loki-mode 11.17.11 → 11.17.13

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: An autonomous software factory that knows what it is supposed to deliver, and proves it did. Use when the user says Loki Mode or asks to build, fix or verify software autonomously.
 ---
 
-# Loki Mode v11.17.11
+# Loki Mode v11.17.13
 
 **Current entry points (Loki 10 engine):** `loki "<task>"`, `loki owner/repo#N` and `loki quick "<task>"` run the Loki 10 engine and end with a signed receipt (`loki verify`). `loki backlog owner/repo --all` runs many issues in parallel. Guide: `docs/v10/GUIDE.md`. The skill instructions below, and `loki start`, describe the previous bash loop. PRD-file starts (`loki start ./prd.md`) and the opencode provider still run on it until FC38-SWEEP ports them; the legacy-engine command and the LOKI_ENGINE switch remain removed. Prefer `loki owner/repo#N` for issues.
 
@@ -483,4 +483,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v11.17.11 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**
+**v11.17.13 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**

package/VERSION

@@ -1 +1 @@
-11.17.11
+11.17.13

package/autonomy/lib/cost-summary.py

@@ -50,7 +50,7 @@ _HERE = os.path.dirname(os.path.abspath(__file__))
 if _HERE not in sys.path:
     sys.path.insert(0, _HERE)
 
-from efficiency_cost import record_is_measured  # noqa: E402
+from efficiency_cost import cost_block_is_partial, record_is_measured  # noqa: E402
 
 # iteration_attribution.py already reads and sorts the efficiency dir, skipping
 # malformed records. Importing it keeps ONE reader of that directory; a third
@@ -167,6 +167,8 @@ def summarize(workspace="."):
         "fully_measured": exists > 0 and measured == exists,
         "total_cost_usd": round(total_usd, 4) if have_cost else None,
         "cost_iterations_counted": len(cost_points),
+        "cost_partial": cost_block_is_partial({
+            "cost_partial": have_cost and (len(cost_points) < measured or measured < exists)}),
         "avg_cost_per_iteration": (
             round(total_usd / len(cost_points), 4) if have_cost else None),
         "cache_hit_ratio": _ratio(
@@ -262,7 +264,8 @@ def render(s):
         s["iterations_found"], s["iterations_measured"],
         "" if s["fully_measured"] else "  <- PARTIAL" if s["iterations_found"]
         else ""))
-    L.append("Total cost:  " + _usd(s["total_cost_usd"]))
+    L.append("Total cost:  " + _usd(s["total_cost_usd"])
+             + ("  <- LOWER BOUND" if s.get("cost_partial") else ""))
     L.append("Avg / iter:  " + _usd(s["avg_cost_per_iteration"]))
     L.append("Cache ratio: " + _pct(s["cache_hit_ratio"])
              + "   (cache_read / (input + cache_read))")

package/autonomy/lib/efficiency_cost.py

@@ -238,6 +238,19 @@ _LEDGER_TOKEN_KEYS = (
 )
 
 
+def cost_block_is_partial(cost):
+    """The one partial-cost check (FC-COST-PARTIAL-b): True when a cost block's
+    dollar total is a lower bound or unknown, so consumers label it and never
+    print it as complete."""
+    if not isinstance(cost, dict):
+        return False
+    if cost.get("cost_partial") is True or cost.get("cost_available") is False:
+        return True
+    return any(
+        isinstance(cost.get(k), int) and not isinstance(cost.get(k), bool) and cost.get(k) > 0
+        for k in ("ledger_invalid_lines", "cost_unpriced_records"))
+
+
 def read_child_ledger(loki_dir):
     """Read .loki/metrics/child-sessions.jsonl, one JSON object per child session.
 

