loki-mode 7.121.3 → 7.121.4

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: Autonomous spec-driven build system with a built-in trust layer. It does not call work done until it is verified (RARV-C closure loop, 8 quality gates, completion council, verified-completion evidence gate). Triggers on "Loki Mode". Takes a spec (PRD, GitHub issue, OpenAPI doc, etc.) to deployed product with minimal human intervention. Provider-agnostic. Requires --dangerously-skip-permissions flag.
 ---
 
-# Loki Mode v7.121.3
+# Loki Mode v7.121.4
 
 **You are an autonomous agent. You make decisions. You do not ask questions. You do not stop.**
 
@@ -408,4 +408,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v7.121.3 | [Autonomi](https://www.autonomi.dev/) flagship product | ~260 lines core**
+**v7.121.4 | [Autonomi](https://www.autonomi.dev/) flagship product | ~260 lines core**

package/VERSION

@@ -1 +1 @@
-7.121.3
+7.121.4

package/autonomy/lib/contract-scaffold/README.md

@@ -0,0 +1,83 @@
+# contract-scaffold (M1: the contract-first codegen spine)
+
+The single load-bearing mechanism behind "a real, wired app, not a static shell."
+See `artifacts/beat-replit-engineering-plan.md` (studied from Replit's Adopt) and
+`artifacts/replit-adopt-study.md`.
+
+## What it does
+
+`scaffold.sh <out_dir> <resource> [field:type ...]` emits a **contract-first**
+project skeleton:
+
+1. An **OpenAPI contract** (`openapi.yaml`) as a first-class artifact -- the single
+   source of truth for the API.
+2. An **Orval config** that generates typed react-query hooks FROM the contract.
+3. `package.json` + `tsconfig.json` with a real codegen + typecheck script.
+
+The point: after `npm run codegen`, a page can only call hooks that the contract
+defines. A page referencing an endpoint the backend does not implement **fails
+typecheck** -- so a static-shell-passed-off-as-wired becomes impossible.
+
+## Proven (tests/test-contract-scaffold.sh, 7/7)
+
+- scaffold -> real `openapi.yaml`
+- real Orval codegen -> `useListBookmark` / `useCreateBookmark` / `useDeleteBookmark`
+- a page on a REAL endpoint typechecks
+- a page on a NON-CONTRACT endpoint **fails typecheck** (drift blocked)
+
+Proven on a throwaway `bookmark` resource -- **general by construction, no
+knowledge of any specific PRD** (anti-teaching-to-the-test).
+
+## Status: STANDALONE + ADDITIVE -- wired into NO build lane
+
+This is a capability module, like FV-1 was. It changes zero existing build
+behavior. **Wiring it into the default build lane is the gated next step** (the
+M1->"M1-wire" fork, analogous to FV-1->FV-2): that step touches the parity-locked
+`run.sh`/`build_prompt.ts` core, reclassifies what every build produces, and
+requires bash+bun parity work + council review + founder sign-off. Do NOT wire it
+in as a solo/rushed action.
+
+## Scope
+
+Gap A (the generated app's own quality). NOT Gap B (Replit's managed cloud:
+hosted DB provisioning, auth, secrets, deploy infra -- multi-quarter, out).
+
+## M2 -- real backend floor (DONE, standalone)
+
+`generate.mjs <out_dir> <resource> [field:type ...]` produces a REAL Express +
+SQLite backend (via `templates/server/`, substitution NOT heredocs) that persists:
+POST creates a row that survives to a later GET, DELETE removes it, one seed row so
+the first screen is never blank. Every declared field is always bound (a partial
+POST persists cleanly, 201, never 500 -- a bug the FV harness caught).
+
+Proven (tests/test-backend-floor.sh, 6/6) on a throwaway `note` resource: generates,
+starts, POST persists, partial POST persists, and **FV-1 reports
+functional_status=verified** -- the convergence. A static shell would fail this.
+
+Architecture: template files + a Node substitutor, NOT bash heredocs emitting JS
+(heredocs collide with JS `${...}`/backticks -- learned the hard way; see the plan).
+
+## M3 -- design-system pass (DONE, standalone)
+
+`generate.mjs` also emits (into `src/`, from `templates/ui/`) a design system so a
+generated frontend looks DESIGNED, not default:
+- `theme.css` -- ROLE tokens (bg/surface/text/primary/...), a confident modern
+  default palette, and a parallel dark theme honored from the OS (`--no-ui` skips).
+- `<Resource>ListView.tsx` -- a data surface with all THREE UI states: a shimmer
+  skeleton (never a blank flash), an inviting empty state with a CTA, and a
+  first-run "you're viewing sample data" banner (backed by M2's seed row). Wired
+  to the M1 contract hook, so it cannot reference a non-contract endpoint.
+
+Small touches that make users smile: friendly copy, a clear primary action,
+graceful loading/empty/error states, no raw hex (re-theme from one block).
+
+Proven (tests/test-design-system.sh, 8/8): no raw hex in components, all three
+states, dark theme, AND the tokenized ListView TYPECHECKS against the generated
+contract hooks (the contract even caught a wrong response-type assumption in the
+UI -- the spine working as designed).
+
+## Next (wiring, see the plan)
+
+- Wire M1+M2+M3 into the build lane (GATED: touches parity-locked run.sh/
+  build_prompt.ts core -> bash+bun parity + council + founder sign-off).
+- Wire the FV harness into the completion verdict (FV-2, founder-gated).

package/autonomy/lib/contract-scaffold/generate.mjs

@@ -0,0 +1,90 @@
+#!/usr/bin/env node
+// generate.mjs -- M2 backend-floor generator (template substitution, NOT heredocs).
+//
+// Reads the server template files and substitutes tokens derived from a portable
+// {resource, fields} descriptor, producing a REAL Express + SQLite backend that
+// persists. General by construction: no knowledge of any specific PRD.
+//
+// Why a Node generator and not a bash heredoc: a heredoc emitting JS collides with
+// JS `${...}` template literals and backticks (bit both the M1 yaml and a first
+// M2 js heredoc). Templates + substitution keeps generated code reviewable as real
+// code. See artifacts/beat-replit-engineering-plan.md (M2 architecture decision).
+//
+// Usage: node generate.mjs <out_dir> <resource> [field:type ...]
+import { readFileSync, writeFileSync, mkdirSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const __dir = dirname(fileURLToPath(import.meta.url));
+const TPL = join(__dir, "templates", "server");
+
+const [, , outDir, resource, ...fieldArgs] = process.argv;
+if (!outDir || !resource) {
+  console.error("usage: generate.mjs <out_dir> <resource> [field:type ...]");
+  process.exit(2);
+}
+
+const fields = (fieldArgs.length ? fieldArgs : ["title:string"]).map((f) => {
+  const [name, type = "string"] = f.split(":");
+  return { name, type };
+});
+
+const cap = resource.charAt(0).toUpperCase() + resource.slice(1);
+const coll = resource.endsWith("s") ? resource : resource + "s";
+
+const sqlType = (t) =>
+  ["int", "integer", "number", "bool", "boolean"].includes(t) ? "INTEGER" : "TEXT";
+const seedVal = (t) =>
+  ["int", "integer", "number"].includes(t) ? "1"
+  : ["bool", "boolean"].includes(t) ? "0"
+  : "'sample value'";
+
+const tokens = {
+  __COLL__: coll,
+  __RESOURCE_CAP__: cap,
+  __COLUMNS_SQL__: fields.map((f) => `  ${f.name} ${sqlType(f.type)},`).join("\n"),
+  __SEED_COLS__: fields.length ? fields.map((f) => f.name).join(", ") + "," : "",
+  __SEED_VALS__: fields.length ? fields.map((f) => seedVal(f.type)).join(", ") + "," : "",
+  __INSERT_COLS__: fields.length ? fields.map((f) => f.name).join(", ") + "," : "",
+  __INSERT_PLACEHOLDERS__: fields.length ? fields.map((f) => "@" + f.name).join(", ") + "," : "",
+  __BODY_FIELDS__: fields.map((f) => `"${f.name}"`).join(", "),
+};
+
+function render(tpl) {
+  let out = tpl;
+  // Replace longer tokens first so __RESOURCE_CAP__ isn't partially hit, etc.
+  for (const key of Object.keys(tokens).sort((a, b) => b.length - a.length)) {
+    out = out.split(key).join(tokens[key]);
+  }
+  return out;
+}
+
+mkdirSync(join(outDir, "server"), { recursive: true });
+for (const [tpl, dest] of [
+  ["index.mjs.tmpl", "index.mjs"],
+  ["package.json.tmpl", "package.json"],
+]) {
+  const src = readFileSync(join(TPL, tpl), "utf8");
+  writeFileSync(join(outDir, "server", dest), render(src));
+}
+
+// M3: the design-system UI templates (tokens + dark + three states), wired to the
+// M1 contract hooks. Emitted into src/ alongside the generated client so a
+// generated frontend looks DESIGNED (not default) and cannot reference a
+// non-contract endpoint. Optional: skip with --no-ui.
+if (!process.argv.includes("--no-ui")) {
+  const UI = join(__dir, "templates", "ui");
+  mkdirSync(join(outDir, "src"), { recursive: true });
+  for (const [tpl, dest] of [
+    ["theme.css.tmpl", "theme.css"],
+    ["ListView.tsx.tmpl", `${cap}ListView.tsx`],
+  ]) {
+    const src = readFileSync(join(UI, tpl), "utf8");
+    writeFileSync(join(outDir, "src", dest), render(src));
+  }
+}
+
+console.log(`generated real backend floor at ${outDir}/server (Express + SQLite, /${coll})`);
+if (!process.argv.includes("--no-ui"))
+  console.log(`generated design-system UI at ${outDir}/src (tokens + dark + 3 states, wired to the contract)`);
+console.log(`next: (cd ${outDir}/server && npm install && PORT=3000 npm start)`);

