loki-mode 11.4.2 → 11.5.1

package/autonomy/provider-offer.sh

@@ -80,6 +80,60 @@ detect_any_provider() {
     return 1
 }
 
+# sdk_binary_present: true (0) when an executable Claude Agent SDK platform binary exists
+# in an installed node_modules. Shared by detect_bundled_sdk_provider and
+# loki_requirements_json.
+sdk_binary_present() {
+    # Search the node_modules trees Loki is actually installed into. The root is
+    # derived from THIS FILE's location (self-containment contract, see header):
+    # SKILL_DIR belongs to autonomy/loki and is NOT exported, so it would be
+    # empty when doctor.ts spawns this script standalone -- which would silently
+    # answer "no SDK" on the Bun route while the bash route said yes, exactly the
+    # kind of route split the parity gate exists to prevent.
+    # LOKI_SDK_NODE_MODULES is a TEST-ONLY seam (never set in production) so the
+    # shell tests can point at a fixture tree without mutating real node_modules.
+    local _po_root
+    _po_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." 2>/dev/null && pwd)" || _po_root=""
+    # Array, not a word-split string: install roots can contain spaces.
+    local _po_search=()
+    if [ -n "${LOKI_SDK_NODE_MODULES:-}" ]; then
+        # When the test seam is set it is AUTHORITATIVE (not merely first): the
+        # real tree must not be consulted as a fallback, or a fixture asserting
+        # "no usable SDK" would silently pass by finding the repo's own binary.
+        _po_search=("$LOKI_SDK_NODE_MODULES")
+    elif [ -n "$_po_root" ]; then
+        # Two layouts, both real:
+        #   repo clone      -> <root>/node_modules, <root>/loki-ts/node_modules
+        #   npm install     -> npm HOISTS the SDK out of node_modules/loki-mode/
+        #                      up to the installing tree's top-level
+        #                      node_modules/ (verified by packing this repo and
+        #                      installing the tarball). Without the hoisted
+        #                      candidates the predicate silently returns 1 for
+        #                      every npm-installed user, i.e. the feature would
+        #                      be dead for exactly the audience it targets.
+        # <root> is .../node_modules/loki-mode, so ../ is the @scope-less
+        # top-level node_modules and ../../ covers a scoped install.
+        _po_search=(
+            "$_po_root/node_modules"
+            "$_po_root/loki-ts/node_modules"
+            "$_po_root/.."
+            "$_po_root/../.."
+        )
+    fi
+    local _nm
+    for _nm in ${_po_search+"${_po_search[@]}"}; do
+        [ -n "$_nm" ] || continue
+        set -- "$_nm"/@anthropic-ai/claude-agent-sdk-*/claude
+        # Unmatched globs stay literal in bash, so test the expansion for real.
+        while [ "$#" -gt 0 ]; do
+            [ -x "$1" ] && return 0
+            shift
+        done
+    done
+    return 1
+}
+
+
 # detect_bundled_sdk_provider: true (0) only when the bundled Claude Agent SDK
 # can ACTUALLY run this machine's main loop with no separate CLI install.
 #
@@ -130,53 +184,7 @@ detect_bundled_sdk_provider() {
         return 1
     fi
 
-    # Search the node_modules trees Loki is actually installed into. The root is
-    # derived from THIS FILE's location (self-containment contract, see header):
-    # SKILL_DIR belongs to autonomy/loki and is NOT exported, so it would be
-    # empty when doctor.ts spawns this script standalone -- which would silently
-    # answer "no SDK" on the Bun route while the bash route said yes, exactly the
-    # kind of route split the parity gate exists to prevent.
-    # LOKI_SDK_NODE_MODULES is a TEST-ONLY seam (never set in production) so the
-    # shell tests can point at a fixture tree without mutating real node_modules.
-    local _po_root
-    _po_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." 2>/dev/null && pwd)" || _po_root=""
-    # Array, not a word-split string: install roots can contain spaces.
-    local _po_search=()
-    if [ -n "${LOKI_SDK_NODE_MODULES:-}" ]; then
-        # When the test seam is set it is AUTHORITATIVE (not merely first): the
-        # real tree must not be consulted as a fallback, or a fixture asserting
-        # "no usable SDK" would silently pass by finding the repo's own binary.
-        _po_search=("$LOKI_SDK_NODE_MODULES")
-    elif [ -n "$_po_root" ]; then
-        # Two layouts, both real:
-        #   repo clone      -> <root>/node_modules, <root>/loki-ts/node_modules
-        #   npm install     -> npm HOISTS the SDK out of node_modules/loki-mode/
-        #                      up to the installing tree's top-level
-        #                      node_modules/ (verified by packing this repo and
-        #                      installing the tarball). Without the hoisted
-        #                      candidates the predicate silently returns 1 for
-        #                      every npm-installed user, i.e. the feature would
-        #                      be dead for exactly the audience it targets.
-        # <root> is .../node_modules/loki-mode, so ../ is the @scope-less
-        # top-level node_modules and ../../ covers a scoped install.
-        _po_search=(
-            "$_po_root/node_modules"
-            "$_po_root/loki-ts/node_modules"
-            "$_po_root/.."
-            "$_po_root/../.."
-        )
-    fi
-    local _nm
-    for _nm in ${_po_search+"${_po_search[@]}"}; do
-        [ -n "$_nm" ] || continue
-        set -- "$_nm"/@anthropic-ai/claude-agent-sdk-*/claude
-        # Unmatched globs stay literal in bash, so test the expansion for real.
-        while [ "$#" -gt 0 ]; do
-            [ -x "$1" ] && return 0
-            shift
-        done
-    done
-    return 1
+    sdk_binary_present
 }
 
