loki-mode 9.75.0 → 9.76.0

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: Autonomous spec-driven build system with a built-in trust layer. It does not call work done until it is verified (RARV-C closure loop, 8 quality gates, completion council, verified-completion evidence gate). Triggers on "Loki Mode". Takes a spec (PRD, GitHub issue, OpenAPI doc, etc.) to deployed product with minimal human intervention. Provider-agnostic. Requires --dangerously-skip-permissions flag.
 ---
 
-# Loki Mode v9.75.0
+# Loki Mode v9.76.0
 
 **You are an autonomous agent. You make decisions. You do not ask questions. You do not stop.**
 
@@ -470,4 +470,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v9.75.0 | [Autonomi](https://www.autonomi.dev/) flagship product | ~410 lines core**
+**v9.76.0 | [Autonomi](https://www.autonomi.dev/) flagship product | ~410 lines core**

package/VERSION

@@ -1 +1 @@
-9.75.0
+9.76.0

package/autonomy/completion-council.sh

@@ -4368,19 +4368,34 @@ council_managed_should_stop() {
         return 1
     fi
 
+    # S-196: every reader and the session heredoc run on the resolved -I -S
+    # interpreter (see _loki_snapshot_py_tool); -E still loads user-site .pth
+    # files. None resolvable -> never start the managed session: Bash fallback.
+    # Deliberate consequence: -S hides site-packages, so the anthropic SDK is
+    # never importable and is_enabled() is always False. The managed council
+    # therefore always falls back to Bash voting (warned below). Reviving it
+    # needs a pinned interpreter plus an SDK path that loads no .pth file;
+    # a PATH or venv python3 without -S would let the agent forge the verdict.
+    local _ms_py
+    _ms_py="$(_loki_snapshot_py_tool)" || {
+        log_warn "[Council] Managed completion council unavailable: no isolated -I -S interpreter; falling back to Bash voting"
+        return 1
+    }
+
     local loki_dir="${TARGET_DIR:-.}/.loki"
-    local project_dir="${PROJECT_DIR:-$(pwd)}"
     local round="${ITERATION_COUNT:-0}"
     local verdicts_dir="$COUNCIL_STATE_DIR/verdicts"
     mkdir -p "$verdicts_dir" 2>/dev/null || true
 
     # Build session context: diff_summary, test_summary, pending_tasks.
     # Kept deliberately small so we never choke the session budget.
+    # S-196: diff the target project (same root as loki_dir and
+    # LOKI_TARGET_DIR), never PROJECT_DIR, which is Loki's install tree.
     local diff_summary=""
-    diff_summary=$(cd "$project_dir" 2>/dev/null && git diff --stat 2>/dev/null | tail -20 | tr '\n' ' ' || echo "")
+    diff_summary=$(cd "${TARGET_DIR:-.}" 2>/dev/null && git diff --stat 2>/dev/null | tail -20 | tr '\n' ' ' || echo "")
     local test_summary=""
     if [ -f "$loki_dir/quality/test-results.json" ]; then
-        test_summary=$(_TRF="$loki_dir/quality/test-results.json" python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
+        test_summary=$(_TRF="$loki_dir/quality/test-results.json" "$_ms_py" -I -S -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
 import json, os
 try:
     d = json.load(open(os.environ['_TRF']))
@@ -4391,7 +4406,7 @@ except Exception:
     fi
     local pending_tasks="[]"
     if [ -f "$loki_dir/queue/pending.json" ]; then
-        pending_tasks=$(_QF="$loki_dir/queue/pending.json" python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
+        pending_tasks=$(_QF="$loki_dir/queue/pending.json" "$_ms_py" -I -S -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
 import json, os
 try:
     d = json.load(open(os.environ['_QF']))
@@ -4415,7 +4430,7 @@ except Exception:
     _CC_LOKI_DIR="$loki_dir" \
     LOKI_TARGET_DIR="${TARGET_DIR:-$(pwd)}" \
     PROJECT_DIR="${PROJECT_DIR:-$(cd "$(dirname "${BASH_SOURCE[0]}")/.." 2>/dev/null && pwd)}" \
-    python3 -E - <<'PYEOF' 2>/dev/null || exit_code=$?
+    "$_ms_py" -I -S - <<'PYEOF' 2>/dev/null || exit_code=$?
 import sys; sys.path[:] = [p for p in sys.path if p not in ("", ".")]
 import json, os, sys, pathlib
 
