loki-mode 10.6.11 → 10.6.12

package/dashboard/server.py

@@ -108,6 +108,20 @@ def _safe_json_read(path: _Path, default: Any = None) -> Any:
     return default
 
 
+def _read_json_or_503(path: _Path, what: str) -> Any:
+    """Read JSON; a missing file is the caller's empty case, anything else is a 503.
+
+    An unreadable (denied) or corrupt file must never read as "no data": the
+    caller would render an empty list as a healthy empty store.
+    """
+    try:
+        return json.loads(path.read_text(encoding="utf-8", errors="replace"))
+    except FileNotFoundError:
+        raise
+    except (OSError, ValueError) as e:
+        raise HTTPException(status_code=503, detail=f"{what} unreadable: {type(e).__name__}")
+
+
 def _safe_read_text(path: _Path) -> str:
     """Read a text file with UTF-8 encoding, replacing non-UTF-8 bytes.
 
@@ -1039,7 +1053,9 @@ async def _push_loki_state_loop() -> None:
                                     "complexity": _sk_complexity,
                                     "mode": "autonomous",
                                     "provider": _sd.get("provider", "claude"),
-                                    "running_agents": 0,
+                                    # Unmeasured: no skill-session file counts
+                                    # agents, so send null, never a claimed 0.
+                                    "running_agents": None,
                                     "pending_tasks": _sk_pending,
                                     "current_task": _sk_current_task,
                                     "version": _sk_version,
@@ -6431,8 +6447,8 @@ async def list_episodes(limit: int = Query(default=50, ge=1, le=1000)):
         if ep_dir.exists():
             for f in _memory_episode_files(ep_dir):
                 try:
-                    loaded.append(json.loads(f.read_text()))
-                except Exception:
+                    loaded.append(_read_json_or_503(f, "episode"))
+                except FileNotFoundError:
                     pass
         loaded.sort(key=lambda e: e.get("timestamp", "") if isinstance(e, dict) else "", reverse=True)
         return loaded[:limit]
@@ -6492,13 +6508,11 @@ async def list_patterns():
     # Fallback to JSON
     sem_dir = _get_loki_dir() / "memory" / "semantic"
     patterns_file = sem_dir / "patterns.json"
-    if patterns_file.exists():
-        try:
-            data = json.loads(patterns_file.read_text())
-            return data if isinstance(data, list) else data.get("patterns", [])
-        except Exception:
-            pass
-    return []
+    try:
+        data = _read_json_or_503(patterns_file, "patterns")
+    except FileNotFoundError:
+        return []
+    return data if isinstance(data, list) else data.get("patterns", [])
 
 
 @app.get("/api/memory/patterns/{pattern_id}", dependencies=[Depends(auth.require_scope("read"))])
@@ -6537,8 +6551,8 @@ async def list_skills():
         if skills_dir.exists():
             for f in _memory_skill_files(skills_dir):
                 try:
-                    skills.append(json.loads(f.read_text()))
-                except Exception:
+                    skills.append(_read_json_or_503(f, "skill"))
+                except FileNotFoundError:
                     pass
         return skills
 
@@ -6749,12 +6763,10 @@ async def retrieve_memory(query: dict = None):
 async def get_memory_index():
     """Get memory index (Layer 1 - lightweight discovery)."""
     index_file = _get_loki_dir() / "memory" / "index.json"
-    if index_file.exists():
-        try:
-            return json.loads(index_file.read_text())
-        except Exception:
-            pass
-    return {"topics": [], "lastUpdated": None}
+    try:
+        return _read_json_or_503(index_file, "memory index")
+    except FileNotFoundError:
+        return {"topics": [], "lastUpdated": None}
 
 
 @app.get("/api/memory/timeline", dependencies=[Depends(auth.require_scope("read"))])
@@ -8985,7 +8997,8 @@ async def get_notification_triggers():
     try:
         return json.loads(triggers_file.read_text())
     except (json.JSONDecodeError, OSError):
-        return {"triggers": []}
+        # Unreadable is unknown, not empty: null plus an error, never [].
+        return {"triggers": None, "error": "triggers.json unreadable"}
 
 
 @app.put("/api/notifications/triggers", dependencies=[Depends(auth.require_scope("control"))])
@@ -12568,16 +12581,24 @@ async def list_proofs():
     items: list[dict] = []
     try:
         entries = sorted(proofs_dir.iterdir())
-    except (OSError, FileNotFoundError):
+    except FileNotFoundError:
         return {"proofs": []}
+    except OSError as e:
+        raise HTTPException(status_code=503, detail=f"proofs unreadable: {type(e).__name__}")
     for entry in entries:
         if not entry.is_dir():
             continue
         proof_json = entry / "proof.json"
         if not proof_json.is_file():
             continue
-        data = _safe_json_read(proof_json, default=None)
+        try:
+            data = _read_json_or_503(proof_json, "proof")
+        except HTTPException as e:
+            # One bad receipt is an error row, never a silently dropped run.
+            items.append({"run_id": entry.name, "error": e.detail})
+            continue
         if not isinstance(data, dict):
+            items.append({"run_id": entry.name, "error": "proof unreadable: not an object"})
             continue
         # Deterministic honesty headline (single source of truth, same access as
         # proofs_summary's bucketing). Read, never recomputed. The list endpoint

package/dashboard/static/index.html

@@ -8974,7 +8974,7 @@ var LokiDashboard=(()=>{var Le=Object.defineProperty;var kt=Object.getOwnPropert
 
