loki-mode 7.113.0 → 7.115.0

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: Autonomous spec-driven build system with a built-in trust layer. It does not call work done until it is verified (RARV-C closure loop, 8 quality gates, completion council, verified-completion evidence gate). Triggers on "Loki Mode". Takes a spec (PRD, GitHub issue, OpenAPI doc, etc.) to deployed product with minimal human intervention. Provider-agnostic. Requires --dangerously-skip-permissions flag.
 ---
 
-# Loki Mode v7.113.0
+# Loki Mode v7.115.0
 
 **You are an autonomous agent. You make decisions. You do not ask questions. You do not stop.**
 
@@ -408,4 +408,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v7.113.0 | [Autonomi](https://www.autonomi.dev/) flagship product | ~260 lines core**
+**v7.115.0 | [Autonomi](https://www.autonomi.dev/) flagship product | ~260 lines core**

package/VERSION

@@ -1 +1 @@
-7.113.0
+7.115.0

package/autonomy/completion-council.sh

@@ -25,6 +25,12 @@
 #   LOKI_COUNCIL_THRESHOLD        - Votes needed for completion (default: 2)
 #   LOKI_COUNCIL_CHECK_INTERVAL   - Check every N iterations (default: 5)
 #   LOKI_COUNCIL_MIN_ITERATIONS   - Minimum iterations before council runs (default: 3)
+#   LOKI_COUNCIL_CONVERGENCE_EARLY - No-claim early-check bypass: when evidence is
+#                                    affirmatively green (real suite passed +
+#                                    checklist not failing) the convergence path
+#                                    may evaluate off the CHECK_INTERVAL boundary
+#                                    (>= MIN_ITERATIONS). Default 1; set 0 to
+#                                    restore interval-only behavior (RANK 15).
 #   LOKI_COUNCIL_CONVERGENCE_WINDOW - Iterations to track for convergence (default: 3)
 #   LOKI_COUNCIL_STAGNATION_LIMIT - Max iterations with no git changes (default: 5)
 #   LOKI_COUNCIL_DONE_SIGNAL_LIMIT - Max total done signals before force stop (default: 10)
@@ -3351,6 +3357,122 @@ PYEOF
 # Main Entry Point - Should the loop stop?
 #===============================================================================
 
