loki-mode 10.5.11 → 10.5.13

package/autonomy/loki

@@ -1280,7 +1280,7 @@ loki_remote_verify_receipt() {
     echo "    Proven: the receipt is internally consistent with its own hash."
     echo "    NOT proven: who produced it. An unsigned receipt is forgeable -- whoever"
     echo "    controls the builder can rewrite the facts and recompute the hash."
-    echo "    For provenance, the build must set LOKI_PROOF_GPG_KEY (docs/SIGNED-RECEIPTS.md)."
+    echo "    For provenance, sign the build (docs/SIGNED-RECEIPTS.md)."
     return 0
 }
 
@@ -9282,14 +9282,14 @@ _deploy_receipt_verdict() {
         printf '%s' "UNCHECKED"; return 0
     fi
 
-    local out hash_ok gpg_ok signed=0
+    local out hash_ok
     out="$(python3 -E "$verifier" "$pj" "${TARGET_DIR:-.}" 2>/dev/null || true)"
 
     # "The verifier did not RUN" and "the verifier says the hash is bad" are
     # different facts and must not collapse. If they do, a broken python3
     # produces the verdict TAMPERED -- an accusation of forgery for a check that
     # never executed. That is the same error the signed path is careful to avoid
-    # with NO_PUBKEY (see loki:852): it sends a user hunting a forgery that never
+    # with a missing key: it sends a user hunting a forgery that never
     # happened, and trains them to shrug at a real TAMPERED. Unparseable output
     # is UNCHECKED, which still REFUSES -- fail-closed, honestly labelled.
     if [ -z "$out" ] || ! printf '%s' "$out" | python3 -c 'import json,sys;json.load(sys.stdin)' >/dev/null 2>&1; then
@@ -9297,28 +9297,39 @@ _deploy_receipt_verdict() {
     fi
 
