loki-mode 7.107.0 → 7.109.0

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: Autonomous spec-driven build system with a built-in trust layer. It does not call work done until it is verified (RARV-C closure loop, 8 quality gates, completion council, verified-completion evidence gate). Triggers on "Loki Mode". Takes a spec (PRD, GitHub issue, OpenAPI doc, etc.) to deployed product with minimal human intervention. Provider-agnostic. Requires --dangerously-skip-permissions flag.
 ---
 
-# Loki Mode v7.107.0
+# Loki Mode v7.109.0
 
 **You are an autonomous agent. You make decisions. You do not ask questions. You do not stop.**
 
@@ -408,4 +408,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v7.107.0 | [Autonomi](https://www.autonomi.dev/) flagship product | ~260 lines core**
+**v7.109.0 | [Autonomi](https://www.autonomi.dev/) flagship product | ~260 lines core**

package/VERSION

@@ -1 +1 @@
-7.107.0
+7.109.0

package/autonomy/lib/expectation-ledger.py

@@ -0,0 +1,366 @@
+#!/usr/bin/env python3
+"""Annotate-before-act expected-outcome ledger for Loki Mode.
+
+Companion to proof-generator.py / proof-verify.py. Before running verification
+for a change or checklist item, the runtime writes a tamper-evident ledger of
+EXPECTED observable outcomes (e.g. "GET /health -> 200 {status:ok}", "test X
+fails before the fix and passes after", "endpoint Y should now exist"). At
+verify time the actual results are compared to this PRE-COMMITTED prediction:
+any expectation that was silently dropped (never executed) or contradicted
+(actual != expected) becomes a finding. An expectation that cannot be evaluated
+maps to INCONCLUSIVE, never VERIFIED.
+
+Why this is trustworthy:
+  - The ledger is written BEFORE the act/verify, so it is a genuine prediction,
+    not a post-hoc rationalization of whatever happened.
+  - It is TAMPER-EVIDENT: the whole ledger is canonicalized and hashed the SAME
+    way proof-generator.py hashes proof.json (sha256 over the compact, sorted
+    JSON form). The hash is recorded in the ledger file AND embedded into
+    evidence.json / proof.json, so an expectation edited after the fact breaks
+    the embedded hash and is detectable.
+
+Design rules (mirror proof-generator.py):
+  - Canonicalization MUST match proof-generator._canonical EXACTLY
+    (json.dumps sort_keys=True, compact separators, default ensure_ascii). The
+    ledger hash and the proof hash therefore use one identical scheme.
+  - Additive + fail-open: nothing writes a ledger yet in the common case, so
+    the read/compare side must no-op cleanly when the ledger is absent.
+  - Catch broadly on the write path; never raise into the run loop.
+
+CLI (bash-callable, mirrors proof-generator.py / proof-verify.py CLIs):
+    expectation-ledger.py write --loki-dir .loki --iter 3 \
+        --id health-200 --statement "GET /health -> 200" \
+        --check-ref tests --expected '{"status":200}'
+    expectation-ledger.py hash --loki-dir .loki --iter 3
+    expectation-ledger.py verify-hash --loki-dir .loki --iter 3
+"""
+
+import argparse
+import hashlib
+import json
+import os
+import sys
+
+
+# ---------------------------------------------------------------------------
+# canonicalization (MUST match proof-generator._canonical / proof-verify._canonical)
+# ---------------------------------------------------------------------------
+
+def _canonical(obj):
+    """Canonical JSON form used for the tamper-evident hash.
+
+    Identical to proof-generator.py _canonical() and proof-verify.py
+    _canonical(): json.dumps with sort_keys=True and compact separators, and no
+    explicit ensure_ascii (defaults to True). Keeping this byte-for-byte
+    identical is what lets the ledger hash and the proof hash share one scheme,
+    so a verifier recomputes it the same way for both artifacts.
+    """
+    return json.dumps(obj, sort_keys=True, separators=(",", ":"))
+
+
+# ---------------------------------------------------------------------------
+# ledger paths + shape
+# ---------------------------------------------------------------------------
+
+def ledger_path(loki_dir, iteration):
+    """Path to the per-iteration ledger: .loki/expectations/<iter>.json."""
+    return os.path.join(loki_dir, "expectations", "%s.json" % iteration)
+
+
+def _normalize_entry(entry):
+    """Coerce one expectation into the frozen entry shape.
+
+    Shape: {id, statement, check_ref, expected}. Unknown keys are dropped so the
+    canonical hash is stable regardless of caller-supplied extras. `expected` is
+    kept as-is (it may be a scalar, dict, or list): the compare step interprets
+    it, the ledger only records it verbatim.
+    """
+    if not isinstance(entry, dict):
+        return None
+    eid = entry.get("id")
+    if eid is None or str(eid).strip() == "":
+        return None
+    return {
+        "id": str(eid),
+        "statement": str(entry.get("statement") or ""),
+        "check_ref": str(entry.get("check_ref") or ""),
+        "expected": entry.get("expected"),
+    }
+
+
+def _sorted_entries(entries):
+    """Entries sorted by id so the ledger hash is order-independent.
+
+    Two runs that record the same expectations in a different order produce the
+    same ledger and the same hash -- the prediction is a SET, not a sequence.
+    """
+    clean = [e for e in (_normalize_entry(x) for x in entries) if e is not None]
+    return sorted(clean, key=lambda e: e["id"])
+
+
+def compute_ledger_hash(entries):
+    """sha256 over the canonical form of the sorted entries.
+
+    Same algorithm proof-generator.py uses for proof.json's integrity hash
+    (sha256 of _canonical(...)), so the value embedded into evidence/proof is
+    recomputable by the same verifier code path.
+    """
+    canonical = _canonical(_sorted_entries(entries)).encode("utf-8")
+    return hashlib.sha256(canonical).hexdigest()
+
+
+# ---------------------------------------------------------------------------
+# read / write
+# ---------------------------------------------------------------------------
+
+def read_ledger(loki_dir, iteration):
+    """Return the ledger dict, or None when absent / unreadable.
+
+    Absent ledger is the common case today; callers treat None as "no ledger,
+    no-op". Never raises: a malformed file returns None so the read side stays
+    fail-open.
+    """
+    path = ledger_path(loki_dir, iteration)
+    if not os.path.isfile(path):
+        return None
+    try:
+        with open(path, "r") as f:
+            data = json.load(f)
+    except Exception:
+        return None
+    if not isinstance(data, dict):
+        return None
+    return data
+
+
+def write_entry(loki_dir, iteration, entry):
+    """Append one expectation to the iteration ledger and re-seal the hash.
+
+    Idempotent per id: writing the same id again REPLACES the prior entry (a
+    prediction is refined, not duplicated). Recomputes ledger_sha256 over the
+    full entry set after each write so the on-disk file is always self-consistent
+    (the recorded hash matches its own entries). Returns the new ledger_sha256,
+    or None on failure (never raises into the run loop).
+    """
+    norm = _normalize_entry(entry)
+    if norm is None:
+        return None
+    try:
+        existing = read_ledger(loki_dir, iteration) or {}
+        entries = existing.get("entries")
+        if not isinstance(entries, list):
+            entries = []
+        # Replace-by-id so refining a prediction does not create a duplicate.
+        entries = [e for e in entries
+                   if not (isinstance(e, dict) and str(e.get("id")) == norm["id"])]
+        entries.append(norm)
+        entries = _sorted_entries(entries)
+
+        ledger = {
+            "schema_version": "1.0",
+            "iteration": str(iteration),
+            "entries": entries,
+            "ledger_sha256": compute_ledger_hash(entries),
+        }
+        path = ledger_path(loki_dir, iteration)
+        os.makedirs(os.path.dirname(path), exist_ok=True)
+        tmp = path + ".tmp"
+        with open(tmp, "w") as f:
+            json.dump(ledger, f, indent=2)
+            f.write("\n")
+        os.replace(tmp, path)
+        return ledger["ledger_sha256"]
+    except Exception:
+        return None
+
+
+def ledger_hash_ok(loki_dir, iteration):
+    """True iff the recorded ledger_sha256 matches its own entries.
+
+    This is the tamper check: an expectation edited after write (without
+    re-sealing) makes the stored hash disagree with the recomputed one. Returns
+    (ok, recorded, recomputed); ok is None when there is no ledger.
+    """
+    ledger = read_ledger(loki_dir, iteration)
+    if ledger is None:
+        return None, None, None
+    recorded = str(ledger.get("ledger_sha256") or "")
+    entries = ledger.get("entries")
+    if not isinstance(entries, list):
+        entries = []
+    recomputed = compute_ledger_hash(entries)
+    return (recorded == recomputed and bool(recorded)), recorded, recomputed
+
+
+# ---------------------------------------------------------------------------
+# compare (READ + COMPARE)
+# ---------------------------------------------------------------------------
+
+def _stringify(v):
+    """Stable string form for equality comparison of an expected/actual value.
+
+    Uses the canonical form for dicts/lists so key order does not matter, and a
+    plain str() for scalars. Comparison is intentionally exact after this
+    normalization -- an expectation is a precise prediction, not a fuzzy match.
+    """
+    if isinstance(v, (dict, list)):
+        return _canonical(v)
+    return str(v)
+
+
+def compare(loki_dir, iteration, observed):
+    """Compare the pre-committed ledger against observed results.
+
+    `observed` maps expectation id -> actual observation. Each observation is
+    either:
+      - a value (scalar/dict/list): compared directly to `expected`; OR
+      - a dict {"actual": <value>} for the same; OR
+      - a dict {"evaluable": False, ...} to mark an expectation that ran but
+        could not be evaluated (-> inconclusive).
+    An id NOT present in `observed` is a DROPPED expectation (never executed).
+
+    Returns a dict:
+      {
+        "ledger_present": bool,
+        "ledger_hash_ok": bool | None,   # None when no ledger
+        "ledger_sha256": str | None,
+        "results": [ {id, statement, check_ref, expected, actual,
+                      outcome} ],        # outcome in met|contradicted|dropped|inconclusive
+        "met": int, "contradicted": int, "dropped": int, "inconclusive": int,
+      }
+    Fully no-op when the ledger is absent: ledger_present False, empty results.
+    """
+    out = {
+        "ledger_present": False,
+        "ledger_hash_ok": None,
+        "ledger_sha256": None,
+        "results": [],
+        "met": 0, "contradicted": 0, "dropped": 0, "inconclusive": 0,
+    }
+    ledger = read_ledger(loki_dir, iteration)
+    if ledger is None:
+        return out
+
+    out["ledger_present"] = True
+    out["ledger_sha256"] = str(ledger.get("ledger_sha256") or "") or None
+    ok, _rec, _recomp = ledger_hash_ok(loki_dir, iteration)
+    out["ledger_hash_ok"] = ok
+
+    observed = observed if isinstance(observed, dict) else {}
+    entries = ledger.get("entries")
+    if not isinstance(entries, list):
+        entries = []
+
+    for e in entries:
+        if not isinstance(e, dict):
+            continue
+        eid = str(e.get("id") or "")
+        expected = e.get("expected")
+        row = {
+            "id": eid,
+            "statement": str(e.get("statement") or ""),
+            "check_ref": str(e.get("check_ref") or ""),
+            "expected": expected,
+            "actual": None,
+            "outcome": "dropped",
+        }
+
+        if eid not in observed:
+            # Not executed at all -> dropped. A predicted-and-forgotten check is
+            # exactly the silent-drop this ledger exists to catch.
+            row["outcome"] = "dropped"
+        else:
+            obs = observed[eid]
+            if isinstance(obs, dict) and obs.get("evaluable") is False:
+                row["outcome"] = "inconclusive"
+                row["actual"] = obs.get("actual")
+            else:
+                actual = obs.get("actual") if isinstance(obs, dict) and "actual" in obs else obs
+                row["actual"] = actual
+                if _stringify(actual) == _stringify(expected):
+                    row["outcome"] = "met"
+                else:
+                    row["outcome"] = "contradicted"
+
+        out[row["outcome"]] += 1
+        out["results"].append(row)
+
+    return out
+
+
+# ---------------------------------------------------------------------------
+# CLI
+# ---------------------------------------------------------------------------
+
+def _cmd_write(args):
+    try:
+        expected = json.loads(args.expected) if args.expected else None
+    except Exception:
+        # A bare string that is not JSON is recorded verbatim as the expected
+        # value (e.g. --expected "200"): honest passthrough, never a crash.
+        expected = args.expected
+    h = write_entry(args.loki_dir, args.iter, {
+        "id": args.id,
+        "statement": args.statement,
+        "check_ref": args.check_ref,
+        "expected": expected,
+    })
+    if h is None:
+        sys.stderr.write("warn: expectation-ledger write failed\n")
+        return 1
+    print(h)
+    return 0
+
+
+def _cmd_hash(args):
+    ledger = read_ledger(args.loki_dir, args.iter)
+    if ledger is None:
+        sys.stderr.write("no ledger for iteration %s\n" % args.iter)
+        return 2
+    print(str(ledger.get("ledger_sha256") or ""))
+    return 0
+
+
+def _cmd_verify_hash(args):
+    ok, recorded, recomputed = ledger_hash_ok(args.loki_dir, args.iter)
+    if ok is None:
+        print(json.dumps({"ok": False, "error": "no ledger"}))
+        return 2
+    print(json.dumps({"ok": bool(ok), "recorded": recorded,
+                      "recomputed": recomputed}))
+    return 0 if ok else 1
+
+
+def main(argv=None):
+    parser = argparse.ArgumentParser(
+        description="Loki Mode annotate-before-act expectation ledger")
+    sub = parser.add_subparsers(dest="cmd")
+
+    w = sub.add_parser("write", help="append/replace one expectation")
+    w.add_argument("--loki-dir", default=".loki")
+    w.add_argument("--iter", required=True)
+    w.add_argument("--id", required=True)
+    w.add_argument("--statement", default="")
+    w.add_argument("--check-ref", default="", dest="check_ref")
+    w.add_argument("--expected", default="")
+    w.set_defaults(func=_cmd_write)
+
+    h = sub.add_parser("hash", help="print the recorded ledger_sha256")
+    h.add_argument("--loki-dir", default=".loki")
+    h.add_argument("--iter", required=True)
+    h.set_defaults(func=_cmd_hash)
+
+    v = sub.add_parser("verify-hash", help="check ledger_sha256 vs its entries")
+    v.add_argument("--loki-dir", default=".loki")
+    v.add_argument("--iter", required=True)
+    v.set_defaults(func=_cmd_verify_hash)
+
+    args = parser.parse_args(argv)
+    if not getattr(args, "func", None):
+        parser.print_help()
+        return 2
+    return args.func(args)
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/autonomy/run.sh