         ${e}
       </div>
-    `,this.shadowRoot.querySelectorAll(".tab").forEach(t=>{t.addEventListener("click",()=>{this._setTab(t.dataset.tab)})})}};customElements.get("loki-context-tracker")||customElements.define("loki-context-tracker",de);var Je={critical:"var(--loki-red, #ef4444)",warning:"var(--loki-yellow, #eab308)",info:"var(--loki-blue, #3b82f6)",success:"var(--loki-green, #1FC5A8)"},ot={build:{label:"Build",icon:"B"},quality:{label:"Quality",icon:"Q"},system:{label:"System",icon:"S"},security:{label:"Security",icon:"!"}},ce=class extends v{static get observedAttributes(){return["api-url","theme"]}constructor(){super(),this._notifications=[],this._triggers=[],this._summary=null,this._connected=!1,this._loadFailed=!1,this._activeTab="feed",this._categoryFilter="all",this._panelOpen=!0,this._pollInterval=null}connectedCallback(){super.connectedCallback(),this._loadNotifications(),this._loadTriggers(),this._startPolling()}disconnectedCallback(){super.disconnectedCallback(),this._stopPolling()}attributeChangedCallback(e,t,i){t!==i&&(e==="api-url"&&(this._loadNotifications(),this._loadTriggers()),e==="theme"&&this._applyTheme())}async _loadNotifications(){try{let e=this.getAttribute("api-url")||window.location.origin,t=await fetch(e+"/api/notifications");if(t.ok){let i=await t.json();i.error?this._markLoadFailed():(this._notifications=i.notifications||[],this._summary=i.summary||null,this._connected=!0,this._loadFailed=!1)}else this._markLoadFailed()}catch{this._markLoadFailed()}this.render()}_markLoadFailed(){this._connected=!1,this._loadFailed=!0,this._summary=null}async _loadTriggers(){try{let e=this.getAttribute("api-url")||window.location.origin,t=await fetch(e+"/api/notifications/triggers");if(t.ok){let i=await t.json();this._triggers=i.triggers||[]}}catch{}}async _acknowledgeNotification(e){let t=this.getAttribute("api-url")||window.location.origin;try{await fetch(t+"/api/notifications/"+encodeURIComponent(e)+"/acknowledge",{method:"POST"})}catch{}this._loadNotifications()}async _unacknowledgeNotification(e){let t=this.getAttribute("api-url")||window.location.origin;await fetch(t+"/api/notifications/"+encodeURIComponent(e)+"/unacknowledge",{method:"POST"}),this._loadNotifications()}async _acknowledgeAll(){let e=this.getAttribute("api-url")||window.location.origin,t=this._notifications.filter(i=>!i.acknowledged);for(let i of t)await fetch(e+"/api/notifications/"+encodeURIComponent(i.id)+"/acknowledge",{method:"POST"});this._loadNotifications()}async _toggleTrigger(e,t){let i=this.getAttribute("api-url")||window.location.origin,a=this._triggers.map(s=>s.id===e?{...s,enabled:t}:s);await fetch(i+"/api/notifications/triggers",{method:"PUT",headers:{"Content-Type":"application/json"},body:JSON.stringify({triggers:a})}),this._triggers=a,this.render()}_startPolling(){this._poll=b({loadFn:()=>{this._loadNotifications(),this._loadTriggers()},intervalMs:5e3,element:this,immediate:!1})}_stopPolling(){this._poll&&(this._poll.stop(),this._poll=null)}_formatTime(e){if(!e)return"";try{let t=new Date(e),a=new Date-t,s=Math.floor(a/1e3),r=Math.floor(s/60),o=Math.floor(r/60),n=Math.floor(o/24);return s<60?s+"s ago":r<60?r+"m ago":o<24?o+"h ago":n<7?n+"d ago":t.toLocaleDateString()}catch{return String(e)}}_getTimeGroup(e){if(!e)return"Other";try{let t=new Date(e),i=new Date,a=new Date(i.getFullYear(),i.getMonth(),i.getDate()),s=new Date(a);s.setDate(s.getDate()-1);let r=new Date(a);return r.setDate(r.getDate()-7),t>=a?"Today":t>=s?"Yesterday":t>=r?"This Week":"Earlier"}catch{return"Other"}}_escapeHTML(e){return e?String(e).replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;"):""}_getSeverityColor(e){return Je[e]||Je.info}_getCategory(e){return e.category||e.type||"system"}_switchTab(e){this._activeTab=e,this.render()}_setCategoryFilter(e){this._categoryFilter=e,this.render()}_togglePanel(){this._panelOpen=!this._panelOpen,this.render()}_bindEvents(){let