 # _po_assume_yes: true when the user has opted into unattended confirmation.
@@ -545,6 +553,46 @@ print(json.dumps({"selected": selected, "providers": rows}, indent=2))
     ) || return 1
 }
 
+# loki_requirements_json: print the setup requirements report (shared table
+# autonomy/lib/setup-requirements.json) as one JSON object, matching the "requirements"
+# key of the Bun doctor (loki-ts/src/commands/doctor.ts). Used by the minimal
+# `loki doctor --json` fallback when the Bun doctor cannot run. Presence only: unlike the
+# Bun evaluator it does not compare versions.
+loki_requirements_json() {
+    local table statuses="" id kind target values st v
+    table="$(cd "$(dirname "${BASH_SOURCE[0]}")" 2>/dev/null && pwd)/lib/setup-requirements.json"
+    if [ ! -f "$table" ] || ! command -v jq >/dev/null 2>&1; then
+        printf 'null\n'
+        return 0
+    fi
+    while IFS=$'\t' read -r id kind target values; do
+        st=missing
+        case "$kind" in
+            command) command -v "$target" >/dev/null 2>&1 && st=present ;;
+            env_any)
+                for v in ${target//,/ }; do [ -n "${!v:-}" ] && st=present; done ;;
+            env_value)
+                for v in ${target//,/ }; do
+                    case ",${values}," in *",${!v:-},"*) [ -n "${!v:-}" ] && st=present ;; esac
+                done ;;
+            sdk_binary) sdk_binary_present && st=present ;;
+        esac
+        statuses="${statuses}${id} ${st}"$'\n'
+    done < <(jq -r '.requirements[] | [.id, .kind, (.target | if type == "array" then join(",") else . end), ((.values // []) | join(","))] | @tsv' "$table")
+
+    jq -n --rawfile st <(printf '%s' "$statuses") --slurpfile t "$table" '
+      ($st | split("\n") | map(select(length > 0) | split(" ") | {(.[0]): .[1]}) | add) as $s
+      | $t[0] as $tab
+      | {paths: [ $tab.paths[] as $p
+          | ([ $tab.requirements[] | select(.path == $p.id)
+               | {id, label, level, status: $s[.id], detail: (if $s[.id] == "present" then null else "not found by presence check" end), fix} ]) as $items
+          | ([ $items[] | select(.level == "required") ]) as $req
+          | {id: $p.id, title: $p.title,
+             ready: (if ($req | length) > 0 then ($req | all(.status == "present")) else ($items | any(.status == "present")) end),
+             items: $items} ]}
+      | . + {first_task_ready: ((.paths[] | select(.id == "common") | .ready) and ([.paths[] | select(.id != "common") | .ready] | any))}'
+}
+
 # Executed directly (doctor.ts child_process bridge, or manual): run the offer.
 # When sourced by autonomy/loki, this block does not run.
 if [ "${BASH_SOURCE[0]}" = "$0" ]; then

package/autonomy/route.sh

@@ -45,7 +45,7 @@ loki_route_resolve() {
     local verb="$1"; shift
     R_DECIDED=0; R_E10=0; R_HARD=0; R_ENGINE=""; R_REASON=""; R_INPUT_TYPE=""; R_INPUT=""
     R_PROVIDER=""; R_MODEL=""; R_NOTICE=""; R_ERR=""; R_EXPLAIN=0; R_JSON=0; R_SESSION_MODEL=""; R_VERB=""
-    R_E10_ARGS=(); R_CLEAN=()
+    R_E10_ARGS=(); R_CLEAN=(); R_ADAPTER=""; R_CAPDIFF=()
 
     local a engine_req="" help=0 legacy_flag="" session_model="" provider_flag=""
     local -a positionals=() passthru=()
@@ -208,21 +208,53 @@ loki_route_resolve() {
             R_REASON="default: $R_INPUT_TYPE input runs on engine10 regardless of flag order"
         fi
     fi
+    _route_adapter_and_diffs "$legacy_flag"
     return 0
 }
 
