loki-mode 7.129.4 → 8.0.0

package/autonomy/sandbox.sh

@@ -671,10 +671,48 @@ cleanup_worktrees() {
 #===============================================================================
 # Docker Desktop Sandbox (microVM-based isolation via Docker Desktop 4.58+)
 #===============================================================================
+#
+# v8.1 DEPRECATION SPLIT (binary-hosting is legacy; isolation is NOT):
+# This path creates a microVM from Docker Desktop's "claude" sandbox TEMPLATE,
+# which bakes the `claude` CLI binary into the VM so the agent can run inside it.
+# With v8's SDK route, the judge/text sites (and, under LOKI_SDK_MODE, the whole
+# engine) run pure-HTTPS with only ANTHROPIC_API_KEY -- NO in-VM `claude` binary
+# is needed. So the *binary-hosting* purpose of this template is obsolete.
+#
+# What is NOT obsolete, and matters MORE with an in-process SDK: isolating
+# untrusted CODE EXECUTION (npm install / build / test / the generated app).
+# In-process SDK judging runs at HOST privilege, so wrapping the code-exec in a
+# container/VM is still the right posture. The forward path is the existing
+# `start_sandbox` container/worktree isolation (the automatic fallback at the
+# `docker sandbox create` failure below); a future release ships a lightweight
+# `bun + SDK` sandbox image with no bundled agent binary.
+#
+# This release: annotation + a one-shot deprecation notice on selection only. No
+# behavior change, no removal. See tests/test-sandbox-deprecation.sh.
 
 # Desktop sandbox name follows same pattern as container name
 DESKTOP_SANDBOX_NAME="$CONTAINER_NAME"
 
+# Emit a one-shot deprecation notice for the microVM binary-hosting path. Names
+# the binary-hosting only and states explicitly that ISOLATION is retained (so it
+# is never misread as "the sandbox is going away"). Best-effort + non-blocking:
+# telemetry must never abort a sandbox start. Mirrors the cli_command_deprecated
+# pattern (event type/source/action + a human log line). Opt out with
+# LOKI_SANDBOX_DEPRECATION_QUIET=1.
+_desktop_deprecation_notice() {
+    [ "${LOKI_SANDBOX_DEPRECATION_QUIET:-0}" = "1" ] && return 0
+    log_warn "DEPRECATED: the Docker Desktop microVM 'claude' template hosts the"
+    log_warn "  claude BINARY in-VM, which the v8 SDK route no longer needs."
+    log_warn "  Code-execution ISOLATION is RETAINED via the container/worktree"
+    log_warn "  sandbox (unchanged); only the binary-hosting template is legacy."
+    # Best-effort telemetry (never abort the start on a telemetry miss).
+    if [ -f "$SKILL_DIR/events/emit.sh" ]; then
+        bash "$SKILL_DIR/events/emit.sh" sandbox cli sandbox_microvm_binary_deprecated \
+            isolation_retained=true path=docker-desktop >/dev/null 2>&1 || true
+    fi
+    return 0
+}
+
 # Install provider CLI inside sandbox if not pre-installed
 _desktop_install_provider_cli() {
     local sandbox_name="$1" provider="$2"
@@ -770,6 +808,10 @@ start_docker_desktop_sandbox() {
     validate_project_dir || return 1
     warn_missing_api_keys "$provider"
 
+    # v8.1: one-shot deprecation notice for the microVM binary-hosting path
+    # (isolation is retained; only the bundled-binary template is legacy).
+    _desktop_deprecation_notice
+
     # Check if sandbox already exists
     local sandbox_exists=false
     if docker sandbox ls 2>/dev/null | grep -q "$DESKTOP_SANDBOX_NAME"; then

package/autonomy/spec-interrogation.sh

@@ -142,16 +142,94 @@ spec_interrogation_class_for() {
     lc_section="$(printf '%s' "$section" | tr '[:upper:]' '[:lower:]')"
     lc_line="$(printf '%s' "$line" | tr '[:upper:]' '[:lower:]')"
 