+#===============================================================================
+# Convergence-floor early-check helpers (RANK 15)
+#
+# Lower the effective convergence floor for the NO-explicit-claim path ONLY.
+# By default the council convergence path only evaluates on the CHECK_INTERVAL
+# boundary (every 5th iteration), so a no-promise/analysis run that is verifiably
+# finished at iteration 2 still grinds to iteration 5 before the council is even
+# allowed to look. These helpers let that path evaluate as soon as there is
+# AFFIRMATIVE evidence of done, without weakening any gate: they only flip WHEN
+# the council evaluates, never WHETHER it approves (council_evaluate still runs
+# the full checklist / held-out / evidence / assumption gates + the vote + the
+# devil's advocate on every trigger).
+#
+# Two knobs preserve full opt-out to the historical behavior:
+#   LOKI_COUNCIL_CONVERGENCE_EARLY=0  -> disable the early-check bypass entirely
+#                                        (byte-identical to prior interval-only).
+#   LOKI_COUNCIL_MIN_ITERATIONS       -> existing floor (already clamps to >=1);
+#                                        the early check never fires below it.
+#===============================================================================
+
+# _council_convergence_evidence_green: read-only, side-effect-free probe that
+# returns 0 ONLY when there is AFFIRMATIVE positive evidence a no-promise run is
+# done -- i.e. a real test suite ran and passed, AND (if a checklist exists) it
+# has no failing items. Deliberately does NOT reuse council_evidence_gate: that
+# gate PASSES on inconclusive inputs (no git repo / no baseline / runner=="none"
+# / missing test-results.json all pass-through). Inconclusive is "not red", not
+# "green" -- fast-pathing on it would be an unverified early stop. Affirmative
+# green means tests ACTUALLY ran and passed. Does NOT call
+# council_reverify_checklist (that has side effects; council_evaluate runs it).
+_council_convergence_evidence_green() {
+    local tr_file="${TARGET_DIR:-.}/.loki/quality/test-results.json"
+    # Affirmative test-green is REQUIRED: a real runner that passed. A missing
+    # file or runner=="none" (no suite) is NOT affirmative evidence -> not green.
+    [ -f "$tr_file" ] || return 1
+    local tr_state
+    tr_state=$(_TR_FILE="$tr_file" python3 -c "
+import json, os, sys
+try:
+    with open(os.environ['_TR_FILE']) as f:
+        d = json.load(f)
+except (json.JSONDecodeError, IOError, KeyError, ValueError):
+    print('no'); sys.exit(0)
+runner = d.get('runner', 'none')
+passed = d.get('pass', True)
+# Affirmative green requires a REAL suite (runner != none) that did not fail.
+print('yes' if (runner != 'none' and passed is not False) else 'no')
+" 2>/dev/null || echo "no")
+    [ "$tr_state" = "yes" ] || return 1
+
+    # If a checklist exists, it must have NO failing items to be affirmatively
+    # green. Absence of a checklist is fine (test-green alone carries the signal);
+    # the council's own hard checklist gate still runs inside council_evaluate.
+    local results_file="${TARGET_DIR:-.}/.loki/checklist/verification-results.json"
+    if [ -f "$results_file" ]; then
+        local cl_state
+        cl_state=$(_RESULTS_FILE="$results_file" python3 -c "
+import json, os, sys
+try:
+    with open(os.environ['_RESULTS_FILE']) as f:
+        r = json.load(f)
+except (json.JSONDecodeError, IOError, KeyError, ValueError):
+    print('no'); sys.exit(0)
+items = [it for cat in r.get('categories', []) for it in cat.get('items', [])]
+if not items:
+    # A present-but-empty checklist is not affirmative done-evidence.
+    print('no'); sys.exit(0)
+failing = any(it.get('status') == 'failing' for it in items)
+print('no' if failing else 'yes')
+" 2>/dev/null || echo "no")
+        [ "$cl_state" = "yes" ] || return 1
+    fi
+    return 0
+}
+
+# _council_should_check_now: pure decision function -- given the current gate
+# inputs (via env/args) returns 0 if the council should evaluate this iteration,
+# 1 otherwise. Extracted so the convergence-floor bypass is unit-testable without
+# driving a real 3-member vote. Inputs (all read from the shell, mirroring
+# council_should_stop's locals):
+#   $1 = circuit_triggered ("true"/other)
+#   $2 = completion_claimed ("true"/other)
+#   ITERATION_COUNT, COUNCIL_CHECK_INTERVAL, COUNCIL_MIN_ITERATIONS (globals)
+#   LOKI_COUNCIL_CONVERGENCE_EARLY (knob; default on)
+# Precedence matches council_should_stop: circuit breaker, then explicit claim,
+# then interval boundary, then the NEW evidence-green early check (last, so it
+# never changes the explicit-claim or circuit paths).
+_council_should_check_now() {
+    local circuit_triggered="${1:-false}"
+    local completion_claimed="${2:-false}"
+    local iter="${ITERATION_COUNT:-0}"
+    local interval="${COUNCIL_CHECK_INTERVAL:-5}"
+    local min_iter="${COUNCIL_MIN_ITERATIONS:-3}"
+
+    # Circuit breaker and explicit-claim paths are UNCHANGED (they already bypass
+    # the interval); return check-now for them without touching the early logic.
+    if [ "$circuit_triggered" = "true" ]; then
+        return 0
+    fi
+    if [ "$completion_claimed" = "true" ]; then
+        return 0
+    fi
+    # Standard interval boundary.
+    if [ $((iter % interval)) -eq 0 ]; then
+        return 0
+    fi
+    # NEW convergence-floor early check (no explicit claim): once we are at/above
+    # the MIN_ITERATIONS floor AND there is affirmative evidence of done, evaluate
+    # now instead of waiting for the next interval boundary. Opt-out preserved.
+    if [ "${LOKI_COUNCIL_CONVERGENCE_EARLY:-1}" != "0" ] \
+       && [ "$iter" -ge "$min_iter" ] 2>/dev/null \
+       && _council_convergence_evidence_green; then
+        return 0
+    fi
+    return 1
+}
+
 council_should_stop() {
     # bash-F1: reset the force-stop sentinel at entry. A return-0 from the
     # genuine approval path leaves this 0; only the safety-valve paths below
@@ -3413,13 +3535,17 @@ council_should_stop() {
         completion_claimed=true
     fi
 