e=this.shadowRoot;e.querySelectorAll(".tab").forEach(a=>{a.addEventListener("click",()=>{this._switchTab(a.dataset.tab)})}),e.querySelectorAll(".cat-btn").forEach(a=>{a.addEventListener("click",()=>{this._setCategoryFilter(a.dataset.cat)})}),e.querySelectorAll(".ack-btn").forEach(a=>{a.addEventListener("click",s=>{s.stopPropagation(),this._acknowledgeNotification(a.dataset.id)})}),e.querySelectorAll(".unread-btn").forEach(a=>{a.addEventListener("click",s=>{s.stopPropagation(),this._unacknowledgeNotification(a.dataset.id)})});let t=e.querySelector(".ack-all-btn");t&&t.addEventListener("click",()=>{this._acknowledgeAll()});let i=e.querySelector(".bell-icon");i&&i.addEventListener("click",()=>{this._togglePanel()}),e.querySelectorAll(".toggle input").forEach(a=>{a.addEventListener("change",()=>{this._toggleTrigger(a.dataset.triggerId,a.checked)})}),e.querySelectorAll(".dismiss-btn").forEach(a=>{a.addEventListener("click",s=>{s.stopPropagation(),this._acknowledgeNotification(a.dataset.id)})})}_renderBellIcon(){let e=this._summary?.unacknowledged;return`
+    `,this.shadowRoot.querySelectorAll(".tab").forEach(t=>{t.addEventListener("click",()=>{this._setTab(t.dataset.tab)})})}};customElements.get("loki-context-tracker")||customElements.define("loki-context-tracker",de);var Je={critical:"var(--loki-red, #ef4444)",warning:"var(--loki-yellow, #eab308)",info:"var(--loki-blue, #3b82f6)",success:"var(--loki-green, #1FC5A8)"},ot={build:{label:"Build",icon:"B"},quality:{label:"Quality",icon:"Q"},system:{label:"System",icon:"S"},security:{label:"Security",icon:"!"}},ce=class extends v{static get observedAttributes(){return["api-url","theme"]}constructor(){super(),this._notifications=[],this._triggers=[],this._triggersFailed=!1,this._summary=null,this._connected=!1,this._loadFailed=!1,this._activeTab="feed",this._categoryFilter="all",this._panelOpen=!0,this._pollInterval=null}connectedCallback(){super.connectedCallback(),this._loadNotifications(),this._loadTriggers(),this._startPolling()}disconnectedCallback(){super.disconnectedCallback(),this._stopPolling()}attributeChangedCallback(e,t,i){t!==i&&(e==="api-url"&&(this._loadNotifications(),this._loadTriggers()),e==="theme"&&this._applyTheme())}async _loadNotifications(){try{let e=this.getAttribute("api-url")||window.location.origin,t=await fetch(e+"/api/notifications");if(t.ok){let i=await t.json();i.error?this._markLoadFailed():(this._notifications=i.notifications||[],this._summary=i.summary||null,this._connected=!0,this._loadFailed=!1)}else this._markLoadFailed()}catch{this._markLoadFailed()}this.render()}_markLoadFailed(){this._connected=!1,this._loadFailed=!0,this._summary=null}async _loadTriggers(){try{let e=this.getAttribute("api-url")||window.location.origin,t=await fetch(e+"/api/notifications/triggers");if(t.ok){let i=await t.json();i.error||i.triggers==null?this._triggersFailed=!0:(this._triggers=i.triggers,this._triggersFailed=!1)}else this._triggersFailed=!0}catch{this._triggersFailed=!0}}async _acknowledgeNotification(e){let t=this.getAttribute("api-url")||window.location.origin;try{await fetch(t+"/api/notifications/"+encodeURIComponent(e)+"/acknowledge",{method:"POST"})}catch{}this._loadNotifications()}async _unacknowledgeNotification(e){let t=this.getAttribute("api-url")||window.location.origin;await fetch(t+"/api/notifications/"+encodeURIComponent(e)+"/unacknowledge",{method:"POST"}),this._loadNotifications()}async _acknowledgeAll(){let e=this.getAttribute("api-url")||window.location.origin,t=this._notifications.filter(i=>!i.acknowledged);for(let i of t)await fetch(e+"/api/notifications/"+encodeURIComponent(i.id)+"/acknowledge",{method:"POST"});this._loadNotifications()}async _toggleTrigger(e,t){let i=this.getAttribute("api-url")||window.location.origin,a=this._triggers.map(s=>s.id===e?