+# Sets R_ADAPTER and R_CAPDIFF[] from R_ENGINE / R_PROVIDER. Empty R_CAPDIFF means the
+# full Claude Code path on the Loki 10 engine. Statements mirror providers/*.sh
+# (PROVIDER_HAS_TASK_TOOL=false for every non-claude provider).
+_route_adapter_and_diffs() {
+    local legacy_flag="$1"
+    R_CAPDIFF=()
+    if [ "$R_ENGINE" = "legacy" ]; then
+        R_ADAPTER="legacy-bash:$R_PROVIDER"
+        R_CAPDIFF+=("runs the previous bash loop (autonomy/run.sh) instead of the Loki 10 supervisor")
+        if [ -n "$legacy_flag" ]; then
+            R_CAPDIFF+=("honors $legacy_flag, which engine10 does not support")
+        fi
+    else
+        R_ADAPTER="engine10:$R_PROVIDER"
+    fi
+    case "$R_PROVIDER" in
+        claude) ;;
+        codex|cline|aider|opencode)
+            R_CAPDIFF+=("provider $R_PROVIDER has no Claude Code Task-tool subagents (providers/$R_PROVIDER.sh)") ;;
+        *)
+            R_CAPDIFF+=("provider $R_PROVIDER has no engine10 invoker") ;;
+    esac
+}
+
 # Print the route (human or --json). Returns 0.
 loki_route_print() {
     local shown="$R_INPUT"
     if [ "${#shown}" -gt 72 ]; then shown="$(printf '%s' "$shown" | cut -c1-69)..."; fi
     if [ "$R_JSON" = "1" ]; then
-        printf '{"engine":"%s","provider":"%s","model":"%s","input_type":"%s","input":"%s","reason":"%s"}\n' \
-            "$(_route_json_str "$R_ENGINE")" "$(_route_json_str "$R_PROVIDER")" "$(_route_json_str "$R_MODEL")" \
-            "$(_route_json_str "$R_INPUT_TYPE")" "$(_route_json_str "$shown")" "$(_route_json_str "$R_REASON")"
+        local diffs="" d
+        for d in ${R_CAPDIFF[@]+"${R_CAPDIFF[@]}"}; do
+            diffs="${diffs:+$diffs,}\"$(_route_json_str "$d")\""
+        done
+        printf '{"engine":"%s","adapter":"%s","provider":"%s","model":"%s","input_type":"%s","input":"%s","reason":"%s","capability_differences":[%s]}\n' \
+            "$(_route_json_str "$R_ENGINE")" "$(_route_json_str "$R_ADAPTER")" "$(_route_json_str "$R_PROVIDER")" "$(_route_json_str "$R_MODEL")" \
+            "$(_route_json_str "$R_INPUT_TYPE")" "$(_route_json_str "$shown")" "$(_route_json_str "$R_REASON")" "$diffs"
     else
-        printf 'engine:   %s\nprovider: %s\nmodel:    %s\ninput:    %s (%s)\nreason:   %s\n' \
-            "$R_ENGINE" "$R_PROVIDER" "$R_MODEL" "$R_INPUT_TYPE" "$shown" "$R_REASON"
+        printf 'engine:   %s\nadapter:  %s\nprovider: %s\nmodel:    %s\ninput:    %s (%s)\nreason:   %s\n' \
+            "$R_ENGINE" "$R_ADAPTER" "$R_PROVIDER" "$R_MODEL" "$R_INPUT_TYPE" "$shown" "$R_REASON"
+        local d
+        for d in ${R_CAPDIFF[@]+"${R_CAPDIFF[@]}"}; do printf 'differs:  %s\n' "$d"; done
     fi
+    return 0
 }
 