@@ -4553,7 +4568,10 @@ PYEOF
         return 0
     fi
 
-    log_warn "[Council] Managed completion council unavailable (exit=$exit_code); falling back to Bash voting"
+    case "$exit_code" in
+        2|3) log_warn "[Council] Managed completion council unavailable (exit=$exit_code): SDK not importable under the isolated -I -S interpreter; falling back to Bash voting" ;;
+        *) log_warn "[Council] Managed completion council unavailable (exit=$exit_code); falling back to Bash voting" ;;
+    esac
     return 1
 }
 

package/autonomy/lib/proof-check.sh

@@ -28,9 +28,41 @@
 # guards on LOKI_PROVEN_PR_CHECK=1). It is also safe if called directly.
 #
 # Inline Python (D7): the call site's cwd is the agent's repo, so the proof
-# readers run python3 -E and drop '' and '.' from sys.path first; a committed
-# json.py or sitecustomize.py cannot change the headline. Pinned by
+# readers drop '' and '.' from sys.path first; a committed json.py or
+# sitecustomize.py cannot change the headline. Pinned by
 # tests/test-proven-pr-check.sh (D7 section).
+#
+# BACKLOG 54 / S-203: python3 -E still loaded the user site-packages, where a
+# .pth "import" line runs before any sys.path scrub and could forge json.load
+# (a NOT VERIFIED proof read as VERIFIED). The readers resolve their
+# interpreter through _loki_snapshot_py_tool and run it -I -S; when none
+# resolves they print empty, as they do when python3 is absent. run.sh sources
+# this file before it defines _loki_snapshot_py_tool, and its later definition
+# replaces this copy, so the copy below only serves callers that source this
+# file on its own (tests). run.sh is the source of truth: keep this copy
+# byte-identical to it. Pinned by tests/test-proof-check-no-user-site-pth.sh
+# and tests/test-council-py-tool-identity.sh.
+declare -F _loki_snapshot_py_tool >/dev/null 2>&1 || \
+_loki_snapshot_py_tool() {
+    local c
+    for c in /usr/bin/python3 /bin/python3; do
+        [ -x "$c" ] && [ ! -d "$c" ] && "$c" -I -S -c '' >/dev/null 2>&1 && { printf '%s\n' "$c"; return 0; }
+    done
+    local dir
+    local IFS=:
+    for dir in $PATH; do
+        case "$dir" in
+            /*) ;;
+            *) continue ;;
+        esac
+        if [ -x "$dir/python3" ] && [ ! -d "$dir/python3" ] \
+           && "$dir/python3" -I -S -c '' >/dev/null 2>&1; then
+            printf '%s\n' "$dir/python3"
+            return 0
+        fi
+    done
+    return 1
+}
 
 # Double-source guard.
 [ -n "${_PROOF_CHECK_SH:-}" ] && return 0
@@ -71,10 +103,11 @@ _proof_check_headline() {
     local proof_path="${1:-}"
     [ -n "$proof_path" ] || { printf '%s' ""; return 0; }
     [ -f "$proof_path" ] || { printf '%s' ""; return 0; }
-    command -v python3 >/dev/null 2>&1 || { printf '%s' ""; return 0; }
+    local _pc_py=""
+    _pc_py="$(_loki_snapshot_py_tool)" || { printf '%s' ""; return 0; }
 
     local headline=""
-    headline="$(python3 -E - "$proof_path" <<'PY' 2>/dev/null || true
+    headline="$("$_pc_py" -I -S - "$proof_path" <<'PY' 2>/dev/null || true
 import sys; sys.path[:] = [p for p in sys.path if p not in ("", ".")]
 import json, sys
 try:
@@ -103,10 +136,11 @@ _proof_check_proof_head_sha() {
     local proof_path="${1:-}"
     [ -n "$proof_path" ] || { printf '%s' ""; return 0; }
     [ -f "$proof_path" ] || { printf '%s' ""; return 0; }
-    command -v python3 >/dev/null 2>&1 || { printf '%s' ""; return 0; }
+    local _pc_py=""
+    _pc_py="$(_loki_snapshot_py_tool)" || { printf '%s' ""; return 0; }
 
