loki-mode 10.5.11 → 10.5.13

package/SKILL.md

@@ -1,9 +1,9 @@
 ---
 name: loki-mode
-description: Autonomous spec-driven build system with a built-in trust layer. It does not call work done until it is verified (RARV-C closure loop, 8 quality gates, completion council, verified-completion evidence gate). Triggers on "Loki Mode". Takes a spec (PRD, GitHub issue, OpenAPI doc, etc.) to deployed product with minimal human intervention. Provider-agnostic. Requires --dangerously-skip-permissions flag.
+description: An autonomous software factory that knows what it is supposed to deliver, and proves it did. Use when the user says Loki Mode or asks to build, fix or verify software autonomously.
 ---
 
-# Loki Mode v10.5.11
+# Loki Mode v10.5.13
 
 **You are an autonomous agent. You make decisions. You do not ask questions. You do not stop.**
 
@@ -470,4 +470,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v10.5.11 | [Autonomi](https://www.autonomi.dev/) flagship product | ~410 lines core**
+**v10.5.13 | [Autonomi](https://www.autonomi.dev/) flagship product | ~410 lines core**

package/VERSION

@@ -1 +1 @@
-10.5.11
+10.5.13

package/autonomy/app-runner.sh

@@ -1015,7 +1015,8 @@ _install_node_deps() {
     local dir="$1"
     if [ -f "$dir/package.json" ] && [ ! -d "$dir/node_modules" ]; then
         log_step "App Runner: installing node dependencies..."
-        (cd "$dir" && npm install >> "$_APP_RUNNER_DIR/app.log" 2>&1) || \
+        # shellcheck disable=SC2046  # A-132: no lockfile the repo did not have
+        (cd "$dir" && npm install $([ -f "$dir/package-lock.json" ] || echo --no-package-lock) >> "$_APP_RUNNER_DIR/app.log" 2>&1) || \
             log_warn "App Runner: npm install failed, app may not start"
     fi
 }

package/autonomy/completion-council.sh

@@ -1865,6 +1865,30 @@ _loki_test_provenance() {
 # actually ran and was red); every inconclusive case passes through so a
 # legitimate completion is never falsely stopped. Default-on; opt out with
 # LOKI_EVIDENCE_GATE=0 (byte-identical to prior behavior, no read/write).
+# A-133: true (rc 0) when the changed-file union (arg 2, newline list, .loki/ already
+# excluded) is a trivial diff: at most 2 files and 20 changed lines, and none of
+# them a test, CI, auth/security, route/entrypoint, manifest, Docker or SQL file. Only the
+# costly persistence, auth and tenant probes are skipped; the free boot read never is.
+# Opt out: LOKI_EVIDENCE_TRIVIAL_SKIP=0.
+_council_trivial_diff() {
+    local base="$1" files="$2" n added deleted f total=0
+    [ "${LOKI_EVIDENCE_TRIVIAL_SKIP:-1}" = "0" ] && return 1
+    n=$(printf '%s\n' "$files" | wc -l | tr -d ' ')
+    [ "$n" -le 2 ] || return 1
+    printf '%s\n' "$files" | grep -qiE '(^|/)(tests?|__tests__|specs?|e2e|cypress|playwright)(/|$)|\.(test|spec)\.[^/]+$|(^|/)test_[^/]+$|_test\.[^/]+$|conftest\.py$|^\.github/|^\.gitlab-ci|^\.circleci/|Jenkinsfile|azure-pipelines|^\.buildkite/|^\.travis|auth|login|logout|session|passw|secret|credential|token|jwt|oauth|saml|sso|security|permission|rbac|acl|crypt|\.env|\.pem$|\.key$|middleware|policy|tenant|rls|route|router|controller|endpoint|(^|/)api/|(^|/)pages/|(^|/)handlers?/|(^|/)(server|app|main|index)\.[a-z]+$|package\.json|Dockerfile|docker-compose|\.sql$|migrations?/' && return 1
+    # Tracked changes vs the run base (committed, staged and unstaged), then untracked files.
+    while read -r added deleted f; do
+        [ -n "$f" ] || continue
+        case "$added$deleted" in *[!0-9]*) return 1 ;; esac  # binary: not trivial
+        total=$((total + added + deleted))
+    done < <(git diff --numstat "$base" -- . ':!.loki' 2>/dev/null || echo "x x x")
+    while IFS= read -r f; do
+        [ -n "$f" ] || continue
+        total=$((total + $(wc -l < "$f" 2>/dev/null || echo 99)))
+    done < <(git ls-files --others --exclude-standard -- . ':!.loki' 2>/dev/null)
+    [ "$total" -le 20 ]
+}
+
 council_evidence_gate() {
     # P2 (S-116): when the caller sets _LOKI_EVIDENCE_REQUIRE_TESTS=1, inconclusive
     # test evidence blocks instead of passing through. council_evaluate sets it as
@@ -1908,6 +1932,7 @@ council_evidence_gate() {
     # diff_inconclusive stays "false" on the conclusive branch below.
     local diff_inconclusive="false"
     local diff_inconclusive_reason=""
+    local _trivial_diff="false"
     if ! git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
         # No git repo => cannot prove fabrication => inconclusive => pass-through.
         diff_inconclusive="true"
@@ -1954,6 +1979,7 @@ council_evidence_gate() {
         local union_files
         union_files=$(printf '%s\n%s\n%s\n%s\n' "$committed_files" "$unstaged_files" "$staged_files" "$untracked_files" | grep -v '^$' | grep -vE '^\.loki/' | sort -u)
         if [ -n "$union_files" ]; then
+            _council_trivial_diff "$base_sha" "$union_files" && _trivial_diff="true"
             diff_files=$(printf '%s\n' "$union_files" | wc -l | tr -d ' ')
         else
             diff_files=0
@@ -2249,6 +2275,11 @@ INCONCLUSIVE_EOF
         "inconclusive": $test_inconclusive,
         "inconclusive_reason": "$test_inconclusive_reason"
     },
+    "boot": {
+        "ok": $([ "${boot_fails:-false}" = "true" ] && echo false || echo true),
+        "inconclusive": ${boot_inconclusive:-false},
+        "reason": "${boot_inconclusive_reason:-}"
+    },
     "nomock": {
         "ok": $_nomock_ok,
         "inconclusive": ${nomock_inconclusive:-false},
@@ -2458,6 +2489,8 @@ PYEOF
 