 # Entry used by bin/loki. Args: the full original argv. Sets R_* and returns:

package/autonomy/run.sh

@@ -31,7 +31,7 @@
 #   LOKI_RESOURCE_MEM_THRESHOLD  - Memory % threshold to warn (default: 80)
 #
 # Budget / Cost Limits (opt-in):
-#   LOKI_BUDGET_LIMIT            - Max USD spend before auto-pause (default: empty = unlimited)
+#   LOKI_BUDGET_LIMIT            - Max USD spend before auto-pause (default: loki-ts/data/model-pricing.json default_max_cost_usd, 100 USD; empty = unlimited)
 #                                  Example: "50.00" pauses session when estimated cost >= $50
 #
 # Security & Autonomy Controls (Enterprise):
@@ -532,7 +532,7 @@ for key, env_var in mapping.items():
     val = get_nested(data, key) or data.get(key) or data.get(key.replace('.', '_'))
     if val and isinstance(val, str):
         safe_val = shlex.quote(val)
-        print(f'[ -z \"\${{{env_var}:-}}\" ] && export {env_var}={safe_val}')
+        print(f'[ -z \"\${{{env_var}:-}}\" ] && export {env_var}={safe_val}' + (\" && export LOKI_BUDGET_SOURCE=config\" if env_var == 'LOKI_BUDGET_LIMIT' else ''))
 " 2>/dev/null)" 2>/dev/null || true
 }
 _LOKI_SETTINGS_FILE="${TARGET_DIR:-.}/.loki/config/settings.json" _load_json_settings
@@ -565,7 +565,23 @@ RESOURCE_MEM_THRESHOLD=${LOKI_RESOURCE_MEM_THRESHOLD:-80}     # Memory % thresho
 # it never kills work or discards a deliverable. The user removes .loki/PAUSE
 # to resume, or raises LOKI_BUDGET_LIMIT. Set LOKI_BUDGET_LIMIT="" to restore
 # the old unlimited behavior explicitly.
-BUDGET_LIMIT=${LOKI_BUDGET_LIMIT-"100.00"}  # USD. Note `-` not `:-`: an
+# LM-002: the default value is read from default_max_cost_usd in loki-ts/data/model-pricing.json, the same
+# file the Loki 10 engine reads (docs/cost-controls.md). "100.00" is only the
+# fallback when that file is absent, and budget_cap.test.ts pins it to the file.
+_loki_budget_default="$(sed -n 's/.*"default_max_cost_usd"[[:space:]]*:[[:space:]]*\([0-9][0-9.]*\).*/\1/p' \
+    "${SCRIPT_DIR}/../loki-ts/data/model-pricing.json" 2>/dev/null | head -n 1)"
+case "$_loki_budget_default" in
+    '' | *[!0-9.]*) _loki_budget_default="100.00" ;;
+    *) _loki_budget_default="$(awk -v v="$_loki_budget_default" 'BEGIN{printf "%.2f", v}')" ;;
+esac
+# Where the active cap came from: flag (loki start --budget), config (settings.json),
+# env (LOKI_BUDGET_LIMIT set by the caller), or default. Printed once at run start.
+if [ "${LOKI_BUDGET_LIMIT+set}" = "set" ]; then
+    BUDGET_SOURCE="${LOKI_BUDGET_SOURCE:-env}"
+else
+    BUDGET_SOURCE="default"
+fi
+BUDGET_LIMIT=${LOKI_BUDGET_LIMIT-"$_loki_budget_default"}  # USD. Note `-` not `:-`: an
                                             # explicit empty value means the
                                             # operator chose unlimited, and is
                                             # honored.
@@ -7536,7 +7552,7 @@ EOF
   "created_at": "$(date -u +%Y-%m-%dT%H:%M:%SZ)"
 }
 BUDGET_EOF
-        log_info "Budget limit set: \$$BUDGET_LIMIT"
+        log_info "Budget limit set: \$$BUDGET_LIMIT (source: ${BUDGET_SOURCE:-default})"
     fi
 
     # v7.0.0 Phase 2: remote->local hydrate. Runs ONCE at session boot (not
@@ -9041,21 +9057,25 @@ _read_iteration_cost() {
     if [ -f "$result_cost_file" ]; then
         python3 -c "
 import json
+def _c(v):
+    return v if isinstance(v, (int, float)) and not isinstance(v, bool) else 'unmeasured'
 try:
     d = json.load(open('$result_cost_file'))
     print(
         d.get('input_tokens', 0) or 0,
         d.get('output_tokens', 0) or 0,
-        d.get('total_cost_usd', 0) or 0,
+        _c(d.get('total_cost_usd')),
         d.get('cache_read_tokens', 0) or 0,
         d.get('cache_creation_tokens', 0) or 0,
     )
 except Exception:
-    print(0, 0, 0, 0, 0)
-" 2>/dev/null || echo "0 0 0 0 0"
+    print(0, 0, 'unmeasured', 0, 0)
+" 2>/dev/null || echo "0 0 unmeasured 0 0"
     elif [ -f ".loki/context/tracking.json" ]; then
         python3 -c "
 import json
+def _c(v):
+    return v if isinstance(v, (int, float)) and not isinstance(v, bool) else 'unmeasured'
 try:
     t = json.load(open('.loki/context/tracking.json'))
     iters = t.get('per_iteration', [])
@@ -9065,17 +9085,17 @@ try:
         print(
             m.get('input_tokens', 0),
             m.get('output_tokens', 0),
-            m.get('cost_usd', 0),
+            _c(m.get('cost_usd')),
             m.get('cache_read_tokens', 0),
             m.get('cache_creation_tokens', 0),
         )
     else:
-        print(0, 0, 0, 0, 0)
+        print(0, 0, 'unmeasured', 0, 0)
 except Exception:
-    print(0, 0, 0, 0, 0)
-" 2>/dev/null || echo "0 0 0 0 0"
+    print(0, 0, 'unmeasured', 0, 0)
+" 2>/dev/null || echo "0 0 unmeasured 0 0"
     else
-        echo "0 0 0 0 0"
+        echo "0 0 unmeasured 0 0"
     fi
 }
 
@@ -9192,6 +9212,15 @@ track_iteration_complete() {
 $iter_cost_line
 ITER_COST_EOF
 
