers_file" python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
+    _WAIVERS_FILE="$waivers_file" "$_cl_py" -I -S -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
 import json, os, sys
 
 waivers_file = os.environ['_WAIVERS_FILE']
@@ -1246,8 +1303,10 @@ checklist_waiver_remove() {
         echo "No waivers file found"
         return 1
     fi
+    local _cl_py
+    _cl_py="$(_loki_snapshot_py_tool)" || return 1
 
-    _WAIVERS_FILE="$waivers_file" python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
+    _WAIVERS_FILE="$waivers_file" "$_cl_py" -I -S -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
 import json, os, sys
 
 waivers_file = os.environ['_WAIVERS_FILE']
@@ -1282,8 +1341,10 @@ checklist_waiver_list() {
         echo "No waivers configured"
         return 0
     fi
+    local _cl_py
+    _cl_py="$(_loki_snapshot_py_tool)" || return 1
 
-    _WAIVERS_FILE="$waivers_file" python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
+    _WAIVERS_FILE="$waivers_file" "$_cl_py" -I -S -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
 import json, os
 waivers_file = os.environ['_WAIVERS_FILE']
 with open(waivers_file) as f:

package/autonomy/run.sh

@@ -10949,9 +10949,26 @@ _loki_untrack_agent_committed_user_files() {
     fi
     rm -f "$rec.added"
     if [ ! -s "$rec.new" ]; then
-        # BACKLOG 102: zero hits this session -- clear a stale record left by
-        # an earlier session, or it persists forever with nothing to read it.
-        rm -f "$rec.new" "$rec"
+        rm -f "$rec.new"
+        # S-194: the tree diff above cannot see a file an earlier (resumed)
+        # session added and then untracked, but the branch history still
+        # holds it and create_session_pr gates the push on this record. Keep
+        # the record while that history holds any recorded path; on a failed
+        # check, keep it too (fail closed).
+        if [ -s "$rec" ]; then
+            local range="${fork}..HEAD" held_paths=() p="" hist=""
+            [ "$(git cat-file -t "$fork" 2>/dev/null)" = tree ] && range="HEAD"
+            while IFS= read -r -d '' p; do held_paths+=("$p"); done < "$rec"
+            if [ "${#held_paths[@]}" -eq 0 ] \
+               || ! hist="$(git -C "$top" --literal-pathspecs log -1 --format=%H --no-renames --diff-filter=A "$range" -- "${held_paths[@]}" 2>/dev/null)" \
+               || [ -n "$hist" ]; then
+                return 0
+            fi
+        fi
+        # BACKLOG 102: zero hits this session and no recorded path left in the
+        # branch history -- clear a stale record left by an earlier session,
+        # or it persists forever with nothing to read it.
+        rm -f "$rec"
         return 0
     fi
     mv -f "$rec.new" "$rec"
@@ -11198,6 +11215,24 @@ create_session_pr() {
         return 0
     fi
 
+    # BACKLOG 108: _loki_untrack_agent_committed_user_files removed the user's
+    # pre-existing files from the branch tip, but the commit that added them is
+    # still in the branch history, so a push publishes them. Print the cleanup
+    # before any push advice, and refuse the LOKI_AUTO_PR push. The fork is the
+    # merge base with the recorded base, as that helper computes it; its
+    # session-start-sha fallback cannot apply here, because without a merge
+    # base commit_count is 0 and this function already returned.
+    if [ -s .loki/state/agent-committed-user-files.z ]; then
+        local _uc_fork="" _uc_names=""
+        _uc_fork="$(git merge-base HEAD "$base" 2>/dev/null)" || _uc_fork=""
+        _uc_names="$(_loki_nul_names .loki/state/agent-committed-user-files.z)"
+        log_warn "The history of ${branch_name} still holds your pre-existing files the agent committed: ${_uc_names:-see .loki/state/agent-committed-user-files.z}. Before pushing, drop them from its history: git reset --soft ${_uc_fork:-<fork commit>} && git commit"
+        if [ "${LOKI_AUTO_PR:-0}" = "1" ]; then
+            log_warn "LOKI_AUTO_PR: not pushing ${branch_name}; its history holds your pre-existing files."
+            return 1
+        fi
+    fi
+
     # DEFAULT: advisory only. Print the exact commands; never push, never PR.
     if [ "${LOKI_AUTO_PR:-0}" != "1" ]; then
         if declare -f print_pr_advice >/dev/null 2>&1; then

