loki-mode 11.89.0 → 11.91.0

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: Runs an autonomous software factory that knows what it is supposed to deliver and proves it did, with a signed receipt. Use when the user says Loki Mode or asks to build, fix or verify software autonomously.
 ---
 
-# Loki Mode v11.89.0
+# Loki Mode v11.91.0
 
 **Current entry points (Loki 10 engine):** `loki "<task>"`, `loki owner/repo#N` and `loki quick "<task>"` run the Loki 10 engine and end with a signed receipt (`loki verify`). `loki backlog owner/repo --all` runs many issues in parallel. Guide: `docs/v10/GUIDE.md`. The skill instructions below, and `loki start`, describe the previous bash loop. PRD-file starts (`loki start ./prd.md`) and the opencode provider still run on it until FC38-SWEEP ports them; the legacy-engine command and the LOKI_ENGINE switch remain removed. Prefer `loki owner/repo#N` for issues.
 
@@ -475,4 +475,4 @@ Implemented, planned and deprecated items, with the version each landed in: `ski
 
 ---
 
-**v11.89.0 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**
+**v11.91.0 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**

package/VERSION

@@ -1 +1 @@
-11.89.0
+11.91.0

package/autonomy/lib/backlog.py

@@ -378,6 +378,15 @@ def main(argv):
                 tmp = dst + ".tmp%d" % os.getpid()
                 shutil.copyfile(src, tmp)
                 os.replace(tmp, dst)
+            # The sealed Wall copies travel with the receipt: integrate reruns them on the merged tree after the worktree is gone.
+            wsrc, wdst = os.path.join(src_dir, "wall"), os.path.join(dst_dir, "wall")
+            if os.path.isdir(wsrc) and not os.path.islink(wsrc) and not os.path.islink(wdst):
+                shutil.rmtree(wdst, ignore_errors=True)
+                os.makedirs(wdst, mode=0o700, exist_ok=True)
+                for name in os.listdir(wsrc):
+                    f = os.path.join(wsrc, name)
+                    if os.path.isfile(f) and not os.path.islink(f):
+                        shutil.copyfile(f, os.path.join(wdst, name))
         except OSError:
             pass
 

