loki-mode 7.113.0 → 7.114.0

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: Autonomous spec-driven build system with a built-in trust layer. It does not call work done until it is verified (RARV-C closure loop, 8 quality gates, completion council, verified-completion evidence gate). Triggers on "Loki Mode". Takes a spec (PRD, GitHub issue, OpenAPI doc, etc.) to deployed product with minimal human intervention. Provider-agnostic. Requires --dangerously-skip-permissions flag.
 ---
 
-# Loki Mode v7.113.0
+# Loki Mode v7.114.0
 
 **You are an autonomous agent. You make decisions. You do not ask questions. You do not stop.**
 
@@ -408,4 +408,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v7.113.0 | [Autonomi](https://www.autonomi.dev/) flagship product | ~260 lines core**
+**v7.114.0 | [Autonomi](https://www.autonomi.dev/) flagship product | ~260 lines core**

package/VERSION

@@ -1 +1 @@
-7.113.0
+7.114.0

package/autonomy/completion-council.sh

@@ -25,6 +25,12 @@
 #   LOKI_COUNCIL_THRESHOLD        - Votes needed for completion (default: 2)
 #   LOKI_COUNCIL_CHECK_INTERVAL   - Check every N iterations (default: 5)
 #   LOKI_COUNCIL_MIN_ITERATIONS   - Minimum iterations before council runs (default: 3)
+#   LOKI_COUNCIL_CONVERGENCE_EARLY - No-claim early-check bypass: when evidence is
+#                                    affirmatively green (real suite passed +
+#                                    checklist not failing) the convergence path
+#                                    may evaluate off the CHECK_INTERVAL boundary
+#                                    (>= MIN_ITERATIONS). Default 1; set 0 to
+#                                    restore interval-only behavior (RANK 15).
 #   LOKI_COUNCIL_CONVERGENCE_WINDOW - Iterations to track for convergence (default: 3)
 #   LOKI_COUNCIL_STAGNATION_LIMIT - Max iterations with no git changes (default: 5)
 #   LOKI_COUNCIL_DONE_SIGNAL_LIMIT - Max total done signals before force stop (default: 10)
@@ -3351,6 +3357,122 @@ PYEOF
 # Main Entry Point - Should the loop stop?
 #===============================================================================
 
+#===============================================================================
+# Convergence-floor early-check helpers (RANK 15)
+#
+# Lower the effective convergence floor for the NO-explicit-claim path ONLY.
+# By default the council convergence path only evaluates on the CHECK_INTERVAL
+# boundary (every 5th iteration), so a no-promise/analysis run that is verifiably
+# finished at iteration 2 still grinds to iteration 5 before the council is even
+# allowed to look. These helpers let that path evaluate as soon as there is
+# AFFIRMATIVE evidence of done, without weakening any gate: they only flip WHEN
+# the council evaluates, never WHETHER it approves (council_evaluate still runs
+# the full checklist / held-out / evidence / assumption gates + the vote + the
+# devil's advocate on every trigger).
+#
+# Two knobs preserve full opt-out to the historical behavior:
+#   LOKI_COUNCIL_CONVERGENCE_EARLY=0  -> disable the early-check bypass entirely
+#                                        (byte-identical to prior interval-only).
+#   LOKI_COUNCIL_MIN_ITERATIONS       -> existing floor (already clamps to >=1);
+#                                        the early check never fires below it.
+#===============================================================================
+
+# _council_convergence_evidence_green: read-only, side-effect-free probe that
+# returns 0 ONLY when there is AFFIRMATIVE positive evidence a no-promise run is
+# done -- i.e. a real test suite ran and passed, AND (if a checklist exists) it
+# has no failing items. Deliberately does NOT reuse council_evidence_gate: that
+# gate PASSES on inconclusive inputs (no git repo / no baseline / runner=="none"
+# / missing test-results.json all pass-through). Inconclusive is "not red", not
+# "green" -- fast-pathing on it would be an unverified early stop. Affirmative
+# green means tests ACTUALLY ran and passed. Does NOT call
+# council_reverify_checklist (that has side effects; council_evaluate runs it).
+_council_convergence_evidence_green() {
+    local tr_file="${TARGET_DIR:-.}/.loki/quality/test-results.json"
+    # Affirmative test-green is REQUIRED: a real runner that passed. A missing
+    # file or runner=="none" (no suite) is NOT affirmative evidence -> not green.
+    [ -f "$tr_file" ] || return 1
+    local tr_state
+    tr_state=$(_TR_FILE="$tr_file" python3 -c "
+import json, os, sys
+try:
+    with open(os.environ['_TR_FILE']) as f:
+        d = json.load(f)
+except (json.JSONDecodeError, IOError, KeyError, ValueError):
+    print('no'); sys.exit(0)
+runner = d.get('runner', 'none')
+passed = d.get('pass', True)
+# Affirmative green requires a REAL suite (runner != none) that did not fail.
+print('yes' if (runner != 'none' and passed is not False) else 'no')
+" 2>/dev/null || echo "no")
+    [ "$tr_state" = "yes" ] || return 1
+
+    # If a checklist exists, it must have NO failing items to be affirmatively
+    # green. Absence of a checklist is fine (test-green alone carries the signal);
+    # the council's own hard checklist gate still runs inside council_evaluate.
+    local results_file="${TARGET_DIR:-.}/.loki/checklist/verification-results.json"
+    if [ -f "$results_file" ]; then
+        local cl_state
+        cl_state=$(_RESULTS_FILE="$results_file" python3 -c "
+import json, os, sys
+try:
+    with open(os.environ['_RESULTS_FILE']) as f:
+        r = json.load(f)
+except (json.JSONDecodeError, IOError, KeyError, ValueError):
+    print('no'); sys.exit(0)
+items = [it for cat in r.get('categories', []) for it in cat.get('items', [])]
+if not items:
+    # A present-but-empty checklist is not affirmative done-evidence.
+    print('no'); sys.exit(0)
+failing = any(it.get('status') == 'failing' for it in items)
+print('no' if failing else 'yes')
+" 2>/dev/null || echo "no")
+        [ "$cl_state" = "yes" ] || return 1
+    fi
+    return 0
+}
+
+# _council_should_check_now: pure decision function -- given the current gate
+# inputs (via env/args) returns 0 if the council should evaluate this iteration,
+# 1 otherwise. Extracted so the convergence-floor bypass is unit-testable without
+# driving a real 3-member vote. Inputs (all read from the shell, mirroring
+# council_should_stop's locals):
+#   $1 = circuit_triggered ("true"/other)
+#   $2 = completion_claimed ("true"/other)
+#   ITERATION_COUNT, COUNCIL_CHECK_INTERVAL, COUNCIL_MIN_ITERATIONS (globals)
+#   LOKI_COUNCIL_CONVERGENCE_EARLY (knob; default on)
+# Precedence matches council_should_stop: circuit breaker, then explicit claim,
+# then interval boundary, then the NEW evidence-green early check (last, so it
+# never changes the explicit-claim or circuit paths).
+_council_should_check_now() {
+    local circuit_triggered="${1:-false}"
+    local completion_claimed="${2:-false}"
+    local iter="${ITERATION_COUNT:-0}"
+    local interval="${COUNCIL_CHECK_INTERVAL:-5}"
+    local min_iter="${COUNCIL_MIN_ITERATIONS:-3}"
+
+    # Circuit breaker and explicit-claim paths are UNCHANGED (they already bypass
+    # the interval); return check-now for them without touching the early logic.
+    if [ "$circuit_triggered" = "true" ]; then
+        return 0
+    fi
+    if [ "$completion_claimed" = "true" ]; then
+        return 0
+    fi
+    # Standard interval boundary.
+    if [ $((iter % interval)) -eq 0 ]; then
+        return 0
+    fi
+    # NEW convergence-floor early check (no explicit claim): once we are at/above
+    # the MIN_ITERATIONS floor AND there is affirmative evidence of done, evaluate
+    # now instead of waiting for the next interval boundary. Opt-out preserved.
+    if [ "${LOKI_COUNCIL_CONVERGENCE_EARLY:-1}" != "0" ] \
+       && [ "$iter" -ge "$min_iter" ] 2>/dev/null \
+       && _council_convergence_evidence_green; then
+        return 0
+    fi
+    return 1
+}
+
 council_should_stop() {
     # bash-F1: reset the force-stop sentinel at entry. A return-0 from the
     # genuine approval path leaves this 0; only the safety-valve paths below
@@ -3413,13 +3535,17 @@ council_should_stop() {
         completion_claimed=true
     fi
 