     if [ "$_proof_persist_disabled" = "true" ]; then
         persist_inconclusive="true"; persist_inconclusive_reason="persist_gate_disabled"
+    elif [ "$_trivial_diff" = "true" ]; then
+        persist_inconclusive="true"; persist_inconclusive_reason="trivial_diff"
     elif [ "$_proof_serveable" != "true" ]; then
         persist_inconclusive="true"; persist_inconclusive_reason="not_serveable"
     elif command -v python3 >/dev/null 2>&1; then
@@ -2522,6 +2555,8 @@ PYEOF
 
     if [ "$_proof_auth_disabled" = "true" ]; then
         auth_inconclusive="true"; auth_inconclusive_reason="auth_gate_disabled"
+    elif [ "$_trivial_diff" = "true" ]; then
+        auth_inconclusive="true"; auth_inconclusive_reason="trivial_diff"
     elif [ "$_proof_serveable" != "true" ]; then
         auth_inconclusive="true"; auth_inconclusive_reason="not_serveable"
     elif command -v python3 >/dev/null 2>&1; then
@@ -2601,6 +2636,8 @@ PYEOF
     # isolation blocks.
     if [ "$_proof_authz_disabled" = "true" ]; then
         authz_inconclusive="true"; authz_inconclusive_reason="authz_gate_disabled"
+    elif [ "$_trivial_diff" = "true" ]; then
+        authz_inconclusive="true"; authz_inconclusive_reason="trivial_diff"
     elif [ "$_proof_serveable" != "true" ]; then
         authz_inconclusive="true"; authz_inconclusive_reason="not_serveable"
     elif command -v python3 >/dev/null 2>&1; then
@@ -2740,13 +2777,13 @@ PYEOF
         if [ "$nomock_inconclusive" = "true" ] && [ "$nomock_inconclusive_reason" != "nomock_gate_disabled" ]; then
             log_warn "[Council] Evidence gate: no-mock not confirmed (${nomock_inconclusive_reason}). Pass-through; set LOKI_PROOF_NOMOCK=0 to silence."
         fi
-        if [ "$persist_inconclusive" = "true" ] && [ "$persist_inconclusive_reason" != "persist_gate_disabled" ]; then
+        if [ "$persist_inconclusive" = "true" ] && [ "$persist_inconclusive_reason" != "persist_gate_disabled" ] && [ "$_trivial_diff" != "true" ]; then
             log_warn "[Council] Evidence gate: persistence not proven (${persist_inconclusive_reason}). Pass-through; set LOKI_PROOF_PERSIST=0 to silence, or expose a create form the driver can exercise (LOKI_PROOF_CREATE_SELECTOR)."
         fi
-        if [ "$auth_inconclusive" = "true" ] && [ "$auth_inconclusive_reason" != "auth_gate_disabled" ]; then
+        if [ "$auth_inconclusive" = "true" ] && [ "$auth_inconclusive_reason" != "auth_gate_disabled" ] && [ "$_trivial_diff" != "true" ]; then
             log_warn "[Council] Evidence gate: auth enforcement not proven (${auth_inconclusive_reason}). Pass-through; set LOKI_PROOF_AUTH=0 to silence, or set LOKI_PROOF_PROTECTED_PATH so the driver can test a logged-out request."
         fi
-        if [ "$authz_inconclusive" = "true" ] && [ "$authz_inconclusive_reason" != "authz_gate_disabled" ]; then
+        if [ "$authz_inconclusive" = "true" ] && [ "$authz_inconclusive_reason" != "authz_gate_disabled" ] && [ "$_trivial_diff" != "true" ]; then
             log_warn "[Council] Evidence gate: tenant isolation not proven (${authz_inconclusive_reason}). Pass-through; set LOKI_PROOF_AUTHZ=0 to silence, or configure LOKI_PROOF_AUTHZ_* selectors so the driver can drive two distinct sessions."
         fi
         _write_evidence_details "pass"

package/autonomy/lib/doctor-fix.py

@@ -58,7 +58,7 @@ INPUT CONTRACT. Blockers are DERIVED, not read: `doctor --json` emits no
 blocker list (that string is built only in the text path, autonomy/loki:11367).
 Anything with status "fail" is a blocker, and failable things live in three
 places -- `checks[]`, plus the siblings `ai_provider` and `disk`. The advisory
-siblings (`sentrux`, `receipt_signing`, `memory`, `model_catalog`) are never
+siblings (`sentrux`, `memory`, `model_catalog`) are never
 "fail" by construction and are not scanned.
 
 KNOWN LIMITATION, stated rather than papered over: the text path reports two

package/autonomy/lib/proof-generator.py

@@ -1056,9 +1056,8 @@ def _git_diffstat(target_dir, include_diffs):
     into _diff_sha256, the receipt's integrity hash, which is written on EVERY
     run. A verifier recomputing it therefore attests to the understated stat,
     and the receipt is exactly the artifact users are told to trust. (Detached
-    GPG signing is a separate opt-in layer gated on LOKI_PROOF_GPG_KEY and
-    default OFF; when enabled it signs these same bytes, but the integrity hash
-    is the always-on path.)
+    Ed25519 signing attests to the same digest; the integrity hash is the
+    always-on path.)
 
     Order of preference:
       1. _LOKI_RUN_START_SHA -- the run's own baseline (run.sh exports it).
@@ -1303,26 +1302,6 @@ def _canonical(obj):
     return json.dumps(obj, sort_keys=True, separators=(",", ":"))
 