     local sha=""
-    sha="$(python3 -E - "$proof_path" <<'PY' 2>/dev/null || true
+    sha="$("$_pc_py" -I -S - "$proof_path" <<'PY' 2>/dev/null || true
 import sys; sys.path[:] = [p for p in sys.path if p not in ("", ".")]
 import json, sys
 try:
@@ -138,10 +172,11 @@ _proof_check_run_id() {
     local proof_path="${1:-}"
     [ -n "$proof_path" ] || { printf '%s' ""; return 0; }
     [ -f "$proof_path" ] || { printf '%s' ""; return 0; }
-    command -v python3 >/dev/null 2>&1 || { printf '%s' ""; return 0; }
+    local _pc_py=""
+    _pc_py="$(_loki_snapshot_py_tool)" || { printf '%s' ""; return 0; }
 
     local rid=""
-    rid="$(python3 -E - "$proof_path" <<'PY' 2>/dev/null || true
+    rid="$("$_pc_py" -I -S - "$proof_path" <<'PY' 2>/dev/null || true
 import sys; sys.path[:] = [p for p in sys.path if p not in ("", ".")]
 import json, sys
 try:

package/autonomy/lib/voter-agents.sh

@@ -28,9 +28,18 @@
 #                                             to existing heuristic dispatch).
 #
 # Inline Python (D7): the dispatch runs with the cwd inside the agent's repo, so
-# every python3 here runs -E and drops '' and '.' from sys.path before any other
-# import; a committed json.py or sitecustomize.py cannot read the votes.
+# every python3 here drops '' and '.' from sys.path before any other import; a
+# committed json.py or sitecustomize.py cannot read the votes.
 # Pinned by tests/test-voter-agents-json.sh (Case D).
+#
+# S-202 (BACKLOG 54): -E alone still loads the user site-packages, whose .pth
+# "import" lines run before that scrub and can forge json.loads (3 REJECT
+# findings read as a COMPLETE round). Every call site resolves its interpreter
+# through _loki_snapshot_py_tool and runs it -I -S; when none resolves, the
+# dispatch returns 1 and completion-council's fail-closed path applies. run.sh
+# is the source of truth for the helper; the guarded copy below only serves
+# callers that source this file on its own. Keep it byte-identical to run.sh's.
+# Pinned by tests/test-voter-agents-no-user-site-pth.sh.
 
 # Guard against double-source.
 if [ "${__LOKI_VOTER_AGENTS_SH_LOADED:-0}" = "1" ]; then
@@ -38,6 +47,28 @@ if [ "${__LOKI_VOTER_AGENTS_SH_LOADED:-0}" = "1" ]; then
 fi
 __LOKI_VOTER_AGENTS_SH_LOADED=1
 
+declare -F _loki_snapshot_py_tool >/dev/null 2>&1 || \
+_loki_snapshot_py_tool() {
+    local c
+    for c in /usr/bin/python3 /bin/python3; do
+        [ -x "$c" ] && [ ! -d "$c" ] && "$c" -I -S -c '' >/dev/null 2>&1 && { printf '%s\n' "$c"; return 0; }
+    done
+    local dir
+    local IFS=:
+    for dir in $PATH; do
+        case "$dir" in
+            /*) ;;
+            *) continue ;;
+        esac
+        if [ -x "$dir/python3" ] && [ ! -d "$dir/python3" ] \
+           && "$dir/python3" -I -S -c '' >/dev/null 2>&1; then
+            printf '%s\n' "$dir/python3"
+            return 0
+        fi
+    done
+    return 1
+}
+
 # Resolve repo root once. This file lives at autonomy/lib/voter-agents.sh.
 __LOKI_VA_LIB_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" 2>/dev/null && pwd)"
 __LOKI_VA_REPO_ROOT="$(cd "${__LOKI_VA_LIB_DIR}/../.." 2>/dev/null && pwd)"
@@ -59,12 +90,14 @@ loki_voter_agents_json() {
     fi
     local prd="${LOKI_PRD_PATH:-}"
     local tier="${LOKI_RARV_TIER:-development}"
+    local _va_py
+    _va_py="$(_loki_snapshot_py_tool)" || { printf '%s' '{}'; return 0; }
 