package/autonomy/loki

@@ -28170,13 +28170,98 @@ _pr_record_merge() {
     return 0
 }
 
+# Owner opt-in earned merge (LOKI_EARNED_MERGE=1, off by default). Every path
+# the PR changes (the new name and, for a rename, the previous name, listed by
+# paginated REST and required to match the PR's changedFiles count) must have a
+# Seal record from `loki trust --json` (path_seals) with at least
+# LOKI_EARNED_MERGE_MIN_VERIFIED (default 20, floor 1) VERIFIED receipts and
+# exactly 0 reverts in git history. A revert count of null (history
+# unreadable), a missing record, an unreadable trust output or an unreadable or
+# truncated file list or an unreadable diff all refuse, as does any PR whose
+# diff touches a symlink (120000) or submodule (160000) mode, including a pure
+# rename of one (modes read from git on the base and head). Protected paths (.github/, .loki/, .env*,
+# .envrc, CODEOWNERS, plus the space-separated globs in
+# LOKI_EARNED_MERGE_PROTECTED), matched case-insensitively, always stay
+# PR-only. The reason for a refusal goes to stdout; the return code is 1.
+_pr_earned_merge_check() {
+    local pr="$1" min="${LOKI_EARNED_MERGE_MIN_VERIFIED:-20}" meta="" num="" want="" lines="" seals=""
+    local kind p lp g row v r got=0 globs=() diff="" bad_mode="" renames="" refs="" base="" head="" from to m_old m_new
+    case "$min" in ''|*[!0-9]*) min=20 ;; esac
+    [ "$min" -ge 1 ] || min=1
+    command -v jq >/dev/null 2>&1 || { echo "jq is required to read the Seal record"; return 1; }
+    meta="$(gh pr view "$pr" --json number,changedFiles -q '"\(.number) \(.changedFiles)"' 2>/dev/null)" || meta=""
+    num="${meta%% *}"; want="${meta#* }"
+    case "$num$want" in ''|*[!0-9]*) echo "the PR's changed files are unreadable"; return 1 ;; esac
+    lines="$(gh api --paginate "repos/{owner}/{repo}/pulls/${num}/files" -q '.[] | ("F\t" + .filename), (select(.previous_filename != null) | "P\t" + .previous_filename)' 2>/dev/null)" || lines=""
+    [ -n "$lines" ] || { echo "the PR's changed files are unreadable"; return 1; }
+    seals="$("$_LOKI_SCRIPT_DIR/../bin/loki" trust --json 2>/dev/null)" || seals=""
+    printf '%s' "$seals" | jq -e '.path_seals | type == "array"' >/dev/null 2>&1 || { echo "the Seal record is unreadable"; return 1; }
+    # read -a splits on whitespace without expanding globs against the cwd.
+    read -r -a globs <<EOF_GLOBS
+$(printf '%s' "${LOKI_EARNED_MERGE_PROTECTED:-}" | tr '[:upper:]' '[:lower:]')
+EOF_GLOBS
+    while IFS="$(printf '\t')" read -r kind p; do
+        [ -n "$p" ] || continue
+        [ "$kind" = "F" ] && got=$((got + 1))
+        lp="$(printf '%s' "$p" | tr '[:upper:]' '[:lower:]')"
+        case "$lp" in .github/*|.loki/*|.env|.env.*|*/.env|*/.env.*|.envrc|*/.envrc|codeowners|docs/codeowners)
+            echo "$p is a protected path"; return 1 ;;
+        esac
+        for g in ${globs[@]+"${globs[@]}"}; do
+            # shellcheck disable=SC2254
+            case "$lp" in $g) echo "$p is a protected path"; return 1 ;; esac
+        done
+        row="$(printf '%s' "$seals" | jq -r --arg p "$p" '[.path_seals[] | select(.path == $p)] | if length == 0 then "none" else "\(.[0].verified) \(.[0].reverts)" end')" || row="none"
+        [ "$row" != "none" ] || { echo "$p has no Seal record"; return 1; }
+        v="${row%% *}"; r="${row#* }"
+        case "$r" in
+            0) ;;
+            null) echo "$p revert status is unknown"; return 1 ;;
+            *) echo "$p has $r recorded revert(s)"; return 1 ;;
+        esac
+        [ "$v" -ge "$min" ] 2>/dev/null || { echo "$p has $v VERIFIED receipts, need $min"; return 1; }
+    done <<EOF_FILES
+$lines
+EOF_FILES
+    [ "$got" = "$want" ] || { echo "the PR lists $want changed files but $got were readable"; return 1; }
+    # A symlink (120000) or submodule (160000) can point an earned path anywhere:
+    # refuse any PR whose diff adds, removes, changes or re-modes one.
+    diff="$(gh pr diff "$pr" 2>/dev/null)" || diff=""
+    [ -n "$diff" ] || { echo "the PR's file modes are unreadable"; return 1; }
+    bad_mode="$(printf '%s\n' "$diff" | awk '/^diff --git /{h=$0} /^(new file mode|deleted file mode|old mode|new mode) (120000|160000)$/{print h; exit} /^index [0-9a-f.]+ (120000|160000)$/{print h; exit}')"
+    [ -z "$bad_mode" ] || { echo "${bad_mode#diff --git } involves a symlink or submodule"; return 1; }
+    # A pure rename (100% similarity) carries no mode or index line, so the scan
+    # above cannot see a symlink moving. Read both sides' modes from git.
+    renames="$(printf '%s\n' "$diff" | awk '/^rename from /{f=substr($0,13)} /^rename to /{print f "\t" substr($0,11); f=""}')"
+    if [ -n "$renames" ]; then
+        refs="$(gh pr view "$pr" --json baseRefOid,headRefOid -q '.baseRefOid + " " + .headRefOid' 2>/dev/null)" || refs=""
+        base="${refs%% *}"; head="${refs#* }"
+        case "$base$head" in ''|*[!0-9a-f]*) echo "the PR's rename modes are unreadable"; return 1 ;; esac
+        if ! git cat-file -e "${base}^{commit}" 2>/dev/null || ! git cat-file -e "${head}^{commit}" 2>/dev/null; then
+            GIT_TERMINAL_PROMPT=0 git fetch -q origin "pull/${num}/head" >/dev/null 2>&1 || true
+        fi
+        while IFS="$(printf '\t')" read -r from to; do
+            [ -n "$to" ] || continue
+            m_old="$(git ls-tree --full-tree "$base" -- "$from" 2>/dev/null | awk '{print $1; exit}')"
+            m_new="$(git ls-tree --full-tree "$head" -- "$to" 2>/dev/null | awk '{print $1; exit}')"
+            case "$m_old:$m_new" in
+                120000:*|160000:*|*:120000|*:160000) echo "rename from $from to $to involves a symlink or submodule"; return 1 ;;
+                '':*|*:'') echo "rename from $from to $to has unreadable file modes"; return 1 ;;
+            esac
+        done <<EOF_RENAMES
+$renames
+EOF_RENAMES
+    fi
+    return 0
+}
+
 # Shared merge gate. One PR (number or branch) merges only when it is not a
 # draft, `gh pr checks` exits 0 after polling pending (rc=8), and, with
 # --require-verified, every clean proof recorded for the PR's head commit
 # (facts.git.head_sha == headRefOid, dirty-tree proofs ignored) says VERIFIED; a stale or missing proof
 # refuses ("gate: head"). The merge passes --match-head-commit so a push after
 # the gate cannot land unjudged. On refusal it prints the exact blocking gate
-# ("gate: draft|head|verdict|checks") and leaves the PR open.
+# ("gate: draft|head|verdict|trust|checks") and leaves the PR open.
 # Usage: _merge_pr_gated <pr> [--require-verified] [--delete-branch]
 _merge_pr_gated() {
     local pr="$1" need_verified=false margs=(--squash) rc d
@@ -28252,6 +28337,14 @@ _merge_pr_gated() {
             return 1
         fi
     fi
+    if [ "${LOKI_EARNED_MERGE:-0}" = "1" ]; then
+        local trust_why=""
+        trust_why="$(_pr_earned_merge_check "$pr")" || {
+            echo "$pr: not merged, gate: trust ($trust_why); PR left open" >&2
+            _pr_record_merge "$pr" "blocked:trust" "trust"
+            return 1
+        }
+    fi
     rc=0; _pr_checks_wait "$pr" || rc=$?
     if [ "$rc" != "0" ]; then
         echo "$pr: not merged, gate: checks (gh pr checks rc=$rc); PR left open" >&2
@@ -31180,6 +31273,7 @@ cmd_metrics() {
     local last_n=0
     local save_file=false
     local share_flag=false
+    local share_visibility=""
 
