loki-mode 11.17.11 → 11.17.15

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: An autonomous software factory that knows what it is supposed to deliver, and proves it did. Use when the user says Loki Mode or asks to build, fix or verify software autonomously.
 ---
 
-# Loki Mode v11.17.11
+# Loki Mode v11.17.15
 
 **Current entry points (Loki 10 engine):** `loki "<task>"`, `loki owner/repo#N` and `loki quick "<task>"` run the Loki 10 engine and end with a signed receipt (`loki verify`). `loki backlog owner/repo --all` runs many issues in parallel. Guide: `docs/v10/GUIDE.md`. The skill instructions below, and `loki start`, describe the previous bash loop. PRD-file starts (`loki start ./prd.md`) and the opencode provider still run on it until FC38-SWEEP ports them; the legacy-engine command and the LOKI_ENGINE switch remain removed. Prefer `loki owner/repo#N` for issues.
 
@@ -483,4 +483,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v11.17.11 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**
+**v11.17.15 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**

package/VERSION

@@ -1 +1 @@
-11.17.11
+11.17.15

package/autonomy/lib/cost-summary.py

@@ -50,7 +50,7 @@ _HERE = os.path.dirname(os.path.abspath(__file__))
 if _HERE not in sys.path:
     sys.path.insert(0, _HERE)
 
-from efficiency_cost import record_is_measured  # noqa: E402
+from efficiency_cost import cost_block_is_partial, record_is_measured  # noqa: E402
 
 # iteration_attribution.py already reads and sorts the efficiency dir, skipping
 # malformed records. Importing it keeps ONE reader of that directory; a third
@@ -167,6 +167,8 @@ def summarize(workspace="."):
         "fully_measured": exists > 0 and measured == exists,
         "total_cost_usd": round(total_usd, 4) if have_cost else None,
         "cost_iterations_counted": len(cost_points),
+        "cost_partial": cost_block_is_partial({
+            "cost_partial": have_cost and (len(cost_points) < measured or measured < exists)}),
         "avg_cost_per_iteration": (
             round(total_usd / len(cost_points), 4) if have_cost else None),
         "cache_hit_ratio": _ratio(
@@ -262,7 +264,8 @@ def render(s):
         s["iterations_found"], s["iterations_measured"],
         "" if s["fully_measured"] else "  <- PARTIAL" if s["iterations_found"]
         else ""))
-    L.append("Total cost:  " + _usd(s["total_cost_usd"]))
+    L.append("Total cost:  " + _usd(s["total_cost_usd"])
+             + ("  <- LOWER BOUND" if s.get("cost_partial") else ""))
     L.append("Avg / iter:  " + _usd(s["avg_cost_per_iteration"]))
     L.append("Cache ratio: " + _pct(s["cache_hit_ratio"])
              + "   (cache_read / (input + cache_read))")

package/autonomy/lib/efficiency_cost.py

@@ -238,6 +238,19 @@ _LEDGER_TOKEN_KEYS = (
 )
 
 
+def cost_block_is_partial(cost):
+    """The one partial-cost check (FC-COST-PARTIAL-b): True when a cost block's
+    dollar total is a lower bound or unknown, so consumers label it and never
+    print it as complete."""
+    if not isinstance(cost, dict):
+        return False
+    if cost.get("cost_partial") is True or cost.get("cost_available") is False:
+        return True
+    return any(
+        isinstance(cost.get(k), int) and not isinstance(cost.get(k), bool) and cost.get(k) > 0
+        for k in ("ledger_invalid_lines", "cost_unpriced_records"))
+
+
 def read_child_ledger(loki_dir):
     """Read .loki/metrics/child-sessions.jsonl, one JSON object per child session.
 

package/autonomy/lib/proof-generator.py

@@ -37,6 +37,7 @@ if _HERE not in sys.path:
 
 import proof_redact  # noqa: E402
 from efficiency_cost import collect_efficiency as _collect_efficiency  # noqa: E402
+from efficiency_cost import cost_block_is_partial as _cost_is_partial  # noqa: E402
 import effort_estimator  # noqa: E402
 from tree_digest import MANIFEST_VERSION, compute_tree_digest  # noqa: E402
 from workspace_diff import collect_workspace_diff  # noqa: E402
@@ -2133,6 +2134,8 @@ def _build_social_hook(proof):
     council ratio. When cost was not collected, omit the cost (never fabricate
     a number, never print "$0.00")."""
     usd = _fmt_usd_hook((proof.get("cost") or {}).get("usd"))
+    if usd is not None and _cost_is_partial(proof.get("cost")):
+        usd = "at least " + usd
     lead = ("Built autonomously for " + usd) if usd is not None \
         else "Built autonomously by Loki Mode"
     parts = [lead]
@@ -2184,6 +2187,8 @@ def _render_fallback_html(proof):
 
