loki-mode 11.77.0 → 11.79.0

package/autonomy/run.sh

@@ -6386,7 +6386,7 @@ ${_del_receipt}"
 # legacy parallel workflow remains byte-for-byte on its old path.
 _loki_exec_manifest() {
     [ "${LOKI_EXEC_MANIFEST:-0}" = "1" ] || return 0
-    bun "${SCRIPT_DIR}/../loki-ts/dist/loki.js" internal exec-manifest "$@"
+    bun --no-env-file --config=/dev/null "${SCRIPT_DIR}/../loki-ts/dist/loki.js" internal exec-manifest "$@"
 }
 
 init_exec_manifest() {
@@ -15759,6 +15759,29 @@ enforce_mock_integrity() {
     return 0
 }
 
+# Skill-declared checks gate. Delegates to `loki internal skill-checks` (the Bun
+# runSkillChecks implementation) so both routes run the same commands with the
+# same hardened env. Sets _LOKI_SKILL_CHECKS_STATUS to pass|fail|not_run.
+# Fail closed: a missing launcher, missing bun, or an absent subcommand (rc 2,
+# e.g. a stale build) is recorded not_run, never pass; any other non-zero rc
+# (a failed check, or the runner erroring) is a fail.
+enforce_skill_checks() {
+    local _sk_loki="${PROJECT_DIR}/bin/loki" _sk_out _sk_rc=0
+    _LOKI_SKILL_CHECKS_STATUS="not_run"
+    _LOKI_SKILL_CHECKS_REASON="launcher_absent"
+    _LOKI_SKILL_CHECKS_DETAIL=""
+    if [ ! -x "$_sk_loki" ] || ! command -v bun >/dev/null 2>&1; then
+        return 0
+    fi
+    _sk_out="$(cd "${TARGET_DIR:-.}" 2>/dev/null && "$_sk_loki" internal skill-checks 2>&1)" || _sk_rc=$?
+    _LOKI_SKILL_CHECKS_DETAIL="$(printf '%s' "$_sk_out" | tail -n 3 | tr '\n' ' ' | cut -c1-500)"
+    case "$_sk_rc" in
+        0) _LOKI_SKILL_CHECKS_STATUS="pass"; _LOKI_SKILL_CHECKS_REASON="measured"; return 0 ;;
+        2) _LOKI_SKILL_CHECKS_REASON="subcommand_absent"; return 0 ;;
+        *) _LOKI_SKILL_CHECKS_STATUS="fail"; _LOKI_SKILL_CHECKS_REASON="check_failed_or_runner_error"; return 1 ;;
+    esac
+}
+
 enforce_lsp_diagnostics() {
     local lsp_file="${TARGET_DIR:-.}/.loki/quality/lsp-diagnostics.json"
     local verdict="absent"
@@ -16977,6 +17000,32 @@ _severity_is_blocking() {
     grep -qiE '(\[(critical|high)\])|(\*\*[[:space:]]*(critical|high)[[:space:]]*\*\*)|(severity:?[[:space:]]*(critical|high))|(^[[:space:]]*[-*][[:space:]]+(critical|high)([[:space:]:.,*]|$))' "$file"
 }
 
+# Advisory reviewers run and record findings but carry no veto. Default on;
+# LOKI_REVIEW_ADVISORY=0 restores blocking. Parity-locked with
+# ADVISORY_REVIEWERS / isAdvisoryReviewer() in loki-ts/src/runner/quality_gates.ts.
+_is_advisory_reviewer() {
+    [ "${LOKI_REVIEW_ADVISORY:-1}" != "0" ] || return 1
+    case "$1" in
+        architecture-strategist|maintainer-mergeability|test-coverage-auditor) return 0 ;;
+        *) return 1 ;;
+    esac
+}
+
+# Count Critical and High findings in a reviewer file, same 4 severity forms as
+# _severity_is_blocking. Echoes "<critical_count> <high_count>". Parity-locked
+# with countBlockingSeverityFindings() in loki-ts/src/runner/quality_gates.ts.
+_count_blocking_severity_findings() {
+    local file="$1"
+    if [ ! -f "$file" ]; then
+        echo "0 0"
+        return 0
+    fi
+    local crit high
+    crit=$(grep -icE '(\[critical\])|(\*\*[[:space:]]*critical[[:space:]]*\*\*)|(severity:?[[:space:]]*critical)|(^[[:space:]]*[-*][[:space:]]+critical([[:space:]:.,*]|$))' "$file")
+    high=$(grep -icE '(\[high\])|(\*\*[[:space:]]*high[[:space:]]*\*\*)|(severity:?[[:space:]]*high)|(^[[:space:]]*[-*][[:space:]]+high([[:space:]:.,*]|$))' "$file")
+    echo "${crit:-0} ${high:-0}"
+}
+
 # 7.114.0 (rank 9): count non-blocking (Medium/Low) findings in a reviewer file.
 # Feeds the weighted mergeability quality score. Mirrors the severity-token
 # tolerance of _severity_is_blocking (bracketed, bold, 'Severity:', or bullet).
@@ -17961,7 +18010,10 @@ reviewers = mandatory + [
 # TRIMMING ORDER IS A SAFETY PROPERTY. Mandatory reviewers
 # (requirements-verifier, architecture-strategist, maintainer-mergeability) are
 # NEVER dropped: each carries a mandate no keyword-selected specialist has, and
-# shrinking a council must never be able to manufacture an approval. Only the
+# shrinking a council must never be able to manufacture an approval. They are
+# mandatory to run, not to block: architecture-strategist, maintainer-mergeability
+# and test-coverage-auditor are advisory (findings recorded, no veto) unless
+# LOKI_REVIEW_ADVISORY=0. Only the
 # appended tail (installed agents, then keyword specialists beyond the floor) is
 # trimmed, and the cap can never cut below the mandatory set.
 #
@@ -18837,6 +18889,10 @@ REVIEW_WAVE_TIMING
     # reviewers to compute the weighted mergeability quality score below.
     local nonblocking_medium=0
     local nonblocking_low=0
+    # Advisory reviewers: Critical/High counts recorded with no veto.
+    local advisory_critical=0
+    local advisory_high=0
+    local reviewer_rows=""
 