+    # Unknown cost is omitted with a reason, never written as 0 (readers treat absence as unmeasured).
+    local iter_cost_json
+    case "${iter_cost:-unmeasured}" in
+        unmeasured) iter_cost_json='  "cost_unmeasured_reason": "no dollar figure recorded for this iteration",
+' ;;
+        *) iter_cost_json="  \"cost_usd\": ${iter_cost},
+" ;;
+    esac
+
     cat > ".loki/metrics/efficiency/iteration-${iteration}.json" << EFF_EOF
 {
   "iteration": $iteration,
@@ -9204,8 +9233,7 @@ ITER_COST_EOF
   "output_tokens": ${iter_output:-0},
   "cache_read_tokens": ${iter_cache_read:-0},
   "cache_creation_tokens": ${iter_cache_creation:-0},
-  "cost_usd": ${iter_cost:-0},
-  "timestamp": "$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+${iter_cost_json}  "timestamp": "$(date -u +%Y-%m-%dT%H:%M:%SZ)"
 }
 EFF_EOF
 

package/autonomy/setup-wizard.sh

@@ -4,7 +4,7 @@
 # file. `loki welcome` (intro), `loki quickstart` (first build) and
 # `loki doctor` (health) remain separate entry points.
 #
-# REQUIRED (doctor fails without them): node >= 18, python3 >= 3.8, jq, git, curl
+# REQUIRED (doctor fails without them): node >= 20, python3 >= 3.8, jq, git, curl
 # AT LEAST ONE of: a provider CLI (claude, codex, cline, aider, opencode) or the
 #   bundled Claude Agent SDK with credentials. Claude Code is the default.
 # OPTIONAL: bun (bundled by npm), bash >= 4, codex/cline/aider/opencode, ollama.
@@ -31,6 +31,14 @@ _lsw_confirm() {
     case "$ans" in y|Y|yes|YES) return 0 ;; *) return 1 ;; esac
 }
 
+_lsw_fix() {
+    # _lsw_fix ID FALLBACK -> the one-line fix from the shared requirements table
+    # (autonomy/lib/setup-requirements.json), the same text loki doctor prints.
+    local out=""
+    out="$(jq -r --arg id "$1" '.requirements[] | select(.id == $id) | .fix' "${SKILL_DIR}/autonomy/lib/setup-requirements.json" 2>/dev/null | head -n 1)" || out=""
+    printf '%s' "${out:-$2}"
+}
+
 _lsw_tool() {
     # _lsw_tool NAME LABEL INSTALL_HINT
     if command -v "$1" >/dev/null 2>&1; then
@@ -79,12 +87,12 @@ cmd_setup() {
     echo "Loki Mode setup"
     echo ""
     echo "1. Required tools"
-    _lsw_tool node REQUIRED "https://nodejs.org (Node 20+ recommended, 18 minimum)" || true
-    _lsw_tool python3 REQUIRED "brew install python3, or your package manager" || true
-    _lsw_tool jq REQUIRED "brew install jq, or your package manager" || true
-    _lsw_tool git REQUIRED "brew install git, or your package manager" || true
-    _lsw_tool curl REQUIRED "brew install curl, or your package manager" || true
-    _lsw_tool bun OPTIONAL "bundled by npm; else see https://bun.sh" || true
+    _lsw_tool node REQUIRED "$(_lsw_fix node "install Node 20+ from https://nodejs.org")" || true
+    _lsw_tool python3 REQUIRED "$(_lsw_fix python3 "install python3")" || true
+    _lsw_tool jq REQUIRED "$(_lsw_fix jq "install jq")" || true
+    _lsw_tool git REQUIRED "$(_lsw_fix git "install git")" || true
+    _lsw_tool curl REQUIRED "$(_lsw_fix curl "install curl")" || true
+    _lsw_tool bun OPTIONAL "$(_lsw_fix bun "bundled by npm; else see https://bun.sh")" || true
     if [ "$_LSW_MISSING" -gt 0 ]; then
         echo ""
         echo "Install the missing REQUIRED tools above with your package manager (setup never installs system packages), then rerun: loki setup"
@@ -95,7 +103,7 @@ cmd_setup() {
     echo "2. Provider CLI (Claude Code is the default and the only Tier-1 provider)"
     local p
     for p in codex cline aider opencode; do
-        _lsw_tool "$p" OPTIONAL "see 'loki doctor' for the command" || true
+        _lsw_tool "$p" OPTIONAL "$(_lsw_fix "$p" "see 'loki doctor' for the command")" || true
     done
     if command -v claude >/dev/null 2>&1; then
         printf '  [ OK ]  %-10s DEFAULT\n' claude
@@ -108,7 +116,7 @@ cmd_setup() {
             fi
         fi
     else
-        echo "  [MISS]  claude     DEFAULT. Install: npm install -g @anthropic-ai/claude-code   (then: claude auth login)"
+        echo "  [MISS]  claude     DEFAULT. Install: $(_lsw_fix claude "npm install -g @anthropic-ai/claude-code")   (then: claude auth login)"
         if [ "$check_only" = 0 ] && [ -f "${SKILL_DIR}/autonomy/provider-offer.sh" ]; then
             if _lsw_confirm "Run that install command now?"; then
                 # shellcheck disable=SC1091
@@ -118,7 +126,8 @@ cmd_setup() {
         fi
         if ! command -v claude >/dev/null 2>&1; then
             echo "          Claude Code is not mandatory if another provider above is installed,"
-            echo "          or if the bundled Claude Agent SDK has credentials."
+            echo "          or if you use the Anthropic API-key path (LOKI_SDK_MODE=full with ANTHROPIC_API_KEY)."
+            echo "          Requirements per path: loki doctor --requirements"
         fi
     fi
 