     _VA_ITER="$iter" \
     _VA_PRD="$prd" \
     _VA_TIER="$tier" \
     _VA_COMPLEXITY="${LOKI_COMPLEXITY:-standard}" \
-    python3 -E -c 'import sys; sys.path[:] = [p for p in sys.path if p not in ("", ".")]
+    "$_va_py" -I -S -c 'import sys; sys.path[:] = [p for p in sys.path if p not in ("", ".")]
 import json, os
 iter_n = os.environ.get("_VA_ITER", "0")
 prd = os.environ.get("_VA_PRD", "")
@@ -133,7 +166,9 @@ print(json.dumps(agents, separators=(",", ":")))
 # Arg $1: terse base findings summary used to brief the DA prompt.
 loki_devils_advocate_json() {
     local summary="${1:-}"
-    _VA_SUMMARY="$summary" python3 -E -c 'import sys; sys.path[:] = [p for p in sys.path if p not in ("", ".")]
+    local _va_py
+    _va_py="$(_loki_snapshot_py_tool)" || { printf '%s' '{}'; return 0; }
+    _VA_SUMMARY="$summary" "$_va_py" -I -S -c 'import sys; sys.path[:] = [p for p in sys.path if p not in ("", ".")]
 import json, os
 summary = os.environ.get("_VA_SUMMARY", "")[:1000]
 agents = {
@@ -355,13 +390,15 @@ loki_council_dispatch_agents() {
     local verdicts_dir="$COUNCIL_STATE_DIR/verdicts"
     local votes_dir="$COUNCIL_STATE_DIR/votes"
     mkdir -p "$verdicts_dir" "$votes_dir" 2>/dev/null || return 1
+    local _va_py
+    _va_py="$(_loki_snapshot_py_tool)" || return 1
 
     _VA_RESP="$response" \
     _VA_ITER="$iteration" \
     _VA_VDIR="$verdicts_dir" \
     _VA_RFILE="$votes_dir/round-${iteration}.json" \
     _VA_EXPECTED="${COUNCIL_SIZE:-3}" \
-    python3 -E -c 'import sys; sys.path[:] = [p for p in sys.path if p not in ("", ".")]
+    "$_va_py" -I -S -c 'import sys; sys.path[:] = [p for p in sys.path if p not in ("", ".")]
 import json, os, sys
 from datetime import datetime, timezone
 

package/autonomy/loki

@@ -1271,6 +1271,8 @@ loki_remote_verify_receipt() {
         echo "    the JWKS URL is not https -- only loopback is allowed over plain http)."
         echo "    Its integrity hash matches. Provenance is unproven here, not disproven."
         echo "    Install python3 cryptography, or re-run where the build server is reachable."
+        echo "    The verifier runs python3 -E, so cryptography supplied through PYTHONPATH is"
+        echo "    not seen; install it where the base interpreter finds it (site or user site)."
         return 0
     fi
 
@@ -37143,6 +37145,7 @@ print(json.dumps(json.load(open(os.environ['LOKI_PROOF_JSON'])), indent=2))
                         # verifier is a finding and is never softened to 2.
                         echo -e "${YELLOW}attestation: NOT CHECKED -- could not check against ${_pv_jwks} (key set unreadable,${NC}" >&2
                         echo -e "${YELLOW}  verifier dependency missing, or the JWKS URL is not https -- only loopback is allowed over plain http).${NC}" >&2
+                        echo "  The verifier runs python3 -E, so cryptography supplied through PYTHONPATH is not seen (a site or user-site install is)." >&2
                         echo "  This is not a failure of the receipt. Nothing was proven either way (exit 2)." >&2
                         if [ "$_pv_rc" -eq 0 ]; then _pv_rc=2; fi
                         _pv_attestation_field="NOT CHECKED"