     for i in $(seq 0 $((reviewer_count - 1))); do
         local reviewer_name
@@ -18892,9 +18948,24 @@ REVIEW_WAVE_TIMING
         # contradictory PASS token. Structured output already normalizes this in
         # cr-rematerialize.py; keep the text fallback equally fail-closed.
         local _reviewer_has_blocking=false
+        local _reviewer_advisory=false _sev_counts _sev_crit _sev_high
+        if _is_advisory_reviewer "$reviewer_name"; then
+            _reviewer_advisory=true
+        fi
+        _sev_counts=$(_count_blocking_severity_findings "$review_output")
+        _sev_crit=${_sev_counts%% *}
+        _sev_high=${_sev_counts##* }
+        if [ "$_reviewer_advisory" = "true" ]; then
+            advisory_critical=$((advisory_critical + _sev_crit))
+            advisory_high=$((advisory_high + _sev_high))
+        fi
         if _severity_is_blocking "$review_output"; then
-            _reviewer_has_blocking=true
-            has_blocking=true
+            if [ "$_reviewer_advisory" = "true" ]; then
+                log_warn "ADVISORY: $reviewer_name recorded critical=$_sev_crit high=$_sev_high (no veto; LOKI_REVIEW_ADVISORY=0 restores blocking)"
+            else
+                _reviewer_has_blocking=true
+                has_blocking=true
+            fi
             if [ "$verdict" = "PASS" ]; then
                 log_error "BLOCKING: $reviewer_name returned PASS with Critical/High findings; normalizing verdict to FAIL"
                 verdict="FAIL"
@@ -18915,6 +18986,8 @@ REVIEW_WAVE_TIMING
                 log_error "BLOCKING: structured requirements contract did not pass"
             elif [ "$_reviewer_has_blocking" = "true" ]; then
                 log_error "BLOCKING: $reviewer_name found Critical/High severity issues"
+            elif [ "$_reviewer_advisory" = "true" ]; then
+                log_warn "FAIL: advisory reviewer $reviewer_name (non-blocking)"
             else
                 log_warn "FAIL: $reviewer_name found Medium/Low issues (non-blocking)"
             fi
@@ -18923,6 +18996,8 @@ REVIEW_WAVE_TIMING
             log_info "PASS: $reviewer_name"
         fi
         verdicts_summary="${verdicts_summary}${reviewer_name}:${verdict:-UNKNOWN} "
+        reviewer_rows="${reviewer_rows}${reviewer_name}|${verdict}|${_reviewer_advisory}|${_sev_crit}|${_sev_high}
+"
     done
 
     # Finding #596 FIX A2 + WAVE8 FIX run.sh-F3: a review is INCONCLUSIVE (=>
@@ -18983,6 +19058,9 @@ REVIEW_WAVE_TIMING
     export LOKI_REVIEW_AGG_QSCORE="$quality_score"
     export LOKI_REVIEW_AGG_QMED="$nonblocking_medium"
     export LOKI_REVIEW_AGG_QLOW="$nonblocking_low"
+    export LOKI_REVIEW_AGG_ADV_CRIT="$advisory_critical"
+    export LOKI_REVIEW_AGG_ADV_HIGH="$advisory_high"
+    export LOKI_REVIEW_AGG_ROWS="$reviewer_rows"
     python3 -E - << 'AGG_SCRIPT'
 import sys; sys.path[:] = [p for p in sys.path if p not in ("", ".")]
 import json, os
@@ -18999,7 +19077,15 @@ result = {
     # else 100 - 5*medium - 2*low, floored at 0). Reported metric, not a hard gate.
     "quality_score": int(os.environ["LOKI_REVIEW_AGG_QSCORE"]),
     "nonblocking_medium": int(os.environ["LOKI_REVIEW_AGG_QMED"]),
-    "nonblocking_low": int(os.environ["LOKI_REVIEW_AGG_QLOW"])
+    "nonblocking_low": int(os.environ["LOKI_REVIEW_AGG_QLOW"]),
+    # Advisory reviewers run and record findings without a veto; never silent.
+    "advisory_critical": int(os.environ["LOKI_REVIEW_AGG_ADV_CRIT"]),
+    "advisory_high": int(os.environ["LOKI_REVIEW_AGG_ADV_HIGH"]),
+    "reviewers": [
+        {"name": f[0], "verdict": f[1], "advisory": f[2] == "true",
+         "critical": int(f[3]), "high": int(f[4])}
+        for f in (ln.split("|") for ln in os.environ["LOKI_REVIEW_AGG_ROWS"].splitlines() if ln.strip())
+    ]
 }
 with open(os.environ["LOKI_REVIEW_AGG_FILE"], "w") as f:
     json.dump(result, f, indent=2)
@@ -19008,6 +19094,7 @@ AGG_SCRIPT
     unset LOKI_REVIEW_AGG_PASS LOKI_REVIEW_AGG_FAIL LOKI_REVIEW_AGG_BLOCKING LOKI_REVIEW_AGG_VERDICTS
     unset LOKI_REVIEW_AGG_REAL LOKI_REVIEW_AGG_INCONCLUSIVE
     unset LOKI_REVIEW_AGG_QSCORE LOKI_REVIEW_AGG_QMED LOKI_REVIEW_AGG_QLOW
+    unset LOKI_REVIEW_AGG_ADV_CRIT LOKI_REVIEW_AGG_ADV_HIGH LOKI_REVIEW_AGG_ROWS
 
     emit_event_json "code_review_council_complete" \
         "review_id=$review_id" \
@@ -19236,6 +19323,9 @@ DA_AGG_PATCH
     fi
 
     log_info "Code review passed ($pass_count/$reviewer_count PASS, $fail_count FAIL - no blocking issues)"
+    if [ "$((advisory_critical + advisory_high))" -gt 0 ]; then
+        log_warn "Advisory findings (no veto): critical=$advisory_critical high=$advisory_high; see $review_dir/$review_id/aggregate.json"
+    fi
     return 0
 }
 