package/autonomy/verify.sh

@@ -2268,6 +2268,7 @@ verify_emit_evidence() {
     _V_SCOPE_SOFT_NET="${VERIFY_SCOPE_SOFT_NET_LINES:-}" \
     _V_SCOPE_MAX_FILES="${VERIFY_SCOPE_MAX_FILES:-}" \
     _V_SCOPE_MAX_NET="${VERIFY_SCOPE_MAX_NET_LINES:-}" \
+    _V_LIBDIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/lib" \
     _verify_py - <<'PYEOF'
 import json, os, hashlib, sys
 
@@ -2401,6 +2402,27 @@ if _scope_verdict:
         "thresholds": _thresholds,
     }
 
+# Verification record (docs/PROOF-PASSPORT.md): integrity, execution
+# validity (revision + environment) and requirement coverage, kept separate, plus
+# per-check status and a scoped label. Additive; verdict/exit_code are untouched.
+# A failure to build it is recorded, never swallowed into a clean-looking doc.
+try:
+    sys.path.insert(0, os.environ["_V_LIBDIR"])
+    import importlib.util
+    _spec = importlib.util.spec_from_file_location(
+        "loki_proof_verify", os.path.join(os.environ["_V_LIBDIR"], "proof-verify.py"))
+    _pv_mod = importlib.util.module_from_spec(_spec)
+    _spec.loader.exec_module(_pv_mod)
+    doc["verification"] = _pv_mod.build_for_evidence(
+        doc, repo_dir=".", loki_dir=os.environ.get("LOKI_DIR") or ".loki",
+        record_path="", fresh_capture=True)
+    # base_verdict duplicates doc["verdict"]; record_path would pin the output
+    # directory into a document that must be byte-identical across directories.
+    doc["verification"].pop("base_verdict", None)
+except Exception as _vr_exc:
+    doc["verification"] = {"schema_version": "1.0", "error": "verification record unavailable: %s" % _vr_exc,
+                           "label": doc["verdict"] + " (verification record unavailable)"}
+
 os.makedirs(out_dir, exist_ok=True)
 ev_path = os.path.join(out_dir, "evidence.json")
 with open(ev_path, "w") as f:
@@ -2437,6 +2459,10 @@ lines.append("# Autonomi Verify report")
 lines.append("")
 lines.append("Verdict: **%s** (exit %d)" % (doc["verdict"], doc["exit_code"]))
 lines.append("")
+_vr_label = (doc.get("verification") or {}).get("label")
+if _vr_label:
+    lines.append("Verification: %s" % _vr_label)
+    lines.append("")
 _llm = doc.get("llm_review") or {}
 _llm_status = _llm.get("status", "unavailable")
 if _llm_status == "reviewed":
@@ -3419,7 +3445,20 @@ verify_main() {
     # Under --json stdout carries the evidence document alone, so the human
     # banner is redirected to stderr rather than dropped: an operator watching a
     # terminal still sees the verdict, and `| jq` still parses.
-    printf 'VERDICT: %s\n' "$VERIFY_VERDICT" >&$_v_banner_fd
+    # Scoped label + compact reviewer summary from the verification record just
+    # written to evidence.json. The exit code is unchanged; only the wording is
+    # stricter: a skipped or not-run check never leaves a bare "VERIFIED".
+    local _v_lib _v_label _v_summary
+    _v_lib="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/lib"
+    _v_label="$VERIFY_VERDICT"
+    if [ -f "$_v_lib/proof-verify.py" ]; then
+        _v_summary="$(_verify_py "$_v_lib/proof-verify.py" summary "$out_dir/evidence.json" --embedded 2>/dev/null)" || _v_summary=""
+        if [ -n "$_v_summary" ]; then
+            _v_label="${_v_summary%%$'\n'*}"
+            printf '%s\n' "${_v_summary#*$'\n'}" >&$_v_banner_fd
+        fi
+    fi
+    printf 'VERDICT: %s\n' "$_v_label" >&$_v_banner_fd
     printf 'Evidence: %s/evidence.json\n' "$out_dir" >&$_v_banner_fd
     printf 'Report:   %s/report.md\n' "$out_dir" >&$_v_banner_fd
     # --hosted only: surface the enrichment in human output so the extra signal

package/completions/_loki

@@ -378,7 +378,8 @@ function _loki_provider {
         'show:Display current provider'
         'set:Set default provider'
         'list:List available providers'
-        'info:Get provider information'
+        'info:Get provider information (--json: capability contract)'
+        'matrix:Show the capability matrix'
         'help:Provider help'
     )
     _describe -t cmds 'provider subcommand' cmds
@@ -389,6 +390,7 @@ function _loki_plan {
         '--json[Machine-readable JSON output]' \
         '--verbose[Detailed per-iteration breakdown]' \
         '--spec[Write editable acceptance criteria to .loki/specs/<slug>.md]' \
+        '--requirements[Print the last run requirement-to-check map (read-only)]' \
         '*:prd file:_files'
 }
 

package/completions/loki.bash

@@ -67,7 +67,7 @@ _loki_completion() {
             ;;
 
         provider)
-            local provider_cmds="show set list info help"
+            local provider_cmds="show set list info matrix help"
             COMPREPLY=( $(compgen -W "${provider_cmds}" -- "$cur") )
             ;;
 