{...s,enabled:t}:s);await fetch(i+"/api/notifications/triggers",{method:"PUT",headers:{"Content-Type":"application/json"},body:JSON.stringify({triggers:a})}),this._triggers=a,this.render()}_startPolling(){this._poll=b({loadFn:()=>{this._loadNotifications(),this._loadTriggers()},intervalMs:5e3,element:this,immediate:!1})}_stopPolling(){this._poll&&(this._poll.stop(),this._poll=null)}_formatTime(e){if(!e)return"";try{let t=new Date(e),a=new Date-t,s=Math.floor(a/1e3),r=Math.floor(s/60),o=Math.floor(r/60),n=Math.floor(o/24);return s<60?s+"s ago":r<60?r+"m ago":o<24?o+"h ago":n<7?n+"d ago":t.toLocaleDateString()}catch{return String(e)}}_getTimeGroup(e){if(!e)return"Other";try{let t=new Date(e),i=new Date,a=new Date(i.getFullYear(),i.getMonth(),i.getDate()),s=new Date(a);s.setDate(s.getDate()-1);let r=new Date(a);return r.setDate(r.getDate()-7),t>=a?"Today":t>=s?"Yesterday":t>=r?"This Week":"Earlier"}catch{return"Other"}}_escapeHTML(e){return e?String(e).replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;"):""}_getSeverityColor(e){return Je[e]||Je.info}_getCategory(e){return e.category||e.type||"system"}_switchTab(e){this._activeTab=e,this.render()}_setCategoryFilter(e){this._categoryFilter=e,this.render()}_togglePanel(){this._panelOpen=!this._panelOpen,this.render()}_bindEvents(){let e=this.shadowRoot;e.querySelectorAll(".tab").forEach(a=>{a.addEventListener("click",()=>{this._switchTab(a.dataset.tab)})}),e.querySelectorAll(".cat-btn").forEach(a=>{a.addEventListener("click",()=>{this._setCategoryFilter(a.dataset.cat)})}),e.querySelectorAll(".ack-btn").forEach(a=>{a.addEventListener("click",s=>{s.stopPropagation(),this._acknowledgeNotification(a.dataset.id)})}),e.querySelectorAll(".unread-btn").forEach(a=>{a.addEventListener("click",s=>{s.stopPropagation(),this._unacknowledgeNotification(a.dataset.id)})});let t=e.querySelector(".ack-all-btn");t&&t.addEventListener("click",()=>{this._acknowledgeAll()});let i=e.querySelector(".bell-icon");i&&i.addEventListener("click",()=>{this._togglePanel()}),e.querySelectorAll(".toggle input").forEach(a=>{a.addEventListener("change",()=>{this._toggleTrigger(a.dataset.triggerId,a.checked)})}),e.querySelectorAll(".dismiss-btn").forEach(a=>{a.addEventListener("click",s=>{s.stopPropagation(),this._acknowledgeNotification(a.dataset.id)})})}_renderBellIcon(){let e=this._summary?.unacknowledged;return`
       <div class="bell-container">
         <button class="bell-icon" title="${e!=null?`${e} unread notifications`:"Unread count unknown"}">
           <svg width="18" height="18" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
@@ -9020,7 +9020,7 @@ var LokiDashboard=(()=>{var Le=Object.defineProperty;var kt=Object.getOwnPropert
               <button class="dismiss-btn" data-id="${this._escapeHTML(r.id)}" title="Dismiss">&#10005;</button>
             </span>
           </div>
-        `}).join(""));return a}_renderTriggerList(){return this._triggers.length===0?'<div class="empty-state">No triggers configured</div>':this._triggers.map(e=>{let t=this._getSeverityColor(e.severity),i=e.threshold_pct!=null?`Threshold: ${e.threshold_pct}%`:e.pattern||"";return`
+        `}).join(""));return a}_renderTriggerList(){return this._triggersFailed&&this._triggers.length===0?'<div class="empty-state">Could not load triggers</div>':this._triggers.length===0?'<div class="empty-state">No triggers configured</div>':this._triggers.map(e=>{let t=this._getSeverityColor(e.severity),i=e.threshold_pct!=null?`Threshold: ${e.threshold_pct}%`:e.pattern||"";return`
         <div class="trigger-row">
           <label class="toggle">
             <input type="checkbox" data-trigger-id="${this._escapeHTML(e.id)}" ${e.enabled?"checked":""}>
@@ -15184,7 +15184,8 @@ document.addEventListener('DOMContentLoaded', function() {
             var files = (x.files_changed === null || x.files_changed === undefined)
               ? '-' : String(x.files_changed);
             var cost = (x.cost_usd === null || x.cost_usd === undefined)
-              ? '-' : ('$' + Number(x.cost_usd).toFixed(2));
+              ? '-' : ((x.cost_partial === true ? 'at least ' : '')
+                       + '$' + Number(x.cost_usd).toFixed(2));
             var when = x.generated_at ? String(x.generated_at).slice(0, 16).replace('T', ' ') : '-';
             var link = x.has_html
               ? ('<a href="/api/proofs/' + encodeURIComponent(x.run_id || '') + '/html"'