@@ -27067,9 +27157,36 @@ EOF
                 gate_failures="${gate_failures}production_build,"
                 log_warn "Production build gate FAILED ($build_count consecutive)"
             fi
+            # Skill-declared checks gate (bash-route parity with the Bun
+            # skill_checks gate). Blocking, fail closed. Toggle
+            # LOKI_GATE_SKILL_CHECKS (default on), same predicate as the Bun
+            # route flag() in quality_gates.ts: unset/empty = on, else only
+            # "true" or "1" keeps the gate on. Runs through the Bun
+            # implementation, so the commands executed and their env match.
+            if [ -z "${LOKI_GATE_SKILL_CHECKS:-}" ] || [ "${LOKI_GATE_SKILL_CHECKS}" = "true" ] || [ "${LOKI_GATE_SKILL_CHECKS}" = "1" ]; then
+            log_info "Quality gate: skill-declared checks..."
+            local _stg_t0=$(date +%s 2>/dev/null); local _stg_ok=pass
+            enforce_skill_checks || true
+            _stg_ok="${_LOKI_SKILL_CHECKS_STATUS:-not_run}"
+            case "$_stg_ok" in
+                pass) clear_gate_failure "skill_checks" ;;
+                fail)
+                    local sk_count
+                    sk_count=$(track_gate_failure "skill_checks")
+                    gate_failures="${gate_failures}skill_checks,"
+                    log_warn "Skill checks gate FAILED ($sk_count consecutive) - ${_LOKI_SKILL_CHECKS_DETAIL:-}"
+                    ;;
+                *) log_info "Skill checks: gate did not run (${_LOKI_SKILL_CHECKS_REASON:-unknown})" ;;
+            esac
+            emit_stage_complete "skill_checks" "$_stg_ok" "$_stg_t0"
+            fi
             # Secure-by-default scan (v7.87.0). Advisory by default (never
             # blocks); records .loki/quality/security-findings.json each
             # iteration. Blocks only on un-waived HIGH when LOKI_SECURE_GATE=block.
+            # LOKI_GATE_SECURITY_SCAN toggle (default on), same predicate as the
+            # Bun route flag() in quality_gates.ts: unset/empty = on, else only
+            # "true" or "1" keeps the gate on.
+            if [ -z "${LOKI_GATE_SECURITY_SCAN:-}" ] || [ "${LOKI_GATE_SECURITY_SCAN}" = "true" ] || [ "${LOKI_GATE_SECURITY_SCAN}" = "1" ]; then
             log_info "Quality gate: security scan (advisory)..."
             local _stg_t0=$(date +%s 2>/dev/null); local _stg_ok=pass
             if run_secure_scan; then
@@ -27082,6 +27199,7 @@ EOF
                 log_warn "Security gate BLOCKED ($sec_count consecutive) - un-waived HIGH findings (LOKI_SECURE_GATE=block)"
             fi
             emit_stage_complete "security_scan" "$_stg_ok" "$_stg_t0"
+            fi
             # BUG-ST-002: Check pause signal between quality gates
             if [ -f "${TARGET_DIR:-.}/.loki/PAUSE" ] || [ -f "${TARGET_DIR:-.}/.loki/STOP" ]; then
                 log_warn "Pause/stop signal detected between quality gates - deferring remaining gates"
@@ -27403,7 +27521,7 @@ EOF
                     local _phase1_overrode=false
                     if [ "${LOKI_OVERRIDE_COUNCIL:-1}" != "0" ] && command -v bun >/dev/null 2>&1; then
                         local _override_out
-                        _override_out=$(bun "${SCRIPT_DIR}/../loki-ts/dist/loki.js" internal phase1-hooks override "$ITERATION_COUNT" 2>/dev/null || true)
+                        _override_out=$(bun --no-env-file --config=/dev/null "${SCRIPT_DIR}/../loki-ts/dist/loki.js" internal phase1-hooks override "$ITERATION_COUNT" 2>/dev/null || true)
                         case "$_override_out" in
                             *"override: LIFTED"*)
                                 log_info "Phase 1 override council lifted code_review BLOCK"
@@ -27435,7 +27553,7 @@ EOF
                         # v7.5.3 Phase 1 hook: structured handoff doc before
                         # bare PAUSE. Embedded; opt out LOKI_HANDOFF_MD=0.
                         if [ "${LOKI_HANDOFF_MD:-1}" != "0" ] && command -v bun >/dev/null 2>&1; then
-                            bun "${SCRIPT_DIR}/../loki-ts/dist/loki.js" internal phase1-hooks handoff code_review "$cr_count" "$ITERATION_COUNT" 2>/dev/null || true
+                            bun --no-env-file --config=/dev/null "${SCRIPT_DIR}/../loki-ts/dist/loki.js" internal phase1-hooks handoff code_review "$cr_count" "$ITERATION_COUNT" 2>/dev/null || true
                         fi
                         touch "${TARGET_DIR:-.}/.loki/PAUSE"
                         gate_failures="${gate_failures}code_review_PAUSED,"
@@ -27456,7 +27574,7 @@ EOF
                     # Best-effort; never fails the main loop.
                     if [ "${LOKI_INJECT_FINDINGS:-1}" != "0" ]; then
                         if command -v bun >/dev/null 2>&1; then
-                            bun "${SCRIPT_DIR}/../loki-ts/dist/loki.js" internal phase1-hooks reflect "$ITERATION_COUNT" 2>/dev/null || true
+                            bun --no-env-file --config=/dev/null "${SCRIPT_DIR}/../loki-ts/dist/loki.js" internal phase1-hooks reflect "$ITERATION_COUNT" 2>/dev/null || true
                         else
                             # DEGRADED, and said so. Findings injection is what
                             # tells the next iteration WHAT to fix; without it the