+    # AUTHORITATIVE SECTION GUARD (first): the grill CATEGORIZES each finding into
+    # a section, and that categorization is the strongest signal of the finding's
+    # KIND. A finding the grill itself filed under an explicitly non-contradiction
+    # section -- Ambiguities, (Unstated) Assumptions, Open questions, Blind spots,
+    # Missing/gaps -- is that KIND, even if its prose happens to use the word
+    # "contradict"/"conflict" while POSING the ambiguity ("two implementations
+    # could show contradictory trends", "a dev-only build contradicts opening
+    # index.html"). Those are assumable-away ambiguities, not spec-internal
+    # "X and not-X". Classify by the grill's own section here so a stray keyword
+    # in the finding prose can never escalate an ambiguity to a no-retry-terminal
+    # contradiction. Opt out with LOKI_SPEC_SECTION_KIND_GUARD=0.
+    if [ "${LOKI_SPEC_SECTION_KIND_GUARD:-1}" = "1" ]; then
+        case "$lc_section" in
+            *ambigu*|*acceptance*)            printf 'ambiguous'; return 0 ;;
+            *unstated\ assumption*|*assumption*) printf 'underspecified'; return 0 ;;
+            *open\ question*)                 printf 'ambiguous'; return 0 ;;
+            *blind\ spot*|*security*|*scale*|*reliability*) printf 'missing'; return 0 ;;
+        esac
+    fi
+
+    # A contradiction keyword classifies the finding as contradictory ONLY when
+    # the finding ASSERTS a contradiction ("section 2 says X, section 5 says
+    # not-X"), NOT when it merely QUESTIONS a hypothetical one ("what stops the
+    # KPIs from contradicting the chart?", "these could conflict"). A grill that
+    # ASKS about a possible inconsistency is raising an AMBIGUITY (assumable-away
+    # with a default: "make them consistent"), not reporting an unresolvable
+    # spec-internal "X and not-X". Naive substring matching force-tagged such
+    # questions as no-retry-terminal contradictions and killed valid specs.
+    # Interrogative / hypothetical / risk framings demote the keyword to a normal
+    # (assumable) finding; the section-based classification below then applies.
+    # Opt back into the old broad substring match with
+    # LOKI_SPEC_CONTRADICTION_KEYWORD_STRICT=0.
     case "$lc_line" in
-        *contradict*|*conflict*|*inconsistent*|*mutually\ exclusive*)
-            printf 'contradictory'; return 0 ;;
+        *contradict*|*conflict*|*inconsistent*|*incompatible*|*mutually\ exclusive*)
+            if [ "${LOKI_SPEC_CONTRADICTION_KEYWORD_STRICT:-1}" = "1" ]; then
+                case "$lc_line" in
+                    # Interrogative or hypothetical -> ambiguity, not a contradiction.
+                    what\ stops*|what\ if*|what\ prevents*|how\ do\ we\ ensure*|\
+                    *could\ contradict*|*could\ conflict*|*might\ contradict*|*might\ conflict*|\
+                    *may\ contradict*|*may\ conflict*|*risk\ of\ *|*potential*|\
+                    *would\ contradict*|*if\ they\ contradict*|*from\ contradicting*|\
+                    *stops\ them\ from*|*prevents\ them\ from*|*avoid*|\
+                    *unclear\ whether*|*not\ specified*|*no\ guarantee*|*to\ ensure*)
+                        : ;;  # demote: fall through to section-based classification
+                    *)
+                        printf 'contradictory'; return 0 ;;
+                esac
+            else
+                printf 'contradictory'; return 0
+            fi
+            ;;
     esac
 