     hash_ok="$(printf '%s' "$out" | python3 -c 'import json,sys;print(str(json.load(sys.stdin).get("hash_ok",False)).lower())' 2>/dev/null || printf 'false')"
-    gpg_ok="$(printf '%s' "$out" | python3 -c 'import json,sys;print(str(json.load(sys.stdin).get("gpg_ok","n/a")).lower())' 2>/dev/null || printf 'n/a')"
-
-    # Whether the receipt CARRIES a signature is read from the receipt, never
-    # inferred from gpg_ok -- gpg_ok is "n/a" both for "no signature" and for
-    # "gpg missing here", and conflating those mislabels a signed receipt.
-    if python3 -c 'import json,sys;sys.exit(0 if (json.load(open(sys.argv[1])).get("verification") or {}).get("gpg_signature") else 1)' "$pj" 2>/dev/null; then
-        signed=1
-    fi
-
     if [ "$hash_ok" != "true" ]; then printf '%s' "TAMPERED"; return 0; fi
-    if [ "$signed" -eq 0 ]; then printf '%s' "UNSIGNED"; return 0; fi
-    case "$gpg_ok" in
-        true)  printf '%s' "VERIFIED" ;;
-        # Signed but the signature does not verify: contents or signature were
-        # altered. A missing PUBLIC KEY is a different fact (uncheckable, not an
-        # accusation), so it reports UNCHECKED -- which refuses here anyway.
-        false) if command -v gpg >/dev/null 2>&1 && [ "$(loki_remote_gpg_status "$pj")" = "nopubkey" ]; then
-                   printf '%s' "UNCHECKED"
-               else
-                   printf '%s' "TAMPERED"
-               fi ;;
-        *)     printf '%s' "UNCHECKED" ;;
+
+    # Provenance is the Ed25519 attestation, checked against the PUBLIC keys we
+    # hold: the local signing key plus LOKI_RECEIPT_RETIRED_PUBKEYS. A legacy
+    # gpg_signature is ignored: old receipts read UNSIGNED here. A token whose
+    # kid is not in that set (another machine, a rotated-away key) cannot be
+    # evaluated, so no key set is written and the verdict is UNCHECKED, never
+    # TAMPERED: the hash is fine, we just cannot vouch for who signed it. A
+    # local key only proves "a holder of this key", not an independent build.
+    local jwks att
+    jwks="$(mktemp "${TMPDIR:-/tmp}/loki-jwks.XXXXXX")" || { printf '%s' "UNCHECKED"; return 0; }
+    python3 -E - "${_LOKI_SCRIPT_DIR}" "$pj" >"$jwks" 2>/dev/null <<'PY' || true
+import sys, json
+sys.path[:] = [p for p in sys.path if p not in ("", ".")]
+sys.path.insert(0, sys.argv[1])
+from receipt_jwt import load_signing_key, load_retired_public_keys, build_jwks, _b64url_decode
+k, _ = load_signing_key(auto_generate=False)
+jwks = build_jwks(k, load_retired_public_keys())
+try:
+    tok = json.load(open(sys.argv[2]))["verification"]["attestation"]
+    kid = json.loads(_b64url_decode(tok.split(".")[0])).get("kid", "")
+except Exception:
+    kid = ""          # malformed or absent: let the checker decide (none / bad)
+if not kid or kid in [j.get("kid") for j in jwks["keys"]]:
+    print(json.dumps(jwks))
+PY
+    att="$(loki_proof_attestation_check "$pj" "$jwks")"
+    rm -f "$jwks"
+    case "$att" in
+        ok)   printf '%s' "VERIFIED" ;;
+        none) printf '%s' "UNSIGNED" ;;
+        bad)  printf '%s' "TAMPERED" ;;
+        *)    printf '%s' "UNCHECKED" ;;
     esac
     return 0
 }
@@ -9680,7 +9691,7 @@ _deploy_gate() {
         verdict="$(_deploy_receipt_verdict "$pj")"
         case "$verdict" in
             VERIFIED) : ;;
-            UNSIGNED)  reasons="${reasons}receipt is UNSIGNED: integrity holds but provenance is unproven (set LOKI_PROOF_GPG_KEY; docs/SIGNED-RECEIPTS.md)
+            UNSIGNED)  reasons="${reasons}receipt is UNSIGNED: integrity holds but provenance is unproven (docs/SIGNED-RECEIPTS.md)
 " ;;
             UNCHECKED) reasons="${reasons}receipt is UNCHECKED: its signature could not be evaluated here, so nothing was proven
 " ;;
@@ -9784,7 +9795,7 @@ cmd_deploy() {
                 echo "     file alone can opt in."
                 echo ""
                 echo "It FAILS CLOSED: if a check cannot be evaluated at all (no receipt,"
-                echo "gpg unavailable, anchor unresolvable, not a git repo), that is a"
+                echo "signing key or keys unavailable, anchor unresolvable, not a git repo), that is a"
                 echo "REFUSAL, not a pass. A refusal still prints the advisory command."
                 echo ""
                 echo "Hard limits, with or without --execute:"
@@ -13635,7 +13646,7 @@ cmd_doctor() {
         if ! command -v "$cmd" &> /dev/null; then
             if [ "$required" = "required" ]; then
                 echo -e "  ${RED}FAIL${NC}  $name - not found"
-                _doctor_block "$name is not installed"
+                _doctor_block "${name%% (*} is not installed"
                 fail_count=$((fail_count + 1))
             elif [ "$required" = "recommended" ]; then
                 echo -e "  ${YELLOW}WARN${NC}  $name - not found (recommended)"
@@ -13704,7 +13715,7 @@ cmd_doctor() {
                { [ "$cur_major" -eq "$min_major" ] 2>/dev/null && [ "$cur_minor" -lt "$min_minor" ] 2>/dev/null; }; then
                 if [ "$required" = "required" ]; then
                     echo -e "  ${RED}FAIL${NC}  $name$version_display - requires >= $min_version"
-                    _doctor_block "$name must be >= $min_version"
+                    _doctor_block "${name%% (*} must be >= $min_version"
                     fail_count=$((fail_count + 1))
                 else
                     echo -e "  ${YELLOW}WARN${NC}  $name$version_display - recommended >= $min_version"
@@ -13806,6 +13817,19 @@ cmd_doctor() {
     fi
     echo ""
 