package/autonomy/lib/proof-generator.py

@@ -37,6 +37,7 @@ if _HERE not in sys.path:
 
 import proof_redact  # noqa: E402
 from efficiency_cost import collect_efficiency as _collect_efficiency  # noqa: E402
+from efficiency_cost import cost_block_is_partial as _cost_is_partial  # noqa: E402
 import effort_estimator  # noqa: E402
 from tree_digest import MANIFEST_VERSION, compute_tree_digest  # noqa: E402
 from workspace_diff import collect_workspace_diff  # noqa: E402
@@ -2133,6 +2134,8 @@ def _build_social_hook(proof):
     council ratio. When cost was not collected, omit the cost (never fabricate
     a number, never print "$0.00")."""
     usd = _fmt_usd_hook((proof.get("cost") or {}).get("usd"))
+    if usd is not None and _cost_is_partial(proof.get("cost")):
+        usd = "at least " + usd
     lead = ("Built autonomously for " + usd) if usd is not None \
         else "Built autonomously by Loki Mode"
     parts = [lead]
@@ -2184,6 +2187,8 @@ def _render_fallback_html(proof):
 
     usd_val = cost.get("usd", None)
     usd_disp = _fmt_usd_hook(usd_val)
+    if usd_disp is not None and _cost_is_partial(cost):
+        usd_disp = "at least " + usd_disp
 
     rows = []
     rows.append("<h1>Loki Mode -- Proof of Run</h1>")

package/autonomy/lib/proof-template.html

@@ -803,14 +803,28 @@
     sec.classList.remove("hide");
   }
 
+  // Mirror of cost_block_is_partial (autonomy/lib/efficiency_cost.py).
+  function costIsPartial(p) {
+    var c = g(p, "cost", null);
+    if (!c || typeof c !== "object") return false;
+    if (c.cost_partial === true || c.cost_available === false) return true;
+    var ks = ["ledger_invalid_lines", "cost_unpriced_records"];
+    for (var i = 0; i < ks.length; i++) {
+      var v = c[ks[i]];
+      if (typeof v === "number" && isFinite(v) && Math.floor(v) === v && v > 0) return true;
+    }
+    return false;
+  }
+
   function renderHero(p) {
     // cost.usd is null when cost was not collected for this run. g() coerces
     // null to its default, so read with a null default and branch BEFORE
     // fmtUsd: a skeptic seeing a zero-dollar total assumes the artifact is fake.
     var usdRaw = g(p, "cost.usd", null);
+    var partial = costIsPartial(p);
     var fc = num(g(p, "files_changed.count", 0));
     var parts = [__PROOF_RECEIPT_TITLE_JSON__];
-    if (usdRaw !== null) parts.push(fmtUsd(usdRaw));
+    if (usdRaw !== null) parts.push((partial ? "at least " : "") + fmtUsd(usdRaw));
     else parts.push("cost not recorded");
     parts.push(fc + " file" + (fc === 1 ? "" : "s") + " changed");
     var cs = councilSummary(p);
@@ -825,7 +839,7 @@
     if (prov || model) sub.push("via " + esc(prov) + (model ? " / " + esc(model) : ""));
     document.getElementById("heroSub").innerHTML = sub.join(" · ");
 
-    renderHeroStats(p, usdRaw, fc, cs);
+    renderHeroStats(p, usdRaw, fc, cs, partial);
 
     var actions = document.getElementById("heroActions");
     var html = "";
@@ -872,7 +886,7 @@
     actions.innerHTML = html + share;
   }
 