     usd_val = cost.get("usd", None)
     usd_disp = _fmt_usd_hook(usd_val)
+    if usd_disp is not None and _cost_is_partial(cost):
+        usd_disp = "at least " + usd_disp
 
     rows = []
     rows.append("<h1>Loki Mode -- Proof of Run</h1>")

package/autonomy/lib/proof-template.html

@@ -803,14 +803,28 @@
     sec.classList.remove("hide");
   }
 
+  // Mirror of cost_block_is_partial (autonomy/lib/efficiency_cost.py).
+  function costIsPartial(p) {
+    var c = g(p, "cost", null);
+    if (!c || typeof c !== "object") return false;
+    if (c.cost_partial === true || c.cost_available === false) return true;
+    var ks = ["ledger_invalid_lines", "cost_unpriced_records"];
+    for (var i = 0; i < ks.length; i++) {
+      var v = c[ks[i]];
+      if (typeof v === "number" && isFinite(v) && Math.floor(v) === v && v > 0) return true;
+    }
+    return false;
+  }
+
   function renderHero(p) {
     // cost.usd is null when cost was not collected for this run. g() coerces
     // null to its default, so read with a null default and branch BEFORE
     // fmtUsd: a skeptic seeing a zero-dollar total assumes the artifact is fake.
     var usdRaw = g(p, "cost.usd", null);
+    var partial = costIsPartial(p);
     var fc = num(g(p, "files_changed.count", 0));
     var parts = [__PROOF_RECEIPT_TITLE_JSON__];
-    if (usdRaw !== null) parts.push(fmtUsd(usdRaw));
+    if (usdRaw !== null) parts.push((partial ? "at least " : "") + fmtUsd(usdRaw));
     else parts.push("cost not recorded");
     parts.push(fc + " file" + (fc === 1 ? "" : "s") + " changed");
     var cs = councilSummary(p);
@@ -825,7 +839,7 @@
     if (prov || model) sub.push("via " + esc(prov) + (model ? " / " + esc(model) : ""));
     document.getElementById("heroSub").innerHTML = sub.join(" · ");
 
-    renderHeroStats(p, usdRaw, fc, cs);
+    renderHeroStats(p, usdRaw, fc, cs, partial);
 
     var actions = document.getElementById("heroActions");
     var html = "";
@@ -872,7 +886,7 @@
     actions.innerHTML = html + share;
   }
 
-  function renderHeroStats(p, usdRaw, fc, cs) {
+  function renderHeroStats(p, usdRaw, fc, cs, partial) {
     var el = document.getElementById("heroStats");
     if (!el) return;
     var cells = [];
@@ -895,7 +909,7 @@
     }
     cells.push(["Verified", vMain, esc(vSub), cs ? "ok" : ""]);
     // Cost: never render a zero-dollar total when cost was not collected.
-    if (usdRaw !== null) cells.push(["Cost", fmtUsd(usdRaw), "total for this run", ""]);
+    if (usdRaw !== null) cells.push(["Cost", (partial ? "at least " : "") + fmtUsd(usdRaw), partial ? "lower bound, some cost not priced" : "total for this run", ""]);
     else cells.push(["Cost", "not recorded", "no cost data", ""]);
     // Duration.
     var dur = g(p, "wall_clock_sec", null);
@@ -962,6 +976,7 @@
   function renderCost(p) {
     var card = document.getElementById("costCard");
     var usdRaw = g(p, "cost.usd", null);
+    var partial = costIsPartial(p);
     function tokenValue(path) {
       var raw = g(p, path, null);
       return raw === null ? "not recorded" : fmtInt(raw);
@@ -981,8 +996,8 @@
     // a zero-dollar total (which reads as fake/broken to a skeptic).
     var top;
     if (usdRaw !== null) {
-      top = '<div class="cost-top"><span class="cost-usd">' + fmtUsd(usdRaw) +
-            '</span><span class="cost-label">total cost for this run, itemized below</span></div>';
+      top = '<div class="cost-top"><span class="cost-usd">' + (partial ? "at least " : "") + fmtUsd(usdRaw) +
+            '</span><span class="cost-label">' + (partial ? "lower bound: some cost was not priced or recorded" : "total cost for this run, itemized below") + '</span></div>';
     } else {
       top = '<div class="cost-top"><span class="cost-label">Cost was not recorded for this run. ' +
             'Token usage is itemized below.</span></div>';

package/autonomy/lib/trust_trajectory.py

@@ -171,6 +171,12 @@ def _interventions_value(proof):
 _IV_TYPES = ("steer", "input", "authorization", "repair")
 