package/autonomy/lib/contract-scaffold/scaffold.sh

@@ -0,0 +1,147 @@
+#!/usr/bin/env bash
+# contract-scaffold/scaffold.sh -- M1: the contract-first codegen spine.
+#
+# The single load-bearing mechanism behind "a real wired app, not a static shell"
+# (see artifacts/beat-replit-engineering-plan.md, studied from Replit's Adopt).
+# It emits an OpenAPI contract as a first-class artifact, then generates typed
+# client hooks + validators FROM it, so a page PHYSICALLY CANNOT call an endpoint
+# the backend does not implement -- it will not typecheck. A static mock stops
+# being possible to pass off as a wired app.
+#
+# STATUS: STANDALONE + ADDITIVE. Wired into NO build lane. It is a capability
+# module proven on throwaway specs; wiring it into the default build is the
+# gated next step (like FV-1 -> FV-2), requiring bash+bun parity work + council.
+#
+# GENERAL by construction: it takes a portable {name, entity, fields} descriptor
+# and produces a contract-first skeleton for ANY simple REST resource. It has NO
+# knowledge of any specific PRD (anti-teaching-to-the-test).
+#
+# Usage:
+#   scaffold.sh <out_dir> <resource_name> [field:type ...]
+# Example:
+#   scaffold.sh /tmp/bookmarks bookmark url:string title:string
+set -euo pipefail
+
+OUT="${1:?usage: scaffold.sh <out_dir> <resource> [field:type ...]}"
+RES="${2:?resource name required}"
+shift 2 || true
+FIELDS=("$@")
+[ "${#FIELDS[@]}" -eq 0 ] && FIELDS=("title:string")
+
+# Plural collection path (naive but sufficient: append 's' unless already plural).
+case "$RES" in *s) COLL="$RES" ;; *) COLL="${RES}s" ;; esac
+
+mkdir -p "$OUT"
+
+# ---- 1. The OpenAPI contract (the single source of truth) -------------------
+# Build the schema properties + a create-body from the field descriptors.
+_props=""; _required=""; _create_props=""
+for f in "${FIELDS[@]}"; do
+    fname="${f%%:*}"; ftype="${f##*:}"
+    case "$ftype" in
+        int|integer|number) otype="integer" ;;
+        bool|boolean) otype="boolean" ;;
+        *) otype="string" ;;
+    esac
+    _props+="        ${fname}: { type: ${otype} }
+"
+    _create_props+="        ${fname}: { type: ${otype} }
+"
+    _required+="        - ${fname}
+"
+done
+
+cat > "$OUT/openapi.yaml" <<YAML
+openapi: 3.1.0
+info: { title: Api, version: 1.0.0 }
+servers: [{ url: /api }]
+paths:
+  /${COLL}:
+    get:
+      operationId: list${RES^}
+      responses:
+        '200':
+          description: OK
+          content:
+            application/json:
+              schema: { type: array, items: { \$ref: '#/components/schemas/${RES^}' } }
+    post:
+      operationId: create${RES^}
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema: { \$ref: '#/components/schemas/${RES^}Create' }
+      responses:
+        '201':
+          description: Created
+          content:
+            application/json:
+              schema: { \$ref: '#/components/schemas/${RES^}' }
+  /${COLL}/{id}:
+    delete:
+      operationId: delete${RES^}
+      parameters:
+        - { name: id, in: path, required: true, schema: { type: string } }
+      responses:
+        '204': { description: No Content }
+components:
+  schemas:
+    ${RES^}:
+      type: object
+      required:
+        - id
+${_required}      properties:
+        id: { type: string }
+${_props}    ${RES^}Create:
+      type: object
+      required:
+${_required}      properties:
+${_create_props}
+YAML
+
+# ---- 2. Orval config: contract -> typed react-query hooks -------------------
+cat > "$OUT/orval.config.ts" <<'TS'
+import { defineConfig } from "orval";
+export default defineConfig({
+  client: {
+    input: "./openapi.yaml",
+    output: {
+      target: "./src/generated/api.ts",
+      client: "react-query",
+      mode: "single",
+      clean: true,
+      override: { header: () => ["// GENERATED by orval -- do not edit manually."] },
+    },
+  },
+});
+TS
+
+# ---- 3. package.json (real deps, real codegen script) ----------------------
+cat > "$OUT/package.json" <<JSON
+{
+  "name": "contract-first-${COLL}",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "codegen": "orval --config ./orval.config.ts",
+    "typecheck": "tsc --noEmit"
+  },
+  "dependencies": { "@tanstack/react-query": "^5.0.0", "react": "^18.0.0" },
+  "devDependencies": { "orval": "^8.0.0", "typescript": "^5.4.0", "@types/react": "^18.0.0" }
+}
+JSON
+
+cat > "$OUT/tsconfig.json" <<'JSON'
+{
+  "compilerOptions": {
+    "strict": true, "noEmit": true, "jsx": "react-jsx",
+    "module": "ESNext", "moduleResolution": "Bundler",
+    "target": "ES2022", "lib": ["ES2022", "DOM"], "skipLibCheck": true
+  },
+  "include": ["src"]
+}
+JSON
+
+echo "scaffolded contract-first skeleton at $OUT (resource=$RES, collection=/$COLL)"
+echo "next: (cd $OUT && npm install && npm run codegen && npm run typecheck)"

package/autonomy/lib/contract-scaffold/templates/server/index.mjs.tmpl

@@ -0,0 +1,62 @@
+// Real backend FLOOR: Express + SQLite persistence implementing the M1 contract.
+// POST persists; GET reflects it; DELETE removes it -- a working data pipeline,
+// not a mock. Generated by contract-scaffold (template-substitution, general).
+// (Token reference intentionally omitted from this comment so the substitutor
+//  does not rewrite it; see generate.mjs for the token list.)
+import express from "express";
+import Database from "better-sqlite3";
+import { randomUUID } from "node:crypto";
+
+const db = new Database(process.env.DB_PATH || ":memory:");
+db.exec(`CREATE TABLE IF NOT EXISTS __COLL__ (
+  id TEXT PRIMARY KEY,
+__COLUMNS_SQL__
+  created_at TEXT NOT NULL
+);`);
+
+// Seed one row so the very first screen is never blank (the empty vs first-run
+// UI-state discipline: a real app greets the user with sample data, not a void).
+const seedCount = db.prepare("SELECT COUNT(*) AS c FROM __COLL__").get().c;
+if (seedCount === 0) {
+  db.prepare(
+    "INSERT INTO __COLL__ (id, __SEED_COLS__ created_at) VALUES (?, __SEED_VALS__ ?)"
+  ).run(randomUUID(), new Date().toISOString());
+}
+
+const app = express();
+app.use(express.json());
+
+// Only these keys are accepted from a POST body -- never arbitrary columns.
+// EVERY declared field is always bound (defaulting to null when the caller omits
+// it), so a partial POST persists cleanly instead of throwing "missing named
+// parameter". A real app tolerates optional fields; it does not 500 on them.
+const BODY_FIELDS = [__BODY_FIELDS__];
+function pickBody(body) {
+  const out = {};
+  for (const k of BODY_FIELDS) out[k] = body != null && body[k] !== undefined ? body[k] : null;
+  return out;
+}
+
+// GET /api/__COLL__  (list__RESOURCE_CAP__)
+app.get("/api/__COLL__", (_req, res) => {
+  res.json(db.prepare("SELECT * FROM __COLL__ ORDER BY created_at DESC").all());
+});
+
+// POST /api/__COLL__  (create__RESOURCE_CAP__) -- PERSISTS
+app.post("/api/__COLL__", (req, res) => {
+  const fields = pickBody(req.body);
+  const row = { id: randomUUID(), ...fields, created_at: new Date().toISOString() };
+  db.prepare(
+    "INSERT INTO __COLL__ (id, __INSERT_COLS__ created_at) VALUES (@id, __INSERT_PLACEHOLDERS__ @created_at)"
+  ).run(row);
+  res.status(201).json(row);
+});
+
+// DELETE /api/__COLL__/:id  (delete__RESOURCE_CAP__)
+app.delete("/api/__COLL__/:id", (req, res) => {
+  db.prepare("DELETE FROM __COLL__ WHERE id = ?").run(req.params.id);
+  res.status(204).end();
+});
+
+const port = process.env.PORT ? Number(process.env.PORT) : 3000;
+app.listen(port, () => console.log(`__RESOURCE_CAP__ API listening on port ${port}`));