+    # A-123: an EXPLICIT LOKI_PROVIDER names the CLI a build will launch, so that
+    # CLI is required even when another provider is installed. Auto-detection
+    # never reaches here: it only picks an installed provider. Bundled-SDK
+    # claude stays allowed. Mirrored in loki-ts/src/commands/doctor.ts.
+    if [ -n "${LOKI_PROVIDER:-}" ] && [ "$fail_count" -eq 0 ] \
+        && ! command -v "$LOKI_PROVIDER" >/dev/null 2>&1 \
+        && ! { [ "$LOKI_PROVIDER" = "claude" ] && [ "$_doctor_sdk_only" = "1" ]; }; then
+        _sel_install=$(doctor_provider_install_cmd "$LOKI_PROVIDER")
+        echo -e "  ${RED}FAIL${NC}  Selected provider '${LOKI_PROVIDER}' CLI not found"
+        _doctor_block "Selected provider ${LOKI_PROVIDER} CLI not found. Fix: ${_sel_install:-install ${LOKI_PROVIDER}, or unset LOKI_PROVIDER}"
+        fail_count=$((fail_count + 1))
+    fi
+
     # Provider Availability. Which provider a build would ACTUALLY pick, which
     # is decided by providers/loader.sh auto_detect_provider, not by PATH order
     # and not by the section above. Rendered by the shared helper in
@@ -14092,22 +14116,14 @@ except Exception:
         echo -e "  ${YELLOW}WARN${NC}  sentrux - not installed (optional, brew install sentrux/tap/sentrux)"
         warn_count=$((warn_count + 1))
     fi
-    # Evidence Receipt signing state (optional). Unsigned receipts are the
-    # default and are still checkable (hash + diff re-derivation); what they
-    # cannot prove is PROVENANCE, so proof-verify.py reports
-    # generator_trusted: true. Surface the state here because it is otherwise
-    # invisible until someone reads a receipt. WARN (never FAIL): unsigned is
-    # a supported, documented mode, not a broken install.
+    # Receipt signing: Ed25519, auto-generated on first run. WARN only, and
+    # only when something needs attention. Byte-mirrored in doctor.ts.
     if [ -n "${LOKI_PROOF_GPG_KEY:-}" ]; then
-        if command -v gpg &>/dev/null; then
-            echo -e "  ${GREEN}PASS${NC}  Receipt signing: LOKI_PROOF_GPG_KEY set and gpg available"
-            pass_count=$((pass_count + 1))
-        else
-            echo -e "  ${YELLOW}WARN${NC}  Receipt signing: LOKI_PROOF_GPG_KEY set but gpg NOT on PATH - receipts will be UNSIGNED"
-            warn_count=$((warn_count + 1))
-        fi
-    else
-        echo -e "  ${YELLOW}WARN${NC}  Receipt signing: UNSIGNED (set LOKI_PROOF_GPG_KEY to a gpg key id; see docs/SIGNED-RECEIPTS.md)"
+        echo -e "  ${YELLOW}WARN${NC}  Receipt signing: LOKI_PROOF_GPG_KEY is no longer supported and is ignored; use LOKI_RECEIPT_SIGNING_KEY or LOKI_RECEIPT_SIGNING_KEY_FILE (docs/SIGNED-RECEIPTS.md)"
+        warn_count=$((warn_count + 1))
+    fi
+    if ! python3 -c 'import cryptography' >/dev/null 2>&1; then
+        echo -e "  ${YELLOW}WARN${NC}  Receipt signing: python3 'cryptography' package missing, receipts will be UNSIGNED (pip install cryptography)"
         warn_count=$((warn_count + 1))
     fi
     echo ""
@@ -14394,6 +14410,8 @@ else:
             esac
             ( loki_emit_first_run_blocked "$_blk_key" >/dev/null 2>&1 </dev/null & ) 2>/dev/null || true
         fi
+        # A-123: the LAST line is the one blocking reason, exactly.
+        printf '%b' "$_doctor_blockers" | awk '/^  - /{sub(/^  - /,""); print; exit}'
         return 1
     elif [ "$warn_count" -gt 0 ]; then
         echo -e "${YELLOW}All required checks passed with some warnings.${NC}"
@@ -14416,6 +14434,46 @@ else:
         echo "Next: loki quickstart (guided first build from your idea, no PRD needed)"
         echo "      or loki demo (builds a sample todo app end to end) or loki start ./prd.md"
     fi
+    # A-123: the last stdout line. Provider and model come from the selected
+    # provider; the key state is read WITHOUT creating a key (auto_generate=False).
+    # Byte-mirrored in loki-ts/src/commands/doctor.ts.
+    local _rd_id _rd_model _rd_key _rd_state
+    _rd_id="${LOKI_PROVIDER:-}"
+    [ -n "$_rd_id" ] || _rd_id="$(effective_provider_id 2>/dev/null || true)"
+    [ -n "$_rd_id" ] || _rd_id="claude"
+    _rd_model="$(bash -c 'source "$1" >/dev/null 2>&1; printf %s "${PROVIDER_MODEL_DEVELOPMENT:-}"' _ "${_LOKI_SCRIPT_DIR}/../providers/${_rd_id}.sh" 2>/dev/null || true)"
+    [ -n "$_rd_model" ] || _rd_model="default"
+    _rd_key="$(python3 -E - "${_LOKI_SCRIPT_DIR}" 2>/dev/null <<'PY' || true
+import os, sys
+sys.path[:] = [p for p in sys.path if p not in ("", ".")]
+sys.path.insert(0, sys.argv[1])
+from receipt_jwt import load_signing_key, _CRYPTO_AVAILABLE
+if not _CRYPTO_AVAILABLE:
+    print("nocrypto")
+else:
+    k, kid = load_signing_key(auto_generate=False)
+    if kid:
+        print("kid " + kid[:8])
+    elif os.environ.get("LOKI_RECEIPT_SIGNING_KEY", "").strip():
+        print("bad")
+    else:
+        # A-122: a missing key FILE is auto-generated on first use when its nearest
+        # existing ancestor directory is writable; an existing file that did not
+        # load (corrupt/unreadable) or an unwritable location is unusable.
+        f = os.environ.get("LOKI_RECEIPT_SIGNING_KEY_FILE", "").strip() or os.path.expanduser("~/.loki/keys/receipt-ed25519.pem")
+        d = os.path.dirname(os.path.abspath(f))
+        while not os.path.isdir(d) and os.path.dirname(d) != d:
+            d = os.path.dirname(d)
+        print("bad" if os.path.lexists(f) or not os.access(d, os.W_OK | os.X_OK) else "none")
+PY
+)"
+    case "$_rd_key" in
+        "kid "*) _rd_state="receipts signed (${_rd_key})" ;;
+        none)    _rd_state="receipts will be signed on first run" ;;
+        bad)     _rd_state="receipts unsigned: signing key could not be loaded" ;;
+        *)       _rd_state="receipts unsigned: python3 cryptography package missing" ;;
+    esac
+    echo "Ready: ${_rd_id} (${_rd_model}), ${_rd_state}"
     # Best-effort stale-install nudge (stderr only; never blocks; off on
     # non-TTY/CI). Reached only on the human-readable path (--json returns above).
     maybe_print_update_hint
@@ -14523,23 +14581,6 @@ sentrux = {
     'required': 'optional'
 }
 