package/dashboard/static/proofs.html

@@ -147,6 +147,11 @@
     for (var i = 0; i < proofs.length; i++) {
       var p = proofs[i];
       var rid = esc(p.run_id);
+      if (p.error) {
+        rows += '<div class="row"><div class="top"><span class="rid">' + rid +
+          '</span><span class="ts">Could not read this proof: ' + esc(p.error) + "</span></div></div>";
+        continue;
+      }
       var usd = (p.cost_usd !== null && p.cost_usd !== undefined) ? atLeastUsd(p.cost_usd, p.cost_partial) : "";
       var fc = (p.files_changed !== null && p.files_changed !== undefined) ? (p.files_changed + " files") : "";
       var verdict = p.final_verdict ? '<span class="badge ' + badgeClass(p.final_verdict) + '" title="Recorded council vote, not a verification result">council ' + esc(p.final_verdict) + "</span>" : "";

package/dashboard/static/start.html

@@ -48,6 +48,8 @@ table{width:100%;border-collapse:collapse}th,td{text-align:left;padding:6px 8px;
 <button class="sec" id="refresh">Refresh</button><span class="mut" id="conc"></span></div>
 <table><thead><tr><th></th><th>#</th><th>Issue</th><th>Size</th><th>Status</th></tr></thead><tbody id="rows"></tbody></table>
 <div id="bl-msg"></div></section>
+<section class="card" id="ws"><h2>Workspace runs</h2>
+<div id="ws-body" class="mut">Loading...</div></section>
 </main>
 <script>
 const $=id=>document.getElementById(id);
@@ -86,6 +88,35 @@ function render(){
     tr.appendChild(sc);tb.appendChild(tr)})}
 async function poll(){try{const s=await api('GET','/api/backlog/status');status={};s.issues.forEach(i=>status[i.number]=i);
   $('conc').textContent='concurrency '+s.concurrency;if(issues.length)render()}catch(e){}}
+async function loadWorkspaceRuns(){
+  const b=$('ws-body');
+  let r;
+  try{r=await api('GET','/api/operator/workspaces/runs')}
+  catch(e){b.replaceChildren(el('div','Could not load workspace runs: '+e.message,'bad'));return}
+  const runs=Array.isArray(r&&r.runs)?r.runs:null;
+  if(!runs){b.replaceChildren(el('div','Could not load workspace runs: unexpected response','bad'));return}
+  if(!runs.length){b.replaceChildren(el('div','No runs'+(r.reason?' ('+r.reason+')':''),'mut'));return}
+  const t=el('table');
+  t.appendChild(el('thead')).appendChild(el('tr')).append(el('th','Run'),el('th','Repo'),el('th','Status'),el('th','Freshness'));
+  const tb=el('tbody');
+  runs.forEach(run=>{
+    const id=(run.workspace||'?')+'/'+(run.run_id||'?');
+    if(run.state==='unreadable'){
+      const tr=el('tr');tr.appendChild(el('td',id));
+      const td=el('td','Unreadable run: '+(run.error||'unknown error'),'bad');td.colSpan=3;tr.appendChild(td);tb.appendChild(tr);return}
+    const oc=run.outcomes&&typeof run.outcomes==='object'?run.outcomes:{};
+    (run.repos||[]).forEach(rp=>{
+      const rs=oc[rp.repo]==null?'':String(oc[rp.repo]);
+      const tr=el('tr');tr.appendChild(el('td',id));tr.appendChild(el('td',rp.repo||'?'));
+      tr.appendChild(el('td',rs||'-','st '+(rs.startsWith('ok')?'ok':rs?'bad':'')));
+      const f=el('td');
+      if(rp.stale===true)f.appendChild(el('span','stale','tag bad'));
+      else if(rp.stale==null&&rp.reason)f.appendChild(el('span',rp.reason,'mut'));
+      tr.appendChild(f);tb.appendChild(tr)});
+    const ig=run.status==null?'':String(run.status);
+    const tr=el('tr');tr.appendChild(el('td',id));tr.appendChild(el('td','integration','mut'));
+    const sc=el('td');sc.appendChild(el('span',ig||'-','st '+(ig||'')));tr.appendChild(sc);tr.appendChild(el('td'));tb.appendChild(tr)});
+  t.appendChild(tb);b.replaceChildren(t)}
 async function go(btn,msg,fn){btn.disabled=true;try{await fn();say(msg,'Done')}catch(e){say(msg,e.message,1)}btn.disabled=false;await state()}
 $('s1-go').onclick=e=>go(e.target,'s1-msg',async()=>{await api('POST','/api/onboarding/provider',{provider:$('prov').value,api_key:$('key').value||null});$('key').value=''});
 $('s2-go').onclick=e=>go(e.target,'s2-msg',async()=>{await api('POST','/api/onboarding/github',{token:$('pat').value});$('pat').value=''});
@@ -94,7 +125,7 @@ $('sel').onclick=e=>go(e.target,'bl-msg',async()=>{const n=[...document.querySel
   if(!n.length)throw new Error('Select at least one issue');await api('POST','/api/backlog/run',{issues:n});await poll()});
 $('all').onclick=e=>go(e.target,'bl-msg',async()=>{await api('POST','/api/backlog/run',{all:true});await poll()});
 $('refresh').onclick=loadIssues;
-state();setInterval(poll,3000);
+state();loadWorkspaceRuns();setInterval(poll,3000);
 </script>
 </body>
 </html>

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 The flagship product of [Autonomi](https://www.autonomi.dev/). Loki Mode is a spec-driven autonomous builder with a built-in trust layer that takes any spec to a deployed product and verifies completion with evidence (quality gates plus a completion council), not just a "done" claim. Complete installation instructions for all platforms and use cases.
 