 
+_LIB_DIR = os.path.dirname(os.path.abspath(__file__))
+if _LIB_DIR not in sys.path:
+    sys.path.insert(0, _LIB_DIR)
+from efficiency_cost import cost_block_is_partial  # noqa: E402
+
+
 def _cost_value(proof):
     usd = _obj(proof.get("cost")).get("usd")
     if usd is None or isinstance(usd, bool):
@@ -236,6 +242,7 @@ def _load_runs(loki_dir):
             "verdict": verdict,
             "false_verified": false_verified,
             "cost_usd": _cost_value(proof),
+            "cost_partial": cost_block_is_partial(_obj(proof.get("cost"))),
             "interventions_by_type": by_type,
             "waited_s": waited_s,
             "active_s": active_s,
@@ -336,6 +343,9 @@ def outcome_effort(series):
         cost_note = "no runs"
     elif accepted == 0:
         cost_note = "no accepted run, cost per accepted is undefined"
+    elif any(r.get("cost_partial") for r in series):
+        cost_note = "cost partial for %d of %d runs, a lower bound is not a total" % (
+            sum(1 for r in series if r.get("cost_partial")), len(series))
     elif unmeasured:
         cost_note = "cost unmeasured for %d of %d runs, a partial sum is not a total" % (unmeasured, len(series))
     else:
@@ -449,7 +459,7 @@ def compute_trajectory(loki_dir):
         "regressing_axes": regressing_axes,
         "series": series,
         "notes": notes,
-        "outcome_effort": outcome_effort(series),
+        "outcome_effort": outcome_effort(runs),
     }
 
 

package/autonomy/loki

@@ -397,6 +397,24 @@ _loki_update_cache_path() {
     echo "$HOME/.loki/cache/update-check-bash.json"
 }
 
+# _loki_verdict_badge <headline> <url> -> prints a "Verified by Loki" markdown
+# badge for an honesty.headline, or nothing. Exact-match only: VERIFIED
+# (brightgreen), VERIFIED WITH GAPS (orange), NOT VERIFIED (red). Any other
+# headline, or an empty url, omits the badge (never green, never forced red).
+_loki_verdict_badge() {
+    local headline="${1:-}" url="${2:-}" message color
+    url="${url#"${url%%[![:space:]]*}"}"; url="${url%"${url##*[![:space:]]}"}"
+    [ -n "$url" ] || return 0
+    case "$headline" in
+        "VERIFIED") message="verified"; color="brightgreen" ;;
+        "VERIFIED WITH GAPS") message="verified with gaps"; color="orange" ;;
+        "NOT VERIFIED") message="not verified"; color="red" ;;
+        *) return 0 ;;
+    esac
+    printf '[![Loki: %s](https://img.shields.io/static/v1?label=Loki&message=%s&color=%s)](%s)\n' \
+        "$message" "${message// /%20}" "$color" "$url"
+}
+
 # _loki_semver_newer <latest> <current> -> 0 (true) iff latest is strictly newer.
 # Rejects anything that is not a plain MAJOR.MINOR.PATCH (e.g. "unknown",
 # prereleases): on any unparseable input it returns 1 (never nudge).
@@ -9973,7 +9991,7 @@ _deploy_latest_receipt() {
     return 0
 }
 
