loki-mode 7.129.4 → 8.0.0

package/dashboard/static/trust.html

@@ -40,7 +40,7 @@
      CSS references them) and remapped to the SPA --loki-* palette, with a
      prefers-color-scheme dark variant mirroring the SPA. */
   :root {
-    --bg: #FAFAF7; --panel: rgba(255,255,255,0.72); --panel-2: #E8E5DE; --border: rgba(0,0,0,0.08);
+    --bg: #F1F2F6; --panel: rgba(255,255,255,0.72); --panel-2: #E8E5DE; --border: rgba(0,0,0,0.08);
     --text: #1A1614; --muted: #4A4640; --faint: #8A857C; --accent: #553DE9;
     --green: #1AAF95; --red: #C04848; --amber: #C4922E;
     --mono: 'JetBrains Mono', ui-monospace, "SF Mono", "Menlo", monospace;

package/docs/ARCHITECTURE-OVERVIEW.md

@@ -0,0 +1,207 @@
+# Loki Mode - Architecture Overview
+
+Spec in, verified product out. This document gives a SIMPLE view for a first read
+and a FULL view for the whole machine, plus one RARV-C iteration as a sequence.
+
+Every claim is verified against source (`autonomy/loki`, `autonomy/run.sh`,
+`autonomy/completion-council.sh`, `skills/quality-gates.md`, `SKILL.md`). Line
+numbers drift; function names are stable. See `CLAUDE.md` for the file map.
+
+---
+
+## SIMPLE flowchart (the whole product in five boxes)
+
+```mermaid
+flowchart LR
+    SPEC[Spec: PRD / issue / OpenAPI / one-liner] --> LOOP[RARV-C loop]
+    LOOP --> VERIFY[Verify: gates + council + evidence gate]
+    VERIFY -- not done --> LOOP
+    VERIFY -- verified --> SHIP[Deployed product + proof-of-run]
+```
+
+Diagram type: flowchart. 4 nodes.
+
+Reason, Act, Reflect, Verify, then Closure. The loop does not exit until the
+verify stage clears; "done" is a verdict the machine has to earn, not a claim it
+gets to make.
+
+---
+
+## USER view: how you run it and what you get
+
+```bash
+# One-time: launch Claude Code with autonomous permissions
+claude --dangerously-skip-permissions
+
+# Then either say "Loki Mode", or run the CLI directly:
+loki start ./prd.md            # PRD-mode (a Markdown spec file)
+loki start owner/repo#123      # issue-mode (a GitHub issue)
+loki start                     # one-line brief, answer the prompt
+```
+
+What happens: `loki start` (`cmd_start` in `autonomy/loki`) execs the runner
+(`autonomy/run.sh`). The `run_autonomous()` loop builds a prompt each iteration
+(`build_prompt()`), invokes the provider, then runs checklist verification, an app
+runner, smoke tests, and code review. It stops when the completion council votes
+stop (`council_should_stop` in `autonomy/completion-council.sh`), a completion
+promise is met, max iterations is hit, or (v8.0.0) a failure is positively
+identified as non-retryable -- bad credentials, unknown model, exhausted quota --
+where further retries would be guaranteed-identical failures
+(`loki-ts/src/runner/retry_class.ts`, `LOKI_SMART_RETRY=0` to disable). An
+unrecognized failure stays transient and retries as before, so the early exit
+can never abandon a build that would have succeeded.
+
+The council's own force-stop valves (stagnation, repeated done-claims) are
+additionally delayed by one iteration when the agent's self-reported confidence
+spikes, so a sudden claim of near-certainty is VERIFIED rather than trusted
+(`loki-ts/src/runner/council.ts`, v8.0.0). That delay is strictly additive: it
+can only add a verification pass, never skip one, and it never delays the
+stagnation valve.
+
+What you get:
+- A runnable artifact (the built product in your working directory).
+- A proof-of-run: `.loki/proofs/<id>/proof.json` plus an HTML report
+  (`autonomy/lib/proof-generator.py`, `autonomy/lib/proof-template.html`).
+- An honest verdict. The evidence gate blocks completion on an empty diff, red
+  tests, an unhealthy serveable app (runtime-boot axis), or a leaked credential in
+  the changed files (secret-leak axis) - v8.0.0, `SKILL.md`.