+    # Decide WHETHER to convene the council this iteration. Precedence (unchanged
+    # for the circuit-breaker and explicit-claim paths): circuit breaker, explicit
+    # completion claim, interval boundary, then the RANK-15 convergence-floor early
+    # check (no explicit claim + affirmative evidence-green -> evaluate now instead
+    # of waiting for the next interval boundary). _council_should_check_now is a
+    # pure decision helper (unit-tested) so this stays a single call.
     local should_check=false
-    if [ "$circuit_triggered" = "true" ]; then
-        should_check=true
-    elif [ "$completion_claimed" = "true" ]; then
-        should_check=true
+    if [ "$completion_claimed" = "true" ] && [ "$circuit_triggered" != "true" ]; then
         log_info "[Council] Completion claimed this iteration -- evaluating now (not deferring to the ${COUNCIL_CHECK_INTERVAL}-iteration interval)"
-    elif [ $((ITERATION_COUNT % COUNCIL_CHECK_INTERVAL)) -eq 0 ]; then
+    fi
+    if _council_should_check_now "$circuit_triggered" "$completion_claimed"; then
         should_check=true
     fi
 

package/autonomy/prd-checklist.sh

@@ -120,24 +120,43 @@ checklist_init() {
 # .loki/checklist/oracle-findings.json and surfaced to the completion council via
 # checklist_as_evidence(), and a best-effort trust event is recorded.
 #
-# Honest scope (v7.x, P2-3 first slice):
-#   IMPLEMENTED: the spec-vs-reality CONFLICT dimension for the database/datastore
-#   choice, which is the highest-signal, lowest-false-positive triangulation
-#   (the choices are mutually exclusive and have unambiguous dependency markers).
+# Honest scope (source-grounded triangulation, rank-2 backlog):
+#   IMPLEMENTED, four legs, each an independent oracle against source reality:
+#     (1) DATASTORE conflict -- spec names DB X but the codebase wires a
+#         DIFFERENT mutually-exclusive DB Y and NOT X. Highest-signal, zero-FP:
+#         choices are mutually exclusive with unambiguous dependency markers.
+#     (2) HTTP ROUTE grounding -- every endpoint the spec NAMES must map to a
+#         real route/handler discovered in source. Fires High ONLY when source
+#         yields a recognizable route set AND a specific spec endpoint is
+#         provably absent from it. If ZERO routes parse out of source we
+#         fail-open (no finding): un-parsed framework syntax must never read as
+#         "route missing". Path params are normalized across frameworks
+#         (/orders/:id ~ /orders/{id} ~ /orders/<id>).
+#     (3) PUBLIC API SYMBOL existence -- symbols the spec names as public API are
+#         verified to EXIST via the LSP proxy (mcp.lsp_proxy --check-symbols,
+#         the same one-shot contract as the LSP-diagnostics gate), NOT via an
+#         LLM-authored grep. When no language server is reachable this leg is
+#         INCONCLUSIVE (fail-open, never a fabricated pass or false High).
+#     (4) DOMAIN INVARIANT -- >=1 high-value invariant enforced deterministically.
+#         First invariant: plaintext-password-store detection (a password column
+#         / field persisted without a hash function anywhere near it). Fires High
+#         only on positive evidence of storage-without-hashing.
 #
-#   DEFERRED (documented follow-up, NOT faked): the third leg of full
-#   triangulation -- DOMAIN INVARIANTS (auth must hash, money must not be float,
-#   PII must be encrypted) -- and additional stack axes (web framework, language
-#   runtime). These need an invariant catalog plus per-language AST-aware
-#   detection to avoid false positives; a regex grep would be noisy. They are
-#   intentionally left out of this slice. Backlog: P2-3 follow-up "domain-
-#   invariant oracle". See the conflict-detection design here as the template.
+#   DEFERRED (documented follow-up, NOT faked): additional stack axes (web
+#   framework, language runtime) and further domain invariants (money-not-float,
+#   PII-encryption). These need a broader catalog plus per-language AST-aware
+#   detection to stay zero-FP; left out of this slice.
 #
 # Non-conflict cases that must NOT fire (guarded + tested):
 #   - spec asserts DB X, codebase has nothing wired yet (greenfield): ABSENT is
 #     not a contradiction -> no finding.
 #   - spec asserts DB X, codebase wires DB X: agreement -> no finding.
 #   - spec asserts nothing about a datastore: no spec oracle -> no finding.
+#   - spec names an endpoint that DOES exist in source -> no finding.
+#   - source has NO parseable routes at all (greenfield / unknown framework) ->
+#     route leg fails open, no finding.
+#   - no language server on PATH -> symbol leg inconclusive, no finding.
+#   - passwords stored WITH a hash near them -> invariant leg does not fire.
 #
 # Opt-out: LOKI_CHECKLIST_ORACLE=0 (default on). When off, this is a no-op.
 
@@ -158,6 +177,15 @@ checklist_oracle_triangulate() {
     local project_dir
     project_dir="$(pwd)"
 
+    # Loki install dir (where the `mcp` package lives) so the symbol leg can shell
+    # out to `python3 -m mcp.lsp_proxy` with the correct import path. This file is
+    # autonomy/prd-checklist.sh, so the install root is its parent's parent. When
+    # sourced by run.sh, LOKI_ORIGINAL_PROJECT_DIR already points there; prefer it.
+    local oracle_install_dir="${LOKI_ORIGINAL_PROJECT_DIR:-}"
+    if [ -z "$oracle_install_dir" ]; then
+        oracle_install_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." 2>/dev/null && pwd)"
+    fi
+
     # Feed the detector to python3 via a quoted heredoc (delimiter in quotes) so
     # bash performs NO interpolation: no dollar-digit footgun, no quote-escaping
     # hazards. All inputs arrive through _ORACLE_* env vars.
@@ -165,6 +193,7 @@ checklist_oracle_triangulate() {
     status_token=$(_ORACLE_SPEC="$CHECKLIST_PRD_PATH" \
                    _ORACLE_OUT="$findings_file" \
                    _ORACLE_PROJECT="$project_dir" \
+                   _ORACLE_INSTALL_DIR="$oracle_install_dir" \
                    python3 - <<'ORACLE_PY' 2>/dev/null || echo "NOOP"
 import json, os, re, sys, tempfile, glob
 
@@ -234,12 +263,11 @@ for name, cfg in DATASTORES.items():
 # If the spec names exactly one PRIMARY datastore, we can triangulate it. If it
 # names several primaries, the spec itself is ambiguous about the datastore;
 # triangulation of "the" choice is unsound, so skip (spec-interrogation owns
-# spec-internal ambiguity, not this oracle).
+# spec-internal ambiguity, not this oracle). spec_db is None when there is no
+# single primary datastore to triangulate -- the datastore leg then contributes
+# nothing, but the route/symbol/invariant legs below still run.
 spec_primary = sorted(spec_asserts - SECONDARY)
-if len(spec_primary) != 1:
-    print("NO_SPEC_DB")
-    sys.exit(0)
-spec_db = spec_primary[0]
+spec_db = spec_primary[0] if len(spec_primary) == 1 else None
 
 # --- Reality oracle: scan a bounded set of dependency/lock/source manifests for
 # datastore markers. We scan manifests first (highest signal, lowest noise). ---
@@ -299,11 +327,13 @@ for name in DATASTORES:
 
 findings = []
 
+# --- Leg 1: DATASTORE conflict ---
 # Conflict iff: spec asserts spec_db, AND reality shows a DIFFERENT primary db,
 # AND reality does NOT also show the spec db. Absent reality (greenfield) and
-# agreement both yield no finding.
-contradicting = sorted(d for d in reality_dbs if d != spec_db)
-if contradicting and spec_db not in reality_dbs:
+# agreement both yield no finding. Skipped entirely when the spec names no single
+# primary datastore (spec_db is None).
+contradicting = sorted(d for d in reality_dbs if d != spec_db) if spec_db else []
+if spec_db and contradicting and spec_db not in reality_dbs:
     findings.append({
         "id": "oracle-datastore-conflict",
         "dimension": "spec_vs_reality",
@@ -321,14 +351,292 @@ if contradicting and spec_db not in reality_dbs:
                    % (spec_db, ", ".join(contradicting), spec_db)),
     })
 