-# _deploy_record <dir> <command> <exit_code> <run_id> <anchor_sha> [state] [health_status] [health_url] [rb_attempted] [rb_exit] [receipt_sha256] [started_at] [finished_at] [target] [canary] [post_rollback_health] [health_http_code] [health_match] [tree_sha] [destination]
+# _deploy_record <dir> <command> <exit_code> <run_id> <anchor_sha> [state] [health_status] [health_url] [rb_attempted] [rb_exit] [receipt_sha256] [started_at] [finished_at] [target] [canary] [post_rollback_health] [health_http_code] [health_match] [tree_sha] [destination] [deployed_url] [health_url_source]
 # Writes the executed deploy's own record, then signs it (loki.deploy/1, Ed25519 via the
 # receipt signer in loki-ts/src/util/receipt_signer.ts) so it is bound to the receipt that
 # authorized it; `loki verify <record>` re-checks it offline. An unsigned record is reported
@@ -9997,6 +10015,7 @@ _deploy_record() {
     local rb_attempted="${9:-false}" rb_exit="${10:-}"
     local receipt_sha="${11:-}" started_at="${12:-}" finished_at="${13:-}" target="${14:-}" canary="${15:-false}"
     local post_rb="${16:-unchecked}" hcode_rec="${17:-}" hmatch="${18:-}" tree_sha="${19:-}" dest_rec="${20:-}"
+    local deployed_url="${21:-}" hsrc="${22:-}"
     local ddir="$dir/.loki/deploys"
     [ -d "${LOKI_DIR:-}" ] && ddir="${LOKI_DIR}/deploys"
     mkdir -p "$ddir" 2>/dev/null || return 0
@@ -10004,7 +10023,7 @@ _deploy_record() {
     DR_CMD="$command" DR_RC="$rc" DR_RUN="$run_id" DR_ANCHOR="$anchor" DR_OUT="$f" \
     DR_STATE="$anchor_state" DR_HS="$health_status" DR_HU="$health_url" \
     DR_RBA="$rb_attempted" DR_RBX="$rb_exit" DR_RSHA="$receipt_sha" DR_T0="$started_at" \
-    DR_T1="$finished_at" DR_TGT="$target" DR_CAN="$canary" DR_PRB="$post_rb" DR_HC="$hcode_rec" DR_HM="$hmatch" DR_TREE="$tree_sha" DR_DEST="$dest_rec" \
+    DR_T1="$finished_at" DR_TGT="$target" DR_CAN="$canary" DR_PRB="$post_rb" DR_HC="$hcode_rec" DR_HM="$hmatch" DR_TREE="$tree_sha" DR_DEST="$dest_rec" DR_DURL="$deployed_url" DR_HSRC="$hsrc" \
         python3 -c '
 import json, os, datetime
 state = os.environ.get("DR_STATE") or "anchored"
@@ -10034,6 +10053,8 @@ json.dump({
     "health_match": os.environ.get("DR_HM", ""),
     "tree_sha": os.environ.get("DR_TREE", ""),
     "destination": os.environ.get("DR_DEST", ""),
+    "deployed_url": os.environ.get("DR_DURL", ""),
+    "health_url_source": os.environ.get("DR_HSRC", ""),
     "health_http_code": int(os.environ["DR_HC"]) if os.environ.get("DR_HC", "").isdigit() else None,
 }, open(os.environ["DR_OUT"], "w"), indent=2)
 ' 2>/dev/null || return 0
@@ -10339,6 +10360,8 @@ _deploy_try_execute() {
 
     local rc=0 started_at finished_at purl="" canary_out=""
     started_at="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+    local deployed_url="" health_src=""
+    [ -n "$health_url" ] && health_src="flag"
     local health_status="unchecked" rb_attempted=false rb_exit="" hcode="" rb_hcode="" post_rb="unchecked"
     if [ "$canary_kind" = vercel ]; then
         # Staged: a preview deploy (no --prod), probe the preview URL, promote only if healthy.
@@ -10349,7 +10372,7 @@ _deploy_try_execute() {
         printf '%s\n' "$canary_out"
         purl="$(grep -Eo 'https?://[^[:space:]]+' <<<"$canary_out" | tail -n 1)"
         if [ "$rc" -eq 0 ] && [ -n "$purl" ]; then
-            health_url="$purl"
+            health_url="$purl"; deployed_url="$purl"; health_src="captured"
             echo "Probing canary health: ${health_url}"
             if hcode="$(_deploy_probe_health "$health_url" "$health_match")"; then
                 health_status="healthy"
@@ -10365,7 +10388,30 @@ _deploy_try_execute() {
             rc=4
         fi
     else
-        ( cd "$dir" && eval "$exec_cmd" ) || rc=$?
+        # Stream provider output live while keeping a copy to parse the URL from.
+        # The copy lives in a private mktemp -d dir removed on exit and on INT/TERM/HUP.
+        local dep_dir dep_tmp dep_errexit=0
+        dep_dir="$(mktemp -d "${TMPDIR:-/tmp}/loki-deploy-out.XXXXXXXX")" || dep_dir=""
+        dep_tmp=/dev/null
+        if [ -n "$dep_dir" ]; then
+            dep_tmp="${dep_dir}/out"
+            # shellcheck disable=SC2064
+            trap "rm -rf -- '${dep_dir}'; trap - INT TERM HUP; exit 130" INT TERM HUP
+        fi
+        case $- in *e*) dep_errexit=1 ;; esac
+        set +e
+        ( cd "$dir" && eval "$exec_cmd" ) 2>&1 | tee "$dep_tmp"
+        rc=${PIPESTATUS[0]}
+        [ "$dep_errexit" -eq 1 ] && set -e
+        if [ "$rc" -eq 0 ] && [ "$dep_tmp" != /dev/null ]; then
+            # Same last-https-URL parse as the canary path; never invented.
+            deployed_url="$(grep -Eo 'https?://[^[:space:]]+' "$dep_tmp" | tail -n 1)" || deployed_url=""
+            if [ -n "$deployed_url" ]; then
+                echo "Live at: ${deployed_url}"
+                if [ -z "$health_url" ]; then health_url="$deployed_url"; health_src="captured"; fi
+            fi
+        fi
+        if [ -n "$dep_dir" ]; then rm -rf -- "$dep_dir"; trap - INT TERM HUP; fi
     fi
 