+
+Provider-agnostic (stable since v5.0.0): Claude (Tier 1, full), Cline (Tier 2),
+Codex and Aider (Tier 3, degraded, sequential). Gemini deprecated v7.5.18. See
+`skills/providers.md`.
+
+---
+
+## FOUNDER view: the moat
+
+The moat is not "an agent that writes code". It is the trust layer wrapped around
+the loop.
+
+- RARV-C rigor. Every iteration is Reason, Act, Reflect, Verify, then Closure
+  (findings injection, override council, learnings, handoff). The closure knobs
+  are default-on in the Bun runner: `LOKI_INJECT_FINDINGS`, `LOKI_OVERRIDE_COUNCIL`,
+  `LOKI_AUTO_LEARNINGS`, `LOKI_HANDOFF_MD` (`CLAUDE.md`, `skills/quality-gates.md`).
+- Verify, not vibes. 8 quality gates (`skills/quality-gates.md`), a blind
+  3-reviewer council with severity blocking, an anti-sycophancy Devil's Advocate on
+  unanimous PASS, and a verified-completion evidence gate that blocks on positive
+  fabrication evidence. The system does not call work done until it is verified
+  (`SKILL.md`).
+- Tier routing. Opus for planning/architecture, Sonnet for development, Haiku for
+  unit tests and simple parallel work (`CLAUDE.md` Model Selection;
+  `get_rarv_tier()` in `autonomy/run.sh`, session-pinned via `LOKI_SESSION_MODEL`,
+  default sonnet). Cost tracks the tier, not a flat premium.
+- Model-equivalence thesis (founder framing). The rigor lives in the HARNESS (the
+  loop, the gates, the council, the evidence gate), not in any one model. Because
+  the harness is provider-agnostic with abstract model tiers and a degraded mode
+  for non-Claude providers, the trust guarantee is not tied to a single vendor
+  (`SKILL.md` provider-agnostic section; `providers/*.sh`). An optional Anthropic
+  Agent SDK route exists behind `LOKI_SDK_MODE` (off by default, v8.0.0); unset is
+  byte-identical to the claude-CLI route (`references/sdk-mode.md`).
+
+---
+
+## FULL flowchart (CLI dispatch to shipped proof)
+
+```mermaid
+flowchart TD
+    subgraph CLI[autonomy/loki - CLI]
+      START[loki start spec] --> DISPATCH[main dispatch]
+      DISPATCH --> EXEC[exec run.sh]
+    end
+
+    subgraph RUNNER[autonomy/run.sh - orchestration]
+      EXEC --> RA[run_autonomous loop]
+      RA --> CPX[detect_complexity]
+      CPX --> TIER[get_rarv_tier / LOKI_SESSION_MODEL]
+      TIER --> BP[build_prompt: RARV + SDLC + memory + queue + checklist]
+      BP --> INV[invoke provider]
+      INV --> ACT[Act: agent edits code]
+      ACT --> CHK[checklist verification]
+      CHK --> APP[app runner + playwright smoke]
+      APP --> CR[run_code_review: 3 blind reviewers]
+    end
+
+    subgraph GATES[Quality gates - skills/quality-gates.md]
+      CR --> G1[1 static analysis]
+      G1 --> G2[2 test suite red blocks]
+      G2 --> G3[3 blind council Crit/High block]
+      G3 --> G4[4 devils advocate on unanimous PASS]
+      G4 --> G5[5 mock integrity HIGH blocks]
+      G5 --> G6[6 test mutation HIGH blocks]
+      G6 --> G7[7 doc coverage]
+      G7 --> G8[8 magic modules debate BLOCK]
+    end
+
+    subgraph CLOSURE[RARV-C closure + memory]
+      G8 --> FIND[inject findings]
+      FIND --> OC[override council on BLOCK]
+      OC --> LEARN[auto learnings]
+      LEARN --> HAND[handoff md]
+      HAND --> MEM[store_episode_trace: episodic/semantic]
+    end
+
+    subgraph VERDICT[Completion decision]
+      MEM --> EG[evidence gate: empty-diff / red-tests / boot / secret-leak]
+      EG --> CC[council_should_stop vote]
+    end
+
+    CC -- keep going --> RA
+    CC -- stop / verified --> PROOF[proof-generator.py -> .loki/proofs/ID/proof.json + HTML]
+    PROOF --> SHIP[deployed product + proof-of-run]
+```
+
+Diagram type: flowchart. 28 nodes across 6 subgraphs.
