loki-mode 7.121.2 → 7.121.4

package/autonomy/lib/functional-verify.py

@@ -0,0 +1,246 @@
+#!/usr/bin/env python3
+"""functional-verify.py -- FV-1: does the built app actually DO what the spec asked?
+
+The completion verifier proves code was written + tests/build passed. It does NOT
+prove the spec's BEHAVIORS work: a "waitlist" spec can be built as a static page
+that captures nothing, yet read VERIFIED (measured: ~half of backend-implying
+specs). This harness closes that gap by EXERCISING the running app against
+assertions DERIVED FROM THE SPEC, and reporting an honest functional signal.
+
+SCOPE (FV-1, deliberately narrow + honest):
+  - It reports a DESCRIPTIVE signal only. It does NOT feed the VERIFIED headline
+    (that is FV-2: a founder-gated trust-semantics decision, council-reviewed).
+  - It derives HTTP endpoint assertions from the spec (GET/POST/DELETE <path>) and
+    runs the CRUD lifecycle they imply against the LIVE app. It never fabricates:
+    an endpoint it cannot reach is `inconclusive`, a behavior that failed is
+    `failed`, a behavior proven is `passed`. Same inconclusive-never-false moat as
+    the rest of the trust layer.
+  - It requires the app to already be running (URL passed in) -- app-runner (>=
+    v7.121.3, static sites included) starts it; this harness only probes.
+
+Output: JSON to stdout -- {spec_behaviors: [...], summary: {passed, failed,
+inconclusive}, functional_status: verified|partial|failed|inconclusive}.
+"""
+from __future__ import annotations
+
+import json
+import re
+import sys
+import urllib.error
+import urllib.request
+
+
+# --- spec -> behavioral assertions ------------------------------------------
+
+# Endpoint declarations in a spec/PRD: "GET /api/tasks", "POST /api/tasks",
+# "DELETE /api/tasks/:id". Method + path; path may carry a :param placeholder.
+_ENDPOINT_RE = re.compile(
+    r'\b(GET|POST|PUT|PATCH|DELETE)\s+(/[A-Za-z0-9_./:{}-]*)',
+)
+
+
+def _clean_path(path: str) -> str:
+    """Strip trailing sentence punctuation a spec sentence leaves on a path
+    (e.g. "DELETE /api/tasks/:id." -> "/api/tasks/:id"). Without this, a probe
+    hits a wrong URL and fabricates a failure on a working app -- a fake-RED in
+    the FV layer itself, exactly what this harness exists to prevent."""
+    return path.rstrip(".,;:)]}") or path
+
+
+def derive_endpoint_assertions(spec_text: str) -> list[dict]:
+    """Extract {method, path} endpoint assertions the spec explicitly names.
+
+    Deduped, order-preserved. A path with a :param / {param} is a resource route
+    (used for the DELETE-a-created-resource lifecycle below)."""
+    seen = set()
+    out = []
+    for m in _ENDPOINT_RE.finditer(spec_text or ""):
+        method = m.group(1).upper()
+        path = _clean_path(m.group(2))
+        key = (method, path)
+        if key in seen:
+            continue
+        seen.add(key)
+        out.append({"method": method, "path": path,
+                    "is_resource": bool(re.search(r'[:{]', path))})
+    return out
+
+
+# --- run assertions against the live app ------------------------------------
+
+def _req(base_url: str, method: str, path: str, body=None, timeout=8):
+    """One HTTP call. Returns (status_code, json_or_text) or (None, error_str)."""
+    url = base_url.rstrip("/") + path
+    data = None
+    headers = {}
+    if body is not None:
+        data = json.dumps(body).encode()
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, method=method, headers=headers)
+    try:
+        with urllib.request.urlopen(req, timeout=timeout) as resp:
+            raw = resp.read().decode("utf-8", "replace")
+            try:
+                return resp.status, json.loads(raw) if raw else None
+            except json.JSONDecodeError:
+                return resp.status, raw
+    except urllib.error.HTTPError as e:
+        return e.code, None
+    except (urllib.error.URLError, OSError) as e:
+        return None, str(e)
+
+
+def verify_crud_lifecycle(base_url: str, assertions: list[dict]) -> list[dict]:
+    """The core functional check: for a REST resource the spec names, prove the
+    CRUD LIFECYCLE actually works end to end (not just that a route responds):
+      POST creates -> the created item appears on GET -> DELETE removes it ->
+      it is gone from a subsequent GET.
+    This is what distinguishes a working backend from a static shell: a static
+    page returns 200 on GET but a POST does not persist. Each behavior is
+    passed / failed / inconclusive, never fabricated."""
+    results = []
+
+    # Collection GET/POST endpoints (non-resource) and their resource DELETE.
+    gets = [a for a in assertions if a["method"] == "GET" and not a["is_resource"]]
+    posts = [a for a in assertions if a["method"] == "POST" and not a["is_resource"]]
+    deletes = [a for a in assertions if a["method"] == "DELETE" and a["is_resource"]]
+
+    # 1. Every named collection GET must actually respond 2xx.
+    for a in gets:
+        code, payload = _req(base_url, "GET", a["path"])
+        if code is None:
+            results.append({"behavior": f"GET {a['path']} responds",
+                            "status": "inconclusive", "detail": f"unreachable: {payload}"})
+        elif 200 <= code < 300:
+            results.append({"behavior": f"GET {a['path']} responds",
+                            "status": "passed", "detail": f"HTTP {code}"})
+        else:
+            results.append({"behavior": f"GET {a['path']} responds",
+                            "status": "failed", "detail": f"HTTP {code}"})
+
+    # 2. POST-creates-and-persists lifecycle: for each collection POST that has a
+    #    matching collection GET, POST an item and assert the collection grew.
+    for p in posts:
+        coll = p["path"]
+        matching_get = next((g for g in gets if g["path"] == coll), None)
+        if matching_get is None:
+            results.append({"behavior": f"POST {coll} persists (verifiable)",
+                            "status": "inconclusive",
+                            "detail": "no matching collection GET to confirm persistence"})
+            continue
+        before_code, before = _req(base_url, "GET", coll)
+        before_n = len(before) if isinstance(before, list) else None