@@ -123,9 +123,15 @@ _loki_completion() {
             fi
             ;;
 
+        setup-skill)
+            if [[ "$cur" == -* ]]; then
+                COMPREPLY=( $(compgen -W "--claude-code --print --project --stop-hook --settings --help" -- "$cur") )
+                return 0
+            fi
+            ;;
         doctor)
             if [[ "$cur" == -* ]]; then
-                COMPREPLY=( $(compgen -W "--json --fix --help" -- "$cur") )
+                COMPREPLY=( $(compgen -W "--json --fix --repo --requirements --help" -- "$cur") )
                 return 0
             fi
             ;;
@@ -197,7 +203,7 @@ _loki_completion() {
 
         plan)
             if [[ "$cur" == -* ]]; then
-                COMPREPLY=( $(compgen -W "--json --verbose --spec --help" -- "$cur") )
+                COMPREPLY=( $(compgen -W "--json --verbose --spec --requirements --help" -- "$cur") )
                 return 0
             fi
             ;;

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "11.4.2"
+__version__ = "11.5.1"
 
 # Expose the control app for easy import
 try:

package/docs/CLI-REFERENCE.md

@@ -1,6 +1,6 @@
 # CLI reference
 
-Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.4.2. Do not edit by hand.
+Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.5.1. Do not edit by hand.
 Hidden and legacy-only commands are omitted; see `docs/v10/CLI-MODERN.md` for the full inventory.
 
 | Command | Description |
@@ -12,6 +12,8 @@ Hidden and legacy-only commands are omitted; see `docs/v10/CLI-MODERN.md` for th
 | `loki provider show` | Show current provider |
 | `loki provider list` | List providers and install status |
 | `loki provider set` | Switch the active provider |
+| `loki provider info` | Provider details; --json prints the capability contract |
+| `loki provider matrix` | Capability matrix per provider and engine |
 | `loki memory` | Cross-project learnings |
 | `loki memory list` | All learnings |
 | `loki memory index` | Show or rebuild the memory index |

package/docs/EVALUATING.md

@@ -184,6 +184,33 @@ per-call cost was not recorded.
 
 ---
 
+## 8. Harness attribution: what Loki adds to the same model
+
+Question: what does Loki add to the same underlying coding agent, and is the benefit worth its cost? Status: pilot. Six tasks, small n. A pilot reports variance; it is not proof of superiority. Running it is a separate, paid step.
+
+```bash
+loki bench attribution --dry-run                       # validate task set, print plan, no model call
+loki bench attribution --model <model-id> --execute    # run, spends API budget
+loki bench attribution --report <result.json>          # re-render the markdown report
+```
+
+Source checkout only. Implementation: `benchmarks/bench/attribution.py`, reusing `runner._apply_overlay`, `report._median` and `benchmarks/bench/adapters` (process-tree reaping, the Claude JSON parser, the Loki adapter and its cost collection). Options: `--tasks id,id`, `--repeats N` (default 1), `--model ID` (default `claude-sonnet-5`, or `LOKI_BENCH_MODEL`), `--budget-usd X` (default 5), `--timeout SECONDS` (default 900, capped by each task's `agent_timeout_s`), `--out-dir DIR`, `--tasks-dir DIR`. Without `--execute` it only prints the plan and never spawns `claude` or `loki`.
+
+Arms and controls: `raw_claude` runs `claude -p <prompt> --output-format json --model M --dangerously-skip-permissions --max-budget-usd B`; `loki` runs `loki start <prompt-file> --provider claude --no-dashboard --yes` with `LOKI_SESSION_MODEL=M` and `LOKI_BUDGET_LIMIT=B`. Both get a byte-identical seed in a fresh git repo with one fixed "seed" commit, the same prompt text (the PRD file for Loki is kept outside the workspace), the same wall-clock cap with the process tree reaped on timeout, separate scratch directories, a scoped child environment and `LOKI_NO_BROWSER=1`. The arm that goes first alternates per task and repeat. Every result JSON pins `claude --version`, `loki version`, the Loki commit SHA, Python version, model, budget, timeout, repeats, and per task the sha256 of the seed tree, acceptance tree and prompt. Disclosed difference: Loki runs its own planning, review and verification loop; that overhead is what is measured. Provider comparisons are out of scope so model and harness effects are not mixed.
+
+Tasks live under `benchmarks/attribution/tasks/<id>/` (2 bug fixes, 2 features, 1 refactor, 1 integration): `task.json`, `prompt.md` (the only instruction either arm sees), `seed/` (workspace), `acceptance/` (hidden test, copied in only after the run, overwriting same-named files) and `reference/` (known-good overlay, used only by tests). Exit code 0 from `acceptance.cmd` means accepted. The loader rejects a task whose acceptance test also appears in the seed. Neither arm grades itself: no council, RARV-C or LLM judge takes part in scoring.
+
+Metrics, per arm and per task class, computed by `compute_metrics`; failures, timeouts and harness errors stay in every denominator:
+
+- Acceptance rate: accepted / assigned, with a 95% Wilson interval.
+- False-completion rate: (reported success and not accepted) / reported success; null when nothing reported success. Reported success means `claude -p` exits 0 with `is_error` false, or `loki start` exits 0.
+- Cost per accepted task: total measured spend across all attempts / accepted. Null (`undefined_no_accepted`) when none accepted. A run with no cost figure is `unmeasured`, never zero: some unmeasured gives `partial_lower_bound` (per-accepted null, lower bound only), all unmeasured gives `unmeasured`. Cost is API-dollar accounting; subscription use is not converted.
+- Elapsed time: median over accepted runs, with completion rate, timeout count and error count; median over all runs is also given.
+
+Not measured: human effort, recovery success, review quality. Output: `--out-dir` (default `benchmarks/attribution/results/`) receives `attribution-<UTC stamp>.json` and the matching `.md`. Publish failures, timeouts and exclusions with the report; do not drop rows. Do not claim superiority from overlapping intervals on a handful of runs; use the pilot to size a larger run with `--repeats` above 1. Tests: `python3 benchmarks/bench/tests/test_attribution.py` (no model call).
+
+---
+
 ## What we do not have
 