+
+Verified anchors: `main` dispatch and `cmd_start` in `autonomy/loki`;
+`run_autonomous()`, `build_prompt()`, `run_code_review()`, `detect_complexity()`,
+`get_rarv_tier()` in `autonomy/run.sh`; the 8-gate table in
+`skills/quality-gates.md`; closure env vars in `CLAUDE.md`; `council_should_stop()`
+in `autonomy/completion-council.sh`; proof generation in
+`autonomy/lib/proof-generator.py`. The evidence-gate axes are quoted from
+`SKILL.md` (v8.0.0).
+
+---
+
+## One RARV-C iteration (sequenceDiagram)
+
+```mermaid
+sequenceDiagram
+    participant Runner as run_autonomous (run.sh)
+    participant Prompt as build_prompt
+    participant Provider as Provider (Claude/Codex/Cline/Aider)
+    participant Verify as Gates + council
+    participant Evidence as Evidence gate
+    participant Council as completion council
+    participant Memory as Episodic/semantic store
+
+    Runner->>Prompt: Reason - assemble prompt (RARV, SDLC, memory, queue, checklist)
+    Prompt-->>Runner: iteration prompt
+    Runner->>Provider: Act - invoke provider
+    Provider-->>Runner: code edits + output
+    Runner->>Runner: Reflect - checklist, app runner, smoke tests
+    Runner->>Verify: Verify - 8 gates + 3 blind reviewers
+    Verify-->>Runner: gate verdicts (Crit/High block)
+    Runner->>Runner: Closure - inject findings, override council, learnings, handoff
+    Runner->>Memory: store episode trace
+    Runner->>Evidence: verified-completion evidence gate
+    Evidence-->>Runner: pass / block (empty-diff, red-tests, boot, secret-leak)
+    Runner->>Council: council_should_stop vote
+    Council-->>Runner: continue OR stop (verified)
+    Note over Runner,Council: on continue, next iteration re-enters Reason with injected findings
+```
+
+Diagram type: sequenceDiagram. 7 participants, 14 messages.
+
+Verified: the RARV cycle (Reason/Act/Reflect/Verify) is `SKILL.md` PRIORITY 2; the
+Closure stage maps to the four default-on closure env vars in `CLAUDE.md`; the
+evidence-gate axes and "does not call work done until verified" are `SKILL.md`
+v8.0.0; the council vote is `council_should_stop` in `autonomy/completion-council.sh`.
+
+---
+
+## Where this connects
+
+Loki Mode is the ENGINE. Its `proof.json` is the evidence that the neutral
+Autonomi Verify signer stamps, and the Autonomi SaaS product is the hosted layer
+that drives the engine for non-technical users. See `docs/AUTONOMI-ECOSYSTEM.md`
+for the three-repo boundary map.

package/docs/AUTONOMI-ECOSYSTEM.md

@@ -0,0 +1,107 @@
+# The Autonomi Ecosystem
+
+Three repos, three jobs, three clean boundaries. This is the map that ties them
+together.
+
+- loki-mode (this repo) - the ENGINE. Spec to verified product via the RARV-C
+  loop, 8 quality gates, the completion council, and the evidence gate.
+- autonomi-verify - the TRUST layer. A neutral signer that stamps observed evidence
+  with a host-held key so a receipt is non-forgeable and independently checkable.
+- autonomi-saas - the hosted PRODUCT. Plain-English builds for non-technical users,
+  driving the engine and stamping every result with Verify.
+
+Deep dives: `docs/ARCHITECTURE-OVERVIEW.md` (engine),
+`../autonomi-verify/docs/INTEGRATION-DIAGRAMS.md` (trust layer),
+`../autonomi-saas/docs/PRODUCT-ARCHITECTURE.md` (product).