+        # A minimal, generic payload. Real apps validate; we send a common shape.
+        post_code, created = _req(base_url, "POST", coll,
+                                  body={"title": "fv-probe", "name": "fv-probe",
+                                        "text": "fv-probe"})
+        after_code, after = _req(base_url, "GET", coll)
+        after_n = len(after) if isinstance(after, list) else None
+        if post_code is None or after_code is None:
+            results.append({"behavior": f"POST {coll} persists",
+                            "status": "inconclusive",
+                            "detail": "app unreachable during lifecycle"})
+        elif post_code and 200 <= post_code < 300 and before_n is not None \
+                and after_n is not None and after_n > before_n:
+            results.append({"behavior": f"POST {coll} persists",
+                            "status": "passed",
+                            "detail": f"collection grew {before_n} -> {after_n} after POST"})
+        elif post_code and 200 <= post_code < 300 and (before_n is None or after_n is None):
+            # POST accepted but the collection is not a JSON array we can count:
+            # we cannot PROVE persistence -> honest inconclusive, never a pass.
+            results.append({"behavior": f"POST {coll} persists",
+                            "status": "inconclusive",
+                            "detail": f"POST HTTP {post_code} but GET is not a countable list"})
+        elif post_code in (400, 422):
+            # The endpoint EXISTS and rejected OUR probe payload (validation).
+            # That is a working backend with a schema our generic {title,name,text}
+            # did not satisfy -- NOT proof the behavior is broken. Marking it failed
+            # would be a fake-RED (a strict-but-working app read as non-working).
+            # Honest inconclusive; FV-2 must never wire a failed verdict off this.
+            results.append({"behavior": f"POST {coll} persists",
+                            "status": "inconclusive",
+                            "detail": f"POST HTTP {post_code}: endpoint exists but rejected the "
+                                      "probe payload (schema mismatch, not proof of no-persistence)"})
+        else:
+            # POST 404 (endpoint absent), 501 (not implemented), or 2xx-but-the-
+            # collection did NOT grow -> the behavior the spec implies does NOT
+            # work (a static shell or a non-persisting backend). Genuine failed.
+            results.append({"behavior": f"POST {coll} persists",
+                            "status": "failed",
+                            "detail": f"POST HTTP {post_code}; collection {before_n} -> {after_n} "
+                                      "(no persistence -- a static shell or non-working backend)"})
+
+        # 3. DELETE lifecycle: if the spec names a resource DELETE and we created
+        #    an item with an id, delete it and assert it's gone.
+        created_id = None
+        if isinstance(created, dict):
+            created_id = created.get("id") or created.get("_id")
+        if deletes and created_id is not None:
+            dpath_tmpl = deletes[0]["path"]
+            dpath = re.sub(r'[:{][A-Za-z0-9_]+[}]?', str(created_id), dpath_tmpl)
+            del_code, _ = _req(base_url, "DELETE", dpath)
+            _, after_del = _req(base_url, "GET", coll)
+            still_there = isinstance(after_del, list) and any(
+                isinstance(x, dict) and (x.get("id") == created_id or x.get("_id") == created_id)
+                for x in after_del)
+            if del_code is None:
+                results.append({"behavior": f"DELETE {dpath_tmpl} removes",
+                                "status": "inconclusive", "detail": "unreachable"})
+            elif 200 <= del_code < 300 and not still_there:
+                results.append({"behavior": f"DELETE {dpath_tmpl} removes",
+                                "status": "passed",
+                                "detail": f"item {created_id} gone after DELETE (HTTP {del_code})"})
+            else:
+                results.append({"behavior": f"DELETE {dpath_tmpl} removes",
+                                "status": "failed",
+                                "detail": f"DELETE HTTP {del_code}; item still present={still_there}"})
+    return results
+
+
+def summarize(results: list[dict]) -> dict:
+    passed = sum(1 for r in results if r["status"] == "passed")
+    failed = sum(1 for r in results if r["status"] == "failed")
+    inconclusive = sum(1 for r in results if r["status"] == "inconclusive")
+    # functional_status: verified only if >=1 behavior passed and NONE failed;
+    # failed if any behavior failed; inconclusive if nothing could be exercised.
+    if failed > 0:
+        status = "failed"
+    elif passed > 0 and inconclusive == 0:
+        status = "verified"
+    elif passed > 0:
+        status = "partial"
+    else:
+        status = "inconclusive"
+    return {"passed": passed, "failed": failed, "inconclusive": inconclusive,
+            "functional_status": status}
+
+
+def run(spec_text: str, base_url: str) -> dict:
+    assertions = derive_endpoint_assertions(spec_text)
+    if not assertions:
+        return {"spec_behaviors": [], "summary": {"passed": 0, "failed": 0,
+                "inconclusive": 0, "functional_status": "inconclusive"},
+                "note": "no HTTP endpoint behaviors derivable from the spec"}
+    results = verify_crud_lifecycle(base_url, assertions)
+    summ = summarize(results)
+    return {"assertions_derived": assertions, "spec_behaviors": results,
+            "summary": summ, "functional_status": summ["functional_status"]}
+
+
+def main(argv):
+    if len(argv) < 3:
+        print("usage: functional-verify.py <spec_file> <base_url>", file=sys.stderr)
+        return 2
+    spec_file, base_url = argv[1], argv[2]
+    try:
+        with open(spec_file, errors="replace") as f:
+            spec_text = f.read()
+    except OSError as e:
+        print(json.dumps({"error": f"cannot read spec: {e}"}))
+        return 1
+    print(json.dumps(run(spec_text, base_url), indent=2))
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main(sys.argv))