 
-def _gpg_detached_sign(data, key_id):
-    """Produce an ASCII-armored gpg detached signature over `data`.
-
-    Returns the armored signature string, or None on any failure (gpg missing,
-    key not found, timeout). Best-effort: signing is an optional add-on and
-    never blocks proof emission. Local-only: invokes the on-PATH gpg, no network.
-    """
-    try:
-        proc = subprocess.run(
-            ["gpg", "--batch", "--yes", "--armor", "--detach-sign",
-             "--local-user", key_id, "--output", "-"],
-            input=data, capture_output=True, timeout=30,
-        )
-        if proc.returncode != 0 or not proc.stdout:
-            return None
-        return proc.stdout.decode("utf-8", errors="replace")
-    except Exception:
-        return None
-
-
 def _build_proof(args, loki_dir, target_dir, repo_root):
     generated_at = _utc_now_iso()
     run_id = args.run_id or os.environ.get("LOKI_SESSION_ID") or _gen_run_id()
@@ -1965,16 +1944,16 @@ def _render_fallback_html(proof):
     # Signing state, stated plainly. Mirrors renderProvenance in
     # proof-template.html (the primary renderer); this fallback path must not
     # be quieter about provenance than the page it stands in for.
-    if ver.get("gpg_signature"):
-        rows.append("<p>Signature: SIGNED (detached GPG over the canonical "
-                    "bytes). A verifier holding the signer public key can "
-                    "confirm provenance offline: loki proof verify &lt;id&gt;</p>")
+    if ver.get("attestation"):
+        rows.append("<p>Signature: SIGNED (Ed25519 attestation over the "
+                    "integrity hash). Confirm provenance offline: "
+                    "loki proof verify &lt;id&gt;</p>")
     else:
         rows.append("<p>Signature: UNSIGNED. The integrity hash proves the "
                     "bytes were not edited after hashing; it does NOT prove "
                     "who produced them, so this receipt trusts its generator. "
-                    "To sign future receipts, set LOKI_PROOF_GPG_KEY to a gpg "
-                    "key id (see docs/SIGNED-RECEIPTS.md).</p>")
+                    "To sign future receipts, install the cryptography "
+                    "package (see docs/SIGNED-RECEIPTS.md).</p>")
 
     # Model provenance, mirrored here for the same reason the signature row is:
     # this fallback "must not be quieter about provenance than the page it
@@ -2150,61 +2129,38 @@ def generate(args):
         "scope": "integrity",
     }
 
-    # Optional, env-gated gpg detached signature over the SAME canonical bytes
-    # that were hashed (the pre-verification form a verifier reconstructs).
-    # Default OFF: absent LOKI_PROOF_GPG_KEY -> no signature field, bytes
-    # byte-identical to the unsigned proof. Never an external service, never
-    # required, best-effort (a gpg failure is swallowed: the proof still emits).
-    gpg_key = os.environ.get("LOKI_PROOF_GPG_KEY", "").strip()
-    if gpg_key:
-        sig = _gpg_detached_sign(canonical_bytes, gpg_key)
-        if sig:
-            verification["gpg_signature"] = sig
-
-    # Optional Ed25519 attestation over the SAME digest, for the case gpg
-    # cannot serve: a receipt checked by someone who does not hold the signing
-    # key. gpg proves provenance only to a verifier who already imported the
-    # public key, which a customer, auditor or CI system handed a proof.json
-    # generally has not. An attestation is checkable against a published JWKS
-    # (or a jwks.json file, offline) with no key exchange at all.
-    #
-    # Binds the DIGEST, not the body, so it attests to exactly the bytes a