+
+---
+
+## The ecosystem in one graph
+
+```mermaid
+graph TD
+    subgraph PRODUCT[autonomi-saas - hosted product, proprietary]
+      WEB[web SPA: prompt-left / output-right]
+      BFF[BFF: only tier with engine token]
+      WORKER[worker: build loop, D-gen, preview, attestor]
+      WEB --> BFF --> WORKER
+    end
+
+    subgraph ENGINE[loki-mode - engine, source-available]
+      CLI[loki CLI + FastAPI]
+      LOOP[RARV-C loop + 8 gates + council + evidence gate]
+      PROOF[proof.json + proof-of-run HTML]
+      CLI --> LOOP --> PROOF
+    end
+
+    subgraph TRUST[autonomi-verify - neutral signer]
+      VAPI[POST /verify: decide then sign]
+      KEY[host Ed25519 key, host only]
+      VAL[POST /validate: check signature, no code run]
+      VAPI --> KEY
+      KEY --> VAL
+    end
+
+    WORKER -->|api-client HTTP| CLI
+    PROOF -->|observed evidence| WORKER
+    WORKER -->|POST evidence| VAPI
+    KEY -->|signed Evidence Receipt| WORKER
+
+    CLIUSER[CLI / CI user] -->|loki start| CLI
+    CLIUSER2[third-party pipeline] -->|loki verify stamp| VAPI
+    ANYONE[anyone with a receipt] -->|validate| VAL
+```
+
+Diagram type: graph. 14 nodes across 3 subgraphs plus 3 external actors.
+
+Verified anchors: the BFF is the only tier holding the engine token
+(`autonomi-saas/apps/bff/src/engine.ts`); the worker attestor POSTs evidence to the
+signer and gets a signed receipt (`autonomi-saas/worker/src/adapters/attestor.ts`);
+the signer decides then signs with a host-only Ed25519 key
+(`autonomi-verify/src/api/index.ts`, `autonomi-verify/src/persistence/index.ts`);
+`/validate` checks a signature without running code
+(`autonomi-verify/src/api/validatePage.ts`); the engine produces `proof.json`
+(`loki-mode/autonomy/lib/proof-generator.py`, `loki-ts/src/runner/proof.ts`).
+
+---
+
+## Where each boundary is
+
+| Concern | loki-mode (engine) | autonomi-verify (trust) | autonomi-saas (product) |
+|---|---|---|---|
+| Runs the build | Yes | No | No (delegates to engine) |
+| Decides the verdict | Yes (gates, council, evidence gate) | Yes (neutral re-decide on presented evidence) | No |
+| Holds the signing key | No | Yes (host only) | No |
+| Runs untrusted code | Yes (sandboxed) | No (never runs code) | Via engine + worker sandbox |
+| Multi-tenant auth / billing | No | Per-tenant API key on /verify | Yes (product concern) |
+| Hosted preview + UI | No | No | Yes |
+| Design generation (D-gen) | Prompt-level, engine-agnostic | No | Yes (default-on directive) |
+| Source posture | Source-available | Source-available | Proprietary hosted |
+
+The three-way trust property: the engine can decide, but the PRODUCT that built the
+app does not hold the key that signs the receipt. Only the neutral TRUST layer does.
+That separation is what lets a skeptic believe a receipt without trusting the
+builder. A competitor who self-signs their own success badge cannot offer that.
+
+---
+
+## The flow, end to end
+
+1. A user describes an app in the SaaS, or a developer runs `loki start`, or a
+   third-party pipeline runs `loki verify stamp`.
+2. The engine runs the RARV-C loop until the gates, council, and evidence gate
+   clear, producing `proof.json`.
+3. The observed evidence (diff + test signal) is POSTed to the neutral signer,
+   which applies one honest verdict rule and signs with the host-only key.
+4. The signed Evidence Receipt comes back. Anyone can validate its signature at
+   `/validate` without running code or trusting the builder.
+
+Honesty invariants that hold across all three:
+- `verified` means "no fabrication evidence", not "tests are green"
+  (`autonomi-verify/src/verifier/verify.ts`).
+- Block only on positive fabrication evidence; inconclusive is pass-through
+  (`autonomi-verify/src/verifier/evidenceGate.ts`).
+- The design/beauty layer never alters the VERIFIED verdict
+  (`autonomi-saas/docs/AUTONOMI-BUILD-PLAN.md`).
+- Signing happens after the verdict is decided, so signing cannot change it
+  (`autonomi-verify/src/api/index.ts`).

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 The flagship product of [Autonomi](https://www.autonomi.dev/). Loki Mode is a spec-driven autonomous builder with a built-in trust layer that takes any spec to a deployed product and verifies completion with evidence (quality gates plus a completion council), not just a "done" claim. Complete installation instructions for all platforms and use cases.