     # Health probe only after a deploy that exited 0. Without a URL, or after a
@@ -10410,7 +10456,7 @@ _deploy_try_execute() {
     rsha="$(python3 -c 'import json,sys;print((json.load(open(sys.argv[1])).get("verification") or {}).get("hash") or "")' "$pj" 2>/dev/null || printf '')"
     rec="$(_deploy_record "$dir" "$exec_cmd" "$rc" "${run_id:-unknown}" "${anchor:-unknown}" \
         "$anchor_state" "$health_status" "$health_url" "$rb_attempted" "$rb_exit" \
-        "$rsha" "$started_at" "$finished_at" "${command%% *}" "$canary" "$post_rb" "$hcode" "$health_match" "$(git -C "$dir" rev-parse 'HEAD^{tree}' 2>/dev/null || true)" "$dest")"
+        "$rsha" "$started_at" "$finished_at" "${command%% *}" "$canary" "$post_rb" "$hcode" "$health_match" "$(git -C "$dir" rev-parse 'HEAD^{tree}' 2>/dev/null || true)" "$dest" "$deployed_url" "$health_src")"
     echo ""
     if [ "$rc" -eq 0 ]; then
         echo -e "${GREEN}Deploy command exited 0.${NC}"
@@ -11041,6 +11087,97 @@ except: print(0)
             fi
             ;;
 