+# ===========================================================================
+# Leg 2: HTTP ROUTE grounding -- spec endpoints must map to real handlers.
+# ===========================================================================
+# Same finding shape as oracle-datastore-conflict (dimension=spec_vs_reality,
+# severity=high). FP-avoidance: this leg fires on ABSENCE, which is more FP-prone
+# than the datastore contradiction. Two hard guards keep it zero-FP:
+#   (a) only run when source yields a RECOGNIZABLE route set (>=1 real route);
+#       zero parsed routes -> greenfield / unknown framework -> fail-open.
+#   (b) normalize path params across frameworks so /orders/:id, /orders/{id} and
+#       /orders/<id> all compare equal; only a genuinely absent path fires.
+
+# Normalize an HTTP path for cross-framework comparison: lowercase, strip a
+# trailing slash, collapse any param segment (:id, {id}, <id>, <int:id>) to "*".
+# Trailing sentence punctuation is stripped per-segment so a spec path written
+# mid-prose ("GET /healthz.") normalizes identically to the source "/healthz".
+_param_seg = re.compile(r"^(:[^/]+|\{[^/}]+\}|<[^/>]+>)$")
+# Strip ONLY sentence punctuation prose glues onto a path. Deliberately EXCLUDES
+# the param close characters } > ) ] so that "{id}." -> "{id}" (still a param),
+# never "{id" (broken). Quotes/backticks are stripped (markdown code spans).
+_trailing_punct = ".,;:!?'\"`"
+def norm_path(p):
+    p = p.strip().strip('"').strip("'").strip("`")
+    # keep only the path portion (drop querystring / trailing text)
+    p = p.split("?")[0].split("#")[0]
+    if not p.startswith("/"):
+        return None
+    segs = [s for s in p.split("/") if s != ""]
+    out = []
+    for s in segs:
+        # strip trailing sentence punctuation ("/healthz." -> "healthz",
+        # "{id}." -> "{id}") without touching a param's close brace.
+        s = s.rstrip(_trailing_punct)
+        if not s:
+            continue
+        out.append("*" if _param_seg.match(s) else s.lower())
+    return "/" + "/".join(out)
+
+# Spec endpoints: match METHOD + PATH pairs the spec explicitly names, e.g.
+# "GET /orders", "POST /users/{id}". Requiring a leading HTTP verb keeps this
+# from grabbing arbitrary slashes in prose (file paths, URLs).
+SPEC_ENDPOINT_RE = re.compile(
+    r"(?i)\b(GET|POST|PUT|PATCH|DELETE)\s+(/[A-Za-z0-9_\-/:{}<>*.]*)")
+spec_endpoints = set()
+for m in SPEC_ENDPOINT_RE.finditer(spec_text):
+    np = norm_path(m.group(2))
+    if np:
+        spec_endpoints.add(np)
+
+# Discover real routes in source across common web frameworks. Each pattern
+# captures the path string literal. We scan the same bounded source set as the
+# datastore leg (SKIP_DIRS, cap files) to stay fast.
+ROUTE_PATTERNS = [
+    # express / fastify / koa-router / node: app.get("/x"), router.post('/x')
+    re.compile(r"""(?i)\b(?:app|router|route|api|server|fastify)\s*\.\s*(?:get|post|put|patch|delete|all|route)\s*\(\s*['"`]([^'"`]+)['"`]"""),
+    # flask: @app.route("/x"), @bp.route('/x')
+    re.compile(r"""(?i)@\s*\w+\.route\s*\(\s*['"]([^'"]+)['"]"""),
+    # fastapi / starlette: @app.get("/x"), @router.post('/x')
+    re.compile(r"""(?i)@\s*\w+\.(?:get|post|put|patch|delete)\s*\(\s*['"]([^'"]+)['"]"""),
+    # django path()/re_path()/url(): path("orders/", ...)  (may be relative)
+    re.compile(r"""(?i)\b(?:re_)?path\s*\(\s*r?['"]([^'"]*)['"]"""),
+    re.compile(r"""(?i)\burl\s*\(\s*r?['"]\^?([^'"$]*)['"]"""),
+    # spring / jax-rs annotations: @GetMapping("/x") @RequestMapping("/x") @Path("/x")
+    re.compile(r"""(?i)@(?:Get|Post|Put|Patch|Delete|Request)Mapping\s*\(\s*(?:value\s*=\s*)?['"]([^'"]+)['"]"""),
+    re.compile(r"""(?i)@Path\s*\(\s*['"]([^'"]+)['"]"""),
+    # go: mux.HandleFunc("/x", ...), r.Get("/x", ...), e.GET("/x", ...)
+    re.compile(r"""(?i)\.\s*(?:HandleFunc|Handle|Get|Post|Put|Patch|Delete|GET|POST|PUT|PATCH|DELETE)\s*\(\s*['"]([^'"]+)['"]"""),
+    # ruby on rails routes.rb: get "/x", post 'x'
+    re.compile(r"""(?i)^\s*(?:get|post|put|patch|delete)\s+['"]([^'"]+)['"]"""),
+]
+SOURCE_EXTS = (".py", ".js", ".ts", ".tsx", ".jsx", ".mjs", ".cjs", ".go",
+               ".rb", ".java", ".kt", ".php", ".rs")
+
+def discover_routes(cap_files=800):
+    found = set()
+    seen = 0
+    for root, dirs, files in os.walk(project):
+        dirs[:] = [d for d in dirs if d not in SKIP_DIRS]
+        for fn in files:
+            if not (fn.endswith(SOURCE_EXTS) or fn == "routes.rb" or fn == "urls.py"):
+                continue
+            seen += 1
+            if seen > cap_files:
+                break
+            txt = read_text(os.path.join(root, fn), 120000)
+            for pat in ROUTE_PATTERNS:
+                for mm in pat.finditer(txt):
+                    raw = mm.group(1)
+                    if not raw:
+                        continue
+                    # django paths are often relative ("orders/"); normalize by
+                    # prefixing a slash so they compare on the same axis.
+                    cand = raw if raw.startswith("/") else "/" + raw
+                    np = norm_path(cand)
+                    if np:
+                        found.add(np)
+        else:
+            continue
+        break
+    return found
+
+if spec_endpoints:
+    real_routes = discover_routes()
+    # Guard (a): only fire when source yields a recognizable route set. Zero
+    # discovered routes means we could not parse this framework -> fail-open.
+    if real_routes:
+        missing = sorted(e for e in spec_endpoints if e not in real_routes)
+        if missing:
+            findings.append({
+                "id": "oracle-route-missing",
+                "dimension": "spec_vs_reality",
+                "axis": "http_route",
+                "severity": "high",
+                "spec_asserts": missing,
+                "codebase_reality": sorted(real_routes)[:20],
+                "title": "Spec names endpoint(s) with no handler in source: %s" % (
+                    ", ".join(missing)),
+                "detail": ("The spec/PRD names the HTTP endpoint(s) %s, but no "
+                           "matching route/handler was discovered in the codebase "
+                           "(source declares %d route(s), none matching after path-"
+                           "param normalization). Acceptance criteria derived from "
+                           "the spec alone would pass while the endpoint is not "
+                           "actually served. Wire the handler or correct the spec "
+                           "before completion."
+                           % (", ".join(missing), len(real_routes))),
+            })
+
+# ===========================================================================
+# Leg 4: DOMAIN INVARIANT -- plaintext password storage detection.
+# ===========================================================================
+# Deterministic, positive-evidence-only: fire High only when source shows a
+# password value being PERSISTED (assigned into a stored record / column / insert)
+# with NO hashing function anywhere nearby. Presence of a known hash primitive in
+# the same file suppresses the finding (the app hashes -> not plaintext).
+HASH_MARKERS = re.compile(
+    r"(?i)\b(bcrypt|scrypt|argon2|argon2id|pbkdf2|"
+    r"passlib|hashpw|generate_password_hash|password_hash|"
+    r"crypto\.(?:pbkdf2|scrypt)|sha256_crypt|make_password)\b")
+# A password being written into a persisted structure. Kept tight to avoid FPs:
+# require the word "password" (NOT password_hash / hashed_password / passwordHash)
+# as an assigned key/column/value, near a persistence verb or a column decl.
+# The negative lookahead/behind on _hash / hashed_ is what keeps hashed-password
+# code (the correct case) from tripping the leg.
+PW_STORE_RE = re.compile(
+    r"(?i)("
+    r"(?<!_)(?<!hashed_)password(?!_hash)(?!_digest)\s*[:=]\s*[^\n,;)]+|"   # password = value
+    r"['\"](?<!_)password(?!_hash)['\"]\s*:\s*[^\n,}]+|"                    # "password": value
+    r"(?<!_)password(?!_hash)\s+(?:VARCHAR|TEXT|CHAR|STRING)\b|"           # SQL column decl
+    r"\.\s*(?<!_)password(?!_hash)\s*=\s*[^\n;]+|"                          # obj.password = value
+    r"INSERT\s+INTO[^;]*?\(\s*[^)]*\bpassword\b[^)]*\)|"                   # INSERT (... password ...)
+    r"CREATE\s+TABLE[^;]*?\bpassword\b"                                     # CREATE TABLE ... password
+    r")")
+PERSIST_VERB = re.compile(
+    r"(?i)\b(INSERT\s+INTO|\.save\(|\.create\(|\.insert\(|"
+    r"session\.add\(|db\.|repository\.|\.execute\(|CREATE\s+TABLE|"
+    r"VALUES\s*\()")
+
+def detect_plaintext_password(cap_files=800):
+    seen = 0
+    for root, dirs, files in os.walk(project):
+        dirs[:] = [d for d in dirs if d not in SKIP_DIRS]
+        for fn in files:
+            if not (fn.endswith(SOURCE_EXTS) or fn.endswith(".sql")):
+                continue
+            seen += 1
+            if seen > cap_files:
+                return None
+            path = os.path.join(root, fn)
+            txt = read_text(path, 120000)
+            if not PW_STORE_RE.search(txt):
+                continue
+            # Suppress when the same file hashes passwords (positive evidence the
+            # app is not storing plaintext).
+            if HASH_MARKERS.search(txt):
+                continue
+            # Require a persistence signal in the same file so we only flag
+            # STORED passwords, not e.g. a login form field or a request parse.
+            if PERSIST_VERB.search(txt):
+                rel = os.path.relpath(path, project)
+                return rel
+    return None
+
+# Only run the invariant when the spec is about something that stores passwords
+# (auth / users / login / register / credential). This keeps the leg from
+# scanning unrelated projects and firing on incidental matches.
+if re.search(r"(?i)\b(password|auth|login|register|credential|sign[\s-]?up|user account)\b", spec_text):
+    pw_file = detect_plaintext_password()
+    if pw_file:
+        findings.append({
+            "id": "oracle-invariant-plaintext-password",
+            "dimension": "domain_invariant",
+            "axis": "auth_password_hashing",
+            "severity": "high",
+            "spec_asserts": "passwords stored securely (hashed)",
+            "codebase_reality": [pw_file],
+            "title": "Password appears stored without hashing in %s" % pw_file,
+            "detail": ("Source in %s persists a password value with no hashing "
+                       "primitive (bcrypt/scrypt/argon2/pbkdf2/passlib/...) present "
+                       "in that file. Storing plaintext (or reversibly-encrypted) "
+                       "passwords is a domain-invariant violation the spec's prose "
+                       "acceptance checks would not catch. Hash passwords before "
+                       "persistence."
+                       % pw_file),
+        })
+
+# ===========================================================================
+# Leg 3: PUBLIC API SYMBOL existence via the LSP proxy (NOT LLM grep).
+# ===========================================================================
+# The spec may name public API symbols ("exports parseConfig", "public function
+# createOrder"). We verify each EXISTS in the workspace via the LSP proxy's
+# one-shot --check-symbols subcommand (same cwd/--root contract as the LSP-
+# diagnostics quality gate). This is deterministic ground truth, not an LLM
+# guessing from the same prose. HONEST DEGRADATION: when no language server is
+# reachable, the probe returns available=false and every verdict is null; we
+# record the leg as INCONCLUSIVE and emit NO finding (never a fabricated pass,
+# never a false High). Symbols with a definite exists=false verdict -> High.
+symbol_leg = {"ran": False, "available": None, "checked": [], "missing": []}
+
+# Extract candidate public-API symbol names the spec explicitly calls out. We
+# require an anchoring keyword so we only probe names the spec asserts as public
+# API, not every identifier in prose.
+SPEC_SYMBOL_RE = re.compile(
+    r"(?i)\b(?:public|export(?:s|ed)?|expose[sd]?|api|function|method|class|endpoint symbol)\b"
+    r"[^\n`]*?`?\b([A-Za-z_][A-Za-z0-9_]{2,})`?\s*\(")
+spec_symbols = []
+for m in SPEC_SYMBOL_RE.finditer(spec_text):
+    nm = m.group(1)
+    if nm and nm.lower() not in ("the", "this", "that", "public", "export", "function", "method", "class") and nm not in spec_symbols:
+        spec_symbols.append(nm)
+spec_symbols = spec_symbols[:25]  # bound the probe
+
+if spec_symbols:
+    install_dir = os.environ.get("_ORACLE_INSTALL_DIR", "")
+    # Only attempt the probe when we know the loki install dir (so `-m
+    # mcp.lsp_proxy` imports). Without it we cannot reach the proxy -> honest
+    # inconclusive, no finding.
+    if install_dir and os.path.isdir(os.path.join(install_dir, "mcp")):
+        import subprocess
+        try:
+            proc = subprocess.run(
+                [sys.executable, "-m", "mcp.lsp_proxy",
+                 "--check-symbols", "--root", project],
+                input="\n".join(spec_symbols),
+                cwd=install_dir,
+                capture_output=True, text=True, timeout=90,
+            )
+            probe = json.loads((proc.stdout or "").strip().splitlines()[-1]) if proc.stdout.strip() else {}
+        except Exception:
+            probe = {}
+        symbol_leg["available"] = bool(probe.get("available"))
+        symbol_leg["ran"] = True
+        res = probe.get("results", {}) or {}
+        symbol_leg["checked"] = sorted(res.keys())
+        if symbol_leg["available"]:
+            # Only a DEFINITE exists=false (not null) is a miss.
+            miss = sorted(k for k, v in res.items() if v is False)
+            symbol_leg["missing"] = miss
+            if miss:
+                findings.append({
+                    "id": "oracle-symbol-missing",
+                    "dimension": "spec_vs_reality",
+                    "axis": "public_api_symbol",
+                    "severity": "high",
+                    "spec_asserts": miss,
+                    "codebase_reality": "symbol(s) not found by LSP workspace search",
+                    "title": "Spec names public API symbol(s) the LSP cannot find: %s" % (
+                        ", ".join(miss)),
+                    "detail": ("The spec/PRD names %s as public API, but the LSP "
+                               "workspace symbol search (ground truth, not an LLM "
+                               "grep) reports they do not exist. Acceptance criteria "
+                               "derived from the spec alone would pass against a "
+                               "missing symbol. Implement the symbol or correct the "
+                               "spec before completion."
+                               % ", ".join(miss)),
+                })
+
 result = {
-    "version": 1,
+    "version": 2,
     "spec_path": spec_path,
     "spec_datastore": spec_db,
     "reality_datastores": sorted(reality_dbs),
+    "spec_endpoints": sorted(spec_endpoints),
+    "spec_symbols": spec_symbols,
+    "symbol_leg": symbol_leg,
     "findings": findings,
     "deferred": [
-        "domain-invariant oracle (auth-hashing, money-not-float, PII-encryption)",
+        "additional domain invariants (money-not-float, PII-encryption)",
         "additional stack axes (web framework, language runtime)",
     ],
 }