+    # Decide WHETHER to convene the council this iteration. Precedence (unchanged
+    # for the circuit-breaker and explicit-claim paths): circuit breaker, explicit
+    # completion claim, interval boundary, then the RANK-15 convergence-floor early
+    # check (no explicit claim + affirmative evidence-green -> evaluate now instead
+    # of waiting for the next interval boundary). _council_should_check_now is a
+    # pure decision helper (unit-tested) so this stays a single call.
     local should_check=false
-    if [ "$circuit_triggered" = "true" ]; then
-        should_check=true
-    elif [ "$completion_claimed" = "true" ]; then
-        should_check=true
+    if [ "$completion_claimed" = "true" ] && [ "$circuit_triggered" != "true" ]; then
         log_info "[Council] Completion claimed this iteration -- evaluating now (not deferring to the ${COUNCIL_CHECK_INTERVAL}-iteration interval)"
-    elif [ $((ITERATION_COUNT % COUNCIL_CHECK_INTERVAL)) -eq 0 ]; then
+    fi
+    if _council_should_check_now "$circuit_triggered" "$completion_claimed"; then
         should_check=true
     fi
 

package/autonomy/lib/effort_estimator.py

@@ -0,0 +1,397 @@
+#!/usr/bin/env python3
+"""Engineering-hours estimator for the per-build proof.json (Rank 6).
+
+Replaces the naive "iterations x 15min" number (which is blind to the actual
+work) with a WORK-based estimate: it reads the real signals available at
+proof-generation time -- the git diff stat (insertions / deletions / files
+changed), the number of files touched, whether tests were written, and the
+task/PRD scope -- and predicts the equivalent human-engineering-hours plus a
+low/high band.
+
+Two methods, chosen HONESTLY at runtime:
+
+  method="llm"       An LLM was available AND returned a parseable number. The
+                     model id is recorded. Gated behind LOKI_EFFORT_LLM=1 so a
+                     model is NEVER called on every build by default (cost /
+                     latency / the 30s proof cap). Any failure -- no key, no
+                     CLI, timeout, unparseable output -- FAILS OPEN to the
+                     heuristic. We never emit method="llm" with a number the
+                     model did not actually give us.
+
+  method="heuristic" The deterministic work-based fallback. Same inputs, a
+                     fixed formula, reproducible for identical inputs. This is
+                     the default path (and the only path in headless CI /
+                     offline). Labeled uncalibrated -- see `calibrated` below.
+
+The estimate is ALWAYS labeled calibrated=false ("uncalibrated") in this lane:
+no ground-truth engineer-hour dataset has scored it yet, so the number is a
+transparent estimate, never presented as validated. A separate calibration
+harness may flip that once an error metric clears a threshold.
+
+inputs_hash: sha256 over the canonical inputs (diff stat + files + tests +
+scope). Identical whether the method is llm or heuristic, so the estimate is
+reproducible and auditable -- a reader can recompute the hash from the same
+proof and confirm the estimator saw exactly these inputs.
+
+This module is import-only and never raises to the caller: estimate() catches
+everything and falls open to the heuristic (and, in the worst case, a zeroed
+estimate) so proof.json generation can never be broken by it.
+"""
+
+import hashlib
+import json
+import os
+import re
+import subprocess
+
+
+# Schema of the emitted effort_estimate object. Bumped if the shape changes so
+# a reader can tell which estimator produced a given field set.
+ESTIMATOR_VERSION = "1"
+
+# The brief is stored truncated to this many chars in proof.json (matches
+# proof-generator.generate()'s brief[:600]); the hashed brief_len is capped to
+# the same bound so inputs_hash is recomputable from the written receipt.
+_BRIEF_HASH_CAP = 600
+
+
+def _canonical(obj):
+    """Stable JSON serialization for hashing (sorted keys, compact)."""
+    return json.dumps(obj, sort_keys=True, separators=(",", ":"),
+                      ensure_ascii=False)
+
+
+def _to_int(v, default=0):
+    try:
+        return int(v)
+    except (TypeError, ValueError):
+        return default
+
+
+def _canonical_inputs(files_changed, tests, spec, iterations):