 
-**Version:** v7.129.2
+**Version:** v8.0.0
 
 ---
 
@@ -215,6 +215,23 @@ loki doctor       # Check skill symlinks, providers, and system prerequisites
 
 ---
 
+## Configuration file
+
+Instead of exporting many `LOKI_*` env vars, point `loki start` at a config file with `--config <path>` (aliases: `--env-file`, `--vars`), or set `LOKI_CONFIG_FILE`. The format is detected from the extension or content: `.yaml`/`.yml`, `.json`, or `.env` (flat `LOKI_*=value` lines). Values resolve by precedence: a CLI flag beats an ambient env var, which beats the `--config` file, which beats built-in defaults. Never inline a secret; reference an env var with `${VAR}` and the loader expands it at load time (an unset reference is skipped with a warning, and a raw-looking secret literal is flagged and rejected by `loki config validate`). Run `loki config example` to generate an annotated starter.
+
+```bash
+# config.yaml
+dashboard:
+  port: 9000
+github:
+  token: ${GITHUB_TOKEN}   # expanded from the environment, never stored inline
+
+loki start --config config.yaml ./prd.md
+loki config validate config.yaml    # check refs and reject raw secrets before a run
+```
+
+---
+
 ## Other Methods
 
 Git clone and Docker installation methods are also available. See
@@ -396,7 +413,7 @@ provider works inside the container. Provide auth with your Anthropic API key:
 # Run Loki Mode in Docker (Claude provider, API-key auth)
 docker run --rm -e ANTHROPIC_API_KEY="$ANTHROPIC_API_KEY" \
   -v $(pwd):/workspace -w /workspace \
-  asklokesh/loki-mode:7.129.2 start ./my-spec.md
+  asklokesh/loki-mode:8.0.0 start ./my-spec.md
 ```
 
 ##### docker compose + .env (no host install)

package/docs/MODEL-EQUIVALENCE-HARNESS-PLAN.md

@@ -0,0 +1,70 @@
+# Model-Equivalence Harness Plan (provable "haiku + harness = opus" moat)
+
+Thesis under test: outcome quality is a property of the ORCHESTRATION, not the raw model. A great harness makes Haiku reach the same end-outcome quality as Opus.
+
+Formal claim (per axis, held-out corpus): outcome_quality(haiku + full-harness) >= outcome_quality(opus + baseline-harness) - epsilon, accepted only when the bootstrap CI of the gap overlaps zero (or sits above -epsilon). Else report the true residual. This is a measurement instrument, not a marketing generator.
+
+Design stance: the bench harness, grader, schema, cost module, tier machinery all exist and are correct. Steering levers are env-var-controlled; _base.run_cli merges os.environ into the loki start subprocess (_base.py:113). So the model x config matrix needs ZERO adapter/grader changes - only an orchestration script that sets env vars and calls the existing runner, plus a new aggregation report.
+
+## Ground truth (build on, don't rebuild)
+- Model pin: LOKI_SESSION_MODEL in {haiku,sonnet,opus,fable}, honored at adapters/loki.py:135-138 and run.sh:17336-17357.
+- Env passthrough: _base.run_cli merges dict(os.environ) (_base.py:113).
+- Grader: held-out overlay + acceptance exit code; adapter forbidden from emitting success/quality/score/verdict (bench_schema.py:219-231).
+- Corpus: 5 discriminator tasks with held-out overlays. HARD tasks (hard-1-order-api, multifail-1-two-modules, tokenheavy-1-crm) are where levers fire; simple tasks one-shot (iterations:1) so levers are noise there.
+- Steering flags (all env-dialable): LOKI_MAX_ITERATIONS, LOKI_COUNCIL_ENABLED, LOKI_PHASE_CODE_REVIEW, LOKI_SELF_HEAL, LOKI_ALLOW_HAIKU, LOKI_COMPLETION_PROMISE, LOKI_COUNCIL_CHECK_INTERVAL/THRESHOLD/MIN_ITERATIONS.
+- Cost: prices.json (opus 15/75, sonnet 3/15, haiku 1/5 per Mtok) + native cost_usd.
+
+## 1. Experiment design
+Matrix 6 cells: {haiku,sonnet,opus} x {baseline-steering, full-harness-steering}. Hero cell = H.F (haiku+full harness) vs O.B (opus+raw). baseline = MAX_ITERATIONS=1, council off, review off, self-heal off (the Replit/Cursor "throw the model at it" mode). full = all levers on.
+
+Three axes, never blended: (1) CORRECTNESS = held-out acceptance exit 0 (deterministic, works today, primary). (2) DESIGN QUALITY = D-val screenshot+rubric 0-100 (web tasks only; NOT yet built; report not_captured until the judge is validated). (3) HONESTY = real proof.json/verify verdict present + true (guards against weak model "declaring done" falsely).