package/autonomy/run.sh

@@ -10490,6 +10490,23 @@ _severity_is_blocking() {
     grep -qiE '(\[(critical|high)\])|(\*\*[[:space:]]*(critical|high)[[:space:]]*\*\*)|(severity:?[[:space:]]*(critical|high))|(^[[:space:]]*[-*][[:space:]]+(critical|high)([[:space:]:.,*]|$))' "$file"
 }
 
+# 7.114.0 (rank 9): count non-blocking (Medium/Low) findings in a reviewer file.
+# Feeds the weighted mergeability quality score. Mirrors the severity-token
+# tolerance of _severity_is_blocking (bracketed, bold, 'Severity:', or bullet).
+# Echoes "<medium_count> <low_count>" so the caller can weight them differently.
+# Parity-locked with countNonBlockingFindings() in loki-ts/src/runner/quality_gates.ts.
+_count_nonblocking_findings() {
+    local file="$1"
+    if [ ! -f "$file" ]; then
+        echo "0 0"
+        return 0
+    fi
+    local med low
+    med=$(grep -icE '(\[medium\])|(\*\*[[:space:]]*medium[[:space:]]*\*\*)|(severity:?[[:space:]]*medium)|(^[[:space:]]*[-*][[:space:]]+medium([[:space:]:.,*]|$))' "$file")
+    low=$(grep -icE '(\[low\])|(\*\*[[:space:]]*low[[:space:]]*\*\*)|(severity:?[[:space:]]*low)|(^[[:space:]]*[-*][[:space:]]+low([[:space:]:.,*]|$))' "$file")
+    echo "${med:-0} ${low:-0}"
+}
+
 run_code_review() {
     local loki_dir="${TARGET_DIR:-.}/.loki"
     local review_dir="$loki_dir/quality/reviews"
@@ -10638,7 +10655,7 @@ MANAGED_SELECTION
         log_warn "Managed review council unavailable; falling back to CLI fan-out"
     fi
 
-    log_info "Selecting 3 specialist reviewers from pool..."
+    log_info "Selecting reviewers (architecture-strategist + maintainer-mergeability always on, plus keyword-scored specialists)..."
 