package/autonomy/prd-checklist.sh

@@ -19,12 +19,23 @@
 #   LOKI_CHECKLIST_ENABLED      - Enable/disable checklist (default: true)
 #
 # Inline Python (D7): verification runs with the cwd inside the agent's repo,
-# so every python3 here runs -E (an empty PYTHONPATH component would load a
-# committed sitecustomize.py) and every -c / - body drops '' and '.' from
-# sys.path before any other import (a committed json.py would print the
-# verdict). Pinned by tests/moat/p2-honest-verdict.sh
+# so every python3 here ignores PYTHON* env vars (an empty PYTHONPATH component
+# would load a committed sitecustomize.py) and every -c / - body drops '' and
+# '.' from sys.path before any other import (a committed json.py would print
+# the verdict). Pinned by tests/moat/p2-honest-verdict.sh
 # P2.checklist-verify-not-shadowed.
 #
+# S-204 (BACKLOG 53): -E alone still loads the user site-packages, whose .pth
+# "import" lines run at startup and can patch json.dump, so checklist-verify.py
+# wrote failing checks as verified into the results file the council hard gate
+# trusts. Every call site resolves its interpreter through
+# _loki_snapshot_py_tool and runs it -I -S; when none resolves, nothing is
+# verified or summarized (the hard gate then blocks fail-closed). See that
+# function's comment in run.sh for the rationale and accepted gaps. The copy
+# below only serves callers that source this file before or without run.sh
+# (tests); run.sh is the source of truth, keep it byte-identical. Pinned by
+# tests/test-prd-checklist-no-user-site-pth.sh.
+#
 # Data:
 #   .loki/checklist/checklist.json          - Full checklist with verification
 #   .loki/checklist/verification-results.json - Summary of last verification
@@ -37,6 +48,28 @@
 #
 #===============================================================================
 
+declare -F _loki_snapshot_py_tool >/dev/null 2>&1 || \
+_loki_snapshot_py_tool() {
+    local c
+    for c in /usr/bin/python3 /bin/python3; do
+        [ -x "$c" ] && [ ! -d "$c" ] && "$c" -I -S -c '' >/dev/null 2>&1 && { printf '%s\n' "$c"; return 0; }
+    done
+    local dir
+    local IFS=:
+    for dir in $PATH; do
+        case "$dir" in
+            /*) ;;
+            *) continue ;;
+        esac
+        if [ -x "$dir/python3" ] && [ ! -d "$dir/python3" ] \
+           && "$dir/python3" -I -S -c '' >/dev/null 2>&1; then
+            printf '%s\n' "$dir/python3"
+            return 0
+        fi
+    done
+    return 1
+}
+
 # Configuration
 CHECKLIST_ENABLED=${LOKI_CHECKLIST_ENABLED:-true}
 CHECKLIST_INTERVAL=${LOKI_CHECKLIST_INTERVAL:-5}
@@ -200,12 +233,14 @@ checklist_oracle_triangulate() {
     local status_token="NOOP"
     local status_file=""
     local status_tmp_root="${TMPDIR:-/tmp}"
+    local _cl_py
+    _cl_py="$(_loki_snapshot_py_tool)" || return 0
     if status_file="$(mktemp "${status_tmp_root%/}/loki-oracle-status.XXXXXX" 2>/dev/null)"; then
         if _ORACLE_SPEC="$CHECKLIST_PRD_PATH" \
            _ORACLE_OUT="$findings_file" \
            _ORACLE_PROJECT="$project_dir" \
            _ORACLE_INSTALL_DIR="$oracle_install_dir" \
-           python3 -E - > "$status_file" 2>/dev/null <<'ORACLE_PY'
+           "$_cl_py" -I -S - > "$status_file" 2>/dev/null <<'ORACLE_PY'
 import sys; sys.path[:] = [p for p in sys.path if p not in ("", ".")]
 import json, os, re, sys, tempfile, glob
 
@@ -701,7 +736,9 @@ checklist_oracle_evidence() {
     if [ ! -f "$findings_file" ]; then
         return 0
     fi
-    _ORACLE_OUT="$findings_file" python3 -E -c 'import sys; sys.path[:] = [p for p in sys.path if p not in ("", ".")]
+    local _cl_py
+    _cl_py="$(_loki_snapshot_py_tool)" || return 0
+    _ORACLE_OUT="$findings_file" "$_cl_py" -I -S -c 'import sys; sys.path[:] = [p for p in sys.path if p not in ("", ".")]
 import json, os
 try:
     with open(os.environ["_ORACLE_OUT"]) as f:
@@ -804,8 +841,9 @@ checklist_select_heldout() {
     # Honest caveat: re-selection or partial-survival after a regen can reserve
     # items the build loop already saw in earlier prompts (the hidden-from-loop
     # guarantee is best-effort once the checklist ids change mid-run).
-    local status_token
-    status_token=$(_CHECKLIST_FILE="$CHECKLIST_FILE" _HELDOUT_FILE="$heldout_file" python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
+    local status_token _cl_py
+    _cl_py="$(_loki_snapshot_py_tool)" || return 0
+    status_token=$(_CHECKLIST_FILE="$CHECKLIST_FILE" _HELDOUT_FILE="$heldout_file" "$_cl_py" -I -S -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
 import json, os, sys, hashlib, tempfile
 