-  function renderHeroStats(p, usdRaw, fc, cs) {
+  function renderHeroStats(p, usdRaw, fc, cs, partial) {
     var el = document.getElementById("heroStats");
     if (!el) return;
     var cells = [];
@@ -895,7 +909,7 @@
     }
     cells.push(["Verified", vMain, esc(vSub), cs ? "ok" : ""]);
     // Cost: never render a zero-dollar total when cost was not collected.
-    if (usdRaw !== null) cells.push(["Cost", fmtUsd(usdRaw), "total for this run", ""]);
+    if (usdRaw !== null) cells.push(["Cost", (partial ? "at least " : "") + fmtUsd(usdRaw), partial ? "lower bound, some cost not priced" : "total for this run", ""]);
     else cells.push(["Cost", "not recorded", "no cost data", ""]);
     // Duration.
     var dur = g(p, "wall_clock_sec", null);
@@ -962,6 +976,7 @@
   function renderCost(p) {
     var card = document.getElementById("costCard");
     var usdRaw = g(p, "cost.usd", null);
+    var partial = costIsPartial(p);
     function tokenValue(path) {
       var raw = g(p, path, null);
       return raw === null ? "not recorded" : fmtInt(raw);
@@ -981,8 +996,8 @@
     // a zero-dollar total (which reads as fake/broken to a skeptic).
     var top;
     if (usdRaw !== null) {
-      top = '<div class="cost-top"><span class="cost-usd">' + fmtUsd(usdRaw) +
-            '</span><span class="cost-label">total cost for this run, itemized below</span></div>';
+      top = '<div class="cost-top"><span class="cost-usd">' + (partial ? "at least " : "") + fmtUsd(usdRaw) +
+            '</span><span class="cost-label">' + (partial ? "lower bound: some cost was not priced or recorded" : "total cost for this run, itemized below") + '</span></div>';
     } else {
       top = '<div class="cost-top"><span class="cost-label">Cost was not recorded for this run. ' +
             'Token usage is itemized below.</span></div>';

package/autonomy/lib/trust_trajectory.py

@@ -171,6 +171,12 @@ def _interventions_value(proof):
 _IV_TYPES = ("steer", "input", "authorization", "repair")
 
 
+_LIB_DIR = os.path.dirname(os.path.abspath(__file__))
+if _LIB_DIR not in sys.path:
+    sys.path.insert(0, _LIB_DIR)
+from efficiency_cost import cost_block_is_partial  # noqa: E402
+
+
 def _cost_value(proof):
     usd = _obj(proof.get("cost")).get("usd")
     if usd is None or isinstance(usd, bool):
@@ -236,6 +242,7 @@ def _load_runs(loki_dir):
             "verdict": verdict,
             "false_verified": false_verified,
             "cost_usd": _cost_value(proof),
+            "cost_partial": cost_block_is_partial(_obj(proof.get("cost"))),
             "interventions_by_type": by_type,
             "waited_s": waited_s,
             "active_s": active_s,
@@ -336,6 +343,9 @@ def outcome_effort(series):
         cost_note = "no runs"
     elif accepted == 0:
         cost_note = "no accepted run, cost per accepted is undefined"
+    elif any(r.get("cost_partial") for r in series):
+        cost_note = "cost partial for %d of %d runs, a lower bound is not a total" % (
+            sum(1 for r in series if r.get("cost_partial")), len(series))
     elif unmeasured:
         cost_note = "cost unmeasured for %d of %d runs, a partial sum is not a total" % (unmeasured, len(series))
     else:
@@ -449,7 +459,7 @@ def compute_trajectory(loki_dir):
         "regressing_axes": regressing_axes,
         "series": series,
         "notes": notes,
-        "outcome_effort": outcome_effort(series),
+        "outcome_effort": outcome_effort(runs),
     }
 
 

package/autonomy/loki

@@ -397,6 +397,24 @@ _loki_update_cache_path() {
     echo "$HOME/.loki/cache/update-check-bash.json"
 }
 
+# _loki_verdict_badge <headline> <url> -> prints a "Verified by Loki" markdown
+# badge for an honesty.headline, or nothing. Exact-match only: VERIFIED
+# (brightgreen), VERIFIED WITH GAPS (orange), NOT VERIFIED (red). Any other
+# headline, or an empty url, omits the badge (never green, never forced red).
+_loki_verdict_badge() {
+    local headline="${1:-}" url="${2:-}" message color
+    url="${url#"${url%%[![:space:]]*}"}"; url="${url%"${url##*[![:space:]]}"}"
+    [ -n "$url" ] || return 0
+    case "$headline" in
+        "VERIFIED") message="verified"; color="brightgreen" ;;
+        "VERIFIED WITH GAPS") message="verified with gaps"; color="orange" ;;
+        "NOT VERIFIED") message="not verified"; color="red" ;;
+        *) return 0 ;;
+    esac
+    printf '[![Loki: %s](https://img.shields.io/static/v1?label=Loki&message=%s&color=%s)](%s)\n' \
+        "$message" "${message// /%20}" "$color" "$url"
+}
+
 # _loki_semver_newer <latest> <current> -> 0 (true) iff latest is strictly newer.
 # Rejects anything that is not a plain MAJOR.MINOR.PATCH (e.g. "unknown",
 # prereleases): on any unparseable input it returns 1 (never nudge).
@@ -9973,7 +9991,7 @@ _deploy_latest_receipt() {
     return 0
 }
 