     # Write diff/files to temp files for python to read (avoid env var size limits)
     # Use printf to prevent shell variable expansion in diff content (#78)
@@ -10770,13 +10787,25 @@ if all(s == 0 for s in scores.values()):
 else:
     selected = ranked[:2]
 
-# Output JSON: architecture-strategist always first, then the 2 selected
+# Output JSON: architecture-strategist + maintainer-mergeability always first
+# (both carry a mandate no keyword-selected specialist does), then the 2 selected.
+# 7.114.0 (rank 9): maintainer-mergeability is the "would a real maintainer merge
+# this PR" reviewer. It covers scope creep, dead/duplicated code, and conformance
+# to the surrounding code's conventions -- the tech-lead axes the security/test/
+# perf/dependency/architecture pool misses. Its findings feed the SAME
+# Critical/High=block, Medium/Low=non-blocking mechanism and additionally the
+# weighted quality score in aggregate.json (rank 9).
 result = {
     "reviewers": [
         {
             "name": "architecture-strategist",
             "focus": "SOLID, coupling, cohesion, patterns, abstraction, dependency direction",
             "checks": "SOLID violations, excessive coupling, wrong patterns, missing abstractions, dependency direction issues, god classes/functions"
+        },
+        {
+            "name": "maintainer-mergeability",
+            "focus": "Would a maintainer merge this PR as-is: scope discipline, dead/duplicated code, convention conformance",
+            "checks": "scope creep (changes unrelated to the stated task, drive-by edits, unrequested refactors), dead code (unreachable, unused, commented-out, leftover debug), duplicated logic that should reuse an existing helper, non-conformance to the surrounding code's conventions (naming, error handling, structure, formatting), and anything a careful human reviewer would ask to be changed before merging"
         }
     ] + [
         {
@@ -10812,7 +10841,9 @@ SPECIALIST_SELECT
         "reviewers=$reviewer_names" \
         "iteration=$ITERATION_COUNT"
 
-    # Dispatch 3 parallel blind reviews using provider-specific invocation
+    # Dispatch all selected reviewers as parallel blind reviews (provider-specific
+    # invocation). Count is dynamic: 2 always-on (architecture-strategist,
+    # maintainer-mergeability) + up to 2 keyword-scored specialists.
     local pids=()
     local reviewer_count
     reviewer_count=$(echo "$selected_specialists" | python3 -c "import sys,json; print(len(json.load(sys.stdin)['reviewers']))")
@@ -10906,6 +10937,10 @@ BUILD_PROMPT
     # Such a review proves nothing, so we treat it as INCONCLUSIVE -> blocking.
     local real_verdict_count=0
     local no_output_count=0
+    # 7.114.0 (rank 9): accumulate non-blocking (Medium/Low) findings across all
+    # reviewers to compute the weighted mergeability quality score below.
+    local nonblocking_medium=0
+    local nonblocking_low=0
 
     for i in $(seq 0 $((reviewer_count - 1))); do
         local reviewer_name
@@ -10945,6 +10980,16 @@ BUILD_PROMPT
             continue
         fi
         ((real_verdict_count++))
+        # 7.114.0 (rank 9): tally this reviewer's non-blocking (Medium/Low)
+        # findings for the weighted quality score. Counted for BOTH PASS and FAIL
+        # reviewers -- a PASS verdict can still list Low-severity nits that should
+        # lower the mergeability score without blocking the gate.
+        local _nb_counts _nb_med _nb_low
+        _nb_counts=$(_count_nonblocking_findings "$review_output")
+        _nb_med=${_nb_counts%% *}
+        _nb_low=${_nb_counts##* }
+        nonblocking_medium=$((nonblocking_medium + _nb_med))
+        nonblocking_low=$((nonblocking_low + _nb_low))
         if [ "$verdict" = "FAIL" ]; then
             ((fail_count++))
             # Check for Critical/High severity findings (bracketed OR unbracketed
@@ -10988,6 +11033,23 @@ BUILD_PROMPT
         fi
     fi
 
+    # 7.114.0 (rank 9): weighted mergeability quality score (FrontierCode-style).
+    # A SCORE reported alongside the binary block verdict, NOT a new hard gate
+    # (surfaced only; opt-in enforcement via LOKI_REVIEW_MERGEABILITY_MIN below).
+    # Deterministic rubric: start at 100; any blocker (Critical/High) => 0; else
+    # subtract 5 per Medium finding and 2 per Low finding, floored at 0. This
+    # separates a tight, mergeable change (high score, no blocker) from a
+    # sprawling one whose scope/dead-code/convention findings pile up.
+    # Parity-locked with computeMergeabilityScore() in loki-ts/src/runner/quality_gates.ts.
+    local quality_score
+    if [ "$has_blocking" = "true" ]; then
+        quality_score=0
+    else
+        quality_score=$((100 - (nonblocking_medium * 5) - (nonblocking_low * 2)))
+        [ "$quality_score" -lt 0 ] && quality_score=0
+    fi
+    log_info "Mergeability quality score: ${quality_score}/100 (medium=${nonblocking_medium}, low=${nonblocking_low}, blocker=${has_blocking})"
+
     # Save aggregate results via python3 + env vars (no shell interpolation in JSON)
     export LOKI_REVIEW_AGG_FILE="$review_dir/$review_id/aggregate.json"
     export LOKI_REVIEW_AGG_ID="$review_id"
@@ -10998,6 +11060,9 @@ BUILD_PROMPT
     export LOKI_REVIEW_AGG_VERDICTS="$verdicts_summary"
     export LOKI_REVIEW_AGG_REAL="$real_verdict_count"
     export LOKI_REVIEW_AGG_INCONCLUSIVE="$review_inconclusive"
+    export LOKI_REVIEW_AGG_QSCORE="$quality_score"
+    export LOKI_REVIEW_AGG_QMED="$nonblocking_medium"
+    export LOKI_REVIEW_AGG_QLOW="$nonblocking_low"
     python3 << 'AGG_SCRIPT'
 import json, os
 result = {
@@ -11008,7 +11073,12 @@ result = {
     "has_blocking": os.environ["LOKI_REVIEW_AGG_BLOCKING"] == "true",
     "real_verdict_count": int(os.environ["LOKI_REVIEW_AGG_REAL"]),
     "inconclusive": os.environ["LOKI_REVIEW_AGG_INCONCLUSIVE"] == "true",
-    "verdicts": os.environ["LOKI_REVIEW_AGG_VERDICTS"].strip()
+    "verdicts": os.environ["LOKI_REVIEW_AGG_VERDICTS"].strip(),
+    # rank 9: weighted mergeability quality score (0 if any blocker, else
+    # 100 - 5*medium - 2*low, floored at 0). Reported metric, not a hard gate.
+    "quality_score": int(os.environ["LOKI_REVIEW_AGG_QSCORE"]),
+    "nonblocking_medium": int(os.environ["LOKI_REVIEW_AGG_QMED"]),
+    "nonblocking_low": int(os.environ["LOKI_REVIEW_AGG_QLOW"])
 }
 with open(os.environ["LOKI_REVIEW_AGG_FILE"], "w") as f:
     json.dump(result, f, indent=2)
@@ -11016,6 +11086,7 @@ AGG_SCRIPT
     unset LOKI_REVIEW_AGG_FILE LOKI_REVIEW_AGG_ID LOKI_REVIEW_AGG_ITER
     unset LOKI_REVIEW_AGG_PASS LOKI_REVIEW_AGG_FAIL LOKI_REVIEW_AGG_BLOCKING LOKI_REVIEW_AGG_VERDICTS
     unset LOKI_REVIEW_AGG_REAL LOKI_REVIEW_AGG_INCONCLUSIVE
+    unset LOKI_REVIEW_AGG_QSCORE LOKI_REVIEW_AGG_QMED LOKI_REVIEW_AGG_QLOW
 
     emit_event_json "code_review_complete" \
         "review_id=$review_id" \
@@ -11141,6 +11212,18 @@ DA_AGG_PATCH
         return 1
     fi
 