package/autonomy/lib/contract-scaffold/templates/server/package.json.tmpl

@@ -0,0 +1,10 @@
+{
+  "name": "contract-first-__COLL__-server",
+  "private": true,
+  "type": "module",
+  "scripts": { "start": "node index.mjs" },
+  "dependencies": {
+    "express": "^5.0.0",
+    "better-sqlite3": "^12.0.0"
+  }
+}

package/autonomy/lib/contract-scaffold/templates/ui/ListView.tsx.tmpl

@@ -0,0 +1,75 @@
+// ListView.tsx -- a data surface that ships all THREE UI states with design
+// tokens, wired to the M1 contract hook. This is what "designed, not default"
+// looks like: skeleton while loading, an inviting empty state with a CTA, a
+// first-run "sample data" banner, and real rows in a tokenized card. It consumes
+// the generated hook, so it physically cannot reference a non-contract endpoint.
+//
+// Generated by contract-scaffold M3 (general: __COLL__/__RESOURCE_CAP__ tokens,
+// no product-specific content). Small touches that make users smile: friendly
+// copy, an icon, a clear primary action, graceful loading + empty states.
+import { useList__RESOURCE_CAP__, useCreate__RESOURCE_CAP__ } from "./generated/api";
+
+export function __RESOURCE_CAP__ListView() {
+  const { data, isLoading, isError } = useList__RESOURCE_CAP__();
+  const create = useCreate__RESOURCE_CAP__();
+  // Orval's react-query hook returns the full response object; the array is at
+  // .data.data, typed straight from the OpenAPI contract (a real __RESOURCE_CAP__[]).
+  // Reading it wrong is a typecheck error -- the contract-first spine catching a
+  // drift in the UI itself.
+  const items = data?.data ?? [];
+  // A seeded backend (M2) means the first real screen shows sample data, not a void.
+  const isFirstRun = items.length > 0 && items.length <= 1;
+
+  // State 1: skeleton -- never a blank flash while loading.
+  if (isLoading) {
+    return (
+      <section className="card" aria-busy="true" aria-label="Loading __COLL__">
+        <div className="skeleton" style={{ width: "40%", marginBottom: 12 }} />
+        <div className="skeleton" style={{ width: "100%", marginBottom: 8 }} />
+        <div className="skeleton" style={{ width: "90%" }} />
+      </section>
+    );
+  }
+
+  if (isError) {
+    return (
+      <section className="empty" role="alert">
+        <p>We couldn't load your __COLL__. Please try again.</p>
+      </section>
+    );
+  }
+
+  // State 2: empty -- a dashed invitation with a clear next action, never a void.
+  if (items.length === 0) {
+    return (
+      <section className="empty">
+        <h3 style={{ margin: "0 0 4px" }}>No __COLL__ yet</h3>
+        <p style={{ margin: "0 0 16px" }}>Get started by creating your first one.</p>
+        <button className="btn-primary" onClick={() => create.mutate({ data: {} as never })}>
+          Create __RESOURCE_CAP__
+        </button>
+      </section>
+    );
+  }
+
+  // State 3: populated (with a friendly first-run banner when it's sample data).
+  return (
+    <section>
+      {isFirstRun ? (
+        <div className="first-run" role="status">
+          <span aria-hidden="true">*</span>
+          You're viewing sample data. Create a __RESOURCE_CAP__ to make it yours.
+        </div>
+      ) : null}
+      <ul style={{ listStyle: "none", padding: 0, margin: "12px 0 0", display: "grid", gap: 12 }}>
+        {items.map((it) => (
+          <li key={String((it as { id?: unknown }).id)} className="card">
+            <pre style={{ margin: 0, fontFamily: "inherit", whiteSpace: "pre-wrap" }}>
+              {JSON.stringify(it, null, 2)}
+            </pre>
+          </li>
+        ))}
+      </ul>
+    </section>
+  );
+}

package/autonomy/lib/contract-scaffold/templates/ui/theme.css.tmpl

@@ -0,0 +1,99 @@
+/* theme.css -- design tokens (role-based, NEVER raw hex in components).
+ *
+ * Why this exists: generated apps look "AI-default" because they scatter raw
+ * colors and ship only a happy-path light theme. A real designed app uses ROLE
+ * tokens (bg, surface, text, primary, ...) referenced everywhere, ships a
+ * parallel dark theme from the same variable block, and honors the OS setting.
+ * Swapping one block re-themes the whole app. Modern, high-contrast, accessible.
+ *
+ * Generated by contract-scaffold M3 (general -- no product-specific colors;
+ * a strong neutral+indigo default any greenfield app can ship and re-brand).
+ */
+:root {
+  /* Surfaces */
+  --bg: #f7f8fa;
+  --surface: #ffffff;
+  --surface-2: #f0f2f5;
+  --border: #e3e6eb;
+  /* Text (AA contrast on --bg / --surface) */
+  --text: #1a1d24;
+  --text-muted: #5a6472;
+  /* Brand accent -- a confident modern indigo (re-brand by editing here only) */
+  --primary: #5b35e8;
+  --primary-contrast: #ffffff;
+  --primary-weak: #ece8fd;
+  /* Semantic */
+  --ok: #1f9d55;
+  --warn: #b7791f;
+  --danger: #c2333a;
+  /* Shape + depth (subtle, not shadow-heavy) */
+  --radius: 12px;
+  --radius-sm: 8px;
+  --shadow-sm: 0 1px 2px rgba(16, 24, 40, 0.06), 0 1px 3px rgba(16, 24, 40, 0.08);
+  --space: 16px;
+}
+
+/* Dark theme -- same roles, honored automatically from the OS preference. */
+@media (prefers-color-scheme: dark) {
+  :root {
+    --bg: #0f1117;
+    --surface: #171a21;
+    --surface-2: #1e222b;
+    --border: #2a2f3a;
+    --text: #eef1f6;
+    --text-muted: #9aa4b2;
+    --primary: #8b6dff;
+    --primary-contrast: #0f1117;
+    --primary-weak: #241f3d;
+    --shadow-sm: 0 1px 2px rgba(0, 0, 0, 0.4), 0 1px 3px rgba(0, 0, 0, 0.5);
+  }
+}
+/* Explicit override hook (a theme toggle sets data-theme on <html>). */
+:root[data-theme="dark"] {
+  --bg: #0f1117; --surface: #171a21; --surface-2: #1e222b; --border: #2a2f3a;
+  --text: #eef1f6; --text-muted: #9aa4b2; --primary: #8b6dff;
+  --primary-contrast: #0f1117; --primary-weak: #241f3d;
+}
+
+* { box-sizing: border-box; }
+body {
+  margin: 0;
+  background: var(--bg);
+  color: var(--text);
+  font: 15px/1.55 -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif;
+  -webkit-font-smoothing: antialiased;
+}
+.card {
+  background: var(--surface);
+  border: 1px solid var(--border);
+  border-radius: var(--radius);
+  box-shadow: var(--shadow-sm);
+  padding: var(--space);
+}
+.btn-primary {
+  background: var(--primary); color: var(--primary-contrast);
+  border: none; border-radius: var(--radius-sm);
+  padding: 8px 16px; font-weight: 600; cursor: pointer;
+}
+.btn-primary:hover { filter: brightness(1.05); }
+
+/* --- the three UI states every data surface ships --- */
+/* 1. skeleton (loading) -- a shimmer, never a blank flash */
+.skeleton {
+  background: linear-gradient(90deg, var(--surface-2) 25%, var(--border) 37%, var(--surface-2) 63%);
+  background-size: 400% 100%;
+  animation: shimmer 1.4s ease infinite;
+  border-radius: var(--radius-sm); height: 16px;
+}
+@keyframes shimmer { 0% { background-position: 100% 0; } 100% { background-position: 0 0; } }
+/* 2. empty state -- a dashed invitation with a CTA, never a void */
+.empty {
+  border: 1px dashed var(--border); border-radius: var(--radius);
+  padding: calc(var(--space) * 2); text-align: center; color: var(--text-muted);
+}
+/* 3. first-run banner -- "you're viewing sample data" so screen 1 is alive */
+.first-run {
+  background: var(--primary-weak); border: 1px solid var(--border);
+  border-radius: var(--radius); padding: 12px 16px; color: var(--text);
+  display: flex; align-items: center; gap: 8px; font-size: 14px;
+}