-# _deploy_record <dir> <command> <exit_code> <run_id> <anchor_sha> [state] [health_status] [health_url] [rb_attempted] [rb_exit] [receipt_sha256] [started_at] [finished_at] [target] [canary] [post_rollback_health] [health_http_code] [health_match] [tree_sha] [destination]
+# _deploy_record <dir> <command> <exit_code> <run_id> <anchor_sha> [state] [health_status] [health_url] [rb_attempted] [rb_exit] [receipt_sha256] [started_at] [finished_at] [target] [canary] [post_rollback_health] [health_http_code] [health_match] [tree_sha] [destination] [deployed_url] [health_url_source]
 # Writes the executed deploy's own record, then signs it (loki.deploy/1, Ed25519 via the
 # receipt signer in loki-ts/src/util/receipt_signer.ts) so it is bound to the receipt that
 # authorized it; `loki verify <record>` re-checks it offline. An unsigned record is reported
@@ -9997,6 +10015,7 @@ _deploy_record() {
     local rb_attempted="${9:-false}" rb_exit="${10:-}"
     local receipt_sha="${11:-}" started_at="${12:-}" finished_at="${13:-}" target="${14:-}" canary="${15:-false}"
     local post_rb="${16:-unchecked}" hcode_rec="${17:-}" hmatch="${18:-}" tree_sha="${19:-}" dest_rec="${20:-}"
+    local deployed_url="${21:-}" hsrc="${22:-}"
     local ddir="$dir/.loki/deploys"
     [ -d "${LOKI_DIR:-}" ] && ddir="${LOKI_DIR}/deploys"
     mkdir -p "$ddir" 2>/dev/null || return 0
@@ -10004,7 +10023,7 @@ _deploy_record() {
     DR_CMD="$command" DR_RC="$rc" DR_RUN="$run_id" DR_ANCHOR="$anchor" DR_OUT="$f" \
     DR_STATE="$anchor_state" DR_HS="$health_status" DR_HU="$health_url" \
     DR_RBA="$rb_attempted" DR_RBX="$rb_exit" DR_RSHA="$receipt_sha" DR_T0="$started_at" \
-    DR_T1="$finished_at" DR_TGT="$target" DR_CAN="$canary" DR_PRB="$post_rb" DR_HC="$hcode_rec" DR_HM="$hmatch" DR_TREE="$tree_sha" DR_DEST="$dest_rec" \
+    DR_T1="$finished_at" DR_TGT="$target" DR_CAN="$canary" DR_PRB="$post_rb" DR_HC="$hcode_rec" DR_HM="$hmatch" DR_TREE="$tree_sha" DR_DEST="$dest_rec" DR_DURL="$deployed_url" DR_HSRC="$hsrc" \
         python3 -c '
 import json, os, datetime
 state = os.environ.get("DR_STATE") or "anchored"
@@ -10034,6 +10053,8 @@ json.dump({
     "health_match": os.environ.get("DR_HM", ""),
     "tree_sha": os.environ.get("DR_TREE", ""),
     "destination": os.environ.get("DR_DEST", ""),
+    "deployed_url": os.environ.get("DR_DURL", ""),
+    "health_url_source": os.environ.get("DR_HSRC", ""),
     "health_http_code": int(os.environ["DR_HC"]) if os.environ.get("DR_HC", "").isdigit() else None,
 }, open(os.environ["DR_OUT"], "w"), indent=2)
 ' 2>/dev/null || return 0
@@ -10339,6 +10360,8 @@ _deploy_try_execute() {
 