+    # 7.114.0 (rank 9): OPT-IN mergeability-score gate. Default OFF -- the score
+    # is reported in aggregate.json regardless, but it only BLOCKS when the
+    # operator explicitly sets a floor via LOKI_REVIEW_MERGEABILITY_MIN. This
+    # keeps the existing Critical/High=block, Medium/Low=non-blocking contract
+    # unchanged by default while giving teams a knob to demand a minimum
+    # mergeability score. Never fabricates a pass; a low score only ever blocks.
+    if [ -n "${LOKI_REVIEW_MERGEABILITY_MIN:-}" ] && [ "$quality_score" -lt "${LOKI_REVIEW_MERGEABILITY_MIN}" ]; then
+        log_error "CODE REVIEW BLOCKED: mergeability quality score ${quality_score} < floor ${LOKI_REVIEW_MERGEABILITY_MIN} (LOKI_REVIEW_MERGEABILITY_MIN)"
+        log_error "  Review details: $review_dir/$review_id/ ; unset LOKI_REVIEW_MERGEABILITY_MIN to disable this gate"
+        return 1
+    fi
+
     # Finding #596 FIX A2 + WAVE8 FIX run.sh-F3: an inconclusive review (fewer
     # usable verdicts than reviewers, retry already exhausted or disabled) blocks
     # unless explicitly opted out. This is the 'verified before done' promise: a
@@ -13956,7 +14039,24 @@ build_prompt() {
     phases="${phases%,}"  # Remove trailing comma
 
     # Ralph Wiggum Mode - Reason-Act-Reflect-VERIFY cycle with self-verification loop (Boris Cherny pattern)
-    local rarv_instruction="RALPH WIGGUM MODE ACTIVE. Use Reason-Act-Reflect-VERIFY cycle: 1) REASON - READ .loki/CONTINUITY.md including 'Mistakes & Learnings' section to avoid past errors. CHECK .loki/state/relevant-learnings.json for cross-project learnings from previous projects (mistakes to avoid, patterns to apply). Check .loki/state/ and .loki/queue/, identify next task. CHECK .loki/state/resources.json for system resource warnings - if CPU or memory is high, reduce parallel agent spawning or pause non-critical tasks. Limit to MAX_PARALLEL_AGENTS=${MAX_PARALLEL_AGENTS}. If queue empty, find new improvements. 2) ACT - Execute task, write code, commit changes atomically (git checkpoint). 3) REFLECT - Update .loki/CONTINUITY.md with progress, update state, identify NEXT improvement. Save valuable learnings for future projects. 4) VERIFY - Run automated tests (unit, integration, E2E), check compilation/build, verify against spec. IF VERIFICATION FAILS: a) Capture error details (stack trace, logs), b) Analyze root cause, c) UPDATE 'Mistakes & Learnings' in CONTINUITY.md with what failed, why, and how to prevent, d) Rollback to last good git checkpoint if needed, e) Apply learning and RETRY from REASON. If verification passes, mark task complete and continue. This self-verification loop achieves 2-3x quality improvement. CRITICAL: There is NEVER a 'finished' state - always find the next improvement, optimization, test, or feature."
+    # 7.114.0 (rank 8): rarv_instruction is now mode-aware. The never-finished
+    # tail is a self-contradiction in a finite PRD/checkpoint run (which has an
+    # auto-derived COMPLETION_PROMISE and was switched out of perpetual). Gate the
+    # never-finished tail on the SAME split that completion_instruction uses
+    # (perpetual OR no completion promise). Finite runs instead get a concise
+    # "stop when verified-done, the completion gates are the authority" directive.
+    # The unverifiable "2-3x quality improvement" clause is removed from ALL modes.
+    # Parity-locked with rarvInstruction() in loki-ts/src/runner/build_prompt.ts.
+    local _rarv_perpetual="false"
+    if [ "$AUTONOMY_MODE" = "perpetual" ] || [ "$PERPETUAL_MODE" = "true" ] || [ -z "$COMPLETION_PROMISE" ]; then
+        _rarv_perpetual="true"
+    fi
+    local rarv_instruction="RALPH WIGGUM MODE ACTIVE. Use Reason-Act-Reflect-VERIFY cycle: 1) REASON - READ .loki/CONTINUITY.md including 'Mistakes & Learnings' section to avoid past errors. CHECK .loki/state/relevant-learnings.json for cross-project learnings from previous projects (mistakes to avoid, patterns to apply). Check .loki/state/ and .loki/queue/, identify next task. CHECK .loki/state/resources.json for system resource warnings - if CPU or memory is high, reduce parallel agent spawning or pause non-critical tasks. Limit to MAX_PARALLEL_AGENTS=${MAX_PARALLEL_AGENTS}. If queue empty, find new improvements. 2) ACT - Execute task, write code, commit changes atomically (git checkpoint). 3) REFLECT - Update .loki/CONTINUITY.md with progress, update state, identify NEXT improvement. Save valuable learnings for future projects. 4) VERIFY - Run automated tests (unit, integration, E2E), check compilation/build, verify against spec. IF VERIFICATION FAILS: a) Capture error details (stack trace, logs), b) Analyze root cause, c) UPDATE 'Mistakes & Learnings' in CONTINUITY.md with what failed, why, and how to prevent, d) Rollback to last good git checkpoint if needed, e) Apply learning and RETRY from REASON. If verification passes, mark task complete and continue."
+    if [ "$_rarv_perpetual" = "true" ]; then
+        rarv_instruction="${rarv_instruction} CRITICAL: There is NEVER a 'finished' state - always find the next improvement, optimization, test, or feature."
+    else
+        rarv_instruction="${rarv_instruction} When the PRD requirements are implemented and completion gates pass, claim done via loki_complete_task and STOP; do not add unrequested improvements. Verify once -- the completion gates (tests, checklist, evidence) are the authority on done; do not re-verify redundantly."
+    fi
 
     # Completion instruction (S0.2 -- structured tool call).
     # When PRD requirements are implemented, tests pass, and the checklist is
@@ -14049,7 +14149,7 @@ build_prompt() {
     # writing any reference to a symbol the agent has not already read with
     # the Read tool, prefer mcp__loki-mode-lsp-proxy__lsp_check_exists. This
     # is the single most leveraged grounding primitive per OpenCode research.
-    local lsp_grounding_instruction="LSP_GROUNDING: When the loki-mode-lsp-proxy MCP server is available, prefer LSP tools for symbol verification BEFORE writing code that references those symbols. Workflow: (1) Need to call \`foo.bar()\` you have not already read? -> mcp__loki-mode-lsp-proxy__lsp_check_exists with symbol='bar' (sub-200ms when cached). If exists:false, do NOT write the call -- use mcp__loki-mode-lsp-proxy__lsp_workspace_symbols with the concept name to find the real symbol, or use Read to see the actual API. (2) Just edited a file? -> mcp__loki-mode-lsp-proxy__lsp_get_diagnostics on that file to see new errors before the next iteration. (3) Need to jump to a definition by name (no file:line known)? -> mcp__loki-mode-lsp-proxy__lsp_find_definition_by_name. Skip these tools silently when the server is not available -- check the tool list, do not retry on errors. Goal: eliminate hallucinated API calls before they ship."
+    local lsp_grounding_instruction="LSP_GROUNDING: When the loki-mode-lsp-proxy MCP server is available, prefer LSP tools for symbol verification BEFORE writing code that references those symbols. Workflow: (1) Need to call \`foo.bar()\` you have not already read? -> mcp__loki-mode-lsp-proxy__lsp_check_exists with symbol='bar' (sub-200ms when cached). If exists:false, do NOT write the call -- use mcp__loki-mode-lsp-proxy__lsp_workspace_symbols with the concept name to find the real symbol, or use Read to see the actual API. (2) Just edited a file? -> mcp__loki-mode-lsp-proxy__lsp_get_diagnostics on that file to see new errors before the next iteration. (3) Need to jump to a definition by name (no file:line known)? -> mcp__loki-mode-lsp-proxy__lsp_find_definition_by_name. Skip these tools silently when the server is not available -- check the tool list, do not retry on errors. Goal: eliminate hallucinated API calls before they ship. PARALLEL_TOOL_CALLS: When issuing independent read-only operations (reads, greps, file lookups, LSP checks) that do not depend on each other, issue them in a single message so they run in parallel; do not serialize independent lookups."
 
     # AGENTS.md instruction (agents.md standard: plain Markdown at repo root,
     # nearest-file-wins, read natively by Claude Code/Codex/etc.). Loki prefers

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "7.113.0"
+__version__ = "7.114.0"
 
 # Expose the control app for easy import
 try:

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 The flagship product of [Autonomi](https://www.autonomi.dev/). Loki Mode is a spec-driven autonomous builder with a built-in trust layer that takes any spec to a deployed product and verifies completion with evidence (quality gates plus a completion council), not just a "done" claim. Complete installation instructions for all platforms and use cases.
 