+
+Statistical rigor: correctness is Bernoulli -> Wilson score interval (not normal approx). gap = success_rate(H.F) - success_rate(O.B); bootstrap CI (>=2000 resamples over (task,trial) pairs). Decision: accept equivalence iff gap CI lower-bound >= -epsilon (default 0.10). CI entirely below -epsilon -> real residual. CI straddles -> underpowered, need more N. HONEST small-N: N=3 x 5 tasks detects only >~20-pt gaps; credible equivalence within epsilon=0.10 needs N>=8-10/task (~40-50 obs/cell). Min credible claim = N=10 x 5 tasks x 6 cells = 300 runs.
+
+## 2. Steering levers + ablation (the mechanism)
+Each lever = an env var wired into run.sh. Ablate: hold model=haiku, toggle one lever, measure delta in success_rate (leave-one-out from full-on; cheaper + more decision-relevant). Do it only on the 3 HARD tasks.
+- More RARV-C iterations (LOKI_MAX_ITERATIONS 1->8): weak models converge by trial-and-error against the acceptance harness.
+- Council gate (LOKI_COUNCIL_ENABLED): 3 reviewers catch weak-model "looks done but isn't".
+- Code review (LOKI_PHASE_CODE_REVIEW): catches weak-model correctness bugs.
+- Self-heal (LOKI_SELF_HEAL=1): feeds prior error back as a hint; weak models fix faster.
+- Verify/proof gate: forces real evidence (honesty axis).
+- Structured decomposition (grill): breaks hard tasks into weak-model-sized pieces.
+- Design gate (D-val): forces design quality regardless of model (web only).
+- Prompt scaffolding: constrains weak-model output toward the spec.
+Output: ablation table (lever -> haiku success_rate OFF vs ON, marginal lift + CI + DEV/LOCKED overfit flag).
+
+## 3. Adaptive harness (the product)
+Encode the ablation result as a tier-aware harness policy (model -> lever settings), so the same outcome ships on any tier. Home: loki_apply_tier_harness_policy() helper + policy table in autonomy/run.sh near the tier case block (17340-17347); exports lever env vars UNLESS the operator set them (override wins). ~15 lines. haiku/fast: MAX_ITERATIONS=8, council on, self-heal on, stricter gate. sonnet: MAX_ITERATIONS=5, council on, self-heal on. opus: MAX_ITERATIONS=3, council on, self-heal off. Ties to Task#6 tier routing (same variable) and SaaS pricing (model-policy.ts allowedModels: free=haiku/$15=sonnet/$99=opus) - they meet at the one env var. This is what makes free-tier haiku yield near-top outcomes = the business case.
+
+## 4. Improvement loop (not one-shot)
+Run 6-cell matrix on HARD held-out tasks (correctness first, it's free) -> measure per-axis gap + bootstrap CI -> if gap CI lower-bound >= -epsilon on all axes, DONE (claim proven with N+spread) -> else leave-one-out ablation on haiku, find the lever closing the largest residual, dial it, re-run only changed cells -> repeat UNTIL equivalence within noise OR marginal lift < CI width (diminishing returns -> report honest residual). Never chase a benchmark number.
+
+Anti-overfit: DEV/LOCKED corpus split (levers tuned on DEV, LOCKED touched only for the final claim). Grow corpus to >=12-15 tasks before any equivalence claim, ~60/40 split. Rotate locked tasks. Any lever lifting DEV but not LOCKED = benchmark-overfit, excluded from shipped policy.
+
+## 5. Rigor/honesty guards
+Grader stays deterministic held-out exit code (no change to runner.grade / validate_adapter_output). The D-val LLM-judge MUST be validated before grading: inter-rater reproducibility (same screenshot >=3x, 2 judge models opus+sonnet, report variance), anchor with known-good/known-bad; if judge variance > the gap being measured, design axis is not_captured (don't fabricate). Correctness + honesty axes don't depend on any LLM judge. No fabricated numbers (report N + spread; null != 0). Never tune corpus/grader across a before/after pair (task_hash binds fixture+spec; refuse to compare mismatched task_hash). Disclose overfit levers (DEV vs LOCKED delta per lever).
+
+## 6. Cost + cheap-first schedule
+Per-build (hard task, full harness): haiku ~$0.30-1, sonnet ~$1-3, opus ~$5-15 (council+review+self-heal add reviewer calls; full-harness cells cost multiples of baseline).