+    """The exact inputs the estimate is a function of, in a canonical shape.
+
+    Only work signals -- NOT wall-clock or cost, which are noisy and would make
+    the hash non-reproducible across machines. Iteration count is carried as a
+    weak secondary signal (it slightly widens the band) but is deliberately not
+    the primary driver: the backlog AC requires the estimate reflect real work,
+    not iteration count alone.
+    """
+    fc = files_changed or {}
+    files = fc.get("files") or []
+    t = tests or {}
+    sp = spec or {}
+    it = iterations or {}
+    return {
+        "diff": {
+            "count": _to_int(fc.get("count")),
+            "insertions": _to_int(fc.get("insertions")),
+            "deletions": _to_int(fc.get("deletions")),
+            # Sorted file paths so ordering never perturbs the hash.
+            "files": sorted(
+                str(f.get("path", "")) for f in files if isinstance(f, dict)
+            ),
+        },
+        "tests": {
+            "status": str(t.get("status") or "not_run"),
+            "passed_count": _to_int(t.get("passed_count")),
+            "failed_count": _to_int(t.get("failed_count")),
+        },
+        "scope": {
+            # NOTE: the raw spec source is a filesystem PATH (e.g. an absolute
+            # path into the build's temp dir), which is build-location noise, NOT
+            # a work signal -- hashing it would make identical work produce
+            # different hashes across machines/dirs. We hash only whether a spec
+            # was present, plus the brief length (a real proxy for scope size).
+            # The full brief text is not hashed (brittle to whitespace edits).
+            "has_spec": bool(str(sp.get("source") or "")
+                             not in ("", "codebase-analysis")),
+            # Cap the hashed length at the SAME 600-char bound the generator
+            # applies to spec.brief before writing proof.json (generate() does
+            # brief[:600] after the estimate is computed). Without this cap, a
+            # brief longer than 600 chars would hash the full length while the
+            # receipt stores only 600, so a third party recomputing inputs_hash
+            # from the written proof.json would get a different value -- the hash
+            # would be self-consistent but NOT reproducible from the artifact,
+            # defeating the auditability the hash exists for.
+            "brief_len": min(len(str(sp.get("brief") or "")), _BRIEF_HASH_CAP),
+        },
+        "iterations": _to_int(it.get("count")),
+    }
+
+
+def _inputs_hash(canon_inputs):
+    return hashlib.sha256(
+        _canonical(canon_inputs).encode("utf-8")
+    ).hexdigest()
+
+
+def heuristic_estimate(canon_inputs):
+    """Deterministic WORK-based hours from the canonical inputs.
+
+    Model (transparent + reproducible):
+      - A baseline per changed file (reading, wiring, context switching).
+      - A per-line component on net churn (insertions + deletions), the bulk of
+        the signal, scaled to a rough "lines of considered code per hour".
+      - A test bonus: writing tests is real engineering effort the line count
+        alone under-counts.
+      - A scope bonus from the PRD/brief size (bigger specs = more design).
+
+    Returns (hours, low, high) rounded to 2 decimals. The band is a fixed
+    +/- fraction, slightly widened by iteration count (more back-and-forth =
+    more uncertainty). Every constant is a stated assumption, NOT a calibrated
+    value -- hence the estimate is always labeled uncalibrated.
+    """
+    diff = canon_inputs.get("diff", {})
+    files = diff.get("files", []) or []
+    n_files = _to_int(diff.get("count")) or len(files)
+    churn = _to_int(diff.get("insertions")) + _to_int(diff.get("deletions"))
+
+    # Test signal: from the tests block AND from test-looking changed files.
+    tests = canon_inputs.get("tests", {})
+    test_files = 0
+    for p in files:
+        pl = str(p).lower()
+        if any(kw in pl for kw in
+               ("test", "spec", ".test.", ".spec.", "_test.", "_spec.")):
+            test_files += 1
+    tests_ran = str(tests.get("status")) in ("verified", "failed", "passed")
+