     while [[ $# -gt 0 ]]; do
         case "$1" in
@@ -31196,7 +31290,8 @@ cmd_metrics() {
                 echo "  --json               Machine-readable JSON output"
                 echo "  --last N             Analyze only the last N sessions (default: all)"
                 echo "  --save               Write report to METRICS.md in project root"
-                echo "  --share              Upload report as GitHub Gist (via loki share)"
+                echo "  --share              Upload report as a secret GitHub Gist (via loki share)"
+                echo "  --public             With --share, create a PUBLIC gist instead"
                 echo "  --help, -h           Show this help"
                 echo ""
                 echo "Subcommands:"
@@ -31207,7 +31302,7 @@ cmd_metrics() {
                 echo "  loki metrics --json            # Machine-readable output"
                 echo "  loki metrics --last 5          # Last 5 sessions only"
                 echo "  loki metrics --save            # Write METRICS.md"
-                echo "  loki metrics --share           # Share as GitHub Gist"
+                echo "  loki metrics --share           # Share as a secret GitHub Gist"
                 echo "  loki metrics prometheus        # Prometheus metrics from dashboard"
                 exit 0
                 ;;
@@ -31216,6 +31311,7 @@ cmd_metrics() {
             --last=*) last_n="${1#*=}"; shift ;;
             --save) save_file=true; shift ;;
             --share) share_flag=true; shift ;;
+            --public) share_visibility="--public"; shift ;;
             prometheus)
                 # Legacy Prometheus metrics subcommand
                 shift
@@ -31638,7 +31734,10 @@ METRICS_SCRIPT
         project_name=$(basename "$(pwd)")
         local gist_desc="Loki Mode productivity report - ${project_name:-project} ($(date +%Y-%m-%d))"
         local gist_url
-        gist_url=$(gh gist create "$tmpfile" --desc "$gist_desc" --public 2>&1)
+        if [ "$share_visibility" = "--public" ]; then
+            echo -e "${YELLOW}Warning: this gist is PUBLIC and visible to anyone with the URL.${NC}" >&2
+        fi
+        gist_url=$(gh gist create "$tmpfile" --desc "$gist_desc" $share_visibility 2>&1)
         local gist_exit=$?
         rm -f "$tmpfile"
 