package/autonomy/lib/functional-verify.py

@@ -0,0 +1,246 @@
+#!/usr/bin/env python3
+"""functional-verify.py -- FV-1: does the built app actually DO what the spec asked?
+
+The completion verifier proves code was written + tests/build passed. It does NOT
+prove the spec's BEHAVIORS work: a "waitlist" spec can be built as a static page
+that captures nothing, yet read VERIFIED (measured: ~half of backend-implying
+specs). This harness closes that gap by EXERCISING the running app against
+assertions DERIVED FROM THE SPEC, and reporting an honest functional signal.
+
+SCOPE (FV-1, deliberately narrow + honest):
+  - It reports a DESCRIPTIVE signal only. It does NOT feed the VERIFIED headline
+    (that is FV-2: a founder-gated trust-semantics decision, council-reviewed).
+  - It derives HTTP endpoint assertions from the spec (GET/POST/DELETE <path>) and
+    runs the CRUD lifecycle they imply against the LIVE app. It never fabricates:
+    an endpoint it cannot reach is `inconclusive`, a behavior that failed is
+    `failed`, a behavior proven is `passed`. Same inconclusive-never-false moat as
+    the rest of the trust layer.
+  - It requires the app to already be running (URL passed in) -- app-runner (>=
+    v7.121.3, static sites included) starts it; this harness only probes.
+
+Output: JSON to stdout -- {spec_behaviors: [...], summary: {passed, failed,
+inconclusive}, functional_status: verified|partial|failed|inconclusive}.
+"""
+from __future__ import annotations
+
+import json
+import re
+import sys
+import urllib.error
+import urllib.request
+
+
+# --- spec -> behavioral assertions ------------------------------------------
+
+# Endpoint declarations in a spec/PRD: "GET /api/tasks", "POST /api/tasks",
+# "DELETE /api/tasks/:id". Method + path; path may carry a :param placeholder.
+_ENDPOINT_RE = re.compile(
+    r'\b(GET|POST|PUT|PATCH|DELETE)\s+(/[A-Za-z0-9_./:{}-]*)',
+)
+
+
+def _clean_path(path: str) -> str:
+    """Strip trailing sentence punctuation a spec sentence leaves on a path
+    (e.g. "DELETE /api/tasks/:id." -> "/api/tasks/:id"). Without this, a probe
+    hits a wrong URL and fabricates a failure on a working app -- a fake-RED in
+    the FV layer itself, exactly what this harness exists to prevent."""
+    return path.rstrip(".,;:)]}") or path
+
+
+def derive_endpoint_assertions(spec_text: str) -> list[dict]:
+    """Extract {method, path} endpoint assertions the spec explicitly names.
+
+    Deduped, order-preserved. A path with a :param / {param} is a resource route
+    (used for the DELETE-a-created-resource lifecycle below)."""
+    seen = set()
+    out = []
+    for m in _ENDPOINT_RE.finditer(spec_text or ""):
+        method = m.group(1).upper()
+        path = _clean_path(m.group(2))
+        key = (method, path)
+        if key in seen:
+            continue
+        seen.add(key)
+        out.append({"method": method, "path": path,
+                    "is_resource": bool(re.search(r'[:{]', path))})
+    return out
+
+
+# --- run assertions against the live app ------------------------------------
+
+def _req(base_url: str, method: str, path: str, body=None, timeout=8):
+    """One HTTP call. Returns (status_code, json_or_text) or (None, error_str)."""
+    url = base_url.rstrip("/") + path
+    data = None
+    headers = {}
+    if body is not None:
+        data = json.dumps(body).encode()
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, method=method, headers=headers)
+    try:
+        with urllib.request.urlopen(req, timeout=timeout) as resp:
+            raw = resp.read().decode("utf-8", "replace")
+            try:
+                return resp.status, json.loads(raw) if raw else None
+            except json.JSONDecodeError:
+                return resp.status, raw
+    except urllib.error.HTTPError as e:
+        return e.code, None
+    except (urllib.error.URLError, OSError) as e:
+        return None, str(e)
+
+
+def verify_crud_lifecycle(base_url: str, assertions: list[dict]) -> list[dict]:
+    """The core functional check: for a REST resource the spec names, prove the
+    CRUD LIFECYCLE actually works end to end (not just that a route responds):
+      POST creates -> the created item appears on GET -> DELETE removes it ->
+      it is gone from a subsequent GET.
+    This is what distinguishes a working backend from a static shell: a static
+    page returns 200 on GET but a POST does not persist. Each behavior is
+    passed / failed / inconclusive, never fabricated."""
+    results = []
+
+    # Collection GET/POST endpoints (non-resource) and their resource DELETE.
+    gets = [a for a in assertions if a["method"] == "GET" and not a["is_resource"]]
+    posts = [a for a in assertions if a["method"] == "POST" and not a["is_resource"]]
+    deletes = [a for a in assertions if a["method"] == "DELETE" and a["is_resource"]]
+
+    # 1. Every named collection GET must actually respond 2xx.
+    for a in gets:
+        code, payload = _req(base_url, "GET", a["path"])
+        if code is None:
+            results.append({"behavior": f"GET {a['path']} responds",
+                            "status": "inconclusive", "detail": f"unreachable: {payload}"})
+        elif 200 <= code < 300:
+            results.append({"behavior": f"GET {a['path']} responds",
+                            "status": "passed", "detail": f"HTTP {code}"})
+        else:
+            results.append({"behavior": f"GET {a['path']} responds",
+                            "status": "failed", "detail": f"HTTP {code}"})
+
+    # 2. POST-creates-and-persists lifecycle: for each collection POST that has a
+    #    matching collection GET, POST an item and assert the collection grew.
+    for p in posts:
+        coll = p["path"]
+        matching_get = next((g for g in gets if g["path"] == coll), None)
+        if matching_get is None:
+            results.append({"behavior": f"POST {coll} persists (verifiable)",
+                            "status": "inconclusive",
+                            "detail": "no matching collection GET to confirm persistence"})
+            continue
+        before_code, before = _req(base_url, "GET", coll)
+        before_n = len(before) if isinstance(before, list) else None
+        # A minimal, generic payload. Real apps validate; we send a common shape.
+        post_code, created = _req(base_url, "POST", coll,
+                                  body={"title": "fv-probe", "name": "fv-probe",
+                                        "text": "fv-probe"})
+        after_code, after = _req(base_url, "GET", coll)
+        after_n = len(after) if isinstance(after, list) else None
+        if post_code is None or after_code is None:
+            results.append({"behavior": f"POST {coll} persists",
+                            "status": "inconclusive",
+                            "detail": "app unreachable during lifecycle"})
+        elif post_code and 200 <= post_code < 300 and before_n is not None \
+                and after_n is not None and after_n > before_n:
+            results.append({"behavior": f"POST {coll} persists",
+                            "status": "passed",
+                            "detail": f"collection grew {before_n} -> {after_n} after POST"})
+        elif post_code and 200 <= post_code < 300 and (before_n is None or after_n is None):
+            # POST accepted but the collection is not a JSON array we can count:
+            # we cannot PROVE persistence -> honest inconclusive, never a pass.
+            results.append({"behavior": f"POST {coll} persists",
+                            "status": "inconclusive",
+                            "detail": f"POST HTTP {post_code} but GET is not a countable list"})
+        elif post_code in (400, 422):
+            # The endpoint EXISTS and rejected OUR probe payload (validation).
+            # That is a working backend with a schema our generic {title,name,text}
+            # did not satisfy -- NOT proof the behavior is broken. Marking it failed
+            # would be a fake-RED (a strict-but-working app read as non-working).
+            # Honest inconclusive; FV-2 must never wire a failed verdict off this.
+            results.append({"behavior": f"POST {coll} persists",
+                            "status": "inconclusive",
+                            "detail": f"POST HTTP {post_code}: endpoint exists but rejected the "
+                                      "probe payload (schema mismatch, not proof of no-persistence)"})
+        else:
+            # POST 404 (endpoint absent), 501 (not implemented), or 2xx-but-the-
+            # collection did NOT grow -> the behavior the spec implies does NOT
+            # work (a static shell or a non-persisting backend). Genuine failed.
+            results.append({"behavior": f"POST {coll} persists",
+                            "status": "failed",
+                            "detail": f"POST HTTP {post_code}; collection {before_n} -> {after_n} "
+                                      "(no persistence -- a static shell or non-working backend)"})
+
+        # 3. DELETE lifecycle: if the spec names a resource DELETE and we created
+        #    an item with an id, delete it and assert it's gone.
+        created_id = None
+        if isinstance(created, dict):
+            created_id = created.get("id") or created.get("_id")
+        if deletes and created_id is not None:
+            dpath_tmpl = deletes[0]["path"]
+            dpath = re.sub(r'[:{][A-Za-z0-9_]+[}]?', str(created_id), dpath_tmpl)
+            del_code, _ = _req(base_url, "DELETE", dpath)
+            _, after_del = _req(base_url, "GET", coll)
+            still_there = isinstance(after_del, list) and any(
+                isinstance(x, dict) and (x.get("id") == created_id or x.get("_id") == created_id)
+                for x in after_del)
+            if del_code is None:
+                results.append({"behavior": f"DELETE {dpath_tmpl} removes",
+                                "status": "inconclusive", "detail": "unreachable"})
+            elif 200 <= del_code < 300 and not still_there:
+                results.append({"behavior": f"DELETE {dpath_tmpl} removes",
+                                "status": "passed",
+                                "detail": f"item {created_id} gone after DELETE (HTTP {del_code})"})
+            else:
+                results.append({"behavior": f"DELETE {dpath_tmpl} removes",
+                                "status": "failed",
+                                "detail": f"DELETE HTTP {del_code}; item still present={still_there}"})
+    return results
+
+
+def summarize(results: list[dict]) -> dict:
+    passed = sum(1 for r in results if r["status"] == "passed")
+    failed = sum(1 for r in results if r["status"] == "failed")
+    inconclusive = sum(1 for r in results if r["status"] == "inconclusive")
+    # functional_status: verified only if >=1 behavior passed and NONE failed;
+    # failed if any behavior failed; inconclusive if nothing could be exercised.
+    if failed > 0:
+        status = "failed"
+    elif passed > 0 and inconclusive == 0:
+        status = "verified"
+    elif passed > 0:
+        status = "partial"
+    else:
+        status = "inconclusive"
+    return {"passed": passed, "failed": failed, "inconclusive": inconclusive,
+            "functional_status": status}
+
+
+def run(spec_text: str, base_url: str) -> dict:
+    assertions = derive_endpoint_assertions(spec_text)
+    if not assertions:
+        return {"spec_behaviors": [], "summary": {"passed": 0, "failed": 0,
+                "inconclusive": 0, "functional_status": "inconclusive"},
+                "note": "no HTTP endpoint behaviors derivable from the spec"}
+    results = verify_crud_lifecycle(base_url, assertions)
+    summ = summarize(results)
+    return {"assertions_derived": assertions, "spec_behaviors": results,
+            "summary": summ, "functional_status": summ["functional_status"]}
+
+
+def main(argv):
+    if len(argv) < 3:
+        print("usage: functional-verify.py <spec_file> <base_url>", file=sys.stderr)
+        return 2
+    spec_file, base_url = argv[1], argv[2]
+    try:
+        with open(spec_file, errors="replace") as f:
+            spec_text = f.read()
+    except OSError as e:
+        print(json.dumps({"error": f"cannot read spec: {e}"}))
+        return 1
+    print(json.dumps(run(spec_text, base_url), indent=2))
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main(sys.argv))