     local rc=0 started_at finished_at purl="" canary_out=""
     started_at="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+    local deployed_url="" health_src=""
+    [ -n "$health_url" ] && health_src="flag"
     local health_status="unchecked" rb_attempted=false rb_exit="" hcode="" rb_hcode="" post_rb="unchecked"
     if [ "$canary_kind" = vercel ]; then
         # Staged: a preview deploy (no --prod), probe the preview URL, promote only if healthy.
@@ -10349,7 +10372,7 @@ _deploy_try_execute() {
         printf '%s\n' "$canary_out"
         purl="$(grep -Eo 'https?://[^[:space:]]+' <<<"$canary_out" | tail -n 1)"
         if [ "$rc" -eq 0 ] && [ -n "$purl" ]; then
-            health_url="$purl"
+            health_url="$purl"; deployed_url="$purl"; health_src="captured"
             echo "Probing canary health: ${health_url}"
             if hcode="$(_deploy_probe_health "$health_url" "$health_match")"; then
                 health_status="healthy"
@@ -10365,7 +10388,16 @@ _deploy_try_execute() {
             rc=4
         fi
     else
-        ( cd "$dir" && eval "$exec_cmd" ) || rc=$?
+        canary_out="$( cd "$dir" && eval "$exec_cmd" )" || rc=$?
+        printf '%s\n' "$canary_out"
+        if [ "$rc" -eq 0 ]; then
+            # Same last-https-URL parse as the canary path; never invented.
+            deployed_url="$(grep -Eo 'https?://[^[:space:]]+' <<<"$canary_out" | tail -n 1)" || deployed_url=""
+            if [ -n "$deployed_url" ]; then
+                echo "Live at: ${deployed_url}"
+                if [ -z "$health_url" ]; then health_url="$deployed_url"; health_src="captured"; fi
+            fi
+        fi
     fi
 
     # Health probe only after a deploy that exited 0. Without a URL, or after a
@@ -10410,7 +10442,7 @@ _deploy_try_execute() {
     rsha="$(python3 -c 'import json,sys;print((json.load(open(sys.argv[1])).get("verification") or {}).get("hash") or "")' "$pj" 2>/dev/null || printf '')"
     rec="$(_deploy_record "$dir" "$exec_cmd" "$rc" "${run_id:-unknown}" "${anchor:-unknown}" \
         "$anchor_state" "$health_status" "$health_url" "$rb_attempted" "$rb_exit" \
-        "$rsha" "$started_at" "$finished_at" "${command%% *}" "$canary" "$post_rb" "$hcode" "$health_match" "$(git -C "$dir" rev-parse 'HEAD^{tree}' 2>/dev/null || true)" "$dest")"
+        "$rsha" "$started_at" "$finished_at" "${command%% *}" "$canary" "$post_rb" "$hcode" "$health_match" "$(git -C "$dir" rev-parse 'HEAD^{tree}' 2>/dev/null || true)" "$dest" "$deployed_url" "$health_src")"
     echo ""
     if [ "$rc" -eq 0 ]; then
         echo -e "${GREEN}Deploy command exited 0.${NC}"
@@ -38275,39 +38307,21 @@ PYEOF
                 # The badge links to the gist we just published (no new egress).
                 # shields.io static/v1 query endpoint avoids structural hyphens.
                 local badge
-                badge=$(LOKI_PROOF_JSON="$pj" LOKI_GIST_URL="$LOKI_LAST_GIST_URL" "$_share_py3" -E - <<'PYEOF' 2>/dev/null || true
+                badge=$(LOKI_PROOF_JSON="$pj" "$_share_py3" -E - <<'PYEOF' 2>/dev/null || true
 # The cwd is the checkout being shared: drop it from sys.path before any
 # other import, or a committed json.py/os.py could answer this badge text.
 import sys; sys.path[:] = [p for p in sys.path if p not in ("", ".")]
 import json, os
-from urllib.parse import quote
 try:
     d = json.load(open(os.environ["LOKI_PROOF_JSON"]))
 except Exception:
     d = {}
-headline = (d.get("honesty") or {}).get("headline")
-# Exact-match ONLY. council.final_verdict is intentionally NOT consulted: it is
-# an LLM opinion, the precise fake-green source the deterministic headline
-# overrides. Unmapped headline -> no entry -> badge omitted.
-mapping = {
-    "VERIFIED": ("verified", "brightgreen"),
-    "VERIFIED WITH GAPS": ("verified with gaps", "orange"),
-    "NOT VERIFIED": ("not verified", "red"),
-}
-entry = mapping.get(headline)
-url = os.environ.get("LOKI_GIST_URL", "").strip()
-# Omit the badge for any unmapped headline (never green, never forced red),
-# and when we have no link target to point at.
-if entry and url:
-    message, color = entry
-    badge_img = (
-        "https://img.shields.io/static/v1?label=Loki"
-        "&message=" + quote(message)
-        + "&color=" + color
-    )
-    print("[![Loki: {msg}]({img})]({url})".format(msg=message, img=badge_img, url=url))
+h = (d.get("honesty") or {}).get("headline")
+if isinstance(h, str):
+    print(h)
 PYEOF
 )
+                badge=$(_loki_verdict_badge "$badge" "$LOKI_LAST_GIST_URL")
                 if [ -n "$badge" ]; then
                     echo ""
                     echo "Markdown badge (paste into a README or PR):"