+- Stage 0 smoke: H.B + O.B on fizzbuzz, N=1 = 2 runs, ~$1. Prove the matrix machinery + haiku pin (needs LOKI_ALLOW_HAIKU=true).
+- Stage 1 pilot: H.F vs O.B on 3 HARD tasks, N=2-3, ~15 runs, ~$30-80. First credible directional signal on the gap. (Underpowered: only detects >20-pt gaps.)
+- Stage 2 ablation: leave-one-out on haiku, hard tasks, N=3, ~50 runs, ~$60-120. Which lever closes the gap.
+- Stage 3 credible claim: full 6-cell, >=12-task corpus, DEV/LOCKED, N=10, ~700 runs, ~$500-2000. Publishable proof with CIs.
+Min for first signal: Stage 0 + Stage 1 ~$30-80 = H.F vs O.B on 3 hard tasks at N=3.
+
+## 7. Deliverables (thin extensions)
+1. benchmarks/bench/matrix.sh (~80 lines): loops 6 cells, exports model+lever env per cell, calls existing run.sh run <task>, writes tagged result JSONs. No runner/adapter change.
+2. benchmarks/bench/equivalence_report.py: reads tagged results, computes per-axis per-model gap + Wilson/bootstrap CI, renders grid + ablation table + explicit decision (equivalent within epsilon / real residual / underpowered). Reuses report.py helpers. Refuses mismatched task_hash.
+3. Adaptive harness policy helper + table in autonomy/run.sh (populated from Stage-2 data; stub first).
+4. Corpus growth: 7-10 new tasks + overlays following the existing 5, DEV/LOCKED split. Web tasks tagged for D-val.
+5. Design-axis integration (deferred until D-val judge validated): non-gating grader signal like quality.lint_ok.
+
+## Ranked (cheapest credible signal first)
+1. Stage 0 smoke (~$1): confirm haiku pin + env passthrough.
+2. Stage 1 pilot (~$30-80): first directional signal; ship equivalence_report.py here, honestly labelled underpowered.
+3. Stage 2 ablation (~$60-120): attribute gap-closing to levers -> harness policy table.
+4. Corpus growth + DEV/LOCKED (dev time): precondition for a published claim.
+5. Stage 3 credible claim (~$500-2000): publishable proof.
+Everything before Stage 3 is under ~$200 and answers "does steering close the haiku-vs-opus gap?" with real data.
+
+CORRECTION: the design axis (D-val) is planned in autonomi-saas, NOT built; its LLM judge must pass reproducibility validation before grading. The first provable claim rests on CORRECTNESS (free, deterministic, works today) + HONESTY (verify verdict). Do not gate the moat claim on the unbuilt design axis.

package/docs/PLANS-INDEX.md

@@ -0,0 +1,33 @@
+# Plans Index
+
+This index maps each historical plan doc to its status. Plan docs are kept as design history; a 'shipped' plan's feature is live in the code.
+
+| Plan | Status | Notes |
+|---|---|---|
+| BRANCH-LIFECYCLE-PLAN.md | shipped | Feature-branch-by-default + CI/CD-aware deploy; `feature_branch` logic in `autonomy/run.sh`. |
+| BUILD-HUD-PLAN.md | shipped | Live in-terminal build HUD; `LOKI_HUD` / `[HUD]` in `autonomy/run.sh`, CHANGELOG "Live in-terminal build HUD". |
+| CONFIG-FILE-PLAN.md | shipped | Unified config file; `--config` / `--vars` / `--env-file` flags in `autonomy/loki`. |
+| CRASH-REPORTING-PLAN.md | shipped | Crash-reporting + auto-fix; `cmd_crash()` in `autonomy/loki` (`loki crash`). |
+| DEPLOY-PLAN.md | shipped | `loki deploy` advisory print-only; CHANGELOG "`loki deploy`: advisory, print-only deploy guidance". |
+| FAILURE-MEMORY-PLAN.md | shipped | Failure-memory loop; `FailureMode` schema in `memory/schemas.py`. |
+| FEAT-PRDREUSE-DOCKER-PLAN.md | shipped | PRD-reuse + Docker batch; Docker dashboard/port + PRD-reuse present in `autonomy/loki`. |