 Stating this plainly, because you will find it out anyway and it is cheaper for

package/docs/HARNESS-INTELLIGENCE-PLAN.md

@@ -133,6 +133,26 @@ Cap overrides (only meaningful when feature 8 is on):
 Profile knobs: `LOKI_REPO_PROFILE_TTL_SECONDS` (86400),
 `LOKI_REPO_PROFILE_MAX_CHARS` (2000).
 
+## Repo commands and baseline (REPOMEM, same module)
+
+`loki-ts/src/runner/repo_profile.ts` also owns the commands profile the engine10 path uses (`loki start`). The goal: the user never explains how the repo builds and tests, and a failure that was already there never blocks the run. It is not gated by `LOKI_REPO_PROFILE`; disable it with `LOKI_REPO_BASELINE=0`. Both profiles share one manifest hash (`manifestHash`: sha256 over name and content of package.json, requirements.txt, Makefile, pyproject.toml, tox.ini, pytest.ini, setup.cfg, go.mod, Cargo.toml and `.github/workflows/*.yml`).
+
+Artifact: `.loki/state/repo-profile.json` (version 1, `CommandProfile`), written by engine10 intake.
+
+- `revision`: HEAD the baseline ran on. `manifest_hash`: as above.
+- `commands[]`: `{kind: test|lint|typecheck|build, cmd, source, validated, exit_code, duration_s, failing_ids}`. `validated` is true only when the command ran to completion on the untouched tree, false when it could not run (missing, timed out), null when discovered but not executed. Only the first test command is executed.
+- `baseline`: `{ran, command, exit_code, duration_s, timed_out, failing_ids, attributable, reason?}`. `attributable` means exit 0, or non-zero with parseable failing ids (`failIds`).
+
+Lifecycle:
+
+1. Intake (after the dirty-tree refusal and the `.loki/` exclude, before any agent edit): same manifest hash and HEAD reuses the file; same hash and a new HEAD keeps the commands and re-runs only the baseline; a changed hash rediscovers and re-runs (`ensureProfile`).
+2. Baseline: `sh -c <test cmd>` in the repo, 60s timeout (SIGKILL), scoped env (`plainTestEnv`, `PYTHONDONTWRITEBYTECODE=1`, `CI=1`). Untracked files the run created are removed so the diff stays the agent's.
+3. Implementer brief (`briefContext`, e10ext/context.ts): a "Repo commands" block and the known-red test ids (`profileBrief`). Bytes depend only on the profile content (no timestamps).
+4. Verify (`verifyStage`): `attribute()` marks a failing check pre-existing only when the profile revision equals the run base sha, the baseline was attributable, the check is neither a Wall/task-named target nor in a file the diff touched, and every one of its failing ids is in the baseline. Those join `pre_red` and `pre_red_checks`. Everything else that fails is introduced and blocks as before; a check with no parsed ids is introduced. Verify data gains `baseline_line` (`baseline: N pre-existing failing check(s) (not blocking), M introduced (blocking)`) and `introduced_checks`; seal lists the line under NOT PROVEN only when a baseline failure was excused.
+5. Surface: `loki doctor --repo` (and `--repo --json`) prints the profile, read-only, from the current directory.
+
+`e10ext/repomemory.ts` still holds the last verified command, flaky list and failure causes (dynamic per-repo cache data, not discovery).
+
 ## Acceptance
 
 1. With all flags unset, `bun test tests/parity/` stays 60/60 byte-exact.