-**Version:** v10.6.11
+**Version:** v10.6.12
 
 **Engine note:** `loki "<task>"`, `loki owner/repo#N` and `loki quick` run the Loki 10 engine. `loki start` still routes to the legacy engine, which is being removed (planned work resumes 2026-10-07); prefer `loki owner/repo#N`. See [docs/v10/GUIDE.md](v10/GUIDE.md).
 

package/docs/SIGNED-RECEIPTS.md

@@ -99,6 +99,45 @@ is required rather than optional: with a single unlabeled key, the first
 rotation would make every previously-issued receipt fail verification -- and a
 receipt that stops verifying is indistinguishable from a tampered one.
 
+### Export as an in-toto Statement (DSSE)
+
+`loki verify <run-id> --export-dsse > receipt.dsse.json` prints a verified v10
+receipt as an in-toto Statement v1 (`_type` `https://in-toto.io/Statement/v1`)
+inside a DSSE envelope (`payloadType` `application/vnd.in-toto+json`). The
+subject is the commit and tree the receipt covers (`gitCommit`, `gitTree`), the
+`predicateType` is `https://autonomi.dev/loki/receipt/v10`, and the predicate is
+the receipt body unchanged. It is signed with the same Ed25519 receipt key (the
+`keyid` is the receipt `kid`) over the DSSE PAE bytes, so any DSSE verifier given
+the public key (`loki keys export`) can check it. `loki verify receipt.dsse.json`
+accepts the envelope too (add `--pubkey FILE` on another machine).
+
+Export rules:
+
+- Only a receipt that verifies AND whose run outcome is `VERIFIED` or
+  `ALREADY_SATISFIED` is exported. A tampered, unsigned, unchecked or
+  failed-run receipt is refused: non-zero exit, empty stdout, reason on stderr.
+  Exit codes: 1 tampered, 2 unsigned or unchecked (also an unreadable or non-JSON
+  receipt), 4 verified receipt of a run whose outcome is not `VERIFIED` or
+  `ALREADY_SATISFIED`, 66 no signing key found.
+- The input must be a receipt, not an envelope: `--export-dsse` on a DSSE envelope
+  exits 1 ("the input is already a DSSE envelope"). When the receipt is found by
+  run id, an envelope under that id whose `predicate.run_id` differs is refused
+  with exit 1 before export.
+- Group (multi-repo) receipts export too: the single-read override applies only
+  to the top-level receipt path, so each sub-receipt is read from its own file.
+- The receipt file is read once; the bytes that were verified are the bytes signed.
+- After a key rotation the envelope is signed by the current key and its `keyid`
+  is that key (the retired private key is not available); the predicate keeps the
+  receipt's own `verification.kid`, and `loki verify` checks it against the active
+  plus `LOKI_RECEIPT_RETIRED_PUBKEYS` keys. The export prints a note when the two differ.
+- Verification uses a threshold of one: a single good signature whose keyid is
+  known verifies the envelope. If no signature has a known keyid the result is
+  UNCHECKED (exit 2), however many signatures there are; a known key with a bad
+  signature is TAMPERED (exit 1).
+- An envelope found by run id (`.loki/runs/<run-id>/receipt.json`) must carry
+  `predicate.run_id` equal to that run id, otherwise exit 1. Verifying an explicit
+  file path does not apply this check.
+
 ### In a Kubernetes cluster
 
 The Helm chart wires this for you. Generate a key and pass it as a file:

package/docs/UNREACHABLE-TESTS.md

@@ -35,7 +35,7 @@ Run the relevant `tests/integration/` script locally with real credentials in a
 
 **Manual procedure that closes the gap:**
 
-Install on a Windows host with WSL2 + Ubuntu, run `loki doctor` and the smoke commands, file an issue with the output. Document any divergence in `docs/PLATFORM-SUPPORT.md` (file does not exist yet -- create it on first finding).
+Install on a Windows host with WSL2 + Ubuntu, run `loki doctor` and the smoke commands, file an issue with the output. Document any divergence in the issue, and see `docs/INSTALLATION.md` and `docs/alternative-installations.md` for supported install paths.
 