@@ -12200,8 +12200,11 @@ parse_claude_reset_time() {
     local current_min=$(date +%M)
     local current_sec=$(date +%S)
 
-    # Calculate seconds until reset
-    local current_secs=$((current_hour * 3600 + current_min * 60 + current_sec))
+    # Calculate seconds until reset. Force base-10 (10#) on the zero-padded
+    # date values: 08/09 are invalid octal, so bare arithmetic aborts ("value
+    # too great for base") during those clock windows and silently discards the
+    # real rate-limit reset wait, falling back to a too-short generic backoff.
+    local current_secs=$((10#$current_hour * 3600 + 10#$current_min * 60 + 10#$current_sec))
     local reset_secs=$((hour * 3600))
 
     local wait_secs=$((reset_secs - current_secs))
@@ -12634,8 +12637,14 @@ except Exception:
     # Return the payload on stdout
     printf '%s\n' "$payload"
 
-    # Consume the signal (next iteration would otherwise re-trigger)
+    # Consume the signal (next iteration would otherwise re-trigger).
+    # Also remove the fallback if it coexists: TASK_COMPLETION_CLAIMED and
+    # COMPLETION_REQUESTED are both valid, non-exclusive completion mechanisms, so
+    # a belt-and-suspenders agent can leave both present. Removing only the active
+    # one orphans the other, which then reads as a phantom claim on a later
+    # iteration and forces every-iteration council evaluation. Consume both.
     rm -f "$signal_file" 2>/dev/null
+    rm -f "$fallback_file" 2>/dev/null
     return 0
 }
 