+        publish)
+            # Receipt-stamped export: push the verified tree to GitHub and set a
+            # loki/receipt commit status whose state comes ONLY from the receipt
+            # verdict. Never stages files; private unless --public is passed.
+            local _pub_vis="--private" _pub_name="" _pub_dir="." _pub_usage=0
+            while [ $# -gt 0 ]; do
+                case "$1" in
+                    --public) _pub_vis="--public"; shift ;;
+                    --private) _pub_vis="--private"; shift ;;
+                    --dir)
+                        case "${2:-}" in ""|-*) _pub_usage=1; break ;; esac
+                        _pub_dir="$2"; shift 2 ;;
+                    -*) _pub_usage=1; break ;;
+                    *)
+                        [ -z "$_pub_name" ] || { _pub_usage=1; break; }
+                        _pub_name="$1"; shift ;;
+                esac
+            done
+            if [ "$_pub_usage" -ne 0 ]; then
+                echo "Usage: loki github publish [name] [--public] [--dir <path>]" >&2
+                exit 2
+            fi
+            local _pub_refuse
+            _pub_refuse="$(_deploy_tree_clean "$_pub_dir")"
+            if [ -n "$_pub_refuse" ]; then
+                echo -e "${RED}Refused: ${_pub_refuse}${NC}" >&2
+                exit 1
+            fi
+            if ! command -v gh &>/dev/null; then
+                echo -e "${RED}Error: gh CLI not found. Install with: brew install gh${NC}" >&2
+                exit 1
+            fi
+            if ! gh auth status &>/dev/null; then
+                echo -e "${RED}Error: gh CLI not authenticated. Run: gh auth login${NC}" >&2
+                exit 1
+            fi
+            local _pub_sha _pub_pj _pub_verdict="NONE" _pub_anchor="" _pub_state="none"
+            _pub_sha="$(git -C "$_pub_dir" rev-parse HEAD 2>/dev/null)" || _pub_sha=""
+            if [ -z "$_pub_sha" ]; then
+                echo -e "${RED}Refused: no HEAD commit to publish${NC}" >&2
+                exit 1
+            fi
+            _pub_pj="$(_deploy_latest_receipt "$_pub_dir")"
+            if [ -n "$_pub_pj" ]; then
+                _pub_verdict="$(_deploy_receipt_verdict "$_pub_pj")"
+                _pub_anchor="$(_deploy_anchor_ok "$_pub_pj" "$_pub_dir")"
+                if [ "$_pub_verdict" = "VERIFIED" ] && [ -z "$_pub_anchor" ]; then
+                    _pub_state="success"
+                else
+                    _pub_state="failure"
+                fi
+            fi
+
+            local _pub_url="" _pub_out=""
+            if git -C "$_pub_dir" remote get-url origin &>/dev/null; then
+                if [ -n "$_pub_anchor" ] || [ -z "$_pub_pj" ]; then
+                    echo -e "${RED}Refused: HEAD is not confirmed as the receipt anchor (${_pub_anchor:-no Evidence Receipt found}). Nothing was pushed.${NC}" >&2
+                    exit 1
+                fi
+                git -C "$_pub_dir" push origin HEAD || exit 1
+            else
+                [ -n "$_pub_name" ] || _pub_name="$(basename "$(cd "$_pub_dir" && pwd)")"
+                _pub_out="$(cd "$_pub_dir" && gh repo create "$_pub_name" "$_pub_vis" --source . --push 2>&1)" || {
+                    echo "$_pub_out" >&2
+                    echo -e "${RED}gh repo create failed; nothing published.${NC}" >&2
+                    exit 1
+                }
+                _pub_url="$(printf '%s\n' "$_pub_out" | grep -Eo 'https://github\.com/[^[:space:]]+' | head -1)"
+            fi
+            [ -n "$_pub_url" ] || _pub_url="$(git -C "$_pub_dir" remote get-url origin 2>/dev/null || true)"
+
+            local _pub_slug
+            _pub_slug="$(printf '%s' "$_pub_url" | sed -E 's|^.*github\.com[:/]||; s|\.git$||')"