-    # P2-4: a "Contradictions" SECTION tags its findings contradictory even when
-    # the line carries no contradiction keyword (see severity_for for rationale).
+    # P2-4 REFINED (false-positive fix): the grill's report sections are free-form
+    # LLM text. A finding under a PURE contradictions heading ("Contradictions",
+    # "Contradictory requirements") is the grill's authoritative "X and not-X"
+    # categorization -- trust it, even when the conflict is stated SEMANTICALLY with
+    # no magic word ("immutable records" vs "an edit endpoint"). Recording a
+    # contradiction is non-fatal by default now (LOKI_SPEC_CONTRADICTION_FASTFAIL=0
+    # in run.sh proceeds with the finding; the completion gate still blocks
+    # fake-green), so trusting a clean heading costs a recorded finding, not a
+    # terminal kill.
+    # The false positives lived in MIXED headings that lump unlike findings
+    # ("Contradictions and ambiguities", "Contradictions / open questions") -- there
+    # a bare ambiguity (assumable away with an implementer default) was mislabeled a
+    # contradiction. For a mixed heading we still require corroborating conflict
+    # language in the line itself. The line-level check above already catches
+    # genuinely-worded contradictions regardless of section.
+    # LOKI_SPEC_SECTION_CONTRADICTION_FORCE=1 forces the old broad behavior (any
+    # contradiction-ish heading -> contradictory).
     case "$lc_section" in
         *contradiction*|*contradictor*)
-            printf 'contradictory'; return 0 ;;
+            # Mixed heading: co-mentions ambiguity/question/assumption/gap words ->
+            # the finding could be either kind, so demand line evidence.
+            local _mixed=0
+            case "$lc_section" in
+                *ambigu*|*question*|*assumption*|*gap*|*missing*|*unclear*|*open*|*blind*)
+                    _mixed=1 ;;
+            esac
+            if [ "${LOKI_SPEC_SECTION_CONTRADICTION_FORCE:-0}" = "1" ] || [ "$_mixed" = "0" ]; then
+                printf 'contradictory'; return 0
+            fi
+            # mixed heading: require corroborating conflict language in the line
+            case "$lc_line" in
+                *contradict*|*conflict*|*inconsistent*|*incompatible*|*cannot\ both*|*mutually\ exclusive*|*versus*|*but\ also*)
+                    printf 'contradictory'; return 0 ;;
+            esac
+            ;;
     esac
 
     case "$lc_section" in
@@ -823,6 +901,71 @@ for t in titles:
 }
 
 # Total ledger entries + high count, "total high" on one line. For summaries.
+# ---------------------------------------------------------------------------
+# spec_contradiction_confident: confirm a contradiction verdict is NOT a flaky
+# single-LLM-sample false positive before it is allowed to trip a no-retry
+# terminal exit.
+#
+# WHY: the contradiction verdict comes from ONE Devil's-Advocate grill sample
+# (grill_main is invoked once per run). An LLM judge is non-deterministic, so the
+# SAME spec is judged "contradictory" only some fraction of runs -- measured
+# ~1/3 in the v8 benchmark. Escalating that lone sample straight to exit 20