package/autonomy/verify.sh

@@ -723,6 +723,502 @@ print(n)
     return 0
 }
 
+# ---------------------------------------------------------------------------
+# Gate: runtime boot smoke (NET-NEW).
+#
+# "It actually runs." A shipped change should not only build and pass tests --
+# for an app that serves HTTP, the strongest cheap evidence is that the app
+# BOOTS and answers a request. This gate detects a start command, boots the app
+# with a hard timeout, probes a health/root path, records the HTTP status (and
+# a screenshot artifact when playwright is available), and tears the app down.
+#
+# REUSE (deterministic port of run.sh smoke machinery, source cited):
+#   - start-command detection order: app_runner_init (app-runner.sh:757-912).
+#     Faithfully ported here (compose/Dockerfile EXCLUDED: docker boots are slow,
+#     need a running daemon, and are out of scope for a fast verify gate).
+#   - default-port map: _detect_port (app-runner.sh:641-731).
+#   - optional screenshot: the inline chromium smoke script from
+#     playwright_verify_app (playwright-verify.sh:118-224), same arg contract.
+#   - bounded-run / liveness discipline: _loki_test_provenance
+#     (completion-council.sh:1587-1600) -- if no timeout binary exists we do NOT
+#     boot unbounded; we mark inconclusive and never hang.
+#
+# VERDICT MAPPING (mirrors this module's inconclusive->CONCERNS policy):
+#   no start command / library / CLI  -> NO gate row emitted (byte-identical to
+#                                        pre-gate output; see BYTE-IDENTITY below).
+#   detected + booted + health 2xx/3xx -> pass, reproducible=true, status+artifact.
+#   detected + won't start / health 5xx/no-answer -> High finding -> not VERIFIED.
+#   detected but boot could not be ATTEMPTED (no timeout binary, no HTTP port
+#     mapping) -> inconclusive -> at-least-CONCERNS (never a silent pass).
+#
+# BYTE-IDENTITY (the critical safety property): when no start command is
+# detectable the gate returns WITHOUT calling _verify_add_gate, so evidence.json
+# and report.md are byte-for-byte identical to a tree without this gate. Library
+# repos, pure CLIs, and any repo with no server therefore see zero change. This
+# is why the gate self-suppresses its row instead of emitting a "skipped" row
+# like the other gates: a skipped row would change the bytes.
+#
+# OPT-OUT: LOKI_RUNTIME_GATE=0 disables the gate entirely (consistent with the
+# other opt-out knobs). Default is on. Disabled -> no row -> byte-identical.
+#
+# NO NETWORK beyond localhost; no secrets. The boot inherits the caller's env.
+# ---------------------------------------------------------------------------
+
+# Resolve a bounded-exec wrapper (GNU timeout, then gtimeout). Echoes the binary
+# name, or nothing if neither exists. Mirrors the fallback chain used across the
+# codebase (run.sh:8814, completion-council.sh:1595).
+_verify_runtime_timeout_bin() {
+    if command -v timeout >/dev/null 2>&1; then
+        echo "timeout"
+    elif command -v gtimeout >/dev/null 2>&1; then
+        echo "gtimeout"
+    fi
+}
+
+# Detect the app's start command + HTTP port from the tree. Echoes two
+# TAB-separated fields "method<TAB>port" when a startable HTTP app is found, or
+# nothing when none is detectable. Faithful port of app_runner_init's cascade
+# (app-runner.sh:757) MINUS docker (compose/Dockerfile), which is intentionally
+# out of scope for a fast verify boot. Honors LOKI_APP_COMMAND / LOKI_APP_PORT
+# overrides exactly as the build loop does. When rank 9's setup recipe exists at
+# .loki/setup-recipe.json it is consulted first; its absence is handled (it is
+# not built yet), so this is purely opportunistic.
+_verify_runtime_detect() {
+    local dir="$1"
+    local method="" port=""
+
+    # 0. Operator override (same env vars the app runner honors).
+    if [ -n "${LOKI_APP_COMMAND:-}" ]; then
+        method="$LOKI_APP_COMMAND"
+    fi
+
+    # 0b. Rank 9 setup recipe (opportunistic; NOT yet built -- absence is normal).
+    if [ -z "$method" ] && [ -f "$dir/.loki/setup-recipe.json" ] && command -v python3 >/dev/null 2>&1; then
+        local recipe
+        recipe="$(python3 - "$dir/.loki/setup-recipe.json" <<'PYEOF' 2>/dev/null || true
+import json, sys
+try:
+    with open(sys.argv[1]) as f:
+        d = json.load(f)
+except Exception:
+    sys.exit(0)
+if not isinstance(d, dict):
+    sys.exit(0)
+cmd = d.get("start") or d.get("start_command") or d.get("run") or ""
+port = d.get("port") or ""
+if isinstance(cmd, str) and cmd.strip():
+    print("%s\t%s" % (cmd.strip(), str(port).strip()))
+PYEOF
+)"
+        if [ -n "$recipe" ]; then
+            method="$(printf '%s' "$recipe" | cut -f1)"
+            port="$(printf '%s' "$recipe" | cut -f2)"
+        fi
+    fi
+
+    # 1. package.json: dev preferred, then start (app-runner.sh:814-828).
+    #    HTTP-SIGNAL REQUIRED (mirrors the Python discipline below): a Node
+    #    "start"/"dev" script is NOT assumed to be an HTTP server. Many legitimate
+    #    CLIs/libraries ship "start":"node cli.js" or "dev":"tsc --watch". We only
+    #    treat the project as bootable-HTTP when there is a POSITIVE HTTP signal:
+    #    an HTTP framework in package.json deps, OR a listen/createServer call in
+    #    the source. Without a signal we leave method empty -> byte-identity path
+    #    (no gate row), so a Node CLI never gets a false-RED boot failure.
+    if [ -z "$method" ] && [ -f "$dir/package.json" ]; then
+        local _node_http_signal=""
+        # (a) HTTP framework or server dep declared in package.json.
+        if grep -qE '"(express|fastify|koa|hapi|@hapi/hapi|next|nuxt|@nestjs/core|@nestjs/platform-express|http-server|connect|restify|polka|@sveltejs/kit|vite)"[[:space:]]*:' "$dir/package.json" 2>/dev/null; then
+            _node_http_signal="dep"
+        fi
+        # (b) a STRONG server-creation call in a shallow scan of JS/TS sources.
+        #     "Strong" means a module-qualified server constructor (http/https/
+        #     http2/net .createServer, or Bun.serve/Deno.serve) -- NOT a bare
+        #     `.listen(` which is common in tests (`http.createServer().listen(0)`)
+        #     and unrelated code. Test/example/build dirs are excluded so an
+        #     incidental server in a test never marks a CLI as bootable-HTTP.
+        #     Uses grep -q (a boolean, no pipe) so this is safe under
+        #     set -o pipefail (a piped `| head` would SIGPIPE grep and, under
+        #     pipefail, drop the result).
+        if [ -z "$_node_http_signal" ]; then
+            if grep -rqE 'https?\.createServer|http2\.createServer|net\.createServer|Bun\.serve\(|Deno\.serve\(' \
+                "$dir" --include='*.js' --include='*.ts' --include='*.mjs' --include='*.cjs' \
+                --exclude-dir=node_modules --exclude-dir=.git \
+                --exclude-dir=test --exclude-dir=tests --exclude-dir=__tests__ \
+                --exclude-dir=examples --exclude-dir=example \
+                --exclude-dir=dist --exclude-dir=build --exclude-dir=spec 2>/dev/null; then
+                _node_http_signal="src"
+            fi
+        fi
+        if [ -n "$_node_http_signal" ]; then
+            if grep -q '"dev"[[:space:]]*:' "$dir/package.json" 2>/dev/null; then
+                method="npm run dev"
+            elif grep -q '"start"[[:space:]]*:' "$dir/package.json" 2>/dev/null; then
+                method="npm start"
+            fi
+        fi
+    fi
+
+    # 2. Procfile (12-factor web: process). Grep the web line's command.
+    if [ -z "$method" ] && [ -f "$dir/Procfile" ]; then
+        local proc_cmd
+        proc_cmd="$(grep -E '^web:' "$dir/Procfile" 2>/dev/null | head -1 | sed -E 's/^web:[[:space:]]*//')"
+        if [ -n "$proc_cmd" ]; then
+            method="$proc_cmd"
+        fi
+    fi
+
+    # 3. Makefile run/serve target (app-runner.sh:831-847).
+    if [ -z "$method" ] && [ -f "$dir/Makefile" ]; then
+        if grep -qE '^run:' "$dir/Makefile" 2>/dev/null; then
+            method="make run"
+        elif grep -qE '^serve:' "$dir/Makefile" 2>/dev/null; then
+            method="make serve"
+        fi
+    fi
+
+    # 4. Python web entrypoints (app-runner.sh:849-892). Only treated as a
+    #    startable HTTP app when a web framework import is present -- a bare
+    #    script (CLI) is NOT booted.