package/autonomy/lib/proof-generator.py

@@ -287,9 +287,22 @@ def _collect_quality_gates(loki_dir):
             elif os.path.exists(result_json):
                 rj = _read_json(result_json, default=None)
                 if isinstance(rj, dict):
-                    status = _norm_gate_status(
-                        rj.get("passed", rj.get("status", "not_run"))
-                    )
+                    # Read the marker's outcome key. enforce_static_analysis writes
+                    # `"pass"` (a bool); other markers may write `"passed"` or
+                    # `"status"`. Try all three so a real result is NEVER misread as
+                    # not_run: a failing static-analysis marker ({"pass":false,
+                    # "findings":11}) was collapsing to not_run (the reader looked
+                    # only for "passed"/"status"), understating a real gate FAILURE
+                    # as "did not run" -- the receipt read "gaps" where it should
+                    # read a failed gate. _norm_gate_status maps a bool correctly
+                    # (True->passed, False->failed). A key that is genuinely absent
+                    # still defaults to not_run (honest -- never fabricated passed).
+                    if "pass" in rj:
+                        status = _norm_gate_status(rj.get("pass"))
+                    else:
+                        status = _norm_gate_status(
+                            rj.get("passed", rj.get("status", "not_run"))
+                        )
             if status is not None:
                 gates.append({"name": gate_name, "status": status})
                 seen.add(gate_name)
@@ -431,6 +444,64 @@ def _norm_tests_status(raw):
     return s
 
 
+def _collect_functional(loki_dir):
+    """Read .loki/quality/functional-results.json (the FV-1 functional harness).
+
+    Deterministic FACT: did the built app actually DO what the spec asked (run the
+    app + exercise spec-derived behaviors -- POST persists, GET reflects, ...), as
+    opposed to just compiling and passing unit tests. Tolerates an absent file ->
+    status not_run. Shape mirrors the FV-1 harness output:
+    {ran, functional_status, passed, failed, inconclusive}.
+
+    DESCRIPTIVE ONLY (FV-2, record half): this fact is RECORDED on the receipt but
+    is deliberately NOT read by _compute_headline / _compute_degraded, so it does
+    NOT change what "Verified" means. Making functional-satisfaction gate the green
+    headline is a trust-semantics product decision (council + founder), the second
+    half of FV-2. Recording it first lets the signal be seen and validated safely.
+    """
+    out = {"ran": False, "functional_status": "not_run",
+           "passed": 0, "failed": 0, "inconclusive": 0}
+    raw = _read_json(
+        os.path.join(loki_dir, "quality", "functional-results.json"), default=None
+    )
+    if not isinstance(raw, dict):
+        return out
+    out["ran"] = True
+    out["functional_status"] = str(raw.get("functional_status") or "inconclusive")
+    summary = raw.get("summary") if isinstance(raw.get("summary"), dict) else raw
+    for k in ("passed", "failed", "inconclusive"):
+        v = summary.get(k)
+        if isinstance(v, int):
+            out[k] = v
+    return out
+
+
+def _collect_healthcheck(loki_dir):
+    """Read .loki/app-runner/health.json (the app-runner liveness probe).
+
+    Deterministic FACT: did the built app actually come up and respond (HTTP/PID
+    health), as written by app-runner. Absent -> not_run. Shape:
+    {ran, ok, status, checked_at}. status: not_run (never checked) | healthy
+    (ran, ok:true) | unhealthy (ran, ok:false).
+
+    DESCRIPTIVE ONLY (Evidence Receipt record half): recorded for transparency,
+    NOT read by _compute_headline / _compute_degraded, so it does not change what
+    "Verified" means. Gating on it is the founder-gated trust decision (mirrors the
+    FV-2 opt-in gate). ponytail: reuses the health.json app-runner already writes.
+    """
+    out = {"ran": False, "ok": False, "status": "not_run", "checked_at": ""}
+    raw = _read_json(
+        os.path.join(loki_dir, "app-runner", "health.json"), default=None
+    )
+    if not isinstance(raw, dict):
+        return out
+    out["ran"] = True
+    out["ok"] = bool(raw.get("ok"))
+    out["checked_at"] = str(raw.get("checked_at") or "")
+    out["status"] = "healthy" if out["ok"] else "unhealthy"
+    return out
+
+
 def _collect_tests(loki_dir):
     """Read .loki/quality/test-results.json.
 
@@ -763,6 +834,8 @@ def _build_proof(args, loki_dir, target_dir, repo_root):
     build = _collect_build(loki_dir)
     tests = _collect_tests(loki_dir)
     security = _collect_security(loki_dir)
+    functional = _collect_functional(loki_dir)  # FV-2 record-half: descriptive only
+    healthcheck = _collect_healthcheck(loki_dir)  # Evidence Receipt record-half
     evidence_gate = _collect_evidence_gate(loki_dir)
 