+# ("terminal failure, no retry", whose own contract asserts "re-running on the
+# same inputs fails the same way") is unsound: re-running an LLM judge does NOT
+# fail the same way. This helper turns a single sample into an N-of-M agreement:
+# it re-grills up to (MIN_SAMPLES - 1) more times and returns confident (0) only
+# if the contradiction PERSISTS across the required number of independent
+# samples. A verdict that does not reproduce is treated as flaky -> not
+# confident (non-zero) -> the caller must NOT terminal-exit; it falls through to
+# the in-loop resolve-with-default recovery (spec_ledger_acknowledge_all).
+#
+# This is a general "confirm before an irreversible terminal action on a
+# non-deterministic verdict" pattern, not a fix for any one spec. It is a no-op
+# (returns confident immediately) when MIN_SAMPLES<=1 (LOKI_SPEC_CONTRADICTION_MIN_SAMPLES=1
+# restores the pre-fix single-sample behavior), or when re-grilling is impossible
+# (no provider / grill unavailable) -- in that degraded case we KEEP the original
+# single-sample verdict rather than silently clearing it (fail-closed on the
+# original signal, never fabricate a clear).
+#
+# Usage: spec_contradiction_confident <spec_path>
+#   exit 0  -> contradiction confirmed across samples (safe to terminal-fail)
+#   exit 1  -> not confirmed / flaky (caller must recover-before-fail, not exit 20)
+# ---------------------------------------------------------------------------
+spec_contradiction_confident() {
+    local spec_path="${1:-}"
+    local min_samples="${LOKI_SPEC_CONTRADICTION_MIN_SAMPLES:-2}"
+    case "$min_samples" in ''|*[!0-9]*) min_samples=2 ;; esac
+
+    # MIN_SAMPLES<=1: legacy single-sample behavior -> the current (already >=1)
+    # verdict is authoritative. Confident.
+    [ "$min_samples" -le 1 ] && return 0
+
+    # Re-grill up to (min_samples - 1) additional times; every re-sample must ALSO
+    # report >=1 unresolved contradiction for the verdict to be confident.
+    # We already hold sample #1 (the caller only invokes us when count>=1).
+    local needed=$(( min_samples - 1 ))
+    local i
+    for (( i = 1; i <= needed; i++ )); do
+        # A fresh grill sample. spec_interrogation_run re-runs grill_main and
+        # re-classifies into the ledger. If re-grilling is not possible (no
+        # provider), the count will not change and we must not clear a real
+        # signal -- so treat an unchanged/failed re-sample as still-present
+        # (fail-closed on the original verdict).
+        if type spec_interrogation_run &>/dev/null; then
+            spec_interrogation_run "$spec_path" >/dev/null 2>&1 || true
+        fi
+        local _n
+        _n="$(spec_ledger_contradiction_unresolved_count 2>/dev/null | head -1)"
+        case "$_n" in ''|*[!0-9]*) _n=0 ;; esac
+        if [ "$_n" -lt 1 ]; then
+            # This independent sample does NOT see the contradiction -> flaky.
+            return 1
+        fi
+    done
+    # Persisted across all required samples -> confident it is a real contradiction.
+    return 0
+}
+
 spec_ledger_counts() {
     local dir
     dir="$(_spec_ledger_dir)"