 **Partial substitute we ship:**
 

package/docs/WORKSPACES.md

@@ -33,4 +33,18 @@ loki workspace status <run-id>
 - Evidence is written to `.loki/workspaces/<name>/<run-id>/integration.json`: head SHA per repo, exit code, log sha256. It is not part of the Seal.
 - Without `path`, a repo is cloned to `~/.loki/repos/owner__name`.
 - After the integration step, a PR comment is posted on each repo PR that exists for its run branch, showing the integration status (PASSED, FAILED, TIMEOUT or NOT CONFIGURED) and every head SHA. It uses your own `gh` login or GH_TOKEN, skips silently when there is no PR, never fails the run, and is disabled with `LOKI_WORKSPACE_COMMENT=0`.
+- Metrics: each run records `timing` (per repo `started_at` and `finished_at`, epoch seconds) in integration.json. `python3 autonomy/lib/workspace_metrics.py <run-dir> --attention-min 30` prints `prs` (repos with outcome ok), `wall_clock_seconds` (earliest start to latest finish), `prs_per_hour` and `prs_per_attention_minute`. Runs recorded before timing existed, and any run where `--attention-min` is not given, print `unmeasured` for the affected rate, never zero.
+- Verify a run: see "Verify a workspace run" below.
 - Backlog (`loki backlog`) and dashboard starts now share the workspace worktree prep: a per-repo lock, a clean start point and copied dependencies. `LOKI_WORKSPACES=0` restores the previous worktree creation (D51-B05, D51-B06).
+
+## Verify a workspace run
+
+After `loki workspace run <name> <ref>` finishes, check the evidence rather than trusting the exit code alone:
+
+1. Exit code: 0 means every repo succeeded and integration did not fail; 3 means only budget stops; 1 is any other failure.
+2. `loki workspace status` prints one row per repo and the integration status for each recorded run.
+3. `.loki/workspaces/<name>/<run-id>/integration.json` holds `status`, the head SHA per repo and `timing`.
+4. `python3 autonomy/lib/workspace_metrics.py <run-dir> --attention-min <minutes>` prints `prs`, `prs_per_hour` and `prs_per_attention_minute`; any value it cannot measure prints `unmeasured`.
+5. Each repo PR for the run branch carries exactly one integration comment.
+
+`tests/workspace/99-e2e.sh` runs this whole check through both `autonomy/loki` and `bin/loki` with a stub launcher and a stub `gh`.

package/docs/audit-logging.md

@@ -304,6 +304,19 @@ if not result['valid']:
     print(f"First tampered line: {result['first_tampered_line']}")
 ```
 
+You can also verify a whole audit directory from the command line:
+
+```bash
+python3 dashboard/audit.py verify ~/.loki/dashboard/audit
+```
+
+It prints one JSON object and exits 0 for a verified chain, 1 for a tampered
+chain, and 2 on a usage error or when it checked nothing (a missing or empty
+directory, or only files with no integrity hashes; the JSON then carries
+`"status": "nothing_checked"`). Nothing checked is not a verified chain.
+`python3 dashboard/audit.py tip <dir>` is unchanged and still exits 0 on an
+empty chain.
+
 ### Disabling Chain Hashing
 