-# Evidence Receipt signing state. Unsigned is the DEFAULT and is a supported
-# mode, so this is never 'fail'. Exposed because signing state is otherwise
-# invisible until someone reads a receipt, and it is exactly what decides
-# whether proof-verify.py reports generator_trusted: true. Sibling of
-# checks/disk/sentrux -- deliberately NOT counted in the summary tally so
-# existing consumers see unchanged numbers.
-signing_key_set = bool(os.environ.get('LOKI_PROOF_GPG_KEY', '').strip())
-signing_gpg_available = shutil.which('gpg') is not None
-signing_enabled = signing_key_set and signing_gpg_available
-receipt_signing = {
-    'enabled': signing_enabled,
-    'key_configured': signing_key_set,
-    'gpg_available': signing_gpg_available,
-    'status': 'pass' if signing_enabled else 'warn',
-    'required': 'optional'
-}
-
 # v7.7.17: memory subsystem health surface. Reports the latest entries
 # from .loki/memory/.errors.log (rotated by memory/error_log.py) so
 # developers see regressions in the previously-silent-fail call sites
@@ -14731,7 +14772,6 @@ result = {
     'ai_provider': ai_provider,
     'skills': skills,
     'sentrux': sentrux,
-    'receipt_signing': receipt_signing,
     'memory': memory,
     'model_catalog': model_catalog,
     'summary': {
@@ -16280,10 +16320,12 @@ cmd_quick() {
             echo "  loki quick \"write unit tests for the API endpoints\""
             echo ""
             echo "Options:"
-            echo "  --help, -h    Show this help and exit"
+            echo "  --help, -h       Show this help and exit"
+            echo "  --verbose, -v    Show setup and progress output (same as LOKI_VERBOSE=1)"
             echo ""
             echo "Environment:"
             echo "  LOKI_MAX_ITERATIONS    Override the default 3-iteration cap"
+            echo "  LOKI_VERBOSE=1         Show setup and progress output (default is quiet)"
             echo ""
             echo "See also: loki start (full RARV cycle), loki run (alias for start)"
             return 0
@@ -16316,19 +16358,27 @@ cmd_quick() {
     # `--config f.env` would be swept into task_desc (cmd_quick has no arg loop).
     local _quick_args=()
     local _skip_next=false
-    local _qa
+    local _qa _quick_task_seen=false
     for _qa in "$@"; do
         if [ "$_skip_next" = "true" ]; then
             _skip_next=false
             continue
         fi
         case "$_qa" in
+            # A-134: --verbose/-v before the task text is a flag, never task text.
+            --verbose|-v) if [ "$_quick_task_seen" = "false" ]; then export LOKI_VERBOSE=1; continue; fi ;;
             --config|--vars|--env-file)        _skip_next=true; continue ;;
             --config=*|--vars=*|--env-file=*)   continue ;;
         esac
+        _quick_task_seen=true
         _quick_args+=("$_qa")
     done
     set -- "${_quick_args[@]+"${_quick_args[@]}"}"
+    if [ $# -eq 0 ]; then
+        echo -e "${RED}Error: No task description provided${NC}"
+        echo "Usage: loki quick [--verbose] \"description of what to do\""
+        exit 2
+    fi
 