-    # verifier independently recomputes. Written INSIDE `verification`, which
-    # the hash excludes -- anywhere else would change the hashed bytes and make
-    # every honest receipt read as tampered the moment it was signed.
-    #
-    # Same default-OFF discipline as gpg above: absent the key, no field, and
-    # the bytes stay identical to an unattested proof. Best-effort for the same
-    # reason -- a signing failure must not cost the user their receipt.
-    # This env check is an EARLY EXIT, not the control that enforces default-off.
-    # Mutation testing showed that removing it changes nothing observable:
-    # load_signing_key() returns (None, "") when neither variable is set, so the
-    # block below cannot attest anyway. It is kept because it skips an import
-    # and a try/except on the overwhelmingly common unconfigured path -- stated
-    # here rather than left to imply a guarantee it does not provide.
-    att_key = (os.environ.get("LOKI_RECEIPT_SIGNING_KEY_FILE", "").strip()
-               or os.environ.get("LOKI_RECEIPT_SIGNING_KEY", "").strip())
-    if att_key:
-        try:
-            sys.path.insert(0, os.path.dirname(os.path.dirname(
-                os.path.abspath(__file__))))
-            from receipt_jwt import load_signing_key, sign_attestation
-            _priv, _kid = load_signing_key()
-            if _priv is not None:
-                _tok = sign_attestation(
-                    _priv, _kid,
-                    job_id=str(redacted.get("run_id") or ""),
-                    run_id=str(redacted.get("run_id") or ""),
-                    receipt_hash=digest,
-                )
-                if _tok:
-                    verification["attestation"] = _tok
-                    verification["attestation_kid"] = _kid
-        except Exception:
-            # Swallowed deliberately, matching the gpg path: an unattested
-            # receipt is a valid state with an existing verdict. Losing the
-            # receipt entirely because signing failed would be strictly worse.
-            pass
+    if os.environ.get("LOKI_PROOF_GPG_KEY", "").strip():
+        sys.stderr.write(
+            "warn: LOKI_PROOF_GPG_KEY is no longer supported and is ignored. "
+            "Receipts are signed with Ed25519 automatically; to use your own "
+            "key set LOKI_RECEIPT_SIGNING_KEY or LOKI_RECEIPT_SIGNING_KEY_FILE "
+            "(docs/SIGNED-RECEIPTS.md).\n")
+
+    # Ed25519 attestation over the SAME digest, checkable against a published
+    # JWKS (or a jwks.json file, offline) with no key exchange. Binds the
+    # DIGEST, not the body, and is written INSIDE `verification`, which the hash
+    # excludes: anywhere else would change the hashed bytes and make every
+    # honest receipt read as tampered. load_signing_key() auto-generates the
+    # default local key, so a first run signs. Best-effort: a signing failure
+    # must not cost the user their receipt (an unattested receipt has its own
+    # verdict). Missing `cryptography` yields no attestation.
+    try:
+        sys.path.insert(0, os.path.dirname(os.path.dirname(
+            os.path.abspath(__file__))))
+        from receipt_jwt import load_signing_key, sign_attestation
+        _priv, _kid = load_signing_key()
+        if _priv is not None:
+            _tok = sign_attestation(
+                _priv, _kid,
+                job_id=str(redacted.get("run_id") or ""),
+                run_id=str(redacted.get("run_id") or ""),
+                receipt_hash=digest,
+            )
+            if _tok:
+                verification["attestation"] = _tok
+                verification["attestation_kid"] = _kid
+    except Exception:
+        pass
 