     deployed_url = os.environ.get("LOKI_DEPLOYED_URL") or None
@@ -800,6 +873,14 @@ def _build_proof(args, loki_dir, target_dir, repo_root):
             for g in (quality_gates.get("gates") or [])
         ],
         "security": security,
+        # FV-2 (record half): did the app actually DO what the spec asked? Present
+        # for transparency; DELIBERATELY NOT read by _compute_headline /
+        # _compute_degraded, so it does not (yet) change the verdict. Wiring it into
+        # the green headline is the founder-gated trust-semantics decision.
+        "functional": functional,
+        # Evidence Receipt (record half): did the built app come up + respond?
+        # Descriptive; NOT read by _compute_headline (gating is founder-gated).
+        "healthcheck": healthcheck,
         "cost": cost,
         "meta": {
             "run_id": run_id,
@@ -964,12 +1045,25 @@ def _compute_headline(facts, degraded):
     # intent). This keeps the receipt honest about security, not just tests.
     sec = facts.get("security") or {}
     sec_high = bool(sec.get("ran") and (sec.get("high_active") or 0) > 0)
+    # FV-2 gate (opt-in via LOKI_FV_GATE=1, default OFF -> headline unchanged). When
+    # enabled, a functional check that RAN and FAILED (the built app does not do what
+    # the spec asked -- a static shell for a backend spec) is a hard failure, same
+    # class as a failed test. Default-off keeps every existing build's verdict
+    # byte-identical; the founder flips it on after reviewing the reclassification.
+    # ponytail: reads the already-recorded functional fact; no new plumbing.
+    fn = facts.get("functional") or {}
+    fn_failed = bool(
+        os.environ.get("LOKI_FV_GATE") == "1"
+        and fn.get("ran")
+        and fn.get("functional_status") == "failed"
+    )
     any_failed = (
         tests.get("status") == "failed"
         or build.get("status") == "failed"
         or any(g.get("status") == "failed"
                for g in (facts.get("quality_gates") or []))
         or sec_high
+        or fn_failed
     )
     if any_failed:
         return "NOT VERIFIED"

package/autonomy/lib/scaffold-hook.sh

@@ -0,0 +1,82 @@
+#!/usr/bin/env bash
+# scaffold-hook.sh -- opt-in seam that wires the contract-first scaffold (M1-M3)
+# into the build lane. Mirrors the LOKI_SENTRUX_GATE pattern: sourced ONLY when
+# the gate is enabled, and no-ops safely otherwise.
+#
+# ENABLED by LOKI_SCAFFOLD_CONTRACT_FIRST=1 (default OFF -> the default build path
+# is byte-identical and completely unaffected). When ON, and ONLY for a GREENFIELD
+# target (an effectively-empty project dir) whose PRD implies a web/API backend,
+# it lays down the contract-first + real-backend + design-system skeleton BEFORE
+# the SDLC loop, so the model builds ON a real wired substrate instead of
+# hand-writing disconnected files. It NEVER touches a non-empty/brownfield repo.
+#
+# It is deliberately conservative: on any doubt it does nothing (returns 0) and
+# lets the normal build proceed -- it can only ADD a starting skeleton, never
+# remove or overwrite existing code.
+#
+# PARITY: this is a bash-only ORCHESTRATION seam in run_autonomous, NOT part of
+# the byte-mirrored build_prompt() contract (build_prompt.ts is unchanged). It
+# mirrors the LOKI_SENTRUX_GATE precedent, which is likewise bash-orchestration
+# only (not behavior-mirrored in the bun runner). Because it is DEFAULT-OFF, the
+# bun default path is unaffected. When the bun runner (loki-ts autonomous.ts,
+# currently a skeleton port) reaches run_autonomous behavior parity, it should
+# mirror this opt-in gate.
+
+# Is the target dir greenfield (no meaningful source yet)? Ignores .loki, .git,
+# the PRD, and dotfiles. Echoes "yes"/"no".
+_scaffold_is_greenfield() {
+    local dir="${1:-.}"
+    local n
+    n=$(find "$dir" -type f \
+        -not -path "*/.loki/*" -not -path "*/.git/*" \
+        -not -name "PRD.md" -not -name "prd.md" -not -name ".*" \
+        -not -path "*/node_modules/*" 2>/dev/null | head -5 | wc -l | tr -d ' ')
+    [ "${n:-0}" -eq 0 ] && echo "yes" || echo "no"
+}
+
+# Derive a resource + fields from a PRD, conservatively. Only fires when the PRD
+# clearly names a REST resource; otherwise echoes nothing (caller skips).
+# Kept intentionally simple + general (no product-specific knowledge).
+_scaffold_derive_resource() {
+    local prd="$1"
+    [ -f "$prd" ] || return 0
+    # Look for an explicit "GET/POST /api/<collection>" the way FV-1 does.
+    local coll
+    coll=$(grep -oiE '(GET|POST)[[:space:]]+/api/[a-z][a-z0-9_-]+' "$prd" 2>/dev/null \
+        | grep -oE '/api/[a-z][a-z0-9_-]+' | head -1 | sed 's#/api/##')
+    [ -z "$coll" ] && return 0
+    # singularize naively for the resource name
+    local res="${coll%s}"; [ -z "$res" ] && res="$coll"
+    echo "$res"
+}
+
+# The hook. Args: <target_dir> <prd_path>. Safe to call unconditionally; it
+# self-gates on the flag + greenfield + a derivable resource.
+run_contract_scaffold_hook() {
+    [ "${LOKI_SCAFFOLD_CONTRACT_FIRST:-0}" = "1" ] || return 0
+    local dir="${1:-.}" prd="${2:-}"
+    local script_dir
+    script_dir="${SCRIPT_DIR:-$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)}"
+
+    [ "$(_scaffold_is_greenfield "$dir")" = "yes" ] || {
+        log_info "contract-scaffold: target is not greenfield -> skipping (never overwrites existing code)" 2>/dev/null || true
+        return 0
+    }
+    local res
+    res=$(_scaffold_derive_resource "$prd")
+    [ -z "$res" ] && {
+        log_info "contract-scaffold: no REST resource derivable from the PRD -> skipping" 2>/dev/null || true
+        return 0
+    }
+
+    local scaffold="${script_dir}/lib/contract-scaffold/scaffold.sh"
+    local generate="${script_dir}/lib/contract-scaffold/generate.mjs"
+    [ -f "$scaffold" ] && [ -f "$generate" ] || return 0
+
+    log_info "contract-scaffold: greenfield + resource '$res' -> laying down contract-first + backend + design skeleton" 2>/dev/null || true
+    bash "$scaffold" "$dir" "$res" 2>/dev/null || true
+    if command -v node >/dev/null 2>&1; then
+        node "$generate" "$dir" "$res" 2>/dev/null || true
+    fi
+    return 0
+}