+    # --- constants (assumptions, uncalibrated) ---
+    PER_FILE_HOURS = 0.15          # ~9 min of context per file touched
+    LINES_PER_HOUR = 40.0          # considered (not typed) lines per hour
+    TEST_FILE_BONUS_HOURS = 0.35   # writing a test file is real effort
+    TESTS_RAN_BONUS_HOURS = 0.25   # having a runnable, green/red suite at all
+    SCOPE_HOURS_PER_1K_CHARS = 0.5  # design time scaling with brief size
+
+    hours = 0.0
+    hours += n_files * PER_FILE_HOURS
+    hours += (churn / LINES_PER_HOUR) if churn > 0 else 0.0
+    hours += test_files * TEST_FILE_BONUS_HOURS
+    if tests_ran:
+        hours += TESTS_RAN_BONUS_HOURS
+    brief_len = _to_int((canon_inputs.get("scope") or {}).get("brief_len"))
+    hours += (brief_len / 1000.0) * SCOPE_HOURS_PER_1K_CHARS
+
+    # A build that changed nothing is genuinely ~0 human-hours; do not invent
+    # effort from a bare iteration count.
+    if n_files == 0 and churn == 0:
+        hours = 0.0
+
+    hours = round(hours, 2)
+
+    # Band: +/- 40% base, widened up to +20% more by iteration churn.
+    iters = _to_int(canon_inputs.get("iterations"))
+    widen = min(iters * 0.02, 0.20)
+    low = round(hours * (1.0 - min(0.40 + widen, 0.75)), 2)
+    high = round(hours * (1.0 + 0.40 + widen), 2)
+    if low < 0:
+        low = 0.0
+    return hours, low, high
+
+
+_HOURS_RE = re.compile(r"(-?\d+(?:\.\d+)?)")
+
+
+def _parse_llm_hours(text):
+    """Extract (hours, low, high) from an LLM completion, or None.
+
+    Accepts a JSON object {"hours":..,"low":..,"high":..} anywhere in the
+    output (preferred), else falls back to the first number as hours. Returns
+    None on anything unparseable so the caller fails open. NEVER guesses a band
+    it was not given: if only hours is found, low/high are derived as a fixed
+    band around it (and the method is still honestly "llm" -- the CENTRAL number
+    came from the model)."""
+    if not text or not str(text).strip():
+        return None
+    s = str(text)
+    # Prefer an embedded JSON object.
+    for m in re.finditer(r"\{[^{}]*\}", s):
+        try:
+            obj = json.loads(m.group(0))
+        except Exception:
+            continue
+        if isinstance(obj, dict) and "hours" in obj:
+            try:
+                h = float(obj["hours"])
+            except (TypeError, ValueError):
+                continue
+            if h < 0:
+                continue
+            low = obj.get("low")
+            high = obj.get("high")
+            try:
+                low = float(low) if low is not None else round(h * 0.6, 2)
+            except (TypeError, ValueError):
+                low = round(h * 0.6, 2)
+            try:
+                high = float(high) if high is not None else round(h * 1.4, 2)
+            except (TypeError, ValueError):
+                high = round(h * 1.4, 2)
+            return round(h, 2), round(low, 2), round(high, 2)
+    # Fallback: first bare number in the text.
+    m = _HOURS_RE.search(s)
+    if m:
+        try:
+            h = float(m.group(1))
+        except ValueError:
+            return None
+        if h < 0:
+            return None
+        return round(h, 2), round(h * 0.6, 2), round(h * 1.4, 2)
+    return None
+
+
+def _llm_estimate(canon_inputs, timeout=18):
+    """Try an LLM estimate. Returns (hours, low, high, model) or None.
+
+    Gated behind LOKI_EFFORT_LLM=1 so a model is never invoked on every build.
+    Honors LOKI_EFFORT_LLM_STUB (its OWN stub env, NOT the wiki one) for
+    deterministic tests: a file path or literal completion string. Any failure
+    returns None -> caller falls open to the heuristic.
+    """
+    if os.environ.get("LOKI_EFFORT_LLM", "") not in ("1", "true", "yes", "on"):
+        return None
+
+    prompt = _build_prompt(canon_inputs)
+
+    stub = os.environ.get("LOKI_EFFORT_LLM_STUB")
+    if stub is not None:
+        completion = _read_stub(stub)
+        model = os.environ.get("LOKI_EFFORT_LLM_MODEL", "stub")
+        parsed = _parse_llm_hours(completion)
+        if parsed is None:
+            return None
+        h, low, high = parsed
+        return h, low, high, model
+
+    provider = os.environ.get("LOKI_PROVIDER", "claude")
+    cmds = {
+        "claude": ["claude", "-p", prompt],