@@ -38845,7 +38944,8 @@ REPORT_SCRIPT
 
 cmd_share() {
     local format="markdown"
-    local visibility="--public"
+    # Secret by default: --public is passed to gh only on an explicit --public.
+    local visibility=""
 
     while [[ $# -gt 0 ]]; do
         case "$1" in
@@ -38858,20 +38958,22 @@ cmd_share() {
                 echo "returning a shareable URL."
                 echo ""
                 echo "Options:"
-                echo "  --private            Create a secret gist (default: public)"
+                echo "  --public             Create a PUBLIC gist, visible to anyone with the URL"
+                echo "  --private            Create a secret gist (default: secret; accepted for compatibility)"
                 echo "  --format <fmt>       Report format: text, markdown, html (default: markdown)"
                 echo "  --help, -h           Show this help"
                 echo ""
                 echo "Examples:"
-                echo "  loki share                         # Public markdown gist"
-                echo "  loki share --private               # Secret gist"
-                echo "  loki share --format html           # Public HTML gist"
-                echo "  loki share --private --format text  # Secret text gist"
+                echo "  loki share                         # Secret markdown gist (default)"
+                echo "  loki share --public                # Public gist"
+                echo "  loki share --format html           # Secret HTML gist"
+                echo "  loki share --public --format text  # Public text gist"
                 echo ""
                 echo "Requires: gh CLI (https://cli.github.com)"
                 exit 0
                 ;;
             --private) visibility=""; shift ;;
+            --public) visibility="--public"; shift ;;
             --format) format="${2:-markdown}"; shift 2 ;;
             --format=*) format="${1#*=}"; shift ;;
             *) echo -e "${RED}Unknown option: $1${NC}" >&2; echo "Run 'loki share --help' for usage." >&2; exit 1 ;;
@@ -38945,8 +39047,8 @@ cmd_share() {
 }
 
 # Internal helper: upload a single file as a GitHub Gist.
-# Args: $1=file path, $2=description, $3=visibility ("--public", "--private",
-# or "" for gh's default). NOTE: $3 is intentionally left unquoted at the
+# Args: $1=file path, $2=description, $3=visibility ("--public" for a public
+# gist, or "" for gh's default, which is a secret gist). NOTE: $3 is intentionally left unquoted at the
 # gh call site so an empty value collapses (the --private case sets it to "").
 # Removes the input file after the attempt. Prints "Shared: <url>" on success;
 # on failure prints the gh error and exits 1.
@@ -38961,6 +39063,9 @@ _loki_gist_upload() {
     # "Shared:" line and the ready-to-post hook with multi-line gh chatter.
     local gist_out gist_err gist_exit
     local errfile
+    if [ "$visibility" = "--public" ]; then
+        echo -e "${YELLOW}Warning: this gist is PUBLIC and visible to anyone with the URL.${NC}" >&2
+    fi
     # Fall back to /dev/null if mktemp fails (disk full / unwritable /tmp) so the
     # redirect target is always a real path -- never an empty string (2>"" is a
     # bash error). We lose the captured stderr text in that rare case, not the
@@ -39425,7 +39530,8 @@ cmd_proof() {
             echo ""
             echo "Options for 'share':"
             echo "  --yes                Skip the redaction-preview confirmation prompt"
-            echo "  --private            Create a secret gist (default: public)"
+            echo "  --public             Create a PUBLIC gist, visible to anyone with the URL"
+            echo "  --private            Create a secret gist (default: secret; accepted for compatibility)"
             echo "  --hosted             Publish to LOKI_HOSTED_ENDPOINT (open-core seam; no official backend yet)"
             echo ""
             echo "Proofs are generated automatically at run completion (LOKI_PROOF=0 to opt out)."
@@ -40083,7 +40189,7 @@ print(json.dumps(doc, indent=2))
         share)
             local id=""
             local skip_confirm=0
-            local visibility="--public"
+            local visibility=""
             local hosted=0
             # every python3 invocation below reads proof.json from inside
             # the checkout being shared. Resolve an absolute path once so an