+    if [ -z "$method" ] && [ -f "$dir/manage.py" ]; then
+        method="python manage.py runserver"
+    fi
+    if [ -z "$method" ] && [ -f "$dir/app.py" ]; then
+        if grep -qE 'from[[:space:]]+fastapi|import[[:space:]]+FastAPI' "$dir/app.py" 2>/dev/null; then
+            method="uvicorn app:app --host 127.0.0.1 --port 8000"
+        elif grep -qE 'from[[:space:]]+flask|import[[:space:]]+Flask' "$dir/app.py" 2>/dev/null; then
+            method="flask run --host 127.0.0.1 --port 5000"
+        fi
+    fi
+    if [ -z "$method" ] && [ -f "$dir/main.py" ]; then
+        if grep -qE 'from[[:space:]]+fastapi|import[[:space:]]+FastAPI' "$dir/main.py" 2>/dev/null; then
+            method="uvicorn main:app --host 127.0.0.1 --port 8000"
+        fi
+    fi
+
+    # No startable HTTP app detected -> echo nothing (byte-identity path).
+    [ -z "$method" ] && return 0
+
+    # Resolve the port when detection did not already set one. Mirrors the
+    # _detect_port default map (app-runner.sh:641-731). LOKI_APP_PORT wins.
+    if [ -n "${LOKI_APP_PORT:-}" ]; then
+        port="$LOKI_APP_PORT"
+    elif [ -z "$port" ]; then
+        case "$method" in
+            *manage.py*)                 port=8000 ;;
+            *flask*)                     port=5000 ;;
+            *uvicorn*|*fastapi*|*main.py*) port=8000 ;;
+            *npm*|*next*|*node*)         port=3000 ;;
+            *)                           port=8080 ;;
+        esac
+    fi
+
+    printf '%s\t%s\n' "$method" "$port"
+    return 0
+}
+
+verify_gate_runtime() {
+    local tree="$1"
+    # Opt-out (default on). Disabled -> emit no row -> byte-identical.
+    [ "${LOKI_RUNTIME_GATE:-1}" = "0" ] && return 0
+
+    local detected
+    detected="$(_verify_runtime_detect "$tree")"
+    # No startable HTTP app -> byte-identity path: no gate row, no findings.
+    [ -z "$detected" ] && return 0
+
+    local method port
+    method="$(printf '%s' "$detected" | cut -f1)"
+    port="$(printf '%s' "$detected" | cut -f2)"
+
+    # Bounded-boot discipline (liveness): without a timeout binary we do NOT boot
+    # unbounded. Mark inconclusive -> CONCERNS, never hang (mirror
+    # _loki_test_provenance's timeout-absent branch, completion-council.sh:1597).
+    local timeout_bin
+    timeout_bin="$(_verify_runtime_timeout_bin)"
+    if [ -z "$timeout_bin" ]; then
+        _verify_add_gate "runtime" "inconclusive" "boot" \
+            "start command detected ('$method') but no timeout binary (install coreutils); boot not attempted" "true"
+        return 0
+    fi
+
+    local boot_timeout="${LOKI_RUNTIME_BOOT_TIMEOUT:-45}"
+    local health_path="${LOKI_RUNTIME_HEALTH_PATH:-/}"
+    local url="http://127.0.0.1:${port}${health_path}"
+    # Artifacts land under the resolved --out dir (VERIFY_OUT_DIR set by
+    # verify_main); default to .loki/verify when the gate is exercised directly.
+    local out_dir="${VERIFY_OUT_DIR:-.loki/verify}"
+    local artifact_dir="$out_dir/runtime"
+    mkdir -p "$artifact_dir" 2>/dev/null || true
+    local boot_log="$artifact_dir/boot.log"
+
+    # Boot the app in the background, bounded by the timeout wrapper. The whole
+    # process group is killed on teardown. Env is inherited (no secrets injected).
+    # PORT is exported to the resolved port so 12-factor apps (node, many python
+    # frameworks) listen where the probe looks; apps that hardcode a port ignore
+    # it harmlessly. This keeps boot-port and probe-port consistent.
+    local app_pid=""
+    (
+        cd "$tree" || exit 127
+        export PORT="$port"
+        exec "$timeout_bin" "$boot_timeout" sh -c "$method"
+    ) >"$boot_log" 2>&1 &
+    app_pid=$!
+
+    # Poll the health endpoint until it answers or the boot budget elapses.
+    # Prefer curl; fall back to a bash /dev/tcp connect + minimal GET when curl
+    # is absent (status then unknown -> treated as "answered" only on a real
+    # HTTP status line). Never blocks past boot_timeout.
+    local http_status="" answered="false"
+    local deadline=$(( $(date +%s) + boot_timeout ))
+    local have_curl="false"
+    command -v curl >/dev/null 2>&1 && have_curl="true"
+    # The port we actually probe. Starts at the guessed default; if the boot log
+    # announces a different bound port (e.g. Vite on 5173, which ignores PORT and
+    # the default map cannot know), we re-point the probe THERE. scraped_port is
+    # stashed so teardown can also reclaim it (fixes the different-port leak).
+    local probe_port="$port" scraped_port=""
+
+    while [ "$(date +%s)" -lt "$deadline" ]; do
+        # If the app process already exited, stop polling (it failed to stay up).
+        if ! kill -0 "$app_pid" 2>/dev/null; then
+            # Give one last probe in case it forked a daemon and exited.
+            :
+        fi
+        # Scrape the actually-bound port from the boot log (progressively filled).
+        # Only re-point when it differs from the current probe target.
+        if [ -z "$scraped_port" ]; then
+            scraped_port="$(_verify_runtime_scrape_port "$boot_log" 2>/dev/null || true)"
+            if [ -n "$scraped_port" ] && [ "$scraped_port" != "$probe_port" ]; then
+                probe_port="$scraped_port"
+                url="http://127.0.0.1:${probe_port}${health_path}"
+            fi
+        fi
+        if [ "$have_curl" = "true" ]; then
+            http_status="$(curl -s -o /dev/null -w '%{http_code}' --max-time 3 "$url" 2>/dev/null || echo "")"
+            if [ -n "$http_status" ] && [ "$http_status" != "000" ]; then
+                answered="true"
+                break
+            fi
+        else
+            # Portable fallback: raw TCP GET via bash /dev/tcp (best effort).
+            local resp=""
+            resp="$(_verify_runtime_raw_probe "$probe_port" "$health_path" 2>/dev/null || true)"
+            if [ -n "$resp" ]; then
+                http_status="$resp"
+                answered="true"
+                break
+            fi
+        fi
+        # Stop early if the launcher died AND nothing is listening yet.
+        if ! kill -0 "$app_pid" 2>/dev/null; then
+            break
+        fi
+        sleep 1
+    done
+
+    # Optional screenshot artifact (only when playwright + node are available and
+    # the app answered). Reuses the inline chromium smoke script contract from
+    # playwright_verify_app (playwright-verify.sh). Best effort: absence or
+    # failure never changes the gate outcome.
+    local artifact="" artifact_field=""
+    if [ "$answered" = "true" ] && command -v node >/dev/null 2>&1 \
+       && npx playwright --version >/dev/null 2>&1; then
+        artifact="$artifact_dir/boot-$(date -u +%Y%m%dT%H%M%SZ).png"
+        _verify_runtime_screenshot "$url" "$artifact" "$timeout_bin" || artifact=""
+        [ -f "$artifact" ] && artifact_field="$artifact"
+    fi
+
+    # Teardown: kill the launcher and any child it spawned. Best effort; bounded.
+    # Reclaim BOTH the detected port and the actually-bound port (scraped from the
+    # boot log) so a server that daemonized onto a different port than we guessed
+    # does not leak. scraped_port may be empty (no banner) -- teardown handles it.
+    _verify_runtime_teardown "$app_pid" "$port" "$scraped_port"
+
+    # Interpret the result.
+    if [ "$answered" != "true" ]; then
+        _verify_add_gate "runtime" "fail" "boot" \
+            "app detected ('$method') but did not answer $url within ${boot_timeout}s (see $boot_log)" "true"
+        _verify_add_finding "High" "runtime" "deterministic:runtime-boot" "" "null" \
+            "Runtime boot smoke failed: '$method' did not serve $url within ${boot_timeout}s. $(tail -2 "$boot_log" 2>/dev/null | tr '\n' ' ')"
+        return 0
+    fi
+
+    # Answered. 5xx is a boot-level failure; 2xx/3xx/4xx means the server is up
+    # and routing (4xx on '/' is common for APIs with no root route -- the server
+    # IS running, so that is a PASS: the gate attests "it runs", not "route X
+    # exists"). Only 5xx (server error) fails.
+    local summary="booted; GET $health_path -> HTTP $http_status"
+    [ -n "$artifact_field" ] && summary="$summary; screenshot $artifact_field"
+    if [ "$http_status" -ge 500 ] 2>/dev/null; then
+        _verify_add_gate "runtime" "fail" "boot" "$summary (server error)" "true"