-**Version:** v7.113.0
+**Version:** v7.114.0
 
 ---
 

package/loki-ts/dist/loki.js

@@ -1,5 +1,5 @@
 // @bun
-var q8=Object.defineProperty;var J8=($)=>$;function V8($,Q){this[$]=J8.bind(null,Q)}var b=($,Q)=>{for(var Z in Q)q8($,Z,{get:Q[Z],enumerable:!0,configurable:!0,set:V8.bind(Q,Z)})};var P=($,Q)=>()=>($&&(Q=$($=0)),Q);var J$=import.meta.require;var m1={};b(m1,{lokiDir:()=>j,homeLokiDir:()=>T$,findRepoRootForVersion:()=>$1,REPO_ROOT:()=>h});import{resolve as t,dirname as e$}from"path";import{fileURLToPath as W8}from"url";import{existsSync as N$}from"fs";import{homedir as H8}from"os";function G8(){let $=v1;for(let Q=0;Q<6;Q++){if(N$(t($,"VERSION"))&&N$(t($,"autonomy/run.sh")))return $;let Z=e$($);if(Z===$)break;$=Z}return t(v1,"..","..","..")}function $1($){let Q=$;for(let Z=0;Z<6;Z++){if(N$(t(Q,"VERSION"))&&N$(t(Q,"autonomy/run.sh")))return Q;let z=e$(Q);if(z===Q)break;Q=z}return t($,"..","..","..")}function j(){return process.env.LOKI_DIR??t(process.cwd(),".loki")}function T$(){return t(H8(),".loki")}var v1,h;var C=P(()=>{v1=e$(W8(import.meta.url));h=G8()});import{readFileSync as U8}from"fs";import{resolve as Y8,dirname as B8}from"path";import{fileURLToPath as M8}from"url";function S$(){if(Q$!==null)return Q$;let $="7.113.0";if(typeof $==="string"&&$.length>0)return Q$=$,Q$;try{let Q=B8(M8(import.meta.url)),Z=$1(Q);Q$=U8(Y8(Z,"VERSION"),"utf-8").trim()}catch{Q$="unknown"}return Q$}var Q$=null;var Q1=P(()=>{C()});var p1={};b(p1,{runOrThrow:()=>S8,run:()=>R,readStreamCapped:()=>c1,commandVersion:()=>C8,commandExists:()=>u,ShellError:()=>Z1,MAX_STDOUT_BYTES:()=>u1});async function c1($,Q=u1){let Z=$.getReader(),z=new TextDecoder,X="",q=0;try{while(q<Q){let{done:K,value:W}=await Z.read();if(K)break;if(!W)continue;if(q+=W.byteLength,q>Q){let V=W.byteLength-(q-Q);X+=z.decode(W.subarray(0,V),{stream:!0});break}X+=z.decode(W,{stream:!0})}X+=z.decode()}finally{try{await Z.cancel()}catch{}Z.releaseLock()}return X}async function R($,Q={}){let Z=Bun.spawn({cmd:[...$],stdout:"pipe",stderr:"pipe",env:Q.env?{...process.env,...Q.env}:process.env,cwd:Q.cwd}),z,X;if(Q.timeoutMs&&Q.timeoutMs>0)z=setTimeout(()=>{try{Z.kill("SIGTERM")}catch{}X=setTimeout(()=>{try{Z.kill("SIGKILL")}catch{}},2000)},Q.timeoutMs);try{let[q,K,W]=await Promise.all([c1(Z.stdout),new Response(Z.stderr).text(),Z.exited]);return{stdout:q,stderr:K,exitCode:W}}finally{if(z)clearTimeout(z);if(X)clearTimeout(X)}}async function S8($,Q={}){let Z=await R($,Q);if(Z.exitCode!==0)throw new Z1(`command failed (${Z.exitCode}): ${$.join(" ")}`,Z.exitCode,Z.stdout,Z.stderr);return Z}async function u($){let Q=D8($),Z=await R(["sh","-c",`command -v ${Q}`],{timeoutMs:5000});if(Z.exitCode===0)return Z.stdout.trim()||null;return null}function D8($){if(!/^[A-Za-z0-9._/-]+$/.test($))throw Error(`refused to shell-escape suspect token: ${$}`);return $}async function C8($,Q="--version"){if(!await u($))return null;let z=await R([$,Q],{timeoutMs:5000});if(z.exitCode!==0)return null;return((z.stdout||z.stderr).split(/\r?\n/)[0]?.trim()??"")||null}var u1=16777216,Z1;var o=P(()=>{Z1=class Z1 extends Error{message;exitCode;stdout;stderr;constructor($,Q,Z,z){super($);this.message=$;this.exitCode=Q;this.stdout=Z;this.stderr=z;this.name="ShellError"}}});function r($){return b8?"":$}var b8,M,S,_,tZ,L,k,y,J;var p=P(()=>{b8=(process.env.NO_COLOR??"").length>0;M=r("\x1B[0;31m"),S=r("\x1B[0;32m"),_=r("\x1B[1;33m"),tZ=r("\x1B[0;34m"),L=r("\x1B[0;36m"),k=r("\x1B[1m"),y=r("\x1B[2m"),J=r("\x1B[0m")});import{existsSync as l8}from"fs";async function Z$(){if(A$!==void 0)return A$;let $="/opt/homebrew/bin/python3.12";if(l8($))return A$=$,$;let Q=await u("python3.12");if(Q)return A$=Q,Q;let Z=await u("python3");return A$=Z,Z}async function z$($,Q={}){let Z=await Z$();if(!Z)return{stdout:"",stderr:"python3 not found",exitCode:127};return R([Z,"-c",$],Q)}var A$;var V$=P(()=>{o()});var V0={};b(V0,{runStatus:()=>U3});import{existsSync as v,readFileSync as H$,readdirSync as $0,statSync as Q0}from"fs";import{resolve as D,basename as z3}from"path";import{homedir as X3}from"os";function Z0($){let Q=Math.trunc($);if(Q>=1e6)return`${(Math.trunc(Q/1e6*10)/10).toFixed(1)}M`;if(Q>=1000)return`${(Math.trunc(Q/1000*10)/10).toFixed(1)}K`;return String(Q)}function z0($,Q,Z){if(Q===0)return null;let z=Math.trunc($*100/Q),X=Math.trunc($*C$/Q);if(X>C$)X=C$;let q=C$-X,K=S;if(z>=80)K=M;else if(z>=50)K=_;let W="=".repeat(Math.max(0,X))+" ".repeat(Math.max(0,q)),V=Z0($),H=Z0(Q);return`  ${k}${Z}${J} ${K}[${W}]${J} ${z}% (${V} / ${H})`}async function q3(){if(await u("jq"))return!0;return process.stdout.write(`${M}Error: jq is required but not installed.${J}
+var q8=Object.defineProperty;var J8=($)=>$;function V8($,Q){this[$]=J8.bind(null,Q)}var b=($,Q)=>{for(var Z in Q)q8($,Z,{get:Q[Z],enumerable:!0,configurable:!0,set:V8.bind(Q,Z)})};var P=($,Q)=>()=>($&&(Q=$($=0)),Q);var J$=import.meta.require;var m1={};b(m1,{lokiDir:()=>j,homeLokiDir:()=>T$,findRepoRootForVersion:()=>$1,REPO_ROOT:()=>h});import{resolve as t,dirname as e$}from"path";import{fileURLToPath as W8}from"url";import{existsSync as N$}from"fs";import{homedir as H8}from"os";function G8(){let $=v1;for(let Q=0;Q<6;Q++){if(N$(t($,"VERSION"))&&N$(t($,"autonomy/run.sh")))return $;let Z=e$($);if(Z===$)break;$=Z}return t(v1,"..","..","..")}function $1($){let Q=$;for(let Z=0;Z<6;Z++){if(N$(t(Q,"VERSION"))&&N$(t(Q,"autonomy/run.sh")))return Q;let z=e$(Q);if(z===Q)break;Q=z}return t($,"..","..","..")}function j(){return process.env.LOKI_DIR??t(process.cwd(),".loki")}function T$(){return t(H8(),".loki")}var v1,h;var C=P(()=>{v1=e$(W8(import.meta.url));h=G8()});import{readFileSync as U8}from"fs";import{resolve as Y8,dirname as B8}from"path";import{fileURLToPath as M8}from"url";function S$(){if(Q$!==null)return Q$;let $="7.114.0";if(typeof $==="string"&&$.length>0)return Q$=$,Q$;try{let Q=B8(M8(import.meta.url)),Z=$1(Q);Q$=U8(Y8(Z,"VERSION"),"utf-8").trim()}catch{Q$="unknown"}return Q$}var Q$=null;var Q1=P(()=>{C()});var p1={};b(p1,{runOrThrow:()=>S8,run:()=>R,readStreamCapped:()=>c1,commandVersion:()=>C8,commandExists:()=>u,ShellError:()=>Z1,MAX_STDOUT_BYTES:()=>u1});async function c1($,Q=u1){let Z=$.getReader(),z=new TextDecoder,X="",q=0;try{while(q<Q){let{done:K,value:W}=await Z.read();if(K)break;if(!W)continue;if(q+=W.byteLength,q>Q){let V=W.byteLength-(q-Q);X+=z.decode(W.subarray(0,V),{stream:!0});break}X+=z.decode(W,{stream:!0})}X+=z.decode()}finally{try{await Z.cancel()}catch{}Z.releaseLock()}return X}async function R($,Q={}){let Z=Bun.spawn({cmd:[...$],stdout:"pipe",stderr:"pipe",env:Q.env?{...process.env,...Q.env}:process.env,cwd:Q.cwd}),z,X;if(Q.timeoutMs&&Q.timeoutMs>0)z=setTimeout(()=>{try{Z.kill("SIGTERM")}catch{}X=setTimeout(()=>{try{Z.kill("SIGKILL")}catch{}},2000)},Q.timeoutMs);try{let[q,K,W]=await Promise.all([c1(Z.stdout),new Response(Z.stderr).text(),Z.exited]);return{stdout:q,stderr:K,exitCode:W}}finally{if(z)clearTimeout(z);if(X)clearTimeout(X)}}async function S8($,Q={}){let Z=await R($,Q);if(Z.exitCode!==0)throw new Z1(`command failed (${Z.exitCode}): ${$.join(" ")}`,Z.exitCode,Z.stdout,Z.stderr);return Z}async function u($){let Q=D8($),Z=await R(["sh","-c",`command -v ${Q}`],{timeoutMs:5000});if(Z.exitCode===0)return Z.stdout.trim()||null;return null}function D8($){if(!/^[A-Za-z0-9._/-]+$/.test($))throw Error(`refused to shell-escape suspect token: ${$}`);return $}async function C8($,Q="--version"){if(!await u($))return null;let z=await R([$,Q],{timeoutMs:5000});if(z.exitCode!==0)return null;return((z.stdout||z.stderr).split(/\r?\n/)[0]?.trim()??"")||null}var u1=16777216,Z1;var o=P(()=>{Z1=class Z1 extends Error{message;exitCode;stdout;stderr;constructor($,Q,Z,z){super($);this.message=$;this.exitCode=Q;this.stdout=Z;this.stderr=z;this.name="ShellError"}}});function r($){return b8?"":$}var b8,M,S,_,tZ,L,k,y,J;var p=P(()=>{b8=(process.env.NO_COLOR??"").length>0;M=r("\x1B[0;31m"),S=r("\x1B[0;32m"),_=r("\x1B[1;33m"),tZ=r("\x1B[0;34m"),L=r("\x1B[0;36m"),k=r("\x1B[1m"),y=r("\x1B[2m"),J=r("\x1B[0m")});import{existsSync as l8}from"fs";async function Z$(){if(A$!==void 0)return A$;let $="/opt/homebrew/bin/python3.12";if(l8($))return A$=$,$;let Q=await u("python3.12");if(Q)return A$=Q,Q;let Z=await u("python3");return A$=Z,Z}async function z$($,Q={}){let Z=await Z$();if(!Z)return{stdout:"",stderr:"python3 not found",exitCode:127};return R([Z,"-c",$],Q)}var A$;var V$=P(()=>{o()});var V0={};b(V0,{runStatus:()=>U3});import{existsSync as v,readFileSync as H$,readdirSync as $0,statSync as Q0}from"fs";import{resolve as D,basename as z3}from"path";import{homedir as X3}from"os";function Z0($){let Q=Math.trunc($);if(Q>=1e6)return`${(Math.trunc(Q/1e6*10)/10).toFixed(1)}M`;if(Q>=1000)return`${(Math.trunc(Q/1000*10)/10).toFixed(1)}K`;return String(Q)}function z0($,Q,Z){if(Q===0)return null;let z=Math.trunc($*100/Q),X=Math.trunc($*C$/Q);if(X>C$)X=C$;let q=C$-X,K=S;if(z>=80)K=M;else if(z>=50)K=_;let W="=".repeat(Math.max(0,X))+" ".repeat(Math.max(0,q)),V=Z0($),H=Z0(Q);return`  ${k}${Z}${J} ${K}[${W}]${J} ${z}% (${V} / ${H})`}async function q3(){if(await u("jq"))return!0;return process.stdout.write(`${M}Error: jq is required but not installed.${J}
 `),process.stdout.write(`Install with:
 `),process.stdout.write(`  brew install jq    (macOS)
 `),process.stdout.write(`  apt install jq     (Debian/Ubuntu)
@@ -814,4 +814,4 @@ Set LOKI_LEGACY_BASH=1 to force the bash CLI for every command.
 `),2}default:return process.stderr.write(`Unknown command: ${Q}
 `),process.stderr.write(K8),2}}e1();process.on("SIGINT",()=>process.exit(130));process.on("SIGTERM",()=>process.exit(143));var SZ=await NZ(Bun.argv.slice(2));process.exit(SZ);
 