+        "codex": ["codex", "exec", "--sandbox", "read-only", prompt],
+        "cline": ["cline", "-y", prompt],
+        "aider": ["aider", "--message", prompt, "--yes-always",
+                  "--no-auto-commits"],
+    }
+    base = cmds.get(provider)
+    if base is None or not _which(base[0]):
+        return None
+    model = os.environ.get("SESSION_MODEL") or provider
+    try:
+        out = subprocess.run(
+            base, capture_output=True, text=True, timeout=timeout,
+            stdin=subprocess.DEVNULL,
+        )
+    except (OSError, subprocess.SubprocessError):
+        return None
+    if out.returncode != 0 and not (out.stdout or "").strip():
+        return None
+    parsed = _parse_llm_hours(out.stdout)
+    if parsed is None:
+        return None
+    h, low, high = parsed
+    return h, low, high, model
+
+
+def _build_prompt(canon_inputs):
+    diff = canon_inputs.get("diff", {})
+    return (
+        "You are estimating how many hours a competent human software engineer "
+        "would take to produce EXACTLY this change, from scratch, including "
+        "design, implementation, and testing. Respond with ONLY a JSON object "
+        "of the form {\"hours\": <number>, \"low\": <number>, \"high\": "
+        "<number>} and nothing else.\n\n"
+        "Change signals:\n"
+        "- files changed: %d\n"
+        "- lines inserted: %d\n"
+        "- lines deleted: %d\n"
+        "- test status: %s\n"
+        "- scope brief length (chars): %d\n"
+        % (
+            _to_int(diff.get("count")),
+            _to_int(diff.get("insertions")),
+            _to_int(diff.get("deletions")),
+            str((canon_inputs.get("tests") or {}).get("status")),
+            _to_int((canon_inputs.get("scope") or {}).get("brief_len")),
+        )
+    )
+
+
+def _read_stub(stub):
+    if os.path.sep in stub or stub.endswith(".txt") or stub.endswith(".json"):
+        if os.path.isfile(stub):
+            try:
+                with open(stub, encoding="utf-8", errors="replace") as f:
+                    return f.read()
+            except OSError:
+                return ""
+    return stub
+
+
+def _which(name):
+    for d in os.environ.get("PATH", "").split(os.pathsep):
+        cand = os.path.join(d, name)
+        if os.path.isfile(cand) and os.access(cand, os.X_OK):
+            return cand
+    return None
+
+
+def estimate(files_changed, tests, spec, iterations):
+    """Return the effort_estimate object for proof.json. Never raises.
+
+    Shape:
+      {
+        hours, low, high,               # equivalent human-engineering-hours
+        method: "llm" | "heuristic",
+        model,                          # model id on the llm path, else ""
+        inputs_hash,                    # sha256 over the canonical inputs
+        calibrated,                     # always False in this lane
+        label,                          # human-facing honesty label
+        estimator_version,
+      }
+    """
+    try:
+        canon = _canonical_inputs(files_changed, tests, spec, iterations)
+    except Exception:
+        canon = {"diff": {"count": 0, "insertions": 0, "deletions": 0,
+                          "files": []}, "tests": {}, "scope": {},
+                 "iterations": 0}
+    try:
+        ihash = _inputs_hash(canon)
+    except Exception:
+        ihash = ""
+
+    method = "heuristic"
+    model = ""
+    hours = low = high = 0.0
+
+    # LLM path first (opt-in); fail open to heuristic on ANY problem.
+    try:
+        llm = _llm_estimate(canon)
+    except Exception:
+        llm = None
+    if llm is not None:
+        hours, low, high, model = llm
+        method = "llm"
+    else:
+        try:
+            hours, low, high = heuristic_estimate(canon)
+        except Exception:
+            hours, low, high = 0.0, 0.0, 0.0
+        method = "heuristic"
+        model = ""
+
+    label = (
+        "estimated (uncalibrated, %s)" % method
+    )
+    return {
+        "hours": hours,
+        "low": low,
+        "high": high,
+        "method": method,
+        "model": model,
+        "inputs_hash": ihash,
+        "calibrated": False,
+        "label": label,
+        "estimator_version": ESTIMATOR_VERSION,
+    }