package/autonomy/run.sh

@@ -8511,6 +8511,30 @@ enforce_build_check() {
     return 0
 }
 
+# True when the workspace's package.json declares a non-empty `lint` script, so
+# the static-analysis gate can run the app's OWN linter (oxlint/eslint/biome/...)
+# via `npm run lint` rather than only recognizing eslint config files. Pure read
+# of package.json; returns non-zero on absence / no lint script / unreadable.
+has_npm_lint_script() {
+    local dir="${1:-.}"
+    local pkg="$dir/package.json"
+    [ -f "$pkg" ] || return 1
+    # Parse with python3 (already a hard dep of the engine) so a `"lint":` inside
+    # a string value or comment cannot yield a false positive; require a real,
+    # non-empty scripts.lint entry.
+    python3 - "$pkg" <<'PYEOF' 2>/dev/null
+import json, sys
+try:
+    with open(sys.argv[1]) as fh:
+        data = json.load(fh)
+except Exception:
+    sys.exit(1)
+scripts = data.get("scripts") or {}
+lint = scripts.get("lint")
+sys.exit(0 if isinstance(lint, str) and lint.strip() else 1)
+PYEOF
+}
+
 enforce_static_analysis() {
     local loki_dir="${TARGET_DIR:-.}/.loki"
     local quality_dir="$loki_dir/quality"
@@ -8539,6 +8563,31 @@ enforce_static_analysis() {
         done
         if [ -n "$abs_files" ]; then
             total_checked=$((total_checked + $(echo "$abs_files" | wc -w)))
+            # v7.x (static-analysis honest coverage): ADDITIVELY run the app's OWN
+            # declared `lint` script when present. Generated apps increasingly use
+            # oxlint / biome (not eslint) -- e.g. package.json `"lint": "oxlint"`
+            # with a `.oxlintrc.json` -- which the eslint-config probe below does
+            # not recognize, so the app's real lint check was skipped. Running
+            # `npm run lint` respects whatever linter the app declares. This is
+            # ADDITIVE (not a replacement): we STILL run the eslint/tsc type checks
+            # below, so a lint pass never silences the type-error check for TS apps
+            # (oxlint is not type-aware). rc 127 = the declared linter is not
+            # installed/resolvable -> HONEST skip, never counted as a violation
+            # (rc-only signal; a real lint failure whose OUTPUT mentions "not
+            # found" must still count, so we do NOT grep the message).
+            if has_npm_lint_script "${TARGET_DIR:-.}"; then
+                local lint_out lint_rc=0
+                lint_out=$(cd "${TARGET_DIR:-.}" && npm run --silent lint 2>&1) || lint_rc=$?
+                if [ "$lint_rc" -eq 127 ]; then
+                    log_info "Static analysis: app 'lint' script did not resolve a linter (not run, honest skip)"
+                elif [ "$lint_rc" -ne 0 ]; then
+                    findings=$((findings + 1))
+                    details="${details}Lint (npm run lint): $(echo "$lint_out" | tail -3 | tr '\n' ' '). "
+                fi
+            fi
+            # Type/syntax check path (unchanged contract): eslint when configured,
+            # else tsc project-mode + per-file parse. Runs REGARDLESS of the lint
+            # step above so TS type errors are always caught.
             if [ -f "${TARGET_DIR:-.}/.eslintrc.js" ] || [ -f "${TARGET_DIR:-.}/.eslintrc.json" ] || \
                [ -f "${TARGET_DIR:-.}/eslint.config.js" ] || [ -f "${TARGET_DIR:-.}/eslint.config.mjs" ]; then
                 local eslint_out
@@ -8559,7 +8608,7 @@ enforce_static_analysis() {
                 if [ -f "${TARGET_DIR:-.}/tsconfig.json" ] && command -v tsc &>/dev/null; then
                     local _has_ts=0
                     for f in $abs_files; do
-                        case "$f" in *.ts|*.tsx) _has_ts=1; break ;; esac
+                        case "$f" in *.ts|*.tsx|*.jsx) _has_ts=1; break ;; esac
                     done
                     if [ "$_has_ts" -eq 1 ]; then
                         _ts_project_mode=1
@@ -8569,7 +8618,7 @@ enforce_static_analysis() {
                             local _changed_ts_errors=""
                             for f in $js_files; do
                                 case "$f" in
-                                    *.ts|*.tsx)
+                                    *.ts|*.tsx|*.jsx)
                                         # tsc emits paths relative to project root with `(line,col):` suffix.
                                         # v7.5.12 Dev11 (R1 MED): use grep -F (literal) so filenames
                                         # containing regex metacharacters cannot cause false positives
@@ -8591,11 +8640,16 @@ enforce_static_analysis() {
                     fi
                 fi
                 for f in $abs_files; do
-                    # node --check cannot parse TypeScript / TSX files; it
-                    # crashes with ERR_UNKNOWN_FILE_EXTENSION. Skip them when
-                    # tsc is not available; otherwise delegate to tsc.
+                    # node --check cannot parse TypeScript / TSX / JSX files; it
+                    # crashes with ERR_UNKNOWN_FILE_EXTENSION (JSX) or a parse error
+                    # (TS syntax). Route .ts/.tsx AND .jsx to the JSX-capable tsc
+                    # path; only plain .js/.mjs/.cjs go through node --check. Before
+                    # the .jsx addition here, every valid .jsx file was falsely
+                    # reported as a "Syntax error" (node --check ERR_UNKNOWN_FILE_
+                    # EXTENSION) -- a whole class of false static-analysis findings
+                    # on React apps.
                     case "$f" in
-                        *.ts|*.tsx)
+                        *.ts|*.tsx|*.jsx)
                             # When tsconfig project-mode handled it above, skip
                             # the per-file fallback to avoid duplicate / false errors.
                             if [ "$_ts_project_mode" -eq 1 ]; then
@@ -16254,6 +16308,21 @@ run_autonomous() {
         esac
     fi
 