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "9.74.0"
+__version__ = "9.76.0"
 
 # Expose the control app for easy import
 try:

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 The flagship product of [Autonomi](https://www.autonomi.dev/). Loki Mode is a spec-driven autonomous builder with a built-in trust layer that takes any spec to a deployed product and verifies completion with evidence (quality gates plus a completion council), not just a "done" claim. Complete installation instructions for all platforms and use cases.
 
-**Version:** v9.74.0
+**Version:** v9.76.0
 
 ---
 

package/docs/R3-COST-OBSERVABILITY-DESIGN.md

@@ -60,6 +60,7 @@ Read-only. Returns two honest series plus a budget block:
      "cost_usd": 1.84, "files_changed": 3, "final_verdict": "APPROVE"}
   ],
   "project_total_usd": 1.89,
+  "project_total_partial": false,
   "runs_count": 1,
   "budget": {
     "limit": 50.0, "used": 1.89, "remaining": 48.11,
@@ -74,7 +75,12 @@ Read-only. Returns two honest series plus a budget block:
   prefer `cost_usd`; if null, price from tokens via the EXISTING
   `_calculate_model_cost` helper (do not add a new pricer).
 - `runs` from `.loki/proofs/*/proof.json` (reuse `_proofs_dir` + `_safe_json_read`).
-- `project_total_usd` = sum of per-run proof costs (the persistent history).
+- `project_total_usd` totals only the runs whose proof recorded a cost
+  (the persistent history). It is null when no run recorded a cost, since
+  runs that each read "not recorded" do not add up to a $0.00 project; a
+  measured $0.00 run still makes it 0.0.
+- `project_total_partial` is true when only some runs recorded a cost. The
+  total is then a lower bound, not the project's full spend.
 - `budget.status`: "ok" (<80%), "warn" (>=80% and <100%), "exceeded" (>=100%).
   Computed at read time. No budget.json schema change (avoids the
   byte-identical-JSON parity trap with run.sh heredoc / budget.ts).

package/docs/exit-codes.md

@@ -67,6 +67,27 @@ An early draft spec listed `1=BLOCKED, 2=CONCERNS`. That ordering was rejected:
 it is not used anywhere, it has no consumers, and it inverts the
 severity-rises-with-the-code rule that every other command follows.
 
+### Known gaps until v10.0.0
+
+The table above is the target. On the current release, four inputs do not
+return what it implies. Measured on this checkout:
+
+| Input | Command | Exit today | Target |
+|---|---|---|---|
+| Empty diff (a git repo with no changes vs base) | `loki verify` | 1 (CONCERNS) | 3 |
+| Not a git directory | `loki verify` | 1 (CONCERNS) | 2 |
+| Unknown flag | `loki verify --no-such-flag` | 3 | 64 |
+| `--fast` with nothing scanned (0 files) | `loki verify --fast <empty-dir> --no-cache` | 0 | nonzero |
+
+`loki verify --fast` (`autonomy/lib/fast_verify.py`) also exits 0 for a
+nonexistent root and silently ignores unknown flags. Until v10.0.0, do not
+trust exit 0 from `--fast` alone: check stdout for `INCONCLUSIVE`, which it
+prints when nothing was scanned.
+
+Both gaps are tracked as pending moat cases, milestone v10.0.0, in
+`tests/moat/pending.txt`: P2.verify-exit-contract (the first three rows)
+and P2.fast-verify-inconclusive-not-zero (the `--fast` row).
+
 ## `loki proof verify <id>`
 
 Re-checks one Evidence Receipt against the repo (tamper and drift). The same