package/autonomy/lib/proof-generator.py

@@ -36,6 +36,7 @@ if _HERE not in sys.path:
 
 import proof_redact  # noqa: E402
 from efficiency_cost import collect_efficiency as _collect_efficiency  # noqa: E402
+import effort_estimator  # noqa: E402
 
 
 # ---------------------------------------------------------------------------
@@ -741,6 +742,25 @@ def _build_proof(args, loki_dir, target_dir, repo_root):
         "evidence_gate": evidence_gate,
     }
 
+    # Effort estimate (Rank 6): equivalent human-engineering-hours for this
+    # build, from the REAL work signals (diff stat + files + tests + scope), NOT
+    # the iteration count alone. Emitted as a TOP-LEVEL additive key on purpose:
+    # it is an ESTIMATE (an opinion, LLM on the opt-in path), so it must never
+    # sit under `facts` where _compute_headline/_compute_degraded could let it
+    # leak into the deterministic VERIFIED headline. Fail-open: never raises,
+    # defaults to the deterministic heuristic when no model is available.
+    try:
+        effort_estimate = effort_estimator.estimate(
+            files_changed, tests, spec, iterations
+        )
+    except Exception:
+        effort_estimate = {
+            "hours": 0.0, "low": 0.0, "high": 0.0,
+            "method": "heuristic", "model": "", "inputs_hash": "",
+            "calibrated": False, "label": "estimated (uncalibrated, heuristic)",
+            "estimator_version": effort_estimator.ESTIMATOR_VERSION,
+        }
+
     # Assemble WITHOUT redaction / verification fields (advisor ordering).
     # Top-level flat keys are RETAINED as a back-compat mirror so existing
     # dashboard/CLI/template readers (schema v1.0 consumers) keep working; the
@@ -761,6 +781,8 @@ def _build_proof(args, loki_dir, target_dir, repo_root):
         "quality_gates": quality_gates,
         "cost": cost,
         "deployment": deployment,
+        # Rank 6: work-based engineering-hours estimate (top-level, NOT a fact).
+        "effort_estimate": effort_estimate,
         # v1.1 evidence model (additive).
         "facts": facts,
         "assessments": assessments,