package/autonomy/spec.sh

@@ -91,7 +91,13 @@ spec_resolve_source() {
         ".loki/generated-prd.md" \
         "prd.md" \
         "PRD.md" \
-        "docs/prd.md"; do
+        "docs/prd.md" \
+        "openapi.yaml" \
+        "openapi.yml" \
+        "openapi.json" \
+        "api/openapi.yaml" \
+        "api/openapi.json" \
+        "schema.graphql"; do
         if [ -f "$candidate" ]; then
             printf '%s\n' "$candidate"
             return 0
@@ -121,6 +127,117 @@ except OSError as exc:
 
 lines = raw.splitlines()
 
+# ---------------------------------------------------------------------------
+# Contract fast path (RUN-25 iter 25): when the spec IS an OpenAPI / GraphQL /
+# Postman contract, lock one requirement PER OPERATION with a per-operation
+# content hash, so `spec status` reports the exact operation id that DRIFTED
+# (a response schema edit on /users flags "users.get", not the whole file).
+# Falls through to the markdown heading/checklist logic below on anything else,
+# byte-identical to the prior behavior for a normal PRD.
+# ---------------------------------------------------------------------------
+def _contract_requirements(text):
+    def load_structured(t):
+        try:
+            return json.loads(t)
+        except Exception:
+            pass
+        try:
+            import yaml
+            return yaml.safe_load(t)
+        except Exception:
+            return None
+
+    def op_hash(payload):
+        # Stable hash of the operation's own definition (order-insensitive for
+        # dict payloads via sort_keys), so a change to THIS op flips only its id.
+        try:
+            blob = json.dumps(payload, sort_keys=True, ensure_ascii=False)
+        except Exception:
+            blob = repr(payload)
+        return hashlib.sha256(blob.encode("utf-8")).hexdigest()
+
+    data = load_structured(text)
+    ops = []
+
+    # OpenAPI / Swagger
+    if isinstance(data, dict) and ("openapi" in data or "swagger" in data) and isinstance(data.get("paths"), dict):
+        for p, item in data["paths"].items():
+            if not isinstance(item, dict):
+                continue
+            for method, op in item.items():
+                if method.lower() not in ("get", "post", "put", "patch", "delete", "head", "options", "trace"):
+                    continue
+                if not isinstance(op, dict):
+                    continue
+                opid = op.get("operationId") or ("%s %s" % (method.upper(), p))
+                ops.append((str(opid).strip(), "operation", op_hash(op)))
+        return ops
+
+    # Postman collection
+    if isinstance(data, dict) and isinstance(data.get("info"), dict) and "item" in data:
+        def walk(items, prefix=""):
+            for it in items or []:
+                if not isinstance(it, dict):
+                    continue
+                name = it.get("name", "request")
+                if isinstance(it.get("item"), list):
+                    walk(it["item"], prefix + name + " / ")
+                elif "request" in it:
+                    label = (prefix + name).strip()
+                    ops.append((label, "request", op_hash(it.get("request"))))
+        walk(data.get("item"))
+        return ops
+
+    # GraphQL SDL (text)
+    if re.search(r"\btype\s+(Query|Mutation|Subscription)\b", text):
+        for root in ("Query", "Mutation", "Subscription"):
+            m = re.search(r"\btype\s+" + root + r"\b[^{]*\{", text)
+            if not m:
+                continue
+            i = m.end()
+            depth = 1
+            body_start = i
+            while i < len(text) and depth > 0:
+                if text[i] == "{":
+                    depth += 1
+                elif text[i] == "}":
+                    depth -= 1
+                i += 1
+            body = text[body_start:i - 1]
+            for fm in re.finditer(r"^\s*([A-Za-z_]\w*)\s*(\([^)]*\))?\s*:\s*([^\n#]+)", body, re.M):
+                field = fm.group(1)
+                sig = fm.group(0).strip()
+                ops.append(("%s.%s" % (root, field), "field", hashlib.sha256(sig.encode("utf-8")).hexdigest()))
+        return ops
+
+    return []
+
+
+_contract_ops = _contract_requirements(raw)
+if _contract_ops:
+    _out = []
+    _seen = {}
+    for _name, _kind, _h in _contract_ops:
+        base = _name.strip().lower() or "op"
+        base = re.sub(r"\s+", " ", base)
+        if base in _seen:
+            _seen[base] += 1
+            rid = "%s#%d" % (base, _seen[base])
+        else:
+            _seen[base] = 0
+            rid = base
+        _out.append({
+            "id": rid,
+            "kind": _kind,
+            "level": 100,
+            "text": _name,
+            "line": 0,
+            "content_hash": _h,
+        })
+    json.dump({"requirements": _out}, sys.stdout, indent=2)
+    sys.stdout.write("\n")
+    sys.exit(0)
+
 heading_re = re.compile(r'^(#{1,6})\s+(.*\S)\s*$')
 # Checklist item: optional leading whitespace, a bullet, then [ ] / [x] / [X].
 checklist_re = re.compile(r'^\s*[-*]\s+\[([ xX])\]\s+(.*\S)\s*$')