package/completions/_loki

@@ -100,7 +100,7 @@ function _loki {
                 estimate)
                     _arguments \
                         '--json[Output machine-readable JSON]' \
-                        '--model[Model whose rough prior to use]:model:' \
+                        '--model[Model whose first-run prior to use]:model:' \
                         '--provider[Provider whose default model is used]:provider:' \
                         '--help[Show help]'
                     ;;
@@ -185,7 +185,8 @@ function _loki {
                         '--json[Machine-readable JSON output]' \
                         '--last[Analyze last N sessions]:number:' \
                         '--save[Write report to METRICS.md]' \
-                        '--share[Upload report as GitHub Gist]' \
+                        '--share[Upload report as a secret GitHub Gist]' \
+                        '--public[With --share, create a PUBLIC gist]' \
                         '--help[Show help]' \
                         '1:subcommand:(prometheus)'
                     ;;
@@ -199,14 +200,16 @@ function _loki {
                     ;;
                 share)
                     _arguments \
-                        '--private[Create a secret gist]' \
+                        '--public[Create a PUBLIC gist, visible to anyone with the URL]' \
+                        '--private[Create a secret gist (default)]' \
                         '--format[Report format]:format:(text markdown html)' \
                         '--help[Show help]'
                     ;;
                 proof)
                     _arguments \
                         '--yes[Skip redaction-preview confirmation]' \
-                        '--private[Create a secret gist when sharing]' \
+                        '--public[Create a PUBLIC gist when sharing]' \
+                        '--private[Create a secret gist when sharing (default)]' \
                         '--hosted[Hosted publishing (coming in R9)]' \
                         '--dry-run[Scan and list what share would publish; publishes nothing]' \
                         '--help[Show help]' \

package/completions/loki.bash

@@ -355,7 +355,7 @@ _loki_completion() {
 
         metrics)
             if [[ "$cur" == -* ]]; then
-                COMPREPLY=( $(compgen -W "--json --last --save --share --help" -- "$cur") )
+                COMPREPLY=( $(compgen -W "--json --last --save --share --public --help" -- "$cur") )
                 return 0
             fi
             local metrics_cmds="prometheus"
@@ -373,7 +373,7 @@ _loki_completion() {
 
         share)
             if [[ "$cur" == -* ]]; then
-                COMPREPLY=( $(compgen -W "--private --format --help" -- "$cur") )
+                COMPREPLY=( $(compgen -W "--public --private --format --help" -- "$cur") )
                 return 0
             fi
             if [[ "$prev" == "--format" ]]; then
@@ -384,7 +384,7 @@ _loki_completion() {
 
         proof)
             if [[ "$cur" == -* ]]; then
-                COMPREPLY=( $(compgen -W "--yes --private --hosted --dry-run --out --help" -- "$cur") )
+                COMPREPLY=( $(compgen -W "--yes --public --private --hosted --dry-run --out --help" -- "$cur") )
                 return 0
             fi
             if [[ $cword -eq 2 ]]; then

package/dashboard/__init__.py

@@ -7,6 +7,6 @@ Modules:
     control: Session control helpers (status, atomic writes, origin check)
 """
 