+        _verify_add_finding "High" "runtime" "deterministic:runtime-boot" "" "null" \
+            "Runtime boot smoke failed: '$method' booted but returned HTTP $http_status on $url (server error)."
+    else
+        _verify_add_gate "runtime" "pass" "boot" "$summary" "true"
+    fi
+
+    # Record a structured runtime artifact alongside the gate row so the boot is
+    # reproducible (command + url + status + artifact are all captured).
+    _VR_DIR="$artifact_dir" _VR_METHOD="$method" _VR_URL="$url" \
+    _VR_STATUS="$http_status" _VR_ART="$artifact_field" _VR_TO="$boot_timeout" \
+    python3 - <<'PYEOF' 2>/dev/null || true
+import json, os
+rec = {
+    "start_command": os.environ.get("_VR_METHOD", ""),
+    "url": os.environ.get("_VR_URL", ""),
+    "http_status": os.environ.get("_VR_STATUS", ""),
+    "screenshot": os.environ.get("_VR_ART") or None,
+    "boot_timeout_s": int(os.environ.get("_VR_TO", "0") or 0),
+    "reproducible": True,
+}
+d = os.environ["_VR_DIR"]
+os.makedirs(d, exist_ok=True)
+with open(os.path.join(d, "runtime.json"), "w") as f:
+    json.dump(rec, f, indent=2)
+    f.write("\n")
+PYEOF
+    return 0
+}
+
+# Raw TCP probe fallback (no curl). Sends a minimal HTTP/1.0 GET via bash
+# /dev/tcp and echoes the numeric status code on success, nothing on failure.
+# Best effort; used only when curl is absent.
+_verify_runtime_raw_probe() {
+    local port="$1" path="$2"
+    # /dev/tcp is a bash builtin; guard against sh-only environments.
+    ( exec 3<>"/dev/tcp/127.0.0.1/${port}" 2>/dev/null ) || return 1
+    local line
+    {
+        exec 3<>"/dev/tcp/127.0.0.1/${port}" || return 1
+        printf 'GET %s HTTP/1.0\r\nHost: 127.0.0.1\r\nConnection: close\r\n\r\n' "$path" >&3
+        IFS= read -r line <&3
+        exec 3>&- 3<&-
+    } 2>/dev/null
+    # line looks like: HTTP/1.0 200 OK
+    printf '%s' "$line" | grep -oE 'HTTP/[0-9.]+ [0-9]{3}' | grep -oE '[0-9]{3}$' || return 1
+}
+
+# Scrape the actually-bound localhost port from a dev server's boot log. Dev
+# servers (Vite, SvelteKit, Nuxt, Next, CRA, ...) print a "Local:" / "listening
+# on" banner with their real port, which is frequently NOT the guessed default
+# (bare Vite binds 5173 and ignores PORT). We parse ONLY a localhost/127.0.0.1
+# bind announcement so we never lock onto an unrelated outbound URL the app might
+# have logged (which some other live process could answer -> false green). ANSI
+# color codes are stripped first (dev banners are colorized). Echoes the first
+# matched port, or nothing. Bounded: reads only the given log file, no network.
+_verify_runtime_scrape_port() {
+    local log="$1"
+    [ -f "$log" ] || return 1
+    # Strip ANSI escapes first (dev banners are colorized). Then, line by line,
+    # match a localhost/127.0.0.1 bind announcement and extract the PORT that
+    # sits at the end of the match (the number after the final colon / after
+    # "port"), never an IP octet. Emit the first port found.
+    local line p
+    while IFS= read -r line; do
+        # A URL like http://localhost:5173 or http://127.0.0.1:5173/ .
+        p="$(printf '%s' "$line" | grep -oiE 'https?://(localhost|127\.0\.0\.1):[0-9]{2,5}' | grep -oE ':[0-9]{2,5}' | grep -oE '[0-9]{2,5}' | head -1)"
+        # Or a "listening on [127.0.0.1:]5173" / "listening on port 5173" phrase.
+        if [ -z "$p" ]; then
+            p="$(printf '%s' "$line" | grep -oiE 'listening on( port)?[[:space:]:]*([0-9.]+:)?[0-9]{2,5}' | grep -oE '[0-9]{2,5}$' | head -1)"
+        fi
+        if [ -n "$p" ]; then
+            printf '%s' "$p"
+            return 0
+        fi
+    done < <(sed -E $'s/\033\\[[0-9;?]*[A-Za-z]//g' "$log" 2>/dev/null)
+    return 1
+}
+
+# Optional screenshot via the playwright inline smoke script (reused contract:
+# url screenshot results timeout). Bounded by the same timeout wrapper. Returns
+# 0 if the screenshot file was produced, nonzero otherwise. Never fatal.
+_verify_runtime_screenshot() {
+    local url="$1" out_png="$2" timeout_bin="$3"
+    local tmp_js results_json
+    tmp_js="$(mktemp -t loki-verify-smoke.XXXXXX.js 2>/dev/null)" || return 1
+    results_json="$(mktemp -t loki-verify-smoke.XXXXXX.json 2>/dev/null)" || { rm -f "$tmp_js"; return 1; }
+    cat >"$tmp_js" <<'SMOKE_SCRIPT'
+const { chromium } = require('playwright');
+(async () => {
+  const url = process.argv[2];
+  const screenshotPath = process.argv[3];
+  const pageTimeout = parseInt(process.argv[4] || '15000', 10);
+  let browser;
+  try {
+    browser = await chromium.launch({ headless: true });
+    const page = await browser.newPage();
+    await page.goto(url, { waitUntil: 'domcontentloaded', timeout: pageTimeout });
+    await page.screenshot({ path: screenshotPath, fullPage: false });
+  } catch (err) {
+    process.exit(1);
+  } finally {
+    if (browser) await browser.close();
+  }
+  process.exit(0);
+})();
+SMOKE_SCRIPT
+    "$timeout_bin" 30 node "$tmp_js" "$url" "$out_png" 15000 >/dev/null 2>&1
+    local rc=$?
+    rm -f "$tmp_js" "$results_json"
+    [ "$rc" -eq 0 ] && [ -f "$out_png" ]
+}
+
+# Teardown: terminate the boot launcher and any process still holding the port.
+# Bounded and best effort; never blocks the gate.
+_verify_runtime_teardown() {
+    local app_pid="$1" port="$2" scraped_port="${3:-}"
+    if [ -n "$app_pid" ]; then
+        # Best: kill the launcher's whole process GROUP so a server it spawned in
+        # a subshell (e.g. `vite &`) dies too. GUARDED against self-suicide: in a
+        # non-interactive script job control is off, so a background job can share
+        # the verifier's OWN process group; a negative-PID kill there would kill
+        # us (and our parent). Only group-kill when the child's PGID differs from
+        # ours AND equals the child PID (i.e. it is a real group leader).
+        local child_pgid="" self_pgid=""
+        child_pgid="$(ps -o pgid= -p "$app_pid" 2>/dev/null | tr -d ' ' || true)"
+        self_pgid="$(ps -o pgid= -p $$ 2>/dev/null | tr -d ' ' || true)"
+        if [ -n "$child_pgid" ] && [ "$child_pgid" != "$self_pgid" ] \
+           && [ "$child_pgid" = "$app_pid" ]; then
+            kill -- -"$child_pgid" 2>/dev/null || true
+        fi
+        # Always TERM the launcher PID itself.
+        kill "$app_pid" 2>/dev/null || true
+        # Kill any direct children (the timeout wrapper spawns sh -c "$method").
+        if command -v pkill >/dev/null 2>&1; then
+            pkill -P "$app_pid" 2>/dev/null || true
+        fi
+        # Give it a moment, then hard-kill (PID, and group again when safe).
+        local i=0
+        while [ "$i" -lt 3 ] && kill -0 "$app_pid" 2>/dev/null; do
+            sleep 1; i=$((i + 1))
+        done
+        if [ -n "$child_pgid" ] && [ "$child_pgid" != "$self_pgid" ] \
+           && [ "$child_pgid" = "$app_pid" ]; then
+            kill -9 -- -"$child_pgid" 2>/dev/null || true
+        fi
+        kill -9 "$app_pid" 2>/dev/null || true
+    fi
+    # Reclaim BOTH the detected port and the actually-bound (scraped) port from
+    # any orphan that outlived the launcher -- a daemonized server that bound a
+    # different port than we guessed would otherwise leak. Bounded, best effort.
+    if command -v lsof >/dev/null 2>&1; then
+        # Build a unique, non-empty port list (scraped only if it differs).
+        local _ports="$port"
+        [ -n "$scraped_port" ] && [ "$scraped_port" != "$port" ] && _ports="$_ports $scraped_port"
+        local _rp
+        for _rp in $_ports; do
+            [ -z "$_rp" ] && continue
+            local holders
+            holders="$(lsof -ti tcp:"$_rp" 2>/dev/null || true)"
+            if [ -n "$holders" ]; then
+                printf '%s\n' "$holders" | while IFS= read -r pid; do
+                    [ -n "$pid" ] && kill -9 "$pid" 2>/dev/null || true
+                done
+            fi
+        done
+    fi
+}
+
 # ---------------------------------------------------------------------------
 # Verdict computation (Entanglement 2: inconclusive -> CONCERNS, never VERIFIED).
 #
@@ -841,6 +1337,8 @@ verify_emit_evidence() {
     _V_START="$started_at" \
     _V_DONE="$completed_at" \
     _V_BLOCKON="$block_on" \
+    _V_LEDGER_SHA="${_VERIFY_EXPECT_LEDGER_SHA:-}" \
+    _V_LEDGER_HASHOK="${_VERIFY_EXPECT_LEDGER_HASH_OK:-}" \
     python3 - <<'PYEOF'
 import json, os, hashlib
 