package/autonomy/telemetry.sh

@@ -146,6 +146,47 @@ _loki_detect_channel() {
     esac
 }
 
+# _loki_known_command <token>: FIXED ALLOWLIST at the telemetry boundary. Prints
+# the token verbatim when it is a real loki subcommand, else the literal "other".
+#
+# WHY THIS EXISTS. Every command-shaped telemetry value is the user's raw first
+# CLI token, and loki_telemetry's payload builder is a PASS-THROUGH dict, not an
+# allowlist. So the honest typo of dropping the subcommand off this project's own
+# documented quickstart --
+#     loki ./client-acme-merger-prd.md
+# -- put a user-authored file name on the wire verbatim. Spec file names routinely
+# carry client and codename. Sanitizing at this boundary bounds the value space to
+# a fixed, public vocabulary by construction, so no path, flag value, or spec name
+# can reach PostHog through a command field regardless of what the user typed.
+#
+# The arms below mirror autonomy/loki's own `case "$command" in` dispatch (whose
+# final `*)` arm is literally this same unknown bucket), UNIONed with the
+# bin/loki Bun-route arm (`internal` is Bun-only) and the `report` pre-route.
+# A token missing from this list degrades to "other": lossy, never leaky, so a
+# stale list after a new subcommand lands is safe by construction.
+_loki_known_command() {
+    case "${1:-}" in
+        --help|--version|-h|-v|agent|analyze|api|assets\
+        |audit|bench|checkpoint|ci|cleanup|cluster|cockpit|code\
+        |completions|compliance|compound|config|context|cost|council|cp\
+        |crash|ctx|dashboard|demo|deploy|docker|docs|doctor\
+        |dogfood|enterprise|explain|export|failover|github|grill|handoff\
+        |heal|help|import|init|internal|issue|kpis|logs\
+        |magic|mcp|memory|metrics|migrate|modernize|monitor|next\
+        |notify|onboard|open|optimize|otel|own|pause|plan\
+        |preview|projects|proof|provider|quick|quickstart|rc|receipt\
+        |remote|report|reset|resume|review|rollback|run|sandbox\
+        |secrets|secure|self-update|self_update|sentrux|serve|setup-skill|share\
+        |ship|spec|start|state|stats|status|steer|stop\
+        |syslog|telemetry|template|test|tour|trigger|trust|trust-metrics\
+        |ultracode|update|verify|version|voice|watch|watchdog|web\
+        |welcome|why|wiki|worktree|wt)
+            printf '%s' "$1" ;;
+        *)
+            printf 'other' ;;
+    esac
+}
+
 loki_telemetry() {
     _loki_telemetry_enabled || return 0
     local event="$1"; shift
@@ -160,12 +201,16 @@ loki_telemetry() {
     os_name=$(uname -s 2>/dev/null || echo "unknown")
     arch=$(uname -m 2>/dev/null || echo "unknown")
 