package/autonomy/lib/proof-generator.py

@@ -287,9 +287,22 @@ def _collect_quality_gates(loki_dir):
             elif os.path.exists(result_json):
                 rj = _read_json(result_json, default=None)
                 if isinstance(rj, dict):
-                    status = _norm_gate_status(
-                        rj.get("passed", rj.get("status", "not_run"))
-                    )
+                    # Read the marker's outcome key. enforce_static_analysis writes
+                    # `"pass"` (a bool); other markers may write `"passed"` or
+                    # `"status"`. Try all three so a real result is NEVER misread as
+                    # not_run: a failing static-analysis marker ({"pass":false,
+                    # "findings":11}) was collapsing to not_run (the reader looked
+                    # only for "passed"/"status"), understating a real gate FAILURE
+                    # as "did not run" -- the receipt read "gaps" where it should
+                    # read a failed gate. _norm_gate_status maps a bool correctly
+                    # (True->passed, False->failed). A key that is genuinely absent
+                    # still defaults to not_run (honest -- never fabricated passed).
+                    if "pass" in rj:
+                        status = _norm_gate_status(rj.get("pass"))
+                    else:
+                        status = _norm_gate_status(
+                            rj.get("passed", rj.get("status", "not_run"))
+                        )
             if status is not None:
                 gates.append({"name": gate_name, "status": status})
                 seen.add(gate_name)
@@ -431,6 +444,64 @@ def _norm_tests_status(raw):
     return s
 
 
+def _collect_functional(loki_dir):
+    """Read .loki/quality/functional-results.json (the FV-1 functional harness).
+
+    Deterministic FACT: did the built app actually DO what the spec asked (run the
+    app + exercise spec-derived behaviors -- POST persists, GET reflects, ...), as
+    opposed to just compiling and passing unit tests. Tolerates an absent file ->
+    status not_run. Shape mirrors the FV-1 harness output:
+    {ran, functional_status, passed, failed, inconclusive}.
+
+    DESCRIPTIVE ONLY (FV-2, record half): this fact is RECORDED on the receipt but
+    is deliberately NOT read by _compute_headline / _compute_degraded, so it does
+    NOT change what "Verified" means. Making functional-satisfaction gate the green
+    headline is a trust-semantics product decision (council + founder), the second
+    half of FV-2. Recording it first lets the signal be seen and validated safely.
+    """
+    out = {"ran": False, "functional_status": "not_run",
+           "passed": 0, "failed": 0, "inconclusive": 0}
+    raw = _read_json(
+        os.path.join(loki_dir, "quality", "functional-results.json"), default=None
+    )
+    if not isinstance(raw, dict):
+        return out
+    out["ran"] = True
+    out["functional_status"] = str(raw.get("functional_status") or "inconclusive")
+    summary = raw.get("summary") if isinstance(raw.get("summary"), dict) else raw
+    for k in ("passed", "failed", "inconclusive"):
+        v = summary.get(k)
+        if isinstance(v, int):
+            out[k] = v
+    return out
+
+
+def _collect_healthcheck(loki_dir):
+    """Read .loki/app-runner/health.json (the app-runner liveness probe).
+
+    Deterministic FACT: did the built app actually come up and respond (HTTP/PID
+    health), as written by app-runner. Absent -> not_run. Shape:
+    {ran, ok, status, checked_at}. status: not_run (never checked) | healthy
+    (ran, ok:true) | unhealthy (ran, ok:false).
+
+    DESCRIPTIVE ONLY (Evidence Receipt record half): recorded for transparency,
+    NOT read by _compute_headline / _compute_degraded, so it does not change what
+    "Verified" means. Gating on it is the founder-gated trust decision (mirrors the
+    FV-2 opt-in gate). ponytail: reuses the health.json app-runner already writes.
+    """
+    out = {"ran": False, "ok": False, "status": "not_run", "checked_at": ""}
+    raw = _read_json(
+        os.path.join(loki_dir, "app-runner", "health.json"), default=None
+    )
+    if not isinstance(raw, dict):
+        return out
+    out["ran"] = True
+    out["ok"] = bool(raw.get("ok"))
+    out["checked_at"] = str(raw.get("checked_at") or "")
+    out["status"] = "healthy" if out["ok"] else "unhealthy"
+    return out
+
+
 def _collect_tests(loki_dir):
     """Read .loki/quality/test-results.json.
 
@@ -763,6 +834,8 @@ def _build_proof(args, loki_dir, target_dir, repo_root):
     build = _collect_build(loki_dir)
     tests = _collect_tests(loki_dir)
     security = _collect_security(loki_dir)
+    functional = _collect_functional(loki_dir)  # FV-2 record-half: descriptive only
+    healthcheck = _collect_healthcheck(loki_dir)  # Evidence Receipt record-half
     evidence_gate = _collect_evidence_gate(loki_dir)
 
     deployed_url = os.environ.get("LOKI_DEPLOYED_URL") or None
@@ -800,6 +873,14 @@ def _build_proof(args, loki_dir, target_dir, repo_root):
             for g in (quality_gates.get("gates") or [])
         ],
         "security": security,
+        # FV-2 (record half): did the app actually DO what the spec asked? Present
+        # for transparency; DELIBERATELY NOT read by _compute_headline /
+        # _compute_degraded, so it does not (yet) change the verdict. Wiring it into
+        # the green headline is the founder-gated trust-semantics decision.
+        "functional": functional,
+        # Evidence Receipt (record half): did the built app come up + respond?
+        # Descriptive; NOT read by _compute_headline (gating is founder-gated).
+        "healthcheck": healthcheck,
         "cost": cost,
         "meta": {
             "run_id": run_id,
@@ -964,12 +1045,25 @@ def _compute_headline(facts, degraded):
     # intent). This keeps the receipt honest about security, not just tests.
     sec = facts.get("security") or {}
     sec_high = bool(sec.get("ran") and (sec.get("high_active") or 0) > 0)
+    # FV-2 gate (opt-in via LOKI_FV_GATE=1, default OFF -> headline unchanged). When
+    # enabled, a functional check that RAN and FAILED (the built app does not do what
+    # the spec asked -- a static shell for a backend spec) is a hard failure, same
+    # class as a failed test. Default-off keeps every existing build's verdict
+    # byte-identical; the founder flips it on after reviewing the reclassification.
+    # ponytail: reads the already-recorded functional fact; no new plumbing.
+    fn = facts.get("functional") or {}
+    fn_failed = bool(
+        os.environ.get("LOKI_FV_GATE") == "1"
+        and fn.get("ran")
+        and fn.get("functional_status") == "failed"
+    )
     any_failed = (
         tests.get("status") == "failed"
         or build.get("status") == "failed"
         or any(g.get("status") == "failed"
                for g in (facts.get("quality_gates") or []))
         or sec_high
+        or fn_failed
     )
     if any_failed:
         return "NOT VERIFIED"