+            if [ "$_pub_state" = "none" ]; then
+                echo -e "${YELLOW}No Evidence Receipt found: no loki/receipt status set.${NC}"
+            elif [ -z "$_pub_slug" ] || [ "$_pub_slug" = "$_pub_url" ]; then
+                echo -e "${YELLOW}Could not resolve owner/repo: no loki/receipt status set.${NC}"
+            else
+                gh api "repos/${_pub_slug}/statuses/${_pub_sha}" \
+                    -f "state=${_pub_state}" -f "context=loki/receipt" \
+                    -f "description=Evidence Receipt verdict: ${_pub_verdict}" >/dev/null \
+                    || echo -e "${YELLOW}Warning: could not set the loki/receipt status.${NC}" >&2
+                echo "loki/receipt status: ${_pub_state} (receipt ${_pub_verdict})"
+            fi
+            if [ -n "$_pub_url" ]; then
+                echo "Repository: ${_pub_url}"
+            else
+                echo "Repository URL could not be determined."
+            fi
+            ;;
+
         help|*)
             echo -e "${BOLD}loki github${NC} - GitHub integration management"
             echo ""
@@ -11049,6 +11186,7 @@ except: print(0)
             echo "  sync         Sync completed task status back to GitHub issues"
             echo "  export       Export local tasks as new GitHub issues"
             echo "  pr [name]    Create pull request from completed work"
+            echo "  publish [name] [--public]  Push to GitHub and set a loki/receipt commit status"
             echo ""
             echo "Environment Variables:"
             echo "  LOKI_GITHUB_IMPORT=true    Import open issues as tasks on start"
@@ -38275,39 +38413,21 @@ PYEOF
                 # The badge links to the gist we just published (no new egress).
                 # shields.io static/v1 query endpoint avoids structural hyphens.
                 local badge
-                badge=$(LOKI_PROOF_JSON="$pj" LOKI_GIST_URL="$LOKI_LAST_GIST_URL" "$_share_py3" -E - <<'PYEOF' 2>/dev/null || true
+                badge=$(LOKI_PROOF_JSON="$pj" "$_share_py3" -E - <<'PYEOF' 2>/dev/null || true
 # The cwd is the checkout being shared: drop it from sys.path before any
 # other import, or a committed json.py/os.py could answer this badge text.
 import sys; sys.path[:] = [p for p in sys.path if p not in ("", ".")]
 import json, os
-from urllib.parse import quote
 try:
     d = json.load(open(os.environ["LOKI_PROOF_JSON"]))
 except Exception:
     d = {}
-headline = (d.get("honesty") or {}).get("headline")
-# Exact-match ONLY. council.final_verdict is intentionally NOT consulted: it is
-# an LLM opinion, the precise fake-green source the deterministic headline
-# overrides. Unmapped headline -> no entry -> badge omitted.
-mapping = {
-    "VERIFIED": ("verified", "brightgreen"),
-    "VERIFIED WITH GAPS": ("verified with gaps", "orange"),
-    "NOT VERIFIED": ("not verified", "red"),
-}
-entry = mapping.get(headline)
-url = os.environ.get("LOKI_GIST_URL", "").strip()
-# Omit the badge for any unmapped headline (never green, never forced red),
-# and when we have no link target to point at.
-if entry and url:
-    message, color = entry
-    badge_img = (
-        "https://img.shields.io/static/v1?label=Loki"
-        "&message=" + quote(message)
-        + "&color=" + color
-    )
-    print("[![Loki: {msg}]({img})]({url})".format(msg=message, img=badge_img, url=url))
+h = (d.get("honesty") or {}).get("headline")
+if isinstance(h, str):
+    print(h)
 PYEOF
 )
+                badge=$(_loki_verdict_badge "$badge" "$LOKI_LAST_GIST_URL")
                 if [ -n "$badge" ]; then
                     echo ""
                     echo "Markdown badge (paste into a README or PR):"