-//# debugId=F380D5B346BDE4D764756E2164756E21
+//# debugId=0888AC629271567B64756E2164756E21

package/mcp/__init__.py

@@ -57,4 +57,4 @@ try:
 except ImportError:
     __all__ = ['mcp']
 
-__version__ = '7.113.0'
+__version__ = '7.114.0'

package/mcp/lsp_proxy.py

@@ -1595,8 +1595,49 @@ def main() -> None:
              'install dir -- the install dir is only the import path for '
              '`-m mcp.lsp_proxy`.',
     )
+    parser.add_argument(
+        '--check-symbols', action='store_true',
+        help='One-shot: read a newline-delimited list of symbol names on stdin '
+             'and, for each, run lsp_check_exists against the workspace at '
+             '--root. Emits JSON {"available": bool, "results": {sym: '
+             'true|false|null}} on stdout. available=false / null verdicts mean '
+             'no language server was reachable (honest inconclusive, never a '
+             'fabricated exists). Same cwd/--root contract as --write-diagnostics: '
+             'cwd is the install dir so `-m mcp.lsp_proxy` imports; --root is the '
+             'TARGET project the symbols must exist in.',
+    )
     args = parser.parse_args()
 
+    if args.check_symbols:
+        # One-shot symbol-existence probe for the acceptance-oracle (source-
+        # grounded checklist). Chdir into --root so the in-process LSP client's
+        # _resolve_workspace_root()/_pick_language_for_workspace() see the TARGET
+        # project (the process cwd is the install dir for the import). Always
+        # cleans up spawned language-server subprocesses via the finally arm.
+        target = os.path.abspath(args.root or os.getcwd())
+        symbols = [ln.strip() for ln in sys.stdin.read().splitlines() if ln.strip()]
+        results: Dict[str, Any] = {}
+        available = False
+        try:
+            if os.path.isdir(target):
+                os.chdir(target)
+            for sym in symbols:
+                try:
+                    raw = _lsp_check_exists_blocking(sym)
+                    parsed = json.loads(raw)
+                except (OSError, ValueError):
+                    results[sym] = None
+                    continue
+                exists = parsed.get('exists', None)
+                results[sym] = exists
+                # A non-null verdict on ANY symbol means the server answered.
+                if exists is not None:
+                    available = True
+        finally:
+            _cleanup_all_clients()
+        print(json.dumps({'available': available, 'results': results}))
+        return
+
     if args.write_diagnostics:
         # One-shot writer mode -- no MCP server, no event loop. Always cleans
         # up any spawned LSP clients before exit. `--root` is the TARGET

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "loki-mode",
   "mcpName": "io.github.asklokesh/loki-mode",
-  "version": "7.113.0",
+  "version": "7.114.0",
   "description": "Loki Mode by Autonomi. Autonomous spec-to-product system: takes a PRD, GitHub issue, OpenAPI/JSON/YAML, or one-line brief to a deployed app via the RARV-C closure loop with 8 quality gates. Provider-agnostic (Claude Code, OpenAI Codex, Cline, Aider).",
   "keywords": [
     "agent",

package/plugins/loki-mode/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "loki-mode",
   "displayName": "Loki Mode",
-  "version": "7.113.0",
+  "version": "7.114.0",
   "description": "Autonomous spec-to-product build system with a built-in trust layer (RARV-C closure loop, 8 quality gates, completion council). Ships Loki's spec-hardening, drift-detection, and deterministic PR verification commands plus the Loki MCP server.",
   "author": {
     "name": "Autonomi",