 ```bash

package/docs/dev/release-checklist.md

@@ -141,6 +141,11 @@ brew update && brew info loki-mode
 gh release view vX.Y.Z
 ```
 
+### Train cycle: previous release must be on npm
+`scripts/train-cycle.sh` (phase C) refuses to cut release N+1 until the previous `release: vX` version is visible on npm (`npm_has_version`). While it is missing, the cycle logs `PREV_NOT_ON_NPM X` and returns 0 (waiting is not a failure). An unreachable registry fails closed and adds `reason=NPM_UNREACHABLE`. After `LOKI_TC_NPM_WAIT_MIN` minutes (default 45) since the previous release commit the log becomes `PREV_NOT_ON_NPM_STALE ... refusing release, needs a human`; the release stays refused either way.
+
+Operator action: wait for the Release workflow publish to land and for the D49 auto-promote to run. Never manually promote or move the `latest` dist-tag, and never unpublish. If the STALE line appears, investigate the failed or stuck publish run rather than bypassing the check.
+
 ### Distribution Channel Checklist
 
 | Channel | Dashboard API | Dashboard Frontend | Memory System | Skills/References |

package/docs/exit-codes.md

@@ -92,6 +92,32 @@ not rank above UNCHECKED.
 | Engine10 (`loki-ts`, `verify_cmd.ts`) | exit 3, `attestation: UNSIGNED, integrity not attested; refusing (pass --allow-unsigned to accept)` | exit 0, `attestation: UNSIGNED (accepted by --allow-unsigned; integrity not attested)` |
 | Legacy shell (`autonomy/verify.sh`) | BLOCKED (non-zero) | the receipt line passes with the same accepted line |
 
+### UNCHECKED attestations and a missing run-id pointer on legacy (D76)
+
+Legacy `loki verify` (`autonomy/verify.sh`) no longer passes a receipt whose
+attestation it cannot evaluate. A well-formed token whose kid matches no local key
+(and no `LOKI_RECEIPT_RETIRED_PUBKEYS` entry) prints `attestation: UNCHECKED`,
+exits 2 (BLOCKED) and the `VERDICT:` line is not VERIFIED, matching engine10.
+Anyone can mint a token with a foreign kid, so exit 0 was a downgrade path. The
+output names the honest cross-machine path: `loki verify --pubkey FILE <run-id>`
+checks a Loki 10 run receipt against the signer's public key, but it does not read
+a legacy `.loki/proofs/<id>/proof.json`; for a legacy receipt signed elsewhere, add
+the signer's public key (PEM) to `LOKI_RECEIPT_RETIRED_PUBKEYS`. A token signed by
+the local key still verifies with exit 0.
+
+Run standalone (`bash autonomy/verify.sh`, outside the `loki` CLI), the script
+has no attestation verdict helper, so every receipt prints
+`attestation: UNCHECKED (run via loki verify)` and the receipt check fails. This
+holds even with `--allow-unsigned`, which accepts only a receipt the CLI has
+classified as UNSIGNED. Run `loki verify` to evaluate the attestation.
+
+A missing `.loki/state/last-proof-id.txt` no longer skips the receipt check. If
+proofs exist under `.loki/proofs` the run is `receipt: NOT VERIFIED` (exit 2); a
+pointer naming a missing proof is the same. A tree that never recorded a proof
+prints `receipt: NONE (no proof was recorded in this tree; no receipt was checked)`
+and is not failed for it, because there is nothing to verify; that line is not a
+receipt pass.
+
 Engine10 `loki verify [run-id]` exits: 0 verified, 1 tampered, 2 unchecked,
 3 unsigned (refused), 4 run outcome not verified (a sealed receipt of a FAILED or
 otherwise unverified run), 66 no runs. The outcome check runs before the UNSIGNED
@@ -104,6 +130,12 @@ never the local JWKS. Exits: 0 VERIFIED, 1 TAMPERED, 2 UNCHECKED (kid does not
 match the key, or the key file is unusable), 3 UNSIGNED (a receipt with no
 signature is refused even with `--allow-unsigned`, because the caller asked for a
 signature check), 4 run outcome not verified (checked before UNSIGNED).
+
+`loki verify <run-id|receipt.json> --export-dsse` (v10 only) exits 0 after
+printing the envelope, 1 TAMPERED, an envelope given as input, or an envelope
+under a run id whose `predicate.run_id` differs, 2 UNSIGNED, UNCHECKED or an
+unreadable receipt, 4 a verified receipt whose run outcome is not VERIFIED or
+ALREADY_SATISFIED, 66 no signing key (or no runs). Refusals print nothing on stdout.
 `--pubkey` may come before or after the run-id and may be written `--pubkey=FILE`; `--pubkey` with no file or an empty `--pubkey=`, a repeated `--pubkey`, an unknown option, or more than one run-id exits 2.
 
 An early draft spec listed `1=BLOCKED, 2=CONCERNS`. That ordering was rejected:
@@ -112,7 +144,7 @@ severity-rises-with-the-code rule that every other command follows.
 
 ### Known gaps until v10.0.0
 
-The table above is the target. On the current release, four inputs do not
+The table above is the target. On the current release, three inputs do not
 return what it implies. Measured on this checkout:
 
 | Input | Command | Exit today | Target |
@@ -120,16 +152,19 @@ return what it implies. Measured on this checkout:
 | Empty diff (a git repo with no changes vs base) | `loki verify` | 1 (CONCERNS) | 3 |
 | Not a git directory | `loki verify` | 1 (CONCERNS) | 2 |
 | Unknown flag | `loki verify --no-such-flag` | 3 | 64 |
-| `--fast` with nothing scanned (0 files) | `loki verify --fast <empty-dir> --no-cache` | 0 | nonzero |
 
-`loki verify --fast` (`autonomy/lib/fast_verify.py`) also exits 0 for a
-nonexistent root and silently ignores unknown flags. Until v10.0.0, do not
-trust exit 0 from `--fast` alone: check stdout for `INCONCLUSIVE`, which it
-prints when nothing was scanned.
+The gap is tracked as the pending moat case P2.verify-exit-contract,
+milestone v10.0.0, in `tests/moat/pending.txt`.
+
+### `loki verify --fast`
 
-Both gaps are tracked as pending moat cases, milestone v10.0.0, in
-`tests/moat/pending.txt`: P2.verify-exit-contract (the first three rows)
-and P2.fast-verify-inconclusive-not-zero (the `--fast` row).
+| Code | Meaning |
+|---|---|
+| 0 | PASS: files were scanned and nothing blocking was found |
+| 1 | FAIL: a blocking finding |
+| 2 | The root directory does not exist |
+| 3 | INCONCLUSIVE: nothing was scanned (0 files) |
+| 64 | Unknown option (`--path DIR` and `--help` are supported; `--help` exits 0) |
 
 ## `loki proof verify <id>`