package/autonomy/mcp-launch.sh

@@ -150,6 +150,7 @@ _ml_help() {
 Loki Mode -- launch the MCP (Model Context Protocol) server
 
 Usage: loki mcp [--transport stdio|http] [--port N] [--help]
+       loki mcp install --client claude|cursor|vscode|windsurf [--project|--global] [--print]
 
 Starts the Loki Mode MCP server so MCP-aware clients (Claude Code, IDEs)
 can call Loki's tools (memory, task queue, code search, build management).
@@ -200,8 +201,164 @@ install command to stderr and exits 2.
 EOF
 }
 
+# --- loki mcp install (TEN-ADOPTION-05) ------------------------------------
+# Registers the loki-mode stdio server (`npx -y loki-mode mcp`) in an MCP
+# client's config. The JSON merge keeps every other server and key, is a no-op
+# (byte-identical, no .bak) when loki-mode is already registered with the same
+# entry, writes <file>.bak before changing an existing file, and refuses to
+# touch invalid JSON.
+
+_ml_install_help() {
+    cat <<'EOF'
+Usage: loki mcp install --client claude|cursor|vscode|windsurf [--project|--global] [--print]
+
+Adds the loki-mode MCP server (npx -y loki-mode mcp) to a client's config.
+
+  claude    runs `claude mcp add loki-mode -- npx -y loki-mode mcp` when the
+            claude CLI is on PATH, otherwise prints that command.
+  cursor    .cursor/mcp.json (--project, default) or ~/.cursor/mcp.json (--global)
+  vscode    .vscode/mcp.json (project only), under the "servers" key
+  windsurf  ~/.codeium/windsurf/mcp_config.json (global only)
+
+Options:
+  --project   Write to the current project (claude: --scope project).
+  --global    Write to the user config (claude: --scope user).
+  --print     Print what would be written to stdout; write nothing.
+
+Existing files are merged (other servers and keys are kept), backed up to
+<file>.bak before a change, and left untouched if they are not valid JSON.
+EOF
+}
+
+# _ml_json_merge <file> <topkey> <type|-> : merge the loki-mode entry into file.
+# Exit codes: 0 ok (changed or already current), 3 invalid or unusable JSON.
+_ml_json_merge() {
+    python3 - "$1" "$2" "$3" <<'PY'
+import json, os, shutil, sys
+path, top, typ = sys.argv[1], sys.argv[2], sys.argv[3]
+entry = {"command": "npx", "args": ["-y", "loki-mode", "mcp"]}
+if typ != "-":
+    entry = dict([("type", typ)] + list(entry.items()))
+exists = os.path.exists(path)
+data = {}
+if exists:
+    try:
+        with open(path) as fh:
+            raw = fh.read()
+        data = json.loads(raw) if raw.strip() else {}
+    except (ValueError, OSError) as exc:
+        sys.stderr.write("Refusing to modify %s: not valid JSON (%s)\n" % (path, exc))
+        sys.exit(3)
+    if not isinstance(data, dict) or not isinstance(data.get(top, {}), dict):
+        sys.stderr.write("Refusing to modify %s: unexpected structure (need an object with an object '%s')\n" % (path, top))
+        sys.exit(3)
+servers = data.setdefault(top, {})
+if servers.get("loki-mode") == entry:
+    print("loki-mode already registered in %s" % path)
+    sys.exit(0)
+servers["loki-mode"] = entry
+if exists:
+    shutil.copy2(path, path + ".bak")
+else:
+    os.makedirs(os.path.dirname(path) or ".", exist_ok=True)
+with open(path, "w") as fh:
+    json.dump(data, fh, indent=2)
+    fh.write("\n")
+print("Registered loki-mode in %s" % path)
+PY
+}
+
+_ml_install_main() {
+    local client="" scope="" do_print=0
+    while [ $# -gt 0 ]; do
+        case "$1" in
+            --client) client="${2:-}"; shift 2 2>/dev/null || shift ;;
+            --client=*) client="${1#--client=}"; shift ;;
+            --project) scope="project"; shift ;;
+            --global) scope="global"; shift ;;
+            --print) do_print=1; shift ;;
+            --help|-h|help) _ml_install_help; return 0 ;;
+            *)
+                printf 'Unknown option for loki mcp install: %s\n' "$1" >&2
+                _ml_install_help >&2
+                return 2
+                ;;
+        esac
+    done
+    case "$client" in
+        claude|cursor|vscode|windsurf) ;;
+        *)
+            printf 'loki mcp install: --client must be one of claude, cursor, vscode, windsurf (got: %s)\n' "${client:-none}" >&2
+            return 2
+            ;;
+    esac
+
+    if [ "$client" = "claude" ]; then
+        local -a cmd=(claude mcp add)
+        case "$scope" in
+            project) cmd+=(--scope project) ;;
+            global) cmd+=(--scope user) ;;
+        esac
+        cmd+=(loki-mode -- npx -y loki-mode mcp)
+        if [ "$do_print" -eq 1 ] || ! command -v claude >/dev/null 2>&1; then
+            [ "$do_print" -eq 1 ] || printf 'claude CLI not found on PATH; run this command yourself:\n' >&2
+            printf '%s\n' "${cmd[*]}"
+            return 0
+        fi
+        "${cmd[@]}"
+        return $?
+    fi
+
+    local file top typ="-"
+    case "$client" in
+        cursor)
+            top="mcpServers"
+            if [ "$scope" = "global" ]; then file="$HOME/.cursor/mcp.json"; else file="$PWD/.cursor/mcp.json"; fi
+            ;;
+        vscode)
+            top="servers"; typ="stdio"
+            if [ "$scope" = "global" ]; then
+                printf 'loki mcp install: vscode supports --project only (workspace .vscode/mcp.json)\n' >&2
+                return 2
+            fi
+            file="$PWD/.vscode/mcp.json"
+            ;;
+        windsurf)
+            top="mcpServers"
+            if [ "$scope" = "project" ]; then
+                printf 'loki mcp install: windsurf supports --global only (~/.codeium/windsurf/mcp_config.json)\n' >&2
+                return 2
+            fi
+            file="$HOME/.codeium/windsurf/mcp_config.json"
+            ;;
+    esac
+
+    if ! command -v python3 >/dev/null 2>&1; then
+        printf 'loki mcp install needs python3 on PATH for the JSON merge.\n' >&2
+        return 2
+    fi
+    if [ "$do_print" -eq 1 ]; then
+        printf 'Would write to %s\n' "$file" >&2
+        python3 - "$top" "$typ" <<'PY'
+import json, sys
+top, typ = sys.argv[1], sys.argv[2]
+entry = {"command": "npx", "args": ["-y", "loki-mode", "mcp"]}
+if typ != "-":
+    entry = dict([("type", typ)] + list(entry.items()))
+print(json.dumps({top: {"loki-mode": entry}}, indent=2))
+PY
+        return 0
+    fi
+    _ml_json_merge "$file" "$top" "$typ"
+}
+
 # mcp_launch_main: dispatcher invoked by cmd_mcp() (autonomy/loki) or directly.
 mcp_launch_main() {
+    if [ "${1:-}" = "install" ]; then
+        shift
+        _ml_install_main "$@"
+        return $?
+    fi
     # Split argv into launcher-owned flags (consumed here) and server argv
     # (forwarded verbatim to the file-exec launch `python "$root/mcp/server.py"`).
     # The server's argparse only

package/completions/_loki

@@ -242,6 +242,7 @@ function _loki_commands {
         'secure:Secure-by-default gate (findings and waivers)'
         'own:Finish-and-own ownership handoff'
         'backup:Back up dashboard state (verified archive)'
+        'restore:Restore dashboard state from a verified backup archive'
         'telemetry:OpenTelemetry management'
         'agent:Agent type dispatch'
         'doctor:Check system prerequisites'