     redacted["verification"] = verification
 

package/autonomy/lib/proof-template.html

@@ -1255,19 +1255,15 @@
     if (hash) {
       kv += '<div class="k">Integrity hash</div><div class="v">' + esc(algo) + ":" + esc(hash) + "</div>";
     }
-    // Signing state, named explicitly. The hash-note below already says the
-    // hash does not prove provenance; without this row a reader is told what
-    // the receipt CANNOT do but never which state this particular receipt is
-    // in, nor how to change it. Signing is gated on LOKI_PROOF_GPG_KEY in
-    // proof-generator.py and is OFF by default -- deliberately, because a
-    // self-minted key would flip proof-verify.py's generator_trusted to false
-    // while the key came from the very process under audit.
-    var signed = !!g(p, "verification.gpg_signature", "");
+    // Signing state, named explicitly: a reader must be told which state this
+    // receipt is in, not just what the hash cannot prove. Signing is an Ed25519
+    // attestation (verification.attestation), auto-generated on first run.
+    var signed = !!g(p, "verification.attestation", "");
     kv += '<div class="k">Signature</div><div class="v">' +
-          (signed ? "SIGNED (detached GPG)" : "UNSIGNED") + "</div>";
+          (signed ? "SIGNED (Ed25519 attestation)" : "UNSIGNED") + "</div>";
     var signNote = signed
-      ? '<p class="hash-note">This receipt carries a detached GPG signature over the same canonical bytes that were hashed. A verifier holding the signer public key can confirm its provenance offline with <code>loki proof verify</code>.</p>'
-      : '<p class="hash-note">This receipt is UNSIGNED, so it trusts the generator that produced it (<code>loki proof verify</code> reports <code>generator_trusted: true</code>). To sign future receipts, set <code>LOKI_PROOF_GPG_KEY</code> to a GPG key id before the run.</p>';
+      ? '<p class="hash-note">This receipt carries an Ed25519 attestation over the integrity hash. <code>loki proof verify</code> checks it offline against the signer public key.</p>'
+      : '<p class="hash-note">This receipt is UNSIGNED, so it trusts the generator that produced it (<code>loki proof verify</code> reports <code>generator_trusted: true</code>). Install the <code>cryptography</code> package so the next run signs automatically (docs/SIGNED-RECEIPTS.md).</p>';
     // Model provenance from the append-only decision trail
     // (.loki/decisions/decisions.jsonl, written once per dispatch).
     //