package/autonomy/lib/scaffold-hook.sh

@@ -0,0 +1,82 @@
+#!/usr/bin/env bash
+# scaffold-hook.sh -- opt-in seam that wires the contract-first scaffold (M1-M3)
+# into the build lane. Mirrors the LOKI_SENTRUX_GATE pattern: sourced ONLY when
+# the gate is enabled, and no-ops safely otherwise.
+#
+# ENABLED by LOKI_SCAFFOLD_CONTRACT_FIRST=1 (default OFF -> the default build path
+# is byte-identical and completely unaffected). When ON, and ONLY for a GREENFIELD
+# target (an effectively-empty project dir) whose PRD implies a web/API backend,
+# it lays down the contract-first + real-backend + design-system skeleton BEFORE
+# the SDLC loop, so the model builds ON a real wired substrate instead of
+# hand-writing disconnected files. It NEVER touches a non-empty/brownfield repo.
+#
+# It is deliberately conservative: on any doubt it does nothing (returns 0) and
+# lets the normal build proceed -- it can only ADD a starting skeleton, never
+# remove or overwrite existing code.
+#
+# PARITY: this is a bash-only ORCHESTRATION seam in run_autonomous, NOT part of
+# the byte-mirrored build_prompt() contract (build_prompt.ts is unchanged). It
+# mirrors the LOKI_SENTRUX_GATE precedent, which is likewise bash-orchestration
+# only (not behavior-mirrored in the bun runner). Because it is DEFAULT-OFF, the
+# bun default path is unaffected. When the bun runner (loki-ts autonomous.ts,
+# currently a skeleton port) reaches run_autonomous behavior parity, it should
+# mirror this opt-in gate.
+
+# Is the target dir greenfield (no meaningful source yet)? Ignores .loki, .git,
+# the PRD, and dotfiles. Echoes "yes"/"no".
+_scaffold_is_greenfield() {
+    local dir="${1:-.}"
+    local n
+    n=$(find "$dir" -type f \
+        -not -path "*/.loki/*" -not -path "*/.git/*" \
+        -not -name "PRD.md" -not -name "prd.md" -not -name ".*" \
+        -not -path "*/node_modules/*" 2>/dev/null | head -5 | wc -l | tr -d ' ')
+    [ "${n:-0}" -eq 0 ] && echo "yes" || echo "no"
+}
+
+# Derive a resource + fields from a PRD, conservatively. Only fires when the PRD
+# clearly names a REST resource; otherwise echoes nothing (caller skips).
+# Kept intentionally simple + general (no product-specific knowledge).
+_scaffold_derive_resource() {
+    local prd="$1"
+    [ -f "$prd" ] || return 0
+    # Look for an explicit "GET/POST /api/<collection>" the way FV-1 does.
+    local coll
+    coll=$(grep -oiE '(GET|POST)[[:space:]]+/api/[a-z][a-z0-9_-]+' "$prd" 2>/dev/null \
+        | grep -oE '/api/[a-z][a-z0-9_-]+' | head -1 | sed 's#/api/##')
+    [ -z "$coll" ] && return 0
+    # singularize naively for the resource name
+    local res="${coll%s}"; [ -z "$res" ] && res="$coll"
+    echo "$res"
+}
+
+# The hook. Args: <target_dir> <prd_path>. Safe to call unconditionally; it
+# self-gates on the flag + greenfield + a derivable resource.
+run_contract_scaffold_hook() {
+    [ "${LOKI_SCAFFOLD_CONTRACT_FIRST:-0}" = "1" ] || return 0
+    local dir="${1:-.}" prd="${2:-}"
+    local script_dir
+    script_dir="${SCRIPT_DIR:-$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)}"
+
+    [ "$(_scaffold_is_greenfield "$dir")" = "yes" ] || {
+        log_info "contract-scaffold: target is not greenfield -> skipping (never overwrites existing code)" 2>/dev/null || true
+        return 0
+    }
+    local res
+    res=$(_scaffold_derive_resource "$prd")
+    [ -z "$res" ] && {
+        log_info "contract-scaffold: no REST resource derivable from the PRD -> skipping" 2>/dev/null || true
+        return 0
+    }
+
+    local scaffold="${script_dir}/lib/contract-scaffold/scaffold.sh"
+    local generate="${script_dir}/lib/contract-scaffold/generate.mjs"
+    [ -f "$scaffold" ] && [ -f "$generate" ] || return 0
+
+    log_info "contract-scaffold: greenfield + resource '$res' -> laying down contract-first + backend + design skeleton" 2>/dev/null || true
+    bash "$scaffold" "$dir" "$res" 2>/dev/null || true
+    if command -v node >/dev/null 2>&1; then
+        node "$generate" "$dir" "$res" 2>/dev/null || true
+    fi
+    return 0
+}

package/autonomy/run.sh

@@ -8511,6 +8511,30 @@ enforce_build_check() {
     return 0
 }
 
+# True when the workspace's package.json declares a non-empty `lint` script, so
+# the static-analysis gate can run the app's OWN linter (oxlint/eslint/biome/...)
+# via `npm run lint` rather than only recognizing eslint config files. Pure read
+# of package.json; returns non-zero on absence / no lint script / unreadable.
+has_npm_lint_script() {
+    local dir="${1:-.}"
+    local pkg="$dir/package.json"
+    [ -f "$pkg" ] || return 1
+    # Parse with python3 (already a hard dep of the engine) so a `"lint":` inside
+    # a string value or comment cannot yield a false positive; require a real,
+    # non-empty scripts.lint entry.
+    python3 - "$pkg" <<'PYEOF' 2>/dev/null
+import json, sys
+try:
+    with open(sys.argv[1]) as fh:
+        data = json.load(fh)
+except Exception:
+    sys.exit(1)
+scripts = data.get("scripts") or {}
+lint = scripts.get("lint")
+sys.exit(0 if isinstance(lint, str) and lint.strip() else 1)
+PYEOF
+}
+
 enforce_static_analysis() {
     local loki_dir="${TARGET_DIR:-.}/.loki"
     local quality_dir="$loki_dir/quality"
@@ -8539,6 +8563,31 @@ enforce_static_analysis() {
         done
         if [ -n "$abs_files" ]; then
             total_checked=$((total_checked + $(echo "$abs_files" | wc -w)))
+            # v7.x (static-analysis honest coverage): ADDITIVELY run the app's OWN
+            # declared `lint` script when present. Generated apps increasingly use
+            # oxlint / biome (not eslint) -- e.g. package.json `"lint": "oxlint"`
+            # with a `.oxlintrc.json` -- which the eslint-config probe below does
+            # not recognize, so the app's real lint check was skipped. Running
+            # `npm run lint` respects whatever linter the app declares. This is
+            # ADDITIVE (not a replacement): we STILL run the eslint/tsc type checks
+            # below, so a lint pass never silences the type-error check for TS apps
+            # (oxlint is not type-aware). rc 127 = the declared linter is not
+            # installed/resolvable -> HONEST skip, never counted as a violation
+            # (rc-only signal; a real lint failure whose OUTPUT mentions "not
+            # found" must still count, so we do NOT grep the message).
+            if has_npm_lint_script "${TARGET_DIR:-.}"; then
+                local lint_out lint_rc=0
+                lint_out=$(cd "${TARGET_DIR:-.}" && npm run --silent lint 2>&1) || lint_rc=$?
+                if [ "$lint_rc" -eq 127 ]; then
+                    log_info "Static analysis: app 'lint' script did not resolve a linter (not run, honest skip)"
+                elif [ "$lint_rc" -ne 0 ]; then
+                    findings=$((findings + 1))
+                    details="${details}Lint (npm run lint): $(echo "$lint_out" | tail -3 | tr '\n' ' '). "
+                fi
+            fi
+            # Type/syntax check path (unchanged contract): eslint when configured,
+            # else tsc project-mode + per-file parse. Runs REGARDLESS of the lint
+            # step above so TS type errors are always caught.
             if [ -f "${TARGET_DIR:-.}/.eslintrc.js" ] || [ -f "${TARGET_DIR:-.}/.eslintrc.json" ] || \
                [ -f "${TARGET_DIR:-.}/eslint.config.js" ] || [ -f "${TARGET_DIR:-.}/eslint.config.mjs" ]; then
                 local eslint_out
@@ -8559,7 +8608,7 @@ enforce_static_analysis() {
                 if [ -f "${TARGET_DIR:-.}/tsconfig.json" ] && command -v tsc &>/dev/null; then
                     local _has_ts=0
                     for f in $abs_files; do
-                        case "$f" in *.ts|*.tsx) _has_ts=1; break ;; esac
+                        case "$f" in *.ts|*.tsx|*.jsx) _has_ts=1; break ;; esac
                     done
                     if [ "$_has_ts" -eq 1 ]; then
                         _ts_project_mode=1
@@ -8569,7 +8618,7 @@ enforce_static_analysis() {
                             local _changed_ts_errors=""
                             for f in $js_files; do
                                 case "$f" in
-                                    *.ts|*.tsx)
+                                    *.ts|*.tsx|*.jsx)
                                         # tsc emits paths relative to project root with `(line,col):` suffix.
                                         # v7.5.12 Dev11 (R1 MED): use grep -F (literal) so filenames
                                         # containing regex metacharacters cannot cause false positives
@@ -8591,11 +8640,16 @@ enforce_static_analysis() {
                     fi
                 fi
                 for f in $abs_files; do
-                    # node --check cannot parse TypeScript / TSX files; it
-                    # crashes with ERR_UNKNOWN_FILE_EXTENSION. Skip them when
-                    # tsc is not available; otherwise delegate to tsc.
+                    # node --check cannot parse TypeScript / TSX / JSX files; it
+                    # crashes with ERR_UNKNOWN_FILE_EXTENSION (JSX) or a parse error
+                    # (TS syntax). Route .ts/.tsx AND .jsx to the JSX-capable tsc
+                    # path; only plain .js/.mjs/.cjs go through node --check. Before
+                    # the .jsx addition here, every valid .jsx file was falsely
+                    # reported as a "Syntax error" (node --check ERR_UNKNOWN_FILE_
+                    # EXTENSION) -- a whole class of false static-analysis findings
+                    # on React apps.
                     case "$f" in
-                        *.ts|*.tsx)
+                        *.ts|*.tsx|*.jsx)
                             # When tsconfig project-mode handled it above, skip
                             # the per-file fallback to avoid duplicate / false errors.
                             if [ "$_ts_project_mode" -eq 1 ]; then
@@ -16254,6 +16308,21 @@ run_autonomous() {
         esac
     fi
 