+    # Contract-first scaffold seam (opt-in via LOKI_SCAFFOLD_CONTRACT_FIRST=1,
+    # default OFF -> default build path is byte-identical). Mirrors the
+    # LOKI_SENTRUX_GATE pattern: source the helper only when the gate is enabled,
+    # and it self-gates further on greenfield + a derivable REST resource. It can
+    # ONLY add a starting skeleton (contract-first codegen + real backend + design
+    # system, M1-M3); it never overwrites existing code or touches a brownfield
+    # repo. On any doubt it no-ops and the normal build proceeds unchanged.
+    if [ "${LOKI_SCAFFOLD_CONTRACT_FIRST:-0}" = "1" ]; then
+        # shellcheck disable=SC1090,SC1091
+        source "${SCRIPT_DIR}/lib/scaffold-hook.sh" 2>/dev/null || true
+        if type run_contract_scaffold_hook >/dev/null 2>&1; then
+            run_contract_scaffold_hook "${TARGET_DIR:-.}" "$prd_path" || true
+        fi
+    fi
+
     # Auto-detect PRD if not provided
     if [ -z "$prd_path" ]; then
         log_step "No PRD provided, searching for existing PRD files..."

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "7.121.2"
+__version__ = "7.121.4"
 
 # Expose the control app for easy import
 try:

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 The flagship product of [Autonomi](https://www.autonomi.dev/). Loki Mode is a spec-driven autonomous builder with a built-in trust layer that takes any spec to a deployed product and verifies completion with evidence (quality gates plus a completion council), not just a "done" claim. Complete installation instructions for all platforms and use cases.
 