-    # Build JSON payload safely using Python to prevent injection
-    local extra_args=""
-    for arg in "$@"; do
-        extra_args="${extra_args}${extra_args:+ }${arg}"
-    done
-
+    # Build JSON payload safely using Python to prevent injection.
+    # The extra key=value pairs are forwarded as "$@" -- one argv slot per pair,
+    # QUOTED. They used to be joined into a single space-delimited string and
+    # then re-split by an unquoted expansion, which broke two ways: a value
+    # containing a space was truncated (`prd=my file.md` -> `prd=my`, rest
+    # dropped) or, if a fragment itself contained `=`, forged an extra PostHog
+    # property KEY; and the unquoted expansion also globbed, so `spec=*.md`
+    # expanded against the cwd and injected file names into the payload. Callers
+    # already pass each pair as its own quoted word, so "$@" is the array and no
+    # caller signature changes.
     local payload
     payload=$(python3 -c "
 import json, sys
@@ -175,7 +220,7 @@ for arg in sys.argv[5:]:
         k, v = arg.split('=', 1)
         props[k] = v
 print(json.dumps({'api_key': '$LOKI_POSTHOG_KEY', 'event': sys.argv[5] if len(sys.argv) > 5 else '', 'distinct_id': '$distinct_id', 'properties': props}))
-" "$os_name" "$arch" "$version" "$channel" $extra_args 2>/dev/null) || return 0
+" "$os_name" "$arch" "$version" "$channel" "$@" 2>/dev/null) || return 0
     # Re-inject event and distinct_id properly
     payload=$(python3 -c "
 import json, sys
@@ -190,3 +235,84 @@ print(json.dumps(d))
         -d "$payload" >/dev/null 2>&1 &) 2>/dev/null
     return 0
 }
+
+# _loki_analytics_enabled: STRICTER, second-layer gate for opt-in build-outcome
+# analytics. Sits BELOW the telemetry gate: build_verified fires ONLY when
+#   1. telemetry is enabled at all (_loki_telemetry_enabled -- so every opt-out
+#      that kills telemetry also kills analytics), AND
+#   2. the user EXPLICITLY turned analytics on (LOKI_ANALYTICS/LOKI_POSTHOG=on or
+#      ~/.loki/config: ANALYTICS_ENABLED=true).
+# Default OFF even for diagnostics-on users: anonymous crash diagnostics are one
+# thing, per-build outcome metrics are a separate, explicit consent. Zero-egress-
+# by-default is a moat, so this stays strictly opt-in. Only already-computed proof
+# scalars are ever sent (see _loki_proof_analytics_props) -- never code, spec text,
+# paths, or file names.
+_loki_analytics_enabled() {
+    _loki_telemetry_enabled || return 1
+    local _lower
+    _lower="$(printf '%s' "${LOKI_ANALYTICS:-${LOKI_POSTHOG:-}}" | tr '[:upper:]' '[:lower:]')"
+    [ "$_lower" = "on" ] && return 0
+    [ "$_lower" = "1" ] && return 0
+    if [ -f "${HOME}/.loki/config" ] && grep -q "^ANALYTICS_ENABLED=true" "${HOME}/.loki/config" 2>/dev/null; then
+        return 0
+    fi
+    return 1
+}
+
+# loki_emit_funnel_once <marker-name> <event> [key=value...]: fire ONE
+# first-run-funnel event, at most once per machine, under the SAME strict double
+# gate as build_verified (telemetry enabled AND analytics explicitly opted in --
+# default OFF even for diagnostics-on users). No new consent knob, no new
+# endpoint: it reuses loki_telemetry, so every existing opt-out kills it too.
+#
+# ORDERING IS LOAD-BEARING. Disclosure runs before the emit, and the marker is
+# written only AFTER the gate has passed and we have actually emitted. The
+# reverted attempt burned its marker unconditionally, which meant a first run
+# under CI/auto-off consumed the one-shot and permanently silenced the event for
+# that user. Mirrors _loki_disclose_telemetry_once: act, then mark.
+#
+# Values must already be bounded (see _loki_known_command). Best-effort: every
+# step returns 0, nothing blocks, nothing throws.
+loki_emit_funnel_once() {
+    local _marker_name="$1"; shift
+    local _event="$1"; shift
+    _loki_analytics_enabled || return 0
+    local _mfile="${HOME}/.loki/funnel-${_marker_name}"
+    [ -f "$_mfile" ] 2>/dev/null && return 0
+    if declare -f _loki_disclose_telemetry_once >/dev/null 2>&1; then
+        _loki_disclose_telemetry_once
+    fi
+    loki_telemetry "$_event" "$@" 2>/dev/null || true
+    mkdir -p "${HOME}/.loki" 2>/dev/null || return 0
+    : > "$_mfile" 2>/dev/null || true
+    return 0
+}
+
+# loki_emit_build_verified <proof.json path>: fire ONE build_verified event
+# carrying a FIXED ALLOWLIST of already-computed scalars from a finished
+# proof.json. Trust-core untouched -- reads the receipt after it is written,
+# never influences the verdict. Fires only under the strict analytics gate.
+# The allowlist is enforced in Python (below); anything not named is never read,
+# so a schema change cannot silently start leaking a new field. Free-text-shaped
+# fields are excluded on purpose: headline is a bounded enum (VERIFIED / VERIFIED
+# WITH GAPS / NOT VERIFIED), never spec/project text; files_changed is a COUNT,
+# never paths.
+loki_emit_build_verified() {
+    _loki_analytics_enabled || return 0
+    local _proof="$1"
+    [ -f "$_proof" ] || return 0
+    command -v python3 >/dev/null 2>&1 || return 0
+    local _reader="${SCRIPT_DIR:-${SKILL_DIR:-}}/lib/proof-analytics-props.py"
+    [ -f "$_reader" ] || return 0
+    local _props
+    _props=$(python3 "$_reader" "$_proof" 2>/dev/null) || return 0
+    [ -n "$_props" ] || return 0
+    # Feed the allowlisted key=value pairs into loki_telemetry (which re-checks
+    # the base gate and owns the injection-safe payload build).
+    local _args=()
+    while IFS= read -r _line; do
+        [ -n "$_line" ] && _args+=("$_line")
+    done <<< "$_props"
+    loki_telemetry "build_verified" "${_args[@]}"
+    return 0
+}