-__version__ = "11.89.0"
+__version__ = "11.91.0"
 
 __all__ = ["__version__"]

package/docs/CLI-REFERENCE.md

@@ -1,6 +1,6 @@
 # CLI reference
 
-Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.89.0. Do not edit by hand.
+Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.91.0. Do not edit by hand.
 Hidden and legacy-only commands are omitted; see `docs/CLI-INVENTORY.md` for the full inventory.
 
 | Command | Description |

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 Loki Mode, by [Autonomi](https://www.autonomi.dev/), turns a spec or an issue into a verified pull request with a receipt you can check. This page covers installing it, a first run, and the options around it.
 
-**Version:** v11.89.0
+**Version:** v11.91.0
 
 **Engine note:** `loki start` is the primary command. `loki start`, `loki "<task>"`, `loki owner/repo#N` and `loki quick` all run the Loki 10 engine, whatever the flag order or input form (PRD file, issue ref, task or one-word brief). The previous loop runs only on `--engine legacy`, `LOKI_ENGINE=legacy`, or for one call when a flag Loki 10 cannot honor is present. See the [user guide](v10/GUIDE.md) and the [5-minute quickstart](QUICKSTART.md).
 

package/docs/v11/VERIFY-PR-SANDBOX.md

@@ -25,6 +25,7 @@ verify-pr-sandbox.sh --repo DIR --out DIR --cmd 'SHELL CMD' --image IMG [--timeo
 | Env scrub | `docker run` inherits no host env; only PATH, HOME=/work, CI=1 are passed. GH_TOKEN, GITHUB_TOKEN, SSH_AUTH_SOCK never reach argv |
 | Mounts | exactly one: the repo, read-only. No HOME, no docker socket, no output mount |
 | Output | stdout is captured by the host, capped in-container (`--max-output`); the host writes result.json and output.txt |
+| Report | `--report /work/NAME` returns the file the check's runner wrote there (up to 1 MiB, outside the output cap) between nonce-bearing markers; the host writes it as report.txt. verify-pr runs bun test, pytest, jest and vitest with a report flag and a random path, and reads pass/fail only from that file |
 
 Deviation from the card: there is no mounted output dir. A writable host mount would let the checked code fill the host disk, so the result travels on stdout and only the host writes `OUT`. Numeric flags are forced to base 10 (a leading zero is not octal) and every value flag requires a value. `--image` is restricted to `[A-Za-z0-9._/:@-]`.
 
@@ -35,6 +36,7 @@ Deviation from the card: there is no mounted output dir. A writable host mount w
 - Oversized output: capped by `--max-output`; `output_truncated` is set.
 - Fork bomb: `--pids-limit 256`. Memory bomb: `--memory`. Disk fill: tmpfs size caps.
 - Forged result: the checked code can print a fake `LOKI_VPR_END` line. A per-run 128-bit nonce is sent to the wrapper on stdin and the checked command runs with stdin from /dev/null; the host accepts only the last line carrying that nonce. Docker's default seccomp profile does NOT block ptrace or process_vm_readv on kernels >= 4.8, and the checked command runs as the same uid as the wrapper inside the container, so a hostile process can read the wrapper's memory and recover the nonce. The nonce therefore only stops accidental or naive forgery; it is not a security boundary. One cross-check is added: the wrapper exits with the check's code and the host rejects (status ERROR) a sentinel that disagrees with docker's own exit code. The PR code can still make its own check report success, which is why `result.json` is a signal about the check and not the final verdict (VPR-2 owns that, and it must not treat a bare COMPLETED exit 0 as proof). A custom seccomp profile denying ptrace is a possible hardening and is not shipped here.
+- Forged report: the report path is a per-run random name given only on the runner's command line, so printed totals cannot forge it. The checked tests run inside the runner's process or its worker processes, so a hostile test that reads the path from the process command line can register an exit hook that rewrites the file after the runner has written it, and can still forge a pass; the same ptrace-class residual applies.
 - Docker pool exhaustion: reported as BLOCKED, never as a failing check.
 
 ## Not covered (residual, tracked for VPR-2 review)