 cl_path = os.environ['_CHECKLIST_FILE']
@@ -953,7 +991,9 @@ checklist_heldout_ids() {
     if [ ! -f "$heldout_file" ]; then
         return 0
     fi
-    _HELDOUT_FILE="$heldout_file" python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
+    local _cl_py
+    _cl_py="$(_loki_snapshot_py_tool)" || return 0
+    _HELDOUT_FILE="$heldout_file" "$_cl_py" -I -S -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
 import json, os
 try:
     with open(os.environ['_HELDOUT_FILE']) as f:
@@ -997,9 +1037,17 @@ checklist_verify() {
         return 0
     fi
 
+    # Non-zero so council_reverify_checklist replaces any stale green results
+    # with its fail-closed sentinel (run.sh's interval call ignores the status).
+    local _cl_py
+    if ! _cl_py="$(_loki_snapshot_py_tool)"; then
+        log_warn "checklist verification skipped: no isolated python3 interpreter resolved"
+        return 1
+    fi
+
     log_step "Running PRD checklist verification..."
 
-    python3 -E "$verify_script" \
+    "$_cl_py" -I -S "$verify_script" \
         --checklist "$CHECKLIST_FILE" \
         --timeout "$CHECKLIST_TIMEOUT" 2>/dev/null || true
 
@@ -1027,11 +1075,13 @@ checklist_summary() {
         echo ""
         return 0
     fi
+    local _cl_py
+    _cl_py="$(_loki_snapshot_py_tool)" || { echo ""; return 0; }
 
     _CHECKLIST_RESULTS="$CHECKLIST_RESULTS_FILE" \
     _CHECKLIST_WAIVERS="${CHECKLIST_DIR:-".loki/checklist"}/waivers.json" \
     _CHECKLIST_HELDOUT="${CHECKLIST_DIR:-".loki/checklist"}/held-out.json" \
-    python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
+    "$_cl_py" -I -S -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
 import json, sys, os
 try:
     fpath = os.environ.get('_CHECKLIST_RESULTS', '')
@@ -1128,13 +1178,16 @@ checklist_as_evidence() {
     if [ ! -f "$CHECKLIST_RESULTS_FILE" ]; then
         return 0
     fi
+    local _cl_py
+    # No interpreter: the failed exec falls to "Checklist data unavailable" below.
+    _cl_py="$(_loki_snapshot_py_tool)" || _cl_py="/nonexistent/python3"
 
     {
         echo ""
         echo "## PRD Checklist Verification"
         echo ""
 
-        _CHECKLIST_RESULTS="$CHECKLIST_RESULTS_FILE" python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
+        _CHECKLIST_RESULTS="$CHECKLIST_RESULTS_FILE" "$_cl_py" -I -S -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
 import json, os
 try:
     data = json.load(open(os.environ['_CHECKLIST_RESULTS']))
@@ -1170,7 +1223,9 @@ checklist_waiver_load() {
     if [ ! -f "$waivers_file" ]; then
         return 0
     fi
-    _WAIVERS_FILE="$waivers_file" python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
+    local _cl_py
+    _cl_py="$(_loki_snapshot_py_tool)" || return 0
+    _WAIVERS_FILE="$waivers_file" "$_cl_py" -I -S -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
 import json, sys, os
 try:
     waivers_file = os.environ['_WAIVERS_FILE']
@@ -1193,8 +1248,10 @@ checklist_waiver_add() {
     local waivers_file="${CHECKLIST_DIR:-".loki/checklist"}/waivers.json"
     local timestamp
     timestamp=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
+    local _cl_py
+    _cl_py="$(_loki_snapshot_py_tool)" || return 1
 
-    _WAIVERS_FILE="$waivers_file" python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
+    _WAIVERS_FILE="$waivers_file" "$_cl_py" -I -S -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
 import json, os, sys
 
 waivers_file = os.environ['_WAIVERS_FILE']
@@ -1246,8 +1303,10 @@ checklist_waiver_remove() {
         echo "No waivers file found"
         return 1
     fi
+    local _cl_py
+    _cl_py="$(_loki_snapshot_py_tool)" || return 1
 