package/autonomy/telemetry.sh

@@ -408,6 +408,19 @@ loki_emit_build_verified() {
     return 0
 }
 
+# loki_emit_seal_hook_decision <allow|block> <reason>: one event per loki-seal
+# Stop hook decision (the Claude Code wedge). Enum args only: any decision or
+# reason outside the fixed lists sends nothing, and the schema re-filters. Never
+# a path, file name, test name or error text. Same strict analytics gate as
+# build_verified, so every existing opt-out wins.
+loki_emit_seal_hook_decision() {
+    _loki_analytics_enabled || return 0
+    case "${1:-}" in allow|block) ;; *) return 0 ;; esac
+    case "${2:-}" in none|tests_failed|tests_weakened|no_tests|contract_unverified|released|error) ;; *) return 0 ;; esac
+    loki_telemetry "seal_hook_decision" "decision=$1" "reason=$2"
+    return 0
+}
+
 # loki_emit_build_verified_enum <headline> <route>: build_verified for the
 # default engine10 route, which has no proof.json reader. Enum args only:
 # anything but headline=VERIFIED and route=engine10 sends nothing. Same strict

package/autonomy/verify.sh

@@ -2972,9 +2972,9 @@ verify_hosted_enrich() {
     [ -z "$engine_base" ] && engine_base="$base_ref"
     local engine_out engine_rc
     if [ -n "$engine_base" ]; then
-        engine_out="$(bun "$bundle" --dir . --base "$engine_base" 2>/dev/null)"; engine_rc=$?
+        engine_out="$(bun --no-env-file --config=/dev/null "$bundle" --dir . --base "$engine_base" 2>/dev/null)"; engine_rc=$?
     else
-        engine_out="$(bun "$bundle" --dir . 2>/dev/null)"; engine_rc=$?
+        engine_out="$(bun --no-env-file --config=/dev/null "$bundle" --dir . 2>/dev/null)"; engine_rc=$?
     fi
     if [ "$engine_rc" -ne 0 ] || [ -z "$engine_out" ]; then
         _verify_log "hosted: embedded engine unusable (rc=$engine_rc); keeping deterministic verdict (fail-open)"

package/bin/loki

@@ -103,6 +103,11 @@ fi
 # v7.4.2 fix (BUG-1): BUN_FROM_SOURCE=1 used to hard-fail on npm/Docker/brew
 # installs because src/ is excluded by .npmignore. Now we warn once and fall
 # back to dist if src/cli.ts is missing.
+# Bun auto-loads bunfig.toml (preload scripts) and .env from its cwd, and the cwd is the
+# user's repo, which may be hostile. Every Bun entry below passes these flags: no .env, and
+# an empty config (/dev/null) instead of the repo's bunfig.toml. The cwd itself is unchanged,
+# so commands still operate on the user's repo.
+_LOKI_BUN_SAFE=(--no-env-file --config=/dev/null)
 if [ -n "${LOKI_TS_ENTRY:-}" ]; then
     # v7.5.1 fix B18: validate that the explicit override actually exists.
     # Pre-v7.5.1 a typo (LOKI_TS_ENTRY=/nonexistent) produced a raw Bun
@@ -166,7 +171,7 @@ if [ -t 1 ] && [ -z "${CI:-}" ] && [ "${LOKI_NO_COMPLETIONS:-}" != "1" ] \
    && [ "${1:-}" != "completion" ] && [ "${1:-}" != "__complete" ] \
    && [ "$(cat "${HOME}/.loki/completions-version" 2>/dev/null)" != "$(cat "$REPO_ROOT/VERSION" 2>/dev/null)" ] \
    && command -v bun >/dev/null 2>&1; then
-    bun "$BUN_CLI" completion --auto </dev/null || true
+    bun "${_LOKI_BUN_SAFE[@]}" "$BUN_CLI" completion --auto </dev/null || true
 fi
 