-**Version:** v7.121.2
+**Version:** v7.121.4
 
 ---
 
@@ -396,7 +396,7 @@ provider works inside the container. Provide auth with your Anthropic API key:
 # Run Loki Mode in Docker (Claude provider, API-key auth)
 docker run --rm -e ANTHROPIC_API_KEY="$ANTHROPIC_API_KEY" \
   -v $(pwd):/workspace -w /workspace \
-  asklokesh/loki-mode:7.121.2 start ./my-spec.md
+  asklokesh/loki-mode:7.121.4 start ./my-spec.md
 ```
 
 ##### docker compose + .env (no host install)

package/loki-ts/dist/loki.js

@@ -1,5 +1,5 @@
 // @bun
-var q8=Object.defineProperty;var J8=($)=>$;function V8($,Q){this[$]=J8.bind(null,Q)}var b=($,Q)=>{for(var Z in Q)q8($,Z,{get:Q[Z],enumerable:!0,configurable:!0,set:V8.bind(Q,Z)})};var P=($,Q)=>()=>($&&(Q=$($=0)),Q);var J$=import.meta.require;var m1={};b(m1,{lokiDir:()=>j,homeLokiDir:()=>T$,findRepoRootForVersion:()=>$1,REPO_ROOT:()=>h});import{resolve as t,dirname as e$}from"path";import{fileURLToPath as W8}from"url";import{existsSync as N$}from"fs";import{homedir as H8}from"os";function G8(){let $=v1;for(let Q=0;Q<6;Q++){if(N$(t($,"VERSION"))&&N$(t($,"autonomy/run.sh")))return $;let Z=e$($);if(Z===$)break;$=Z}return t(v1,"..","..","..")}function $1($){let Q=$;for(let Z=0;Z<6;Z++){if(N$(t(Q,"VERSION"))&&N$(t(Q,"autonomy/run.sh")))return Q;let z=e$(Q);if(z===Q)break;Q=z}return t($,"..","..","..")}function j(){return process.env.LOKI_DIR??t(process.cwd(),".loki")}function T$(){return t(H8(),".loki")}var v1,h;var C=P(()=>{v1=e$(W8(import.meta.url));h=G8()});import{readFileSync as U8}from"fs";import{resolve as Y8,dirname as B8}from"path";import{fileURLToPath as M8}from"url";function S$(){if(Q$!==null)return Q$;let $="7.121.2";if(typeof $==="string"&&$.length>0)return Q$=$,Q$;try{let Q=B8(M8(import.meta.url)),Z=$1(Q);Q$=U8(Y8(Z,"VERSION"),"utf-8").trim()}catch{Q$="unknown"}return Q$}var Q$=null;var Q1=P(()=>{C()});var p1={};b(p1,{runOrThrow:()=>S8,run:()=>R,readStreamCapped:()=>c1,commandVersion:()=>C8,commandExists:()=>u,ShellError:()=>Z1,MAX_STDOUT_BYTES:()=>u1});async function c1($,Q=u1){let Z=$.getReader(),z=new TextDecoder,X="",q=0;try{while(q<Q){let{done:K,value:W}=await Z.read();if(K)break;if(!W)continue;if(q+=W.byteLength,q>Q){let V=W.byteLength-(q-Q);X+=z.decode(W.subarray(0,V),{stream:!0});break}X+=z.decode(W,{stream:!0})}X+=z.decode()}finally{try{await Z.cancel()}catch{}Z.releaseLock()}return X}async function R($,Q={}){let Z=Bun.spawn({cmd:[...$],stdout:"pipe",stderr:"pipe",env:Q.env?{...process.env,...Q.env}:process.env,cwd:Q.cwd}),z,X;if(Q.timeoutMs&&Q.timeoutMs>0)z=setTimeout(()=>{try{Z.kill("SIGTERM")}catch{}X=setTimeout(()=>{try{Z.kill("SIGKILL")}catch{}},2000)},Q.timeoutMs);try{let[q,K,W]=await Promise.all([c1(Z.stdout),new Response(Z.stderr).text(),Z.exited]);return{stdout:q,stderr:K,exitCode:W}}finally{if(z)clearTimeout(z);if(X)clearTimeout(X)}}async function S8($,Q={}){let Z=await R($,Q);if(Z.exitCode!==0)throw new Z1(`command failed (${Z.exitCode}): ${$.join(" ")}`,Z.exitCode,Z.stdout,Z.stderr);return Z}async function u($){let Q=D8($),Z=await R(["sh","-c",`command -v ${Q}`],{timeoutMs:5000});if(Z.exitCode===0)return Z.stdout.trim()||null;return null}function D8($){if(!/^[A-Za-z0-9._/-]+$/.test($))throw Error(`refused to shell-escape suspect token: ${$}`);return $}async function C8($,Q="--version"){if(!await u($))return null;let z=await R([$,Q],{timeoutMs:5000});if(z.exitCode!==0)return null;return((z.stdout||z.stderr).split(/\r?\n/)[0]?.trim()??"")||null}var u1=16777216,Z1;var o=P(()=>{Z1=class Z1 extends Error{message;exitCode;stdout;stderr;constructor($,Q,Z,z){super($);this.message=$;this.exitCode=Q;this.stdout=Z;this.stderr=z;this.name="ShellError"}}});function r($){return b8?"":$}var b8,M,S,_,tZ,L,k,y,J;var p=P(()=>{b8=(process.env.NO_COLOR??"").length>0;M=r("\x1B[0;31m"),S=r("\x1B[0;32m"),_=r("\x1B[1;33m"),tZ=r("\x1B[0;34m"),L=r("\x1B[0;36m"),k=r("\x1B[1m"),y=r("\x1B[2m"),J=r("\x1B[0m")});import{existsSync as l8}from"fs";async function Z$(){if(A$!==void 0)return A$;let $="/opt/homebrew/bin/python3.12";if(l8($))return A$=$,$;let Q=await u("python3.12");if(Q)return A$=Q,Q;let Z=await u("python3");return A$=Z,Z}async function z$($,Q={}){let Z=await Z$();if(!Z)return{stdout:"",stderr:"python3 not found",exitCode:127};return R([Z,"-c",$],Q)}var A$;var V$=P(()=>{o()});var V0={};b(V0,{runStatus:()=>U3});import{existsSync as v,readFileSync as H$,readdirSync as $0,statSync as Q0}from"fs";import{resolve as D,basename as z3}from"path";import{homedir as X3}from"os";function Z0($){let Q=Math.trunc($);if(Q>=1e6)return`${(Math.trunc(Q/1e6*10)/10).toFixed(1)}M`;if(Q>=1000)return`${(Math.trunc(Q/1000*10)/10).toFixed(1)}K`;return String(Q)}function z0($,Q,Z){if(Q===0)return null;let z=Math.trunc($*100/Q),X=Math.trunc($*C$/Q);if(X>C$)X=C$;let q=C$-X,K=S;if(z>=80)K=M;else if(z>=50)K=_;let W="=".repeat(Math.max(0,X))+" ".repeat(Math.max(0,q)),V=Z0($),H=Z0(Q);return`  ${k}${Z}${J} ${K}[${W}]${J} ${z}% (${V} / ${H})`}async function q3(){if(await u("jq"))return!0;return process.stdout.write(`${M}Error: jq is required but not installed.${J}