@@ -922,6 +1420,18 @@ doc = {
     "suppressed": [],
 }
 
+# Annotate-before-act ledger hash embed (additive; ONLY when a ledger was
+# present this run). Embedding the ledger_sha256 into evidence.json makes an
+# expectation edited after the fact detectable from the evidence document, the
+# same tamper-evidence proof.json carries. When no ledger existed the env var is
+# empty and this key is omitted, so evidence.json stays byte-identical to today.
+_ledger_sha = os.environ.get("_V_LEDGER_SHA") or ""
+if _ledger_sha:
+    doc["expectation_ledger"] = {
+        "ledger_sha256": _ledger_sha,
+        "hash_ok": (os.environ.get("_V_LEDGER_HASHOK") == "true"),
+    }
+
 os.makedirs(out_dir, exist_ok=True)
 ev_path = os.path.join(out_dir, "evidence.json")
 with open(ev_path, "w") as f:
@@ -1116,6 +1626,200 @@ verify_spec_drift_gate() {
     return 0
 }
 
+# ---------------------------------------------------------------------------
+# Annotate-before-act expectation-ledger gate (autonomy/lib/expectation-ledger.py).
+#
+# When a pre-committed expectation ledger exists at .loki/expectations/<iter>.json
+# (written BEFORE the act/verify), diff its predicted outcomes against the actual
+# observations recorded at .loki/expectations/<iter>.observed.json. Any predicted
+# check that was silently DROPPED (never executed) or CONTRADICTED (actual !=
+# expected) becomes a finding; an UNEVALUABLE prediction -> inconclusive ->
+# CONCERNS (never VERIFIED). A ledger whose recorded hash no longer matches its
+# own entries (edited after the fact) is a tamper finding.
+#
+# ADDITIVE + fail-open. Nothing writes a ledger yet in the common case, so:
+#   - No ledger file present  -> this returns immediately, adds NO gate row and
+#     NO finding, so evidence.json is BYTE-IDENTICAL to today.
+#   - LOKI_EXPECTATION_LEDGER=0 -> disabled entirely (same byte-identical result).
+#   - python3 missing, module missing, or any error -> a single inconclusive
+#     gate row at most, never an abort, never a silent pass.
+#
+# The embedded ledger_sha256 is folded into evidence.json (verify_emit_evidence
+# reads _VERIFY_EXPECT_LEDGER_SHA / _VERIFY_EXPECT_LEDGER_HASH_OK) so an
+# expectation edited after write is detectable from the evidence document too.
+# ---------------------------------------------------------------------------
+verify_expectation_ledger_gate() {
+    local tree="${1:-.}"
+
+    # Opt-out knob, consistent with other verify env knobs. Default ON, but the
+    # gate is a total no-op unless a ledger file actually exists, so default-ON is
+    # byte-identical to today for every run that has no ledger.
+    if [ "${LOKI_EXPECTATION_LEDGER:-1}" = "0" ]; then
+        return 0
+    fi
+
+    local expect_dir="$tree/.loki/expectations"
+    expect_dir="${expect_dir#./}"
+    # No ledger directory at all -> byte-identical no-op (no gate row emitted).
+    [ -d "$expect_dir" ] || return 0
+
+    # Pick the most recent ledger (highest-numbered / newest .json that is not an
+    # .observed.json sidecar). No ledger file -> byte-identical no-op.
+    local ledger_file=""
+    local _f
+    for _f in "$expect_dir"/*.json; do
+        [ -f "$_f" ] || continue
+        case "$_f" in
+            *.observed.json) continue ;;
+        esac
+        if [ -z "$ledger_file" ] || [ "$_f" -nt "$ledger_file" ]; then
+            ledger_file="$_f"
+        fi
+    done
+    [ -n "$ledger_file" ] || return 0
+
+    # Derive the iteration token from the ledger filename (<iter>.json).
+    local iter
+    iter="$(basename "$ledger_file" .json)"
+    local observed_file="$expect_dir/$iter.observed.json"
+    [ -f "$observed_file" ] || observed_file=""
+
+    local mod
+    mod="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/lib/expectation-ledger.py"
+    if [ ! -f "$mod" ]; then
+        _verify_add_gate "expectation_ledger" "inconclusive" "loki-ledger" "ledger present but expectation-ledger module not found" "true"
+        return 0
+    fi
+    if ! command -v python3 >/dev/null 2>&1; then
+        _verify_add_gate "expectation_ledger" "inconclusive" "loki-ledger" "ledger present but python3 not on PATH" "true"
+        return 0
+    fi
+
+    # Compare via the module. It prints TAB-separated finding lines (verify TSV
+    # shape) on stdout for contradicted/dropped/tamper, a GATE:<status>:<summary>
+    # control line for the gate row, and SHA:/HASHOK: control lines for the
+    # evidence embed. Any failure degrades to a single inconclusive gate.
+    local compare_out
+    compare_out="$(
+        _LK_LOKI_DIR="$expect_dir/.." \
+        _LK_ITER="$iter" \
+        _LK_OBSERVED="$observed_file" \
+        _LK_MOD="$mod" \
+        python3 - <<'PYEOF' 2>/dev/null
+import importlib.util, json, os, sys
+
+mod_path = os.environ["_LK_MOD"]
+loki_dir = os.environ["_LK_LOKI_DIR"]
+iteration = os.environ["_LK_ITER"]
+observed_path = os.environ.get("_LK_OBSERVED") or ""
+
+spec = importlib.util.spec_from_file_location("expectation_ledger", mod_path)
+mod = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(mod)
+
+observed = {}
+if observed_path and os.path.isfile(observed_path):
+    try:
+        with open(observed_path) as f:
+            observed = json.load(f)
+    except Exception:
+        observed = {}
+    if not isinstance(observed, dict):
+        observed = {}
+
+res = mod.compare(loki_dir, iteration, observed)
+
+def emit_finding(sev, source, fpath, msg):
+    # verify TSV: severity \t category \t source \t file \t line \t message
+    line = str(msg).replace("\t", " ").replace("\n", " ")
+    print("\t".join([sev, "expectation_ledger", source, fpath or "", "null", line]))
+
+# Tamper check: a broken ledger hash means an expectation was edited after it
+# was sealed. That is a High finding regardless of the compare outcome.
+if res.get("ledger_hash_ok") is False:
+    emit_finding("High", "deterministic:ledger-tamper",
+                 ".loki/expectations/%s.json" % iteration,
+                 "expectation ledger hash mismatch (ledger edited after it was sealed)")
+
+for row in res.get("results", []):
+    outcome = row.get("outcome")
+    stmt = row.get("statement") or row.get("id")
+    if outcome == "contradicted":
+        emit_finding("High", "deterministic:ledger-contradicted", "",
+                     "predicted outcome contradicted: %s (expected=%r actual=%r)"
+                     % (stmt, row.get("expected"), row.get("actual")))
+    elif outcome == "dropped":
+        # Medium (CONCERNS, not BLOCKED): a predicted-but-unobserved check is a
+        # gap, but until observed-capture is wired into the run loop (follow-up)
+        # every un-observed expectation would land here -- blocking on it would
+        # be a footgun. Record-and-surface, do not hard-block. A contradicted
+        # prediction (actively disproven) stays High above.
+        emit_finding("Medium", "deterministic:ledger-dropped", "",
+                     "predicted check never executed (silently dropped): %s" % stmt)
+
+# Gate control line. An inconclusive prediction, OR a tamper, forces
+# at-least-CONCERNS via an inconclusive gate. Contradicted/dropped already emit
+# findings above (which drive BLOCKED/CONCERNS through the finding severity).
+n_c = res.get("contradicted", 0)
+n_d = res.get("dropped", 0)
+n_i = res.get("inconclusive", 0)
+n_m = res.get("met", 0)
+tamper = res.get("ledger_hash_ok") is False
+
+if tamper:
+    gate_status = "fail"
+    summary = "ledger tampered (hash mismatch); %d met / %d contradicted / %d dropped / %d inconclusive" % (n_m, n_c, n_d, n_i)
+elif n_c or n_d:
+    gate_status = "fail"
+    summary = "%d met / %d contradicted / %d dropped / %d inconclusive" % (n_m, n_c, n_d, n_i)
+elif n_i:
+    # Unevaluable prediction -> inconclusive -> CONCERNS (never VERIFIED).
+    gate_status = "inconclusive"
+    summary = "%d met / %d inconclusive (unevaluable predictions)" % (n_m, n_i)
+else:
+    gate_status = "pass"
+    summary = "all %d predicted outcomes met" % n_m
+
+print("GATE:%s:%s" % (gate_status, summary))
+print("SHA:%s" % (res.get("ledger_sha256") or ""))
+print("HASHOK:%s" % ("true" if res.get("ledger_hash_ok") else "false"))
+PYEOF
+    )"
+
+    if [ -z "$compare_out" ]; then
+        _verify_add_gate "expectation_ledger" "inconclusive" "loki-ledger" "ledger present but comparison could not run" "true"
+        return 0
+    fi
+
+    # Parse the module output: finding TSV lines, then GATE:/SHA:/HASHOK: controls.
+    local gate_status="inconclusive"
+    local gate_summary="ledger comparison produced no gate verdict"
+    local line
+    while IFS= read -r line; do
+        case "$line" in
+            GATE:*)
+                # GATE:<status>:<summary>
+                local rest="${line#GATE:}"
+                gate_status="${rest%%:*}"
+                gate_summary="${rest#*:}"
+                ;;
+            SHA:*)
+                _VERIFY_EXPECT_LEDGER_SHA="${line#SHA:}"
+                ;;
+            HASHOK:*)
+                _VERIFY_EXPECT_LEDGER_HASH_OK="${line#HASHOK:}"
+                ;;
+            *)
+                # A finding TSV line (severity has no leading control prefix).
+                [ -n "$line" ] && printf '%s\n' "$line" >>"$_VERIFY_FINDINGS_FILE"
+                ;;
+        esac
+    done <<<"$compare_out"
+
+    _verify_add_gate "expectation_ledger" "$gate_status" "loki-ledger" "$gate_summary" "true"
+    return 0
+}
+
 # ---------------------------------------------------------------------------
 # Hosted-engine enrichment (--hosted opt-in).
 #
@@ -1356,6 +2060,11 @@ verify_main() {
     local started_at completed_at
     started_at="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
 
+    # Expose the resolved output dir to gates that write artifacts (runtime boot
+    # log / screenshot / runtime.json) so those land alongside evidence.json even
+    # when --out overrides the default.
+    VERIFY_OUT_DIR="$out_dir"
+
     _verify_log "loki verify (deterministic-only MVP) starting; base=$base_ref out=$out_dir"
 
     verify_diff_base "$base_ref"
@@ -1382,6 +2091,10 @@ verify_main() {
         verify_gate_static "$tree"
         verify_gate_secret_scan "$tree"
         verify_gate_dependency_audit "$tree"
+        # Runtime boot smoke (NET-NEW). Self-suppresses (no gate row) when no
+        # startable HTTP app is detectable, so library/CLI repos stay byte-
+        # identical. Opt-out via LOKI_RUNTIME_GATE=0.
+        verify_gate_runtime "$tree"
     fi
 
     # Living-spec integration: when a spec lock exists, fold a SPEC_DRIFT
@@ -1390,6 +2103,11 @@ verify_main() {
     # because the optional spec module is missing.
     verify_spec_drift_gate "$tree"
 
+    # Annotate-before-act ledger: diff pre-committed expected outcomes against
+    # observed results. Total no-op (no gate row, no finding, byte-identical
+    # evidence) when no ledger exists -- the common case today.
+    verify_expectation_ledger_gate "$tree"
+
     verify_compute_verdict "$block_on"
 
     completed_at="$(date -u +%Y-%m-%dT%H:%M:%SZ)"

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "7.107.0"
+__version__ = "7.109.0"
 
 # Expose the control app for easy import
 try:

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 The flagship product of [Autonomi](https://www.autonomi.dev/). Loki Mode is a spec-driven autonomous builder with a built-in trust layer that takes any spec to a deployed product and verifies completion with evidence (quality gates plus a completion council), not just a "done" claim. Complete installation instructions for all platforms and use cases.
 