+    # Contract-first scaffold seam (opt-in via LOKI_SCAFFOLD_CONTRACT_FIRST=1,
+    # default OFF -> default build path is byte-identical). Mirrors the
+    # LOKI_SENTRUX_GATE pattern: source the helper only when the gate is enabled,
+    # and it self-gates further on greenfield + a derivable REST resource. It can
+    # ONLY add a starting skeleton (contract-first codegen + real backend + design
+    # system, M1-M3); it never overwrites existing code or touches a brownfield
+    # repo. On any doubt it no-ops and the normal build proceeds unchanged.
+    if [ "${LOKI_SCAFFOLD_CONTRACT_FIRST:-0}" = "1" ]; then
+        # shellcheck disable=SC1090,SC1091
+        source "${SCRIPT_DIR}/lib/scaffold-hook.sh" 2>/dev/null || true
+        if type run_contract_scaffold_hook >/dev/null 2>&1; then
+            run_contract_scaffold_hook "${TARGET_DIR:-.}" "$prd_path" || true
+        fi
+    fi
+
     # Auto-detect PRD if not provided
     if [ -z "$prd_path" ]; then
         log_step "No PRD provided, searching for existing PRD files..."

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "7.121.3"
+__version__ = "7.121.4"
 
 # Expose the control app for easy import
 try:

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 The flagship product of [Autonomi](https://www.autonomi.dev/). Loki Mode is a spec-driven autonomous builder with a built-in trust layer that takes any spec to a deployed product and verifies completion with evidence (quality gates plus a completion council), not just a "done" claim. Complete installation instructions for all platforms and use cases.
 