+var q8=Object.defineProperty;var J8=($)=>$;function V8($,Q){this[$]=J8.bind(null,Q)}var b=($,Q)=>{for(var Z in Q)q8($,Z,{get:Q[Z],enumerable:!0,configurable:!0,set:V8.bind(Q,Z)})};var P=($,Q)=>()=>($&&(Q=$($=0)),Q);var J$=import.meta.require;var m1={};b(m1,{lokiDir:()=>j,homeLokiDir:()=>T$,findRepoRootForVersion:()=>$1,REPO_ROOT:()=>h});import{resolve as t,dirname as e$}from"path";import{fileURLToPath as W8}from"url";import{existsSync as N$}from"fs";import{homedir as H8}from"os";function G8(){let $=v1;for(let Q=0;Q<6;Q++){if(N$(t($,"VERSION"))&&N$(t($,"autonomy/run.sh")))return $;let Z=e$($);if(Z===$)break;$=Z}return t(v1,"..","..","..")}function $1($){let Q=$;for(let Z=0;Z<6;Z++){if(N$(t(Q,"VERSION"))&&N$(t(Q,"autonomy/run.sh")))return Q;let z=e$(Q);if(z===Q)break;Q=z}return t($,"..","..","..")}function j(){return process.env.LOKI_DIR??t(process.cwd(),".loki")}function T$(){return t(H8(),".loki")}var v1,h;var C=P(()=>{v1=e$(W8(import.meta.url));h=G8()});import{readFileSync as U8}from"fs";import{resolve as Y8,dirname as B8}from"path";import{fileURLToPath as M8}from"url";function S$(){if(Q$!==null)return Q$;let $="7.121.4";if(typeof $==="string"&&$.length>0)return Q$=$,Q$;try{let Q=B8(M8(import.meta.url)),Z=$1(Q);Q$=U8(Y8(Z,"VERSION"),"utf-8").trim()}catch{Q$="unknown"}return Q$}var Q$=null;var Q1=P(()=>{C()});var p1={};b(p1,{runOrThrow:()=>S8,run:()=>R,readStreamCapped:()=>c1,commandVersion:()=>C8,commandExists:()=>u,ShellError:()=>Z1,MAX_STDOUT_BYTES:()=>u1});async function c1($,Q=u1){let Z=$.getReader(),z=new TextDecoder,X="",q=0;try{while(q<Q){let{done:K,value:W}=await Z.read();if(K)break;if(!W)continue;if(q+=W.byteLength,q>Q){let V=W.byteLength-(q-Q);X+=z.decode(W.subarray(0,V),{stream:!0});break}X+=z.decode(W,{stream:!0})}X+=z.decode()}finally{try{await Z.cancel()}catch{}Z.releaseLock()}return X}async function R($,Q={}){let Z=Bun.spawn({cmd:[...$],stdout:"pipe",stderr:"pipe",env:Q.env?{...process.env,...Q.env}:process.env,cwd:Q.cwd}),z,X;if(Q.timeoutMs&&Q.timeoutMs>0)z=setTimeout(()=>{try{Z.kill("SIGTERM")}catch{}X=setTimeout(()=>{try{Z.kill("SIGKILL")}catch{}},2000)},Q.timeoutMs);try{let[q,K,W]=await Promise.all([c1(Z.stdout),new Response(Z.stderr).text(),Z.exited]);return{stdout:q,stderr:K,exitCode:W}}finally{if(z)clearTimeout(z);if(X)clearTimeout(X)}}async function S8($,Q={}){let Z=await R($,Q);if(Z.exitCode!==0)throw new Z1(`command failed (${Z.exitCode}): ${$.join(" ")}`,Z.exitCode,Z.stdout,Z.stderr);return Z}async function u($){let Q=D8($),Z=await R(["sh","-c",`command -v ${Q}`],{timeoutMs:5000});if(Z.exitCode===0)return Z.stdout.trim()||null;return null}function D8($){if(!/^[A-Za-z0-9._/-]+$/.test($))throw Error(`refused to shell-escape suspect token: ${$}`);return $}async function C8($,Q="--version"){if(!await u($))return null;let z=await R([$,Q],{timeoutMs:5000});if(z.exitCode!==0)return null;return((z.stdout||z.stderr).split(/\r?\n/)[0]?.trim()??"")||null}var u1=16777216,Z1;var o=P(()=>{Z1=class Z1 extends Error{message;exitCode;stdout;stderr;constructor($,Q,Z,z){super($);this.message=$;this.exitCode=Q;this.stdout=Z;this.stderr=z;this.name="ShellError"}}});function r($){return b8?"":$}var b8,M,S,_,tZ,L,k,y,J;var p=P(()=>{b8=(process.env.NO_COLOR??"").length>0;M=r("\x1B[0;31m"),S=r("\x1B[0;32m"),_=r("\x1B[1;33m"),tZ=r("\x1B[0;34m"),L=r("\x1B[0;36m"),k=r("\x1B[1m"),y=r("\x1B[2m"),J=r("\x1B[0m")});import{existsSync as l8}from"fs";async function Z$(){if(A$!==void 0)return A$;let $="/opt/homebrew/bin/python3.12";if(l8($))return A$=$,$;let Q=await u("python3.12");if(Q)return A$=Q,Q;let Z=await u("python3");return A$=Z,Z}async function z$($,Q={}){let Z=await Z$();if(!Z)return{stdout:"",stderr:"python3 not found",exitCode:127};return R([Z,"-c",$],Q)}var A$;var V$=P(()=>{o()});var V0={};b(V0,{runStatus:()=>U3});import{existsSync as v,readFileSync as H$,readdirSync as $0,statSync as Q0}from"fs";import{resolve as D,basename as z3}from"path";import{homedir as X3}from"os";function Z0($){let Q=Math.trunc($);if(Q>=1e6)return`${(Math.trunc(Q/1e6*10)/10).toFixed(1)}M`;if(Q>=1000)return`${(Math.trunc(Q/1000*10)/10).toFixed(1)}K`;return String(Q)}function z0($,Q,Z){if(Q===0)return null;let z=Math.trunc($*100/Q),X=Math.trunc($*C$/Q);if(X>C$)X=C$;let q=C$-X,K=S;if(z>=80)K=M;else if(z>=50)K=_;let W="=".repeat(Math.max(0,X))+" ".repeat(Math.max(0,q)),V=Z0($),H=Z0(Q);return`  ${k}${Z}${J} ${K}[${W}]${J} ${z}% (${V} / ${H})`}async function q3(){if(await u("jq"))return!0;return process.stdout.write(`${M}Error: jq is required but not installed.${J}
 `),process.stdout.write(`Install with:
 `),process.stdout.write(`  brew install jq    (macOS)
 `),process.stdout.write(`  apt install jq     (Debian/Ubuntu)
@@ -814,4 +814,4 @@ Set LOKI_LEGACY_BASH=1 to force the bash CLI for every command.
 `),2}default:return process.stderr.write(`Unknown command: ${Q}
 `),process.stderr.write(K8),2}}e1();process.on("SIGINT",()=>process.exit(130));process.on("SIGTERM",()=>process.exit(143));var SZ=await NZ(Bun.argv.slice(2));process.exit(SZ);
 
-//# debugId=1A0B5967C64F275B64756E2164756E21
+//# debugId=8F986B79CB65C96964756E2164756E21