-**Version:** v7.107.0
+**Version:** v7.109.0
 
 ---
 

package/docs/TOP-100-BACKLOG.md

@@ -120,3 +120,40 @@ Generated 2026-07-01 by the top100-backlog-enumeration ultracode workflow (7 age
 | 98 | low | S | autonomous | dashboard | Web-app docs: fill video placeholder (coming-soon text) |
 | 99 | low | M | autonomous | cli | C# provider support (roslyn analyzers + dotnet build, deferred) |
 | 100 | low | XL | founder-gated | engine | BMAD-METHOD v6 integration (net-new, needs founder planning) |
+
+## Gate split (what can actually close autonomously) - 2026-07-01
+
+The /goal asks to work through all 100. The honest structural reality: only a
+subset is autonomously completable. The rest need a founder decision or are
+community/CI-infra work that cannot be forced from this session.
+
+- **Autonomous (I can execute end-to-end): ~25 items** (the `gate=autonomous` rows).
+- **Founder-gated (blocked on a decision only the founder can make): ~35 items.**
+  Licensing (#5), hosted deploy target (#6, #23, #36), enterprise RBAC/SSO (#15),
+  sandbox backend choice (#14, #42), spend (#49 SWE-bench, #18 live-model), npm
+  publish + brand (#4, #13, #61), telemetry (#62), GitHub App (#46). Prepped to
+  one-approval-away where possible; CANNOT close without the founder.
+- **Community / CI-infra (~40 items):** flake root-causes, coverage thresholds,
+  platform runners (ARM64/Windows), distribution resilience. Environmental
+  hardening, not single-session feature work.
+
+### Shipped this session (accuracy-moat, from the competitive gap-analysis)
+
+Net-new accuracy work driven from docs/research-2026-07/gap-analysis-backlog.json
+(a companion list), NOT retroactive Top-100 claims:
+
+- v7.105.0 - convergence: council evaluates on completion-claim (4.0x faster, n=3). commit b8a368a0.
+- v7.106.0 - reverse-classical test provenance (tautological tests downgraded). commit 71299faa.
+- v7.107.0 - loki mcp --transport http loopback bind + bearer auth (+ latent crash fix). commit f3aa523c.
+- v7.108.0 - runtime boot smoke gate + annotate-before-act expectation ledger. commit 806fc374.
+
+### Top-100 items with a concrete shipped commit
+
+- #40 (dashboard memory summary on JSON-backed projects) - commit 330de52d.
+- #22 (3 parallel code reviewers) - already present in the engine (council path).
+
+### Next autonomous batch (by value, unblocked, user-visible)
+
+Picked from the `autonomous` rows by value + real-user impact (not primitives that
+ship dormant). Verify each before starting; several may overlap the already-built
+private autonomi-verify TS engine (e.g. #7/#8 - check before rebuilding).