-**Version:** v7.121.3
+**Version:** v7.121.4
 
 ---
 
@@ -396,7 +396,7 @@ provider works inside the container. Provide auth with your Anthropic API key:
 # Run Loki Mode in Docker (Claude provider, API-key auth)
 docker run --rm -e ANTHROPIC_API_KEY="$ANTHROPIC_API_KEY" \
   -v $(pwd):/workspace -w /workspace \
-  asklokesh/loki-mode:7.121.3 start ./my-spec.md
+  asklokesh/loki-mode:7.121.4 start ./my-spec.md
 ```
 
 ##### docker compose + .env (no host install)

package/loki-ts/dist/loki.js

@@ -1,5 +1,5 @@
 // @bun
-var q8=Object.defineProperty;var J8=($)=>$;function V8($,Q){this[$]=J8.bind(null,Q)}var b=($,Q)=>{for(var Z in Q)q8($,Z,{get:Q[Z],enumerable:!0,configurable:!0,set:V8.bind(Q,Z)})};var P=($,Q)=>()=>($&&(Q=$($=0)),Q);var J$=import.meta.require;var m1={};b(m1,{lokiDir:()=>j,homeLokiDir:()=>T$,findRepoRootForVersion:()=>$1,REPO_ROOT:()=>h});import{resolve as t,dirname as e$}from"path";import{fileURLToPath as W8}from"url";import{existsSync as N$}from"fs";import{homedir as H8}from"os";function G8(){let $=v1;for(let Q=0;Q<6;Q++){if(N$(t($,"VERSION"))&&N$(t($,"autonomy/run.sh")))return $;let Z=e$($);if(Z===$)break;$=Z}return t(v1,"..","..","..")}function $1($){let Q=$;for(let Z=0;Z<6;Z++){if(N$(t(Q,"VERSION"))&&N$(t(Q,"autonomy/run.sh")))return Q;let z=e$(Q);if(z===Q)break;Q=z}return t($,"..","..","..")}function j(){return process.env.LOKI_DIR??t(process.cwd(),".loki")}function T$(){return t(H8(),".loki")}var v1,h;var C=P(()=>{v1=e$(W8(import.meta.url));h=G8()});import{readFileSync as U8}from"fs";import{resolve as Y8,dirname as B8}from"path";import{fileURLToPath as M8}from"url";function S$(){if(Q$!==null)return Q$;let $="7.121.3";if(typeof $==="string"&&$.length>0)return Q$=$,Q$;try{let Q=B8(M8(import.meta.url)),Z=$1(Q);Q$=U8(Y8(Z,"VERSION"),"utf-8").trim()}catch{Q$="unknown"}return Q$}var Q$=null;var Q1=P(()=>{C()});var p1={};b(p1,{runOrThrow:()=>S8,run:()=>R,readStreamCapped:()=>c1,commandVersion:()=>C8,commandExists:()=>u,ShellError:()=>Z1,MAX_STDOUT_BYTES:()=>u1});async function c1($,Q=u1){let Z=$.getReader(),z=new TextDecoder,X="",q=0;try{while(q<Q){let{done:K,value:W}=await Z.read();if(K)break;if(!W)continue;if(q+=W.byteLength,q>Q){let V=W.byteLength-(q-Q);X+=z.decode(W.subarray(0,V),{stream:!0});break}X+=z.decode(W,{stream:!0})}X+=z.decode()}finally{try{await Z.cancel()}catch{}Z.releaseLock()}return X}async function R($,Q={}){let Z=Bun.spawn({cmd:[...$],stdout:"pipe",stderr:"pipe",env:Q.env?{...process.env,...Q.env}:process.env,cwd:Q.cwd}),z,X;if(Q.timeoutMs&&Q.timeoutMs>0)z=setTimeout(()=>{try{Z.kill("SIGTERM")}catch{}X=setTimeout(()=>{try{Z.kill("SIGKILL")}catch{}},2000)},Q.timeoutMs);try{let[q,K,W]=await Promise.all([c1(Z.stdout),new Response(Z.stderr).text(),Z.exited]);return{stdout:q,stderr:K,exitCode:W}}finally{if(z)clearTimeout(z);if(X)clearTimeout(X)}}async function S8($,Q={}){let Z=await R($,Q);if(Z.exitCode!==0)throw new Z1(`command failed (${Z.exitCode}): ${$.join(" ")}`,Z.exitCode,Z.stdout,Z.stderr);return Z}async function u($){let Q=D8($),Z=await R(["sh","-c",`command -v ${Q}`],{timeoutMs:5000});if(Z.exitCode===0)return Z.stdout.trim()||null;return null}function D8($){if(!/^[A-Za-z0-9._/-]+$/.test($))throw Error(`refused to shell-escape suspect token: ${$}`);return $}async function C8($,Q="--version"){if(!await u($))return null;let z=await R([$,Q],{timeoutMs:5000});if(z.exitCode!==0)return null;return((z.stdout||z.stderr).split(/\r?\n/)[0]?.trim()??"")||null}var u1=16777216,Z1;var o=P(()=>{Z1=class Z1 extends Error{message;exitCode;stdout;stderr;constructor($,Q,Z,z){super($);this.message=$;this.exitCode=Q;this.stdout=Z;this.stderr=z;this.name="ShellError"}}});function r($){return b8?"":$}var b8,M,S,_,tZ,L,k,y,J;var p=P(()=>{b8=(process.env.NO_COLOR??"").length>0;M=r("\x1B[0;31m"),S=r("\x1B[0;32m"),_=r("\x1B[1;33m"),tZ=r("\x1B[0;34m"),L=r("\x1B[0;36m"),k=r("\x1B[1m"),y=r("\x1B[2m"),J=r("\x1B[0m")});import{existsSync as l8}from"fs";async function Z$(){if(A$!==void 0)return A$;let $="/opt/homebrew/bin/python3.12";if(l8($))return A$=$,$;let Q=await u("python3.12");if(Q)return A$=Q,Q;let Z=await u("python3");return A$=Z,Z}async function z$($,Q={}){let Z=await Z$();if(!Z)return{stdout:"",stderr:"python3 not found",exitCode:127};return R([Z,"-c",$],Q)}var A$;var V$=P(()=>{o()});var V0={};b(V0,{runStatus:()=>U3});import{existsSync as v,readFileSync as H$,readdirSync as $0,statSync as Q0}from"fs";import{resolve as D,basename as z3}from"path";import{homedir as X3}from"os";function Z0($){let Q=Math.trunc($);if(Q>=1e6)return`${(Math.trunc(Q/1e6*10)/10).toFixed(1)}M`;if(Q>=1000)return`${(Math.trunc(Q/1000*10)/10).toFixed(1)}K`;return String(Q)}function z0($,Q,Z){if(Q===0)return null;let z=Math.trunc($*100/Q),X=Math.trunc($*C$/Q);if(X>C$)X=C$;let q=C$-X,K=S;if(z>=80)K=M;else if(z>=50)K=_;let W="=".repeat(Math.max(0,X))+" ".repeat(Math.max(0,q)),V=Z0($),H=Z0(Q);return`  ${k}${Z}${J} ${K}[${W}]${J} ${z}% (${V} / ${H})`}async function q3(){if(await u("jq"))return!0;return process.stdout.write(`${M}Error: jq is required but not installed.${J}
+var q8=Object.defineProperty;var J8=($)=>$;function V8($,Q){this[$]=J8.bind(null,Q)}var b=($,Q)=>{for(var Z in Q)q8($,Z,{get:Q[Z],enumerable:!0,configurable:!0,set:V8.bind(Q,Z)})};var P=($,Q)=>()=>($&&(Q=$($=0)),Q);var J$=import.meta.require;var m1={};b(m1,{lokiDir:()=>j,homeLokiDir:()=>T$,findRepoRootForVersion:()=>$1,REPO_ROOT:()=>h});import{resolve as t,dirname as e$}from"path";import{fileURLToPath as W8}from"url";import{existsSync as N$}from"fs";import{homedir as H8}from"os";function G8(){let $=v1;for(let Q=0;Q<6;Q++){if(N$(t($,"VERSION"))&&N$(t($,"autonomy/run.sh")))return $;let Z=e$($);if(Z===$)break;$=Z}return t(v1,"..","..","..")}function $1($){let Q=$;for(let Z=0;Z<6;Z++){if(N$(t(Q,"VERSION"))&&N$(t(Q,"autonomy/run.sh")))return Q;let z=e$(Q);if(z===Q)break;Q=z}return t($,"..","..","..")}function j(){return process.env.LOKI_DIR??t(process.cwd(),".loki")}function T$(){return t(H8(),".loki")}var v1,h;var C=P(()=>{v1=e$(W8(import.meta.url));h=G8()});import{readFileSync as U8}from"fs";import{resolve as Y8,dirname as B8}from"path";import{fileURLToPath as M8}from"url";function S$(){if(Q$!==null)return Q$;let $="7.121.4";if(typeof $==="string"&&$.length>0)return Q$=$,Q$;try{let Q=B8(M8(import.meta.url)),Z=$1(Q);Q$=U8(Y8(Z,"VERSION"),"utf-8").trim()}catch{Q$="unknown"}return Q$}var Q$=null;var Q1=P(()=>{C()});var p1={};b(p1,{runOrThrow:()=>S8,run:()=>R,readStreamCapped:()=>c1,commandVersion:()=>C8,commandExists:()=>u,ShellError:()=>Z1,MAX_STDOUT_BYTES:()=>u1});async function c1($,Q=u1){let Z=$.getReader(),z=new TextDecoder,X="",q=0;try{while(q<Q){let{done:K,value:W}=await Z.read();if(K)break;if(!W)continue;if(q+=W.byteLength,q>Q){let V=W.byteLength-(q-Q);X+=z.decode(W.subarray(0,V),{stream:!0});break}X+=z.decode(W,{stream:!0})}X+=z.decode()}finally{try{await Z.cancel()}catch{}Z.releaseLock()}return X}async function R($,Q={}){let Z=Bun.spawn({cmd:[...$],stdout:"pipe",stderr:"pipe",env:Q.env?{...process.env,...Q.env}:process.env,cwd:Q.cwd}),z,X;if(Q.timeoutMs&&Q.timeoutMs>0)z=setTimeout(()=>{try{Z.kill("SIGTERM")}catch{}X=setTimeout(()=>{try{Z.kill("SIGKILL")}catch{}},2000)},Q.timeoutMs);try{let[q,K,W]=await Promise.all([c1(Z.stdout),new Response(Z.stderr).text(),Z.exited]);return{stdout:q,stderr:K,exitCode:W}}finally{if(z)clearTimeout(z);if(X)clearTimeout(X)}}async function S8($,Q={}){let Z=await R($,Q);if(Z.exitCode!==0)throw new Z1(`command failed (${Z.exitCode}): ${$.join(" ")}`,Z.exitCode,Z.stdout,Z.stderr);return Z}async function u($){let Q=D8($),Z=await R(["sh","-c",`command -v ${Q}`],{timeoutMs:5000});if(Z.exitCode===0)return Z.stdout.trim()||null;return null}function D8($){if(!/^[A-Za-z0-9._/-]+$/.test($))throw Error(`refused to shell-escape suspect token: ${$}`);return $}async function C8($,Q="--version"){if(!await u($))return null;let z=await R([$,Q],{timeoutMs:5000});if(z.exitCode!==0)return null;return((z.stdout||z.stderr).split(/\r?\n/)[0]?.trim()??"")||null}var u1=16777216,Z1;var o=P(()=>{Z1=class Z1 extends Error{message;exitCode;stdout;stderr;constructor($,Q,Z,z){super($);this.message=$;this.exitCode=Q;this.stdout=Z;this.stderr=z;this.name="ShellError"}}});function r($){return b8?"":$}var b8,M,S,_,tZ,L,k,y,J;var p=P(()=>{b8=(process.env.NO_COLOR??"").length>0;M=r("\x1B[0;31m"),S=r("\x1B[0;32m"),_=r("\x1B[1;33m"),tZ=r("\x1B[0;34m"),L=r("\x1B[0;36m"),k=r("\x1B[1m"),y=r("\x1B[2m"),J=r("\x1B[0m")});import{existsSync as l8}from"fs";async function Z$(){if(A$!==void 0)return A$;let $="/opt/homebrew/bin/python3.12";if(l8($))return A$=$,$;let Q=await u("python3.12");if(Q)return A$=Q,Q;let Z=await u("python3");return A$=Z,Z}async function z$($,Q={}){let Z=await Z$();if(!Z)return{stdout:"",stderr:"python3 not found",exitCode:127};return R([Z,"-c",$],Q)}var A$;var V$=P(()=>{o()});var V0={};b(V0,{runStatus:()=>U3});import{existsSync as v,readFileSync as H$,readdirSync as $0,statSync as Q0}from"fs";import{resolve as D,basename as z3}from"path";import{homedir as X3}from"os";function Z0($){let Q=Math.trunc($);if(Q>=1e6)return`${(Math.trunc(Q/1e6*10)/10).toFixed(1)}M`;if(Q>=1000)return`${(Math.trunc(Q/1000*10)/10).toFixed(1)}K`;return String(Q)}function z0($,Q,Z){if(Q===0)return null;let z=Math.trunc($*100/Q),X=Math.trunc($*C$/Q);if(X>C$)X=C$;let q=C$-X,K=S;if(z>=80)K=M;else if(z>=50)K=_;let W="=".repeat(Math.max(0,X))+" ".repeat(Math.max(0,q)),V=Z0($),H=Z0(Q);return`  ${k}${Z}${J} ${K}[${W}]${J} ${z}% (${V} / ${H})`}async function q3(){if(await u("jq"))return!0;return process.stdout.write(`${M}Error: jq is required but not installed.${J}
 `),process.stdout.write(`Install with:
 `),process.stdout.write(`  brew install jq    (macOS)
 `),process.stdout.write(`  apt install jq     (Debian/Ubuntu)
@@ -814,4 +814,4 @@ Set LOKI_LEGACY_BASH=1 to force the bash CLI for every command.
 `),2}default:return process.stderr.write(`Unknown command: ${Q}
 `),process.stderr.write(K8),2}}e1();process.on("SIGINT",()=>process.exit(130));process.on("SIGTERM",()=>process.exit(143));var SZ=await NZ(Bun.argv.slice(2));process.exit(SZ);
 
-//# debugId=B98C998AFA90A20E64756E2164756E21
+//# debugId=8F986B79CB65C96964756E2164756E21

package/mcp/__init__.py

@@ -57,4 +57,4 @@ try:
 except ImportError:
     __all__ = ['mcp']
 
-__version__ = '7.121.3'
+__version__ = '7.121.4'

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "loki-mode",
   "mcpName": "io.github.asklokesh/loki-mode",
-  "version": "7.121.3",
+  "version": "7.121.4",
   "description": "Loki Mode by Autonomi. Autonomous spec-to-product system: takes a PRD, GitHub issue, OpenAPI/JSON/YAML, or one-line brief to a deployed app via the RARV-C closure loop with 8 quality gates. Provider-agnostic (Claude Code, OpenAI Codex, Cline, Aider).",
   "keywords": [
     "agent",

package/plugins/loki-mode/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "loki-mode",
   "displayName": "Loki Mode",
-  "version": "7.121.3",
+  "version": "7.121.4",
   "description": "Autonomous spec-to-product build system with a built-in trust layer (RARV-C closure loop, 8 quality gates, completion council). Ships Loki's spec-hardening, drift-detection, and deterministic PR verification commands plus the Loki MCP server.",
   "author": {
     "name": "Autonomi",