 # v7.88.1 covert-path fix (council cF_r2 + cG_r2 sentinel edge): under on-by-default
@@ -494,7 +499,7 @@ if [ "${1:-}" = "modernize" ]; then
         if [ "$_loki_mod_a" = "--to" ] || [ "${2:-}" = "unit" ]; then
             _lb=$(_loki_bun)
             [ -n "$_lb" ] || { echo "Error: loki modernize needs bun." >&2; exit 1; }
-            exec "$_lb" "$BUN_CLI" engine10 "$@"
+            exec "$_lb" "${_LOKI_BUN_SAFE[@]}" "$BUN_CLI" engine10 "$@"
         fi
     done
     unset _loki_mod_a
@@ -586,7 +591,7 @@ if [ "${1:-}" = "start" ]; then
                 _lb=$(_loki_bun)
                 [ -n "$_lb" ] || { echo "loki: --attempts $_loki_att_n needs bun (install from https://bun.sh); refusing to run a single attempt silently." >&2; exit 1; }
                 _loki_attempts_refuse "${@:2}"
-                exec "$_lb" "$BUN_CLI" "$@"
+                exec "$_lb" "${_LOKI_BUN_SAFE[@]}" "$BUN_CLI" "$@"
                 ;;
             *) echo "loki: --attempts must be an integer from 1 to 5, got '$_loki_att_n'." >&2; exit 2 ;;
         esac
@@ -602,7 +607,7 @@ if [ "${1:-}" = "start" ]; then
             --spec|--spec=*|--spec-first)
                 _lb=$(_loki_bun)
                 [ -n "$_lb" ] || { echo "loki: --spec needs bun (install from https://bun.sh)." >&2; exit 1; }
-                exec "$_lb" "$BUN_CLI" "$@"
+                exec "$_lb" "${_LOKI_BUN_SAFE[@]}" "$BUN_CLI" "$@"
                 ;;
         esac
     done
@@ -617,7 +622,7 @@ if [ "${1:-}" = "start" ]; then
     for _loki_da in "${@:2}"; do [ "$_loki_da" = "--dry-run" ] && _loki_dry=1; done
     if [ "$_loki_dry" = "1" ] && ! _loki_start_needs_bash "${@:2}"; then
         _loki_dry_bun="$(_loki_bun)"
-        [ -n "$_loki_dry_bun" ] && exec "$_loki_dry_bun" "$BUN_CLI" "$@"
+        [ -n "$_loki_dry_bun" ] && exec "$_loki_dry_bun" "${_LOKI_BUN_SAFE[@]}" "$BUN_CLI" "$@"
     fi
     unset _loki_dry _loki_da _loki_dry_bun
 fi
@@ -772,7 +777,7 @@ case "v10" in
                     unset _e10_v
                     ;;
             esac
-            exec "$_lb" "$BUN_CLI" engine10 "${_e10_args[@]}"
+            exec "$_lb" "${_LOKI_BUN_SAFE[@]}" "$BUN_CLI" engine10 "${_e10_args[@]}"
         fi
         unset _e10 _e10_args _e10_hard
         ;;
@@ -814,13 +819,13 @@ fi
 # legacy route honored, or a provider engine10 cannot invoke, is refused loudly instead.
 if [ "${1:-}" = "start" ] && [ "$_LOKI_START_ATTEMPTS" = "1" ]; then
     _loki_attempts_refuse "${@:2}"
-    exec bun "$BUN_CLI" "$@"
+    exec bun "${_LOKI_BUN_SAFE[@]}" "$BUN_CLI" "$@"
 fi
 if [ "${1:-}" = "start" ] && { [ "${LOKI_SDK_LOOP:-}" = "1" ] || [ "${LOKI_SDK_LOOP:-}" = "true" ]; }; then
     if _loki_start_needs_bash "${@:2}"; then
         exec "$BASH_CLI" "$@"
     fi
-    exec bun "$BUN_CLI" "$@"
+    exec bun "${_LOKI_BUN_SAFE[@]}" "$BUN_CLI" "$@"
 fi
 
 # CLI consolidation (Phase A): `trust detail` is the grouped form of the
@@ -862,9 +867,9 @@ if [ "${1:-}" = "doctor" ]; then
     fi
     _doctor_t=$(command -v timeout || command -v gtimeout || true)
     if [ -n "$_doctor_t" ]; then
-        "$_doctor_t" -k 1 5 "$_doctor_bun" "$BUN_CLI" version >/dev/null 2>&1 || exec "$BASH_CLI" "$@"
+        "$_doctor_t" -k 1 5 "$_doctor_bun" "${_LOKI_BUN_SAFE[@]}" "$BUN_CLI" version >/dev/null 2>&1 || exec "$BASH_CLI" "$@"
     else
-        "$_doctor_bun" "$BUN_CLI" version >/dev/null 2>&1 || exec "$BASH_CLI" "$@"
+        "$_doctor_bun" "${_LOKI_BUN_SAFE[@]}" "$BUN_CLI" version >/dev/null 2>&1 || exec "$BASH_CLI" "$@"
     fi
 fi
 
@@ -910,7 +915,7 @@ if [ "${1:-}" = "report" ]; then
             ( SCRIPT_DIR="$REPO_ROOT/autonomy"; source "$SCRIPT_DIR/telemetry.sh" 2>/dev/null && loki_telemetry "cli_command" "command=$(_loki_known_command "${1:-}")" 2>/dev/null ) >/dev/null 2>&1 </dev/null &
             disown 2>/dev/null || true
         fi
-        exec bun "$BUN_CLI" "$@"
+        exec bun "${_LOKI_BUN_SAFE[@]}" "$BUN_CLI" "$@"
     fi
 fi
 
@@ -952,7 +957,7 @@ case "${1:-}" in
             ( SCRIPT_DIR="$REPO_ROOT/autonomy"; source "$SCRIPT_DIR/telemetry.sh" 2>/dev/null && loki_telemetry "cli_command" "command=$(_loki_known_command "${1:-}")" 2>/dev/null ) >/dev/null 2>&1 </dev/null &
             disown 2>/dev/null || true
         fi
-        exec bun "$BUN_CLI" "$@"
+        exec bun "${_LOKI_BUN_SAFE[@]}" "$BUN_CLI" "$@"
         ;;
     *)
         exec "$BASH_CLI" "$@"