     local task_desc="$*"
     local version=$(get_version)
@@ -36677,10 +36727,9 @@ cmd_proof() {
             echo ""
             echo "Proofs are generated automatically at run completion (LOKI_PROOF=0 to opt out)."
             echo ""
-            echo "Signing (off by default): receipts are UNSIGNED unless LOKI_PROOF_GPG_KEY is"
-            echo "set to a gpg key id. Unsigned, the integrity hash proves the bytes were not"
-            echo "edited after hashing but NOT who produced them, so verify reports"
-            echo "generator_trusted: true. Export LOKI_PROOF_GPG_KEY to close that gap."
+            echo "Signing: receipts are Ed25519-signed automatically (key auto-generated at"
+            echo "~/.loki/keys/receipt-ed25519.pem). To use your own key set"
+            echo "LOKI_RECEIPT_SIGNING_KEY or LOKI_RECEIPT_SIGNING_KEY_FILE."
             echo "See docs/SIGNED-RECEIPTS.md."
             [ "$sub" = "" ] && exit 1
             exit 0
@@ -37131,8 +37180,8 @@ print(json.dumps(json.load(open(os.environ['LOKI_PROOF_JSON'])), indent=2))
                         # verified. Exiting 0 here let a stripped signature pass
                         # any CI step that asked for provenance.
                         echo -e "${YELLOW}attestation: ABSENT -- this receipt carries no attestation.${NC}" >&2
-                        echo "  Nothing was checked against ${_pv_jwks}. The receipt may still be" >&2
-                        echo "  gpg-signed; this says only that it has no JWKS attestation." >&2
+                        echo "  Nothing was checked against ${_pv_jwks}. This says only that the" >&2
+                        echo "  receipt has no JWKS attestation." >&2
                         echo "  Not verified: a key set was supplied, but the receipt is unsigned (exit 1)." >&2
                         _pv_rc=1
                         _pv_attestation_field="ABSENT"

package/autonomy/receipt_jwt.py

@@ -1,8 +1,8 @@
 """Per-job receipt attestation: a signed JWT plus a public JWKS.
 
-WHY THIS EXISTS, given receipts are ALREADY gpg-signable.
+WHY THIS EXISTS, given old receipts could carry a gpg signature.
 