package/loki-ts/dist/loki.js

@@ -1,5 +1,5 @@
 // @bun
-var X8=Object.defineProperty;var K8=($)=>$;function q8($,Q){this[$]=K8.bind(null,Q)}var b=($,Q)=>{for(var Z in Q)X8($,Z,{get:Q[Z],enumerable:!0,configurable:!0,set:q8.bind(Q,Z)})};var L=($,Q)=>()=>($&&(Q=$($=0)),Q);var J$=import.meta.require;var v1={};b(v1,{lokiDir:()=>P,homeLokiDir:()=>T$,findRepoRootForVersion:()=>e$,REPO_ROOT:()=>h});import{resolve as r,dirname as i$}from"path";import{fileURLToPath as J8}from"url";import{existsSync as x$}from"fs";import{homedir as V8}from"os";function W8(){let $=y1;for(let Q=0;Q<6;Q++){if(x$(r($,"VERSION"))&&x$(r($,"autonomy/run.sh")))return $;let Z=i$($);if(Z===$)break;$=Z}return r(y1,"..","..","..")}function e$($){let Q=$;for(let Z=0;Z<6;Z++){if(x$(r(Q,"VERSION"))&&x$(r(Q,"autonomy/run.sh")))return Q;let z=i$(Q);if(z===Q)break;Q=z}return r($,"..","..","..")}function P(){return process.env.LOKI_DIR??r(process.cwd(),".loki")}function T$(){return r(V8(),".loki")}var y1,h;var C=L(()=>{y1=i$(J8(import.meta.url));h=W8()});import{readFileSync as U8}from"fs";import{resolve as H8,dirname as G8}from"path";import{fileURLToPath as B8}from"url";function N$(){if(Q$!==null)return Q$;let $="7.107.0";if(typeof $==="string"&&$.length>0)return Q$=$,Q$;try{let Q=G8(B8(import.meta.url)),Z=e$(Q);Q$=U8(H8(Z,"VERSION"),"utf-8").trim()}catch{Q$="unknown"}return Q$}var Q$=null;var $1=L(()=>{C()});var c1={};b(c1,{runOrThrow:()=>x8,run:()=>F,readStreamCapped:()=>u1,commandVersion:()=>S8,commandExists:()=>f,ShellError:()=>Q1,MAX_STDOUT_BYTES:()=>f1});async function u1($,Q=f1){let Z=$.getReader(),z=new TextDecoder,X="",q=0;try{while(q<Q){let{done:K,value:W}=await Z.read();if(K)break;if(!W)continue;if(q+=W.byteLength,q>Q){let V=W.byteLength-(q-Q);X+=z.decode(W.subarray(0,V),{stream:!0});break}X+=z.decode(W,{stream:!0})}X+=z.decode()}finally{try{await Z.cancel()}catch{}Z.releaseLock()}return X}async function F($,Q={}){let Z=Bun.spawn({cmd:[...$],stdout:"pipe",stderr:"pipe",env:Q.env?{...process.env,...Q.env}:process.env,cwd:Q.cwd}),z,X;if(Q.timeoutMs&&Q.timeoutMs>0)z=setTimeout(()=>{try{Z.kill("SIGTERM")}catch{}X=setTimeout(()=>{try{Z.kill("SIGKILL")}catch{}},2000)},Q.timeoutMs);try{let[q,K,W]=await Promise.all([u1(Z.stdout),new Response(Z.stderr).text(),Z.exited]);return{stdout:q,stderr:K,exitCode:W}}finally{if(z)clearTimeout(z);if(X)clearTimeout(X)}}async function x8($,Q={}){let Z=await F($,Q);if(Z.exitCode!==0)throw new Q1(`command failed (${Z.exitCode}): ${$.join(" ")}`,Z.exitCode,Z.stdout,Z.stderr);return Z}async function f($){let Q=N8($),Z=await F(["sh","-c",`command -v ${Q}`],{timeoutMs:5000});if(Z.exitCode===0)return Z.stdout.trim()||null;return null}function N8($){if(!/^[A-Za-z0-9._/-]+$/.test($))throw Error(`refused to shell-escape suspect token: ${$}`);return $}async function S8($,Q="--version"){if(!await f($))return null;let z=await F([$,Q],{timeoutMs:5000});if(z.exitCode!==0)return null;return((z.stdout||z.stderr).split(/\r?\n/)[0]?.trim()??"")||null}var f1=16777216,Q1;var d=L(()=>{Q1=class Q1 extends Error{message;exitCode;stdout;stderr;constructor($,Q,Z,z){super($);this.message=$;this.exitCode=Q;this.stdout=Z;this.stderr=z;this.name="ShellError"}}});function t($){return D8?"":$}var D8,T,S,_,nZ,I,k,y,J;var c=L(()=>{D8=(process.env.NO_COLOR??"").length>0;T=t("\x1B[0;31m"),S=t("\x1B[0;32m"),_=t("\x1B[1;33m"),nZ=t("\x1B[0;34m"),I=t("\x1B[0;36m"),k=t("\x1B[1m"),y=t("\x1B[2m"),J=t("\x1B[0m")});import{existsSync as c8}from"fs";async function Z$(){if(A$!==void 0)return A$;let $="/opt/homebrew/bin/python3.12";if(c8($))return A$=$,$;let Q=await f("python3.12");if(Q)return A$=Q,Q;let Z=await f("python3");return A$=Z,Z}async function z$($,Q={}){let Z=await Z$();if(!Z)return{stdout:"",stderr:"python3 not found",exitCode:127};return F([Z,"-c",$],Q)}var A$;var V$=L(()=>{d()});var J0={};b(J0,{runStatus:()=>U3});import{existsSync as v,readFileSync as U$,readdirSync as e1,statSync as $0}from"fs";import{resolve as D,basename as Q3}from"path";import{homedir as Z3}from"os";function Q0($){let Q=Math.trunc($);if(Q>=1e6)return`${(Math.trunc(Q/1e6*10)/10).toFixed(1)}M`;if(Q>=1000)return`${(Math.trunc(Q/1000*10)/10).toFixed(1)}K`;return String(Q)}function Z0($,Q,Z){if(Q===0)return null;let z=Math.trunc($*100/Q),X=Math.trunc($*D$/Q);if(X>D$)X=D$;let q=D$-X,K=S;if(z>=80)K=T;else if(z>=50)K=_;let W="=".repeat(Math.max(0,X))+" ".repeat(Math.max(0,q)),V=Q0($),U=Q0(Q);return`  ${k}${Z}${J} ${K}[${W}]${J} ${z}% (${V} / ${U})`}async function X3(){if(await f("jq"))return!0;return process.stdout.write(`${T}Error: jq is required but not installed.${J}
+var X8=Object.defineProperty;var K8=($)=>$;function q8($,Q){this[$]=K8.bind(null,Q)}var b=($,Q)=>{for(var Z in Q)X8($,Z,{get:Q[Z],enumerable:!0,configurable:!0,set:q8.bind(Q,Z)})};var L=($,Q)=>()=>($&&(Q=$($=0)),Q);var J$=import.meta.require;var v1={};b(v1,{lokiDir:()=>P,homeLokiDir:()=>T$,findRepoRootForVersion:()=>e$,REPO_ROOT:()=>h});import{resolve as r,dirname as i$}from"path";import{fileURLToPath as J8}from"url";import{existsSync as x$}from"fs";import{homedir as V8}from"os";function W8(){let $=y1;for(let Q=0;Q<6;Q++){if(x$(r($,"VERSION"))&&x$(r($,"autonomy/run.sh")))return $;let Z=i$($);if(Z===$)break;$=Z}return r(y1,"..","..","..")}function e$($){let Q=$;for(let Z=0;Z<6;Z++){if(x$(r(Q,"VERSION"))&&x$(r(Q,"autonomy/run.sh")))return Q;let z=i$(Q);if(z===Q)break;Q=z}return r($,"..","..","..")}function P(){return process.env.LOKI_DIR??r(process.cwd(),".loki")}function T$(){return r(V8(),".loki")}var y1,h;var C=L(()=>{y1=i$(J8(import.meta.url));h=W8()});import{readFileSync as U8}from"fs";import{resolve as H8,dirname as G8}from"path";import{fileURLToPath as B8}from"url";function N$(){if(Q$!==null)return Q$;let $="7.109.0";if(typeof $==="string"&&$.length>0)return Q$=$,Q$;try{let Q=G8(B8(import.meta.url)),Z=e$(Q);Q$=U8(H8(Z,"VERSION"),"utf-8").trim()}catch{Q$="unknown"}return Q$}var Q$=null;var $1=L(()=>{C()});var c1={};b(c1,{runOrThrow:()=>x8,run:()=>F,readStreamCapped:()=>u1,commandVersion:()=>S8,commandExists:()=>f,ShellError:()=>Q1,MAX_STDOUT_BYTES:()=>f1});async function u1($,Q=f1){let Z=$.getReader(),z=new TextDecoder,X="",q=0;try{while(q<Q){let{done:K,value:W}=await Z.read();if(K)break;if(!W)continue;if(q+=W.byteLength,q>Q){let V=W.byteLength-(q-Q);X+=z.decode(W.subarray(0,V),{stream:!0});break}X+=z.decode(W,{stream:!0})}X+=z.decode()}finally{try{await Z.cancel()}catch{}Z.releaseLock()}return X}async function F($,Q={}){let Z=Bun.spawn({cmd:[...$],stdout:"pipe",stderr:"pipe",env:Q.env?{...process.env,...Q.env}:process.env,cwd:Q.cwd}),z,X;if(Q.timeoutMs&&Q.timeoutMs>0)z=setTimeout(()=>{try{Z.kill("SIGTERM")}catch{}X=setTimeout(()=>{try{Z.kill("SIGKILL")}catch{}},2000)},Q.timeoutMs);try{let[q,K,W]=await Promise.all([u1(Z.stdout),new Response(Z.stderr).text(),Z.exited]);return{stdout:q,stderr:K,exitCode:W}}finally{if(z)clearTimeout(z);if(X)clearTimeout(X)}}async function x8($,Q={}){let Z=await F($,Q);if(Z.exitCode!==0)throw new Q1(`command failed (${Z.exitCode}): ${$.join(" ")}`,Z.exitCode,Z.stdout,Z.stderr);return Z}async function f($){let Q=N8($),Z=await F(["sh","-c",`command -v ${Q}`],{timeoutMs:5000});if(Z.exitCode===0)return Z.stdout.trim()||null;return null}function N8($){if(!/^[A-Za-z0-9._/-]+$/.test($))throw Error(`refused to shell-escape suspect token: ${$}`);return $}async function S8($,Q="--version"){if(!await f($))return null;let z=await F([$,Q],{timeoutMs:5000});if(z.exitCode!==0)return null;return((z.stdout||z.stderr).split(/\r?\n/)[0]?.trim()??"")||null}var f1=16777216,Q1;var d=L(()=>{Q1=class Q1 extends Error{message;exitCode;stdout;stderr;constructor($,Q,Z,z){super($);this.message=$;this.exitCode=Q;this.stdout=Z;this.stderr=z;this.name="ShellError"}}});function t($){return D8?"":$}var D8,T,S,_,nZ,I,k,y,J;var c=L(()=>{D8=(process.env.NO_COLOR??"").length>0;T=t("\x1B[0;31m"),S=t("\x1B[0;32m"),_=t("\x1B[1;33m"),nZ=t("\x1B[0;34m"),I=t("\x1B[0;36m"),k=t("\x1B[1m"),y=t("\x1B[2m"),J=t("\x1B[0m")});import{existsSync as c8}from"fs";async function Z$(){if(A$!==void 0)return A$;let $="/opt/homebrew/bin/python3.12";if(c8($))return A$=$,$;let Q=await f("python3.12");if(Q)return A$=Q,Q;let Z=await f("python3");return A$=Z,Z}async function z$($,Q={}){let Z=await Z$();if(!Z)return{stdout:"",stderr:"python3 not found",exitCode:127};return F([Z,"-c",$],Q)}var A$;var V$=L(()=>{d()});var J0={};b(J0,{runStatus:()=>U3});import{existsSync as v,readFileSync as U$,readdirSync as e1,statSync as $0}from"fs";import{resolve as D,basename as Q3}from"path";import{homedir as Z3}from"os";function Q0($){let Q=Math.trunc($);if(Q>=1e6)return`${(Math.trunc(Q/1e6*10)/10).toFixed(1)}M`;if(Q>=1000)return`${(Math.trunc(Q/1000*10)/10).toFixed(1)}K`;return String(Q)}function Z0($,Q,Z){if(Q===0)return null;let z=Math.trunc($*100/Q),X=Math.trunc($*D$/Q);if(X>D$)X=D$;let q=D$-X,K=S;if(z>=80)K=T;else if(z>=50)K=_;let W="=".repeat(Math.max(0,X))+" ".repeat(Math.max(0,q)),V=Q0($),U=Q0(Q);return`  ${k}${Z}${J} ${K}[${W}]${J} ${z}% (${V} / ${U})`}async function X3(){if(await f("jq"))return!0;return process.stdout.write(`${T}Error: jq is required but not installed.${J}
 `),process.stdout.write(`Install with:
 `),process.stdout.write(`  brew install jq    (macOS)
 `),process.stdout.write(`  apt install jq     (Debian/Ubuntu)
@@ -805,4 +805,4 @@ Set LOKI_LEGACY_BASH=1 to force the bash CLI for every command.
 `),2}default:return process.stderr.write(`Unknown command: ${Q}
 `),process.stderr.write(z8),2}}i1();process.on("SIGINT",()=>process.exit(130));process.on("SIGTERM",()=>process.exit(143));var EZ=await RZ(Bun.argv.slice(2));process.exit(EZ);
 
-//# debugId=FBA0E62D8D186E7164756E2164756E21
+//# debugId=68DF9A47D3B818A364756E2164756E21

package/mcp/__init__.py

@@ -57,4 +57,4 @@ try:
 except ImportError:
     __all__ = ['mcp']
 
-__version__ = '7.107.0'
+__version__ = '7.109.0'

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "loki-mode",
   "mcpName": "io.github.asklokesh/loki-mode",
-  "version": "7.107.0",
+  "version": "7.109.0",
   "description": "Loki Mode by Autonomi. Autonomous spec-to-product system: takes a PRD, GitHub issue, OpenAPI/JSON/YAML, or one-line brief to a deployed app via the RARV-C closure loop with 8 quality gates. Provider-agnostic (Claude Code, OpenAI Codex, Cline, Aider).",
   "keywords": [
     "agent",

package/plugins/loki-mode/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "loki-mode",
   "displayName": "Loki Mode",
-  "version": "7.107.0",
+  "version": "7.109.0",
   "description": "Autonomous spec-to-product build system with a built-in trust layer (RARV-C closure loop, 8 quality gates, completion council). Ships Loki's spec-hardening, drift-detection, and deterministic PR verification commands plus the Loki MCP server.",
   "author": {
     "name": "Autonomi",