package/autonomy/verify.sh

@@ -726,6 +726,91 @@ verify_gate_static() {
     return 0
 }
 
+# ---------------------------------------------------------------------------
+# Gate: NO-MOCK data render (Proof-of-Function, static half).
+#
+# WHAT IS SCANNED:
+#   The changed-file union identifies the trust boundary. The shared scanner may
+#   follow a named relative import into an unchanged source module, but it only
+#   blocks when either the render module or backing declaration changed. A
+#   rendered operational collection backed by an inline mock array, faker, or
+#   placeholder literal is the disproof: a fake app that only looks done.
+#
+# ARTIFACT:
+#   Writes .loki/verification/nomock-scan.json as an audit receipt. Completion
+#   never trusts this mutable file and independently reruns the engine-owned
+#   scanner over current source. On a hit, verify also emits a High finding so
+#   `loki verify` blocks. This is an observation of shipped source, not a guess.
+#
+# FAIL-CLOSED / FALSE-POSITIVE TUNING:
+#   Binds the rendered symbol to its declaration and exempts static content such
+#   as features, pricing, comparisons, and stories. Excludes test, story, mock,
+#   fixture, MSW, generated, and declaration paths. High-confidence only;
+#   anything else passes or skips to avoid blocking design-system demos, empty
+#   states, or seed files.
+# ---------------------------------------------------------------------------
+verify_gate_nomock() {
+    local tree="$1"
+    local changed="$VERIFY_DIFF_NAMES"
+    local PYTHONPATH="" PYTHONNOUSERSITE=1
+    export PYTHONPATH PYTHONNOUSERSITE
+
+    if [ "${LOKI_PROOF_NOMOCK:-1}" = "0" ]; then
+        _verify_add_gate "nomock" "skipped" "" "nomock gate disabled (LOKI_PROOF_NOMOCK=0)" "true"
+        return 0
+    fi
+    if [ -z "$changed" ]; then
+        _verify_add_gate "nomock" "skipped" "" "no changed files in diff" "true"
+        return 0
+    fi
+    if ! command -v python3 >/dev/null 2>&1; then
+        _verify_add_gate "nomock" "inconclusive" "" "python3 unavailable" "true"
+        return 0
+    fi
+
+    local scan_dir=".loki/verification"
+    mkdir -p "$scan_dir" 2>/dev/null || true
+    local scan_file="$scan_dir/nomock-scan.json"
+
+    # The scan runs in $tree over the changed files, writes the receipt JSON, and
+    # prints its status line (FAIL:<file>:<line>:<snippet> | PASS:<n> | SKIP:0).
+    local scanner
+    scanner="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/lib/no_mock_scan.py"
+    if [ ! -f "$scanner" ]; then
+        _verify_add_gate "nomock" "inconclusive" "" "no-mock scanner unavailable" "true"
+        return 0
+    fi
+    local status_line
+    status_line=$(
+        _NM_FILES="$changed" \
+        _NM_TREE="$tree" \
+        _NM_OUT="$scan_file" \
+        _NM_BASE="${VERIFY_MERGE_BASE:-}" \
+        python3 -I "$scanner" 2>/dev/null \
+            || echo "INCONCLUSIVE:detector_error"
+    )
+
+    case "$status_line" in
+        FAIL:*)
+            local rest="${status_line#FAIL:}"
+            local hit_file="${rest%%:*}"
+            _verify_add_gate "nomock" "fail" "static-scan" "rendered operational collection resolves to inline, faker, or placeholder-backed data: $rest" "true"
+            _verify_add_finding "High" "functionality" "deterministic:nomock-scan" "$hit_file" "null" \
+                "Mock-backed data render: a list, table, or dashboard in $hit_file resolves to an inline mock array, faker value, or placeholder literal. Wire the rendered collection to a real data source. ($rest)"
+            ;;
+        PASS:*)
+            _verify_add_gate "nomock" "pass" "static-scan" "${status_line#PASS:} UI module(s) scanned, no high-confidence rendered operational mock detected" "true"
+            ;;
+        SKIP:*)
+            _verify_add_gate "nomock" "skipped" "" "no scannable UI/data-render files in diff" "true"
+            ;;
+        *)
+            _verify_add_gate "nomock" "inconclusive" "" "scanner error" "true"
+            ;;
+    esac
+    return 0
+}
+
 # ---------------------------------------------------------------------------
 # Gate: secret scan (NET-NEW).
 #
@@ -780,6 +865,27 @@ verify_gate_static() {
 verify_secret_scan_file() {
     local file="$1"
 
+    # TEMPLATE / FIXTURE / TEST PATHS: a file whose name declares it is an
+    # example, or that exists to TEST the secret scanner, is not a leak.
+    # Kept byte-identical in intent to the same guard in
+    # autonomy/lib/secret-scan.sh, because these two matchers are duplicates and
+    # a fix applied to only one of them is a fix that does not hold.
+    #
+    # Concretely: tests/test-secret-gate-false-positives.sh has to contain
+    # realistic-looking keys to prove the gate still catches real ones. Without
+    # this, adding a test for the scanner FAILS the scanner -- and the CI gate
+    # reported exactly that, two CRITICAL "hardcoded secret" findings pointing
+    # at deliberately fake fixtures.
+    #
+    # Scoped to paths that ANNOUNCE themselves. A real secret in a real source
+    # path is still caught by both tiers below.
+    case "$file" in
+        *.example|*.example.*|*.sample|*.sample.*|*.template|*.template.*|*.dist)
+            return 1 ;;
+        */fixtures/*|*/__fixtures__/*|*/tests/*|*/test/*|*test-*.sh|*.test.*|*_test.*)
+            return 1 ;;
+    esac
+
     # TIER 1: specific formats. No deny filter -- a format match is a finding.
     local tier1=(
         'AKIA[0-9A-Z]{16}'                          # AWS access key id
@@ -2657,6 +2763,7 @@ verify_main() {
         verify_gate_build "$tree"
         verify_gate_tests "$tree"
         verify_gate_static "$tree"
+        verify_gate_nomock "$tree"
         verify_gate_secret_scan "$tree"
         verify_gate_dependency_audit "$tree"
         # Runtime boot smoke (NET-NEW). Self-suppresses (no gate row) when no