package/completions/_loki

@@ -43,6 +43,12 @@ function _loki {
                         '--provider[Provider]:provider:(claude opencode codex cline aider)' \
                         '--max-cost[Hard per-run cap in USD]:usd:'
                     ;;
+                try)
+                    _arguments \
+                        '--dry-run[Clone, print the task and estimate, no model call]' \
+                        '--provider[Provider]:provider:(claude opencode codex cline aider)' \
+                        '--max-cost[Hard per-run cap in USD]:usd:'
+                    ;;
                 control)
                     _arguments \
                         '--port[Port for the control plane server]:port:' \
@@ -74,6 +80,23 @@ function _loki {
                 agent)
                     _loki_agent
                     ;;
+                cost)
+                    _arguments \
+                        '--json[Output machine-readable JSON]' \
+                        '--last[Show only the last N runs]:count:' \
+                        '--month[Only runs generated in that month]:month (YYYY-MM):' \
+                        '--csv[One CSV row per run]' \
+                        '--detail[Per-iteration cache and trend breakdown]' \
+                        '--help[Show help]'
+                    ;;
+                next)
+                    _arguments \
+                        '--yes[Skip the confirmation prompt]' \
+                        '--dry-run[Show what would run without running it]' \
+                        '--suggest[With no active run, propose up to 3 small tasks]' \
+                        '--json[Output machine-readable JSON]' \
+                        '--help[Show help]'
+                    ;;
                 estimate)
                     _arguments \
                         '--json[Output machine-readable JSON]' \
@@ -267,6 +290,7 @@ function _loki_commands {
         'demo:Interactive 60-second demo'
         'tour:Offline sample receipt replay (no key, no spend)'
         'wow:Tiny real task in a temp repo, or the offline sample'
+        'try:Try Loki on a public repo in a temp clone, keep only the receipt'
         'factory:loki start with the autonomy policy printed'
         'welcome:Friendly first-run opener (what Loki is, next steps)'
         'init:Interactive PRD builder'

package/completions/loki.bash

@@ -5,7 +5,7 @@ _loki_completion() {
     _init_completion || return
 
     # Main subcommands (must match autonomy/loki main case statement)
-    local main_commands="start backlog quick monitor demo tour wow factory welcome init stop pause resume cancel steer status next ship dashboard web serve api sandbox notify import github issue intent config provider reset memory compound checkpoint council dogfood projects enterprise secrets cockpit secure own handoff doctor watchdog audit metrics syslog onboard share proof receipt outcomes explain plan report cost estimate kpis stats test ci watch telemetry agent context ctx code run export review optimize heal modernize migrate cluster worktree wt trigger failover remote deploy docker mcp magic assets analyze compliance crash control workspace open otel preview quickstart rc rollback merge self-update sentrux setup-skill spec state template trust trust-metrics ultracode update verify voice why wiki bench cleanup logs grill docs cp version completions help keys answer queue issues undo runs acp verify-pr chat route edit setup models agents diff backup restore"
+    local main_commands="start backlog quick monitor demo tour wow try factory welcome init stop pause resume cancel steer status next ship dashboard web serve api sandbox notify import github issue intent config provider reset memory compound checkpoint council dogfood projects enterprise secrets cockpit secure own handoff doctor watchdog audit metrics syslog onboard share proof receipt outcomes explain plan report cost estimate kpis stats test ci watch telemetry agent context ctx code run export review optimize heal modernize migrate cluster worktree wt trigger failover remote deploy docker mcp magic assets analyze compliance crash control workspace open otel preview quickstart rc rollback merge self-update sentrux setup-skill spec state template trust trust-metrics ultracode update verify voice why wiki bench cleanup logs grill docs cp version completions help keys answer queue issues undo runs acp verify-pr chat route edit setup models agents diff backup restore"
 
     # 1. If we are on the first argument (subcommand)
     if [[ $cword -eq 1 ]]; then
@@ -125,6 +125,20 @@ _loki_completion() {
             COMPREPLY=( $(compgen -W "${syslog_cmds}" -- "$cur") )
             ;;
 
+        cost)
+            if [[ "$cur" == -* ]]; then
+                COMPREPLY=( $(compgen -W "--json --last --month --csv --detail --help" -- "$cur") )
+                return 0
+            fi
+            ;;
+
+        next)
+            if [[ "$cur" == -* ]]; then
+                COMPREPLY=( $(compgen -W "--yes --dry-run --suggest --json --help" -- "$cur") )
+                return 0
+            fi
+            ;;
+
         estimate)
             if [[ "$cur" == -* ]]; then
                 COMPREPLY=( $(compgen -W "--json --model --provider --help" -- "$cur") )
@@ -254,6 +268,13 @@ _loki_completion() {
             fi
             ;;
 
+        try)
+            if [[ "$cur" == -* ]]; then
+                COMPREPLY=( $(compgen -W "--dry-run --provider --max-cost --help" -- "$cur") )
+                return 0
+            fi
+            ;;
+
         quickstart)
             if [[ "$cur" == -* ]]; then
                 COMPREPLY=( $(compgen -W "--dry-run --explain-match --from-preview --verify-preview --json --list-templates --template --yes --help" -- "$cur") )

package/dashboard/__init__.py

@@ -7,6 +7,6 @@ Modules:
     control: Session control helpers (status, atomic writes, origin check)
 """
 
-__version__ = "11.77.0"
+__version__ = "11.79.0"
 
 __all__ = ["__version__"]

package/docs/{v10/CLI-MODERN.md → CLI-INVENTORY.md}

@@ -6,12 +6,12 @@ Classes: KEEP-MODERN (v10-native or engine-neutral), UPDATE (live but needs mode
 
 ## Counts
 
-- KEEP-MODERN: 77
+- KEEP-MODERN: 78
 - UPDATE: 22
 - DROP-LEGACY: 31
 - DELETE: 14
-- Total rows: 144
-- Registry paths (commands and nested subcommands): 212
+- Total rows: 145
+- Registry paths (commands and nested subcommands): 215
 