package/completions/_loki

@@ -242,6 +242,7 @@ function _loki_commands {
         'secure:Secure-by-default gate (findings and waivers)'
         'own:Finish-and-own ownership handoff'
         'backup:Back up dashboard state (verified archive)'
+        'restore:Restore dashboard state from a verified backup archive'
         'telemetry:OpenTelemetry management'
         'agent:Agent type dispatch'
         'doctor:Check system prerequisites'

package/completions/loki.bash

@@ -150,7 +150,7 @@ _loki_completion() {
 
         deploy)
             if [[ "$cur" == -* ]]; then
-                COMPREPLY=( $(compgen -W "--execute --canary --health-url --health-match --auto-rollback --dir --no-clip --allow-unanchored --help" -- "$cur") )
+                COMPREPLY=( $(compgen -W "--execute --destination --canary --health-url --health-match --auto-rollback --dir --no-clip --allow-unanchored --help" -- "$cur") )
                 return 0
             fi
             ;;

package/dashboard/__init__.py

@@ -7,6 +7,6 @@ Modules:
     control: Session control helpers (status, atomic writes, origin check)
 """
 
-__version__ = "11.17.11"
+__version__ = "11.17.13"
 
 __all__ = ["__version__"]

package/docs/CLI-REFERENCE.md

@@ -1,6 +1,6 @@
 # CLI reference
 
-Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.17.11. Do not edit by hand.
+Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.17.13. Do not edit by hand.
 Hidden and legacy-only commands are omitted; see `docs/v10/CLI-MODERN.md` for the full inventory.
 
 | Command | Description |

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 Loki Mode, by [Autonomi](https://www.autonomi.dev/), turns a spec or an issue into a verified pull request with a receipt you can check. This page covers installing it, a first run, and the options around it.
 
-**Version:** v11.17.11
+**Version:** v11.17.13
 
 **Engine note:** `loki start` is the primary command. `loki start`, `loki "<task>"`, `loki owner/repo#N` and `loki quick` all run the Loki 10 engine, whatever the flag order or input form (PRD file, issue ref, task or one-word brief). The previous loop runs only on `--engine legacy`, `LOKI_ENGINE=legacy`, or for one call when a flag Loki 10 cannot honor is present. See the [user guide](v10/GUIDE.md) and the [5-minute quickstart](QUICKSTART.md).