-`LOKI_PROOF_GPG_KEY` proves a receipt was produced by a holder of that gpg key,
+A gpg signature proves a receipt was produced by a holder of that gpg key,
 and for a LOCAL build that is the whole story: the operator already has the
 keyring. It does not survive the remote path. A submitter who ran
 `loki start --remote https://loki.corp` never had local access to the cluster,
@@ -114,13 +114,14 @@ def _load_private_key(pem_bytes: bytes):
     return key
 
 
-def load_signing_key():
+def load_signing_key(auto_generate=True):
     """Return (private_key, kid) from env or a mounted file, or (None, "").
 
-    Mirrors load_api_token's precedence deliberately: LOKI_RECEIPT_SIGNING_KEY
-    then LOKI_RECEIPT_SIGNING_KEY_FILE, the normal Kubernetes mounted-secret
-    path. Absence is NOT an error -- it is the default, and it means receipts
-    stay UNSIGNED exactly as they were before this module existed.
+    Precedence: LOKI_RECEIPT_SIGNING_KEY (inline PEM), then
+    LOKI_RECEIPT_SIGNING_KEY_FILE, then ~/.loki/keys/receipt-ed25519.pem. A
+    missing key FILE is generated (PKCS8, 0600, O_EXCL) so a first run signs
+    without setup unless auto_generate=False (the server path: an ephemeral
+    container key would orphan old receipts). The private key is never logged or printed.
     """
     if not _CRYPTO_AVAILABLE:
         return None, ""
@@ -129,21 +130,65 @@ def load_signing_key():
         key = _load_private_key(pem.encode("utf-8"))
     else:
         key_file = os.environ.get("LOKI_RECEIPT_SIGNING_KEY_FILE", "").strip()
-        if not key_file:
-            return None, ""
+        is_default = not key_file
+        if is_default:
+            key_file = str(Path.home() / ".loki" / "keys" / "receipt-ed25519.pem")
         try:
-            key = _load_private_key(Path(key_file).read_bytes())
+            try:
+                data = Path(key_file).read_bytes()
+                if is_default:  # never chmod an operator's key: it may be a :ro mount
+                    _tighten(key_file)
+            except FileNotFoundError:
+                if not auto_generate:
+                    return None, ""
+                data = _create_key_file(key_file)
+                logging.info("receipt signing: auto-generated local key at %s", key_file)
+            key = _load_private_key(data)
         except OSError as e:
-            logging.error(
-                "receipt signing: cannot read LOKI_RECEIPT_SIGNING_KEY_FILE %s: %s",
-                key_file, e,
-            )
+            logging.error("receipt signing: cannot use key file %s: %s", key_file, e)
             return None, ""
     if key is None:
         return None, ""
     return key, compute_kid(key.public_key())
 
 
+def _tighten(path: str) -> None:
+    """Drop group/other access on an existing key file and its directory."""
+    # best effort: a failed chmod must never downgrade signing
+    try:
+        if os.stat(path).st_mode & 0o077:
+            os.chmod(path, 0o600)
+        d = os.path.dirname(path)
+        if os.stat(d).st_mode & 0o077:
+            os.chmod(d, 0o700)
+    except OSError as e:
+        logging.warning("receipt signing: could not tighten %s: %s", path, e)
+
+
+def _create_key_file(path: str) -> bytes:
+    """Create the key 0600, published atomically via link(); a concurrent first run reads the winner's file."""
+    pem = Ed25519PrivateKey.generate().private_bytes(
+        encoding=serialization.Encoding.PEM,
+        format=serialization.PrivateFormat.PKCS8,
+        encryption_algorithm=serialization.NoEncryption(),
+    )
+    d = os.path.dirname(path) or "."
+    if d.endswith(os.path.join(".loki", "keys")):
+        os.makedirs(os.path.dirname(d), mode=0o700, exist_ok=True)
+    os.makedirs(d, mode=0o700, exist_ok=True)
+    tmp = "%s.%d.tmp" % (path, os.getpid())
+    fd = os.open(tmp, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
+    try:
+        with os.fdopen(fd, "wb") as f:
+            f.write(pem)
+        os.link(tmp, path)  # atomic and fails if a concurrent run won
+    except FileExistsError:
+        return Path(path).read_bytes()
+    finally:
+        os.unlink(tmp)
+    return pem
+
+
 def load_retired_public_keys():
     """Public keys that must stay in JWKS so OLD receipts still verify.