 ## Commands
 
@@ -85,6 +85,7 @@ Classes: KEEP-MODERN (v10-native or engine-neutral), UPDATE (live but needs mode
 | notify | autonomy/loki | KEEP-MODERN | Engine-neutral |
 | tour | autonomy/loki | KEEP-MODERN | Onboarding |
 | wow | autonomy/loki | KEEP-MODERN | Onboarding: loki tour --live |
+| try | autonomy/loki | KEEP-MODERN | Onboarding: never touches your checkout |
 | factory | autonomy/loki | KEEP-MODERN | propose, execute, operate unchanged |
 | welcome | autonomy/loki | KEEP-MODERN | Onboarding |
 | onboard | autonomy/loki | UPDATE | Overlaps wiki |
@@ -169,19 +170,19 @@ Classes: KEEP-MODERN (v10-native or engine-neutral), UPDATE (live but needs mode
 - compliance: 1
 - config: 4
 - context: 5
-- cost: 6
+- cost: 7
 - deploy: 1
 - docs: 4
 - enterprise: 2
 - explain: 5
-- export: 6
-- github: 6
+- export: 7
+- github: 7
 - import: 1
 - init: 21
 - issue: 2
 - magic: 12
 - memory: 7
-- metrics: 6
+- metrics: 7
 - modernize: 3
 - next: 1
 - notify: 6
@@ -198,7 +199,7 @@ Classes: KEEP-MODERN (v10-native or engine-neutral), UPDATE (live but needs mode
 - secrets: 3
 - secure: 3
 - setup-skill: 1
-- share: 6
+- share: 7
 - ship: 1
 - syslog: 3
 - telemetry: 1

package/docs/CLI-REFERENCE.md

@@ -1,7 +1,7 @@
 # CLI reference
 
-Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.77.0. Do not edit by hand.
-Hidden and legacy-only commands are omitted; see `docs/v10/CLI-MODERN.md` for the full inventory.
+Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.79.0. Do not edit by hand.
+Hidden and legacy-only commands are omitted; see `docs/CLI-INVENTORY.md` for the full inventory.
 
 | Command | Description |
 | --- | --- |
@@ -147,6 +147,7 @@ Hidden and legacy-only commands are omitted; see `docs/v10/CLI-MODERN.md` for th
 | `loki notify desktop` | Send a desktop notification (macOS or Linux notify-send) |
 | `loki tour` | See a sample result |
 | `loki wow` | Tiny real task, or the offline sample |
+| `loki try` | Try Loki on a public repo in a temp clone, keep only the receipt |
 | `loki factory` | loki start with the autonomy policy printed |
 | `loki welcome` | First-run opener |
 | `loki onboard` | Onboard to a codebase |

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 Loki Mode, by [Autonomi](https://www.autonomi.dev/), turns a spec or an issue into a verified pull request with a receipt you can check. This page covers installing it, a first run, and the options around it.
 
-**Version:** v11.77.0
+**Version:** v11.79.0
 
 **Engine note:** `loki start` is the primary command. `loki start`, `loki "<task>"`, `loki owner/repo#N` and `loki quick` all run the Loki 10 engine, whatever the flag order or input form (PRD file, issue ref, task or one-word brief). The previous loop runs only on `--engine legacy`, `LOKI_ENGINE=legacy`, or for one call when a flag Loki 10 cannot honor is present. See the [user guide](v10/GUIDE.md) and the [5-minute quickstart](QUICKSTART.md).
 

package/docs/PRIVACY.md

@@ -101,6 +101,7 @@ paths, keys, or repo names -- only anonymous diagnostics.
   | `dashboard_start` | the dashboard starts | none |
   | `first_start_attempted` | first `loki start`, strict opt-in (section 4) | `entry` (a known loki subcommand, else `other`) |
   | `first_run_blocked` | first run stopped, strict opt-in (section 5) | `blocker` (fixed enum, section 5) |
+  | `seal_hook_decision` | the loki-seal Stop hook decides, strict opt-in (section 4) | `decision` (allow, block), `reason` (none, tests_failed, tests_weakened, no_tests, contract_unverified, released, error) |
   | `build_verified` | a build finishes, strict opt-in (section 4) | see section 4 |
 
   The `install` event of older versions is now `installed`. The npm postinstall

package/docs/dev/architecture-reference.md

@@ -82,7 +82,7 @@ time-to-first-preview write-once (bash route only).
 
 ## Anthropic SDK upgrade capability matrix (RQ-104, 2026-10-23)
 
-Pins (exact, all sites): `@anthropic-ai/sdk` 0.124.0 -> 1.2.0 (loki-ts/package.json, loki-ts/bun.lock, docker/Dockerfile peer pin); `@anthropic-ai/claude-agent-sdk` 0.3.293 -> 0.3.309 (loki-ts/package.json, package.json, package-lock.json, bun.lock, docker/Dockerfile). `tests/test-sdk-version-sync.sh` asserts both. Sources: sdk CHANGELOG 0.125.0..1.2.0, agent-sdk CHANGELOG 0.3.294..0.3.309.
+Pins (exact, all sites): `@anthropic-ai/sdk` 0.124.0 -> 1.3.0 (loki-ts/package.json, loki-ts/bun.lock, docker/Dockerfile peer pin); `@anthropic-ai/claude-agent-sdk` 0.3.293 -> 0.3.312 (loki-ts/package.json, package.json, package-lock.json, bun.lock, docker/Dockerfile). `tests/test-sdk-version-sync.sh` asserts both. Sources: sdk CHANGELOG 0.125.0..1.3.0, agent-sdk CHANGELOG 0.3.294..0.3.312.
 