-    _WAIVERS_FILE="$waivers_file" python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
+    _WAIVERS_FILE="$waivers_file" "$_cl_py" -I -S -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
 import json, os, sys
 
 waivers_file = os.environ['_WAIVERS_FILE']
@@ -1282,8 +1341,10 @@ checklist_waiver_list() {
         echo "No waivers configured"
         return 0
     fi
+    local _cl_py
+    _cl_py="$(_loki_snapshot_py_tool)" || return 1
 
-    _WAIVERS_FILE="$waivers_file" python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
+    _WAIVERS_FILE="$waivers_file" "$_cl_py" -I -S -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
 import json, os
 waivers_file = os.environ['_WAIVERS_FILE']
 with open(waivers_file) as f:

package/autonomy/run.sh

@@ -10949,9 +10949,26 @@ _loki_untrack_agent_committed_user_files() {
     fi
     rm -f "$rec.added"
     if [ ! -s "$rec.new" ]; then
-        # BACKLOG 102: zero hits this session -- clear a stale record left by
-        # an earlier session, or it persists forever with nothing to read it.
-        rm -f "$rec.new" "$rec"
+        rm -f "$rec.new"
+        # S-194: the tree diff above cannot see a file an earlier (resumed)
+        # session added and then untracked, but the branch history still
+        # holds it and create_session_pr gates the push on this record. Keep
+        # the record while that history holds any recorded path; on a failed
+        # check, keep it too (fail closed).
+        if [ -s "$rec" ]; then
+            local range="${fork}..HEAD" held_paths=() p="" hist=""
+            [ "$(git cat-file -t "$fork" 2>/dev/null)" = tree ] && range="HEAD"
+            while IFS= read -r -d '' p; do held_paths+=("$p"); done < "$rec"
+            if [ "${#held_paths[@]}" -eq 0 ] \
+               || ! hist="$(git -C "$top" --literal-pathspecs log -1 --format=%H --no-renames --diff-filter=A "$range" -- "${held_paths[@]}" 2>/dev/null)" \
+               || [ -n "$hist" ]; then
+                return 0
+            fi
+        fi
+        # BACKLOG 102: zero hits this session and no recorded path left in the
+        # branch history -- clear a stale record left by an earlier session,
+        # or it persists forever with nothing to read it.
+        rm -f "$rec"
         return 0
     fi
     mv -f "$rec.new" "$rec"
@@ -11198,6 +11215,24 @@ create_session_pr() {
         return 0
     fi
 
+    # BACKLOG 108: _loki_untrack_agent_committed_user_files removed the user's
+    # pre-existing files from the branch tip, but the commit that added them is
+    # still in the branch history, so a push publishes them. Print the cleanup
+    # before any push advice, and refuse the LOKI_AUTO_PR push. The fork is the
+    # merge base with the recorded base, as that helper computes it; its
+    # session-start-sha fallback cannot apply here, because without a merge
+    # base commit_count is 0 and this function already returned.
+    if [ -s .loki/state/agent-committed-user-files.z ]; then
+        local _uc_fork="" _uc_names=""
+        _uc_fork="$(git merge-base HEAD "$base" 2>/dev/null)" || _uc_fork=""
+        _uc_names="$(_loki_nul_names .loki/state/agent-committed-user-files.z)"
+        log_warn "The history of ${branch_name} still holds your pre-existing files the agent committed: ${_uc_names:-see .loki/state/agent-committed-user-files.z}. Before pushing, drop them from its history: git reset --soft ${_uc_fork:-<fork commit>} && git commit"
+        if [ "${LOKI_AUTO_PR:-0}" = "1" ]; then
+            log_warn "LOKI_AUTO_PR: not pushing ${branch_name}; its history holds your pre-existing files."
+            return 1
+        fi
+    fi
+
     # DEFAULT: advisory only. Print the exact commands; never push, never PR.
     if [ "${LOKI_AUTO_PR:-0}" != "1" ]; then
         if declare -f print_pr_advice >/dev/null 2>&1; then

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "9.75.0"
+__version__ = "9.76.0"
 
 # Expose the control app for easy import
 try:

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 The flagship product of [Autonomi](https://www.autonomi.dev/). Loki Mode is a spec-driven autonomous builder with a built-in trust layer that takes any spec to a deployed product and verifies completion with evidence (quality gates plus a completion council), not just a "done" claim. Complete installation instructions for all platforms and use cases.
 
-**Version:** v9.75.0
+**Version:** v9.76.0
 
 ---