 | Change | Status |
 |---|---|
@@ -117,6 +117,7 @@ Default-on in the Bun runner (see `CHANGELOG.md` v7.x entries; documented in `sk
 - `LOKI_AUTO_LEARNINGS` -- auto-write structured learnings per code_review cycle. Optional `LOKI_AUTO_LEARNINGS_EPISODE=1` also writes the learning into the episode store.
   **Bun route only.** This var has ZERO occurrences in `autonomy/run.sh` and `autonomy/loki` (measured; controls: `LOKI_HANDOFF_MD` returns 2, `LOKI_INJECT_FINDINGS` returns 3), so "set to `1` to force-enable on the bash route" does not apply to this knob -- there is nothing on bash to enable. The bash route DOES have a learnings store (`init_learnings_db`, `run.sh`); what is Bun-only is the automatic per-code_review-cycle write.
 - `LOKI_HANDOFF_MD` -- write a structured handoff doc before iteration close.
+- `LOKI_REVIEW_ADVISORY` -- default on (`0` restores blocking). architecture-strategist, maintainer-mergeability and test-coverage-auditor are mandatory to run, not to block: they still run and their findings are recorded (`advisory: true` per reviewer plus `advisory_critical` / `advisory_high` in the review `aggregate.json`, one display-only row in the Evidence Receipt), but they carry no veto. `has_blocking` ignores them; security-sentinel and the other reviewers still block. maintainer-mergeability and test-coverage-auditor are routed to haiku at every tier. Bun: `ADVISORY_REVIEWERS` in `loki-ts/src/runner/quality_gates.ts`; bash: `_is_advisory_reviewer` in `autonomy/run.sh` (parity-locked in `tests/test-mergeability-review.sh`).
 
 These knobs together implement the RARV-C (closure) loop: findings -> override council -> learnings -> handoff. Reference: `skills/quality-gates.md`, `CHANGELOG.md` entries from v7.x for default-on flip and override-council semantics.
 
@@ -142,7 +143,7 @@ extract_learnings_from_session (autonomy/run.sh) mirrors learnings and decisions
 
 - Wall publish (FC-VERIFIED-PR-WITHOUT-ITS-TEST): on a VERIFIED seal only, `publishWall` (`util/check_result.ts`, called from `stages/seal.ts`) makes ONE child commit (trailer `Loki-Wall-Publish: <runId>`) of the SEALED Wall bytes (`runDir/wall`, hash-checked against `wall.files[].sha256`) that verify ran and passed (`publishableWall`). Before writing, the realpath of each Wall file's parent directory must be inside the repo, and an existing file or symlink is removed first. The child commit runs with hooks and signing OFF (the default `git()` call, no `userHooks`), so a pre-commit hook cannot add files or rewrite the Wall bytes. Afterwards the commit must touch exactly the published paths and each committed blob must equal the blob hash of the sealed bytes (computed in process, never read from the worktree); on any mismatch the child is rolled back (`update-ref` HEAD to the product head plus `read-tree`), nothing is published and a NOT PROVEN note is added. The receipt binds the PRODUCT head (head_sha, tree, diff_sha256 are computed before the child commit). A re-seal binds `HEAD^` only when HEAD's message has the exact trailer line for this run, HEAD touches only paths of this run's `wall.files`, and every blob sha256 matches (`wallChild`); a forged trailer is not enough. `util/seal_drift.ts` accepts a moved HEAD after head_sha as benign only when every commit after it is such a Wall publish commit (linear, trailer line for the receipt's run_id, only `wall.files` paths, blob sha256 equal to the sealed one); any commit after head_sha that carries this run's trailer but fails that check is head drift (UNCHECKED). Later commits without the trailer stay under the TEN-GATES-16 sealed-path overlap rule. The PR body gains an "Acceptance tests" section. Commit stage and `backstopCommit` still drop Wall files. `LOKI_COMMIT_WALL=0` restores the old behavior (nothing published).
 
-### Python anthropic SDK (RQ-105: pinned `anthropic==2.2.0`)
+### Python anthropic SDK (RQ-105: pinned `anthropic==2.3.0`)
 
 `mcp/requirements.txt` pins the Python SDK exactly (was `>=0.40,<1.0.0`; the resolver landed on 0.125.0). Requires Python >=3.10 (Ubuntu 24.04 image ships 3.12). The SDK runs on `httpx2`; no repo code passes `httpx` objects to it. v2.0.0 changes (API version 2026-10-21): `temperature`/`top_p`/`top_k` removed from Messages (no call site uses them), Admin API field renames (unused). Python-side call sites: `memory/managed_memory/client.py` (the only importer) and `providers/managed.py` (lazy import, `tests/managed/test_registry_lazy.py` contract unchanged).
 

package/docs/dev/project-structure.md

@@ -61,7 +61,8 @@ events/                     # Unified Event Bus (v5.17.0)
   emit.sh                   # Bash helper for emitting events
 docs/                       # Architecture documentation
   SYNERGY-ROADMAP.md        # 5-pillar tool integration architecture
-  v10/                      # User guides: GUIDE.md, GUIDE-MODERNIZE.md, CLI-MODERN.md, DEPS.md
+  CLI-INVENTORY.md          # Generated command inventory (from loki-ts/src/cli/registry.ts)
+  v10/                      # User guides: GUIDE.md, GUIDE-MODERNIZE.md, DEPS.md
   dev/                      # Developer reference docs (this file and its siblings)
 autonomy/                   # Runtime and autonomous execution
   context-tracker.py        # Context window usage tracking

package/loki-ts/data/child-env.json

@@ -256,6 +256,7 @@
   "LOKI_RESUME_SESSION",
   "LOKI_REVIEWER_BRIEF",
   "LOKI_REVIEWER_TIER_ROUTING",
+  "LOKI_REVIEW_ADVISORY",
   "LOKI_REVIEW_ALLOWLIST",
   "LOKI_REVIEW_INCONCLUSIVE_BLOCK",
   "LOKI_REVIEW_JSON_SCHEMA",