+| MERGE3-PLAN.md | shipped | Purple-Lab-into-Dashboard integration; `/lab/` mount in `dashboard/server.py`. |
+| P0-SWEEP-PLAN.md | shipped | Verification-credibility sweep; wired detectors are part of the 8-gate system. |
+| P2-SPEC-ROBUSTNESS-PLAN.md | shipped | Spec interrogation gate + assumption ledger; part of quality-gates spec robustness. |
+| PRD-REUSE-DONE-RECOGNITION-PLAN.md | shipped | PRD-reuse done-recognition gate; reuse-then-verify behavior in the engine. |
+| PREVIEW-LINK-PLAN.md | shipped | `loki preview --public`; `_preview_public` in `autonomy/loki`, CHANGELOG "`loki preview --public`". |
+| R10-MARKETPLACE-PLAN.md | shipped | Agent/template marketplace (install-from-source); `loki template` marketplace in `autonomy/loki`. |
+| R6-ROLLBACK-CHECKPOINT-PLAN.md | shipped | 1-click rollback + checkpoint UX; `cmd_rollback()` / `rollback)` dispatch in `autonomy/loki`. |
+| R7-ZERO-CONFIG-FIRST-RUN-PLAN.md | shipped | Zero-config first run; welcome/first-run path in `autonomy/loki`. |
+| R8-SHAREABLE-TEAM-ASSETS-PLAN.md | shipped | Exportable/importable team assets; `cmd_export()` / `cmd_import()` in `autonomy/loki`. |
+| R9-OPEN-CORE-HOOKS-PLAN.md | shipped | Open-core seams (BUSL-1.1); open-core seam references in `autonomy/loki`. Seams only; no hosted backend (by design). |
+| RARV-C-100X-PLAN.md | active | v8.0.0 native-primitives arc; v8 lives on the `feature/v8-agent-sdk` branch, not yet merged to main. |
+| RARV-C-LOOP-EFFICIENCY-PLAN.md | superseded | Self-marked SUPERSEDED by RARV-C-100X-PLAN.md (v8.0.0 arc); anchors drifted, kept as history. |
+| SHAREABLE-PROOF-PLAN.md | shipped | Opt-in shareable proof-of-run (v7.19.3) preserving zero-egress posture. |
+| SONNET5-DEFAULT-PLAN.md | shipped | Sonnet 5 default execution model; `v7.104.0: Sonnet 5 is the default` in `providers/claude.sh`. |
+| TASKLIST-ACCURACY-PLAN.md | shipped | Dashboard task-list accuracy fix; task-list handling in `dashboard/server.py`, CHANGELOG v7.104.x task-list fixes. |
+| UNCERTAINTY-ESCALATION-PLAN.md | shipped | Uncertainty-gated escalation (v7.19.2); uncertainty escalation logic in `autonomy/run.sh`. |
+| VERIFIED-COMPLETION-PLAN.md | shipped | Verified completion (v7.19.1); verified-completion gate in `autonomy/run.sh` + `autonomy/completion-council.sh`. |
+| WELCOME-OPENER-PLAN.md | shipped | Welcome opener ("magic opener"); `welcome` path in `autonomy/loki`. |
+| V8-AGENT-SDK-PLAN.md | shipped | The v8 Anthropic SDK runtime migration; shipped on `feature/v8-agent-sdk` as v8.0.0 + v8.1 (`loki-ts/src/runner/sdk_invoker.ts`, `sdk_mode.ts`, CHANGELOG v8.0.0/v8.1). Feature-branch-only, not yet merged to main. |
+| V8-SDK-RESEARCH-RAW.md | shipped | Research notes underpinning V8-AGENT-SDK-PLAN; design history for the v8 SDK arc. |

package/docs/PRIVACY.md

@@ -88,8 +88,36 @@ the tools you use, plus the same anonymous `distinct_id`. It still never sends
 your name, email, or IP. In headless / Docker / CI environments there is no
 browser, so this path never runs.
 
+### 4. Build-outcome analytics (anonymous, STRICT opt-in, default OFF)
+
+A `build_verified` event that reports how a build turned out. Unlike crash
+reporting and usage telemetry (which default ON for individuals), this path is
+OFF by default even for users who have telemetry enabled -- it requires a
+SECOND, explicit opt-in:
+
+- Set `LOKI_ANALYTICS=on` (or `LOKI_POSTHOG=on`), or
+- Add `ANALYTICS_ENABLED=true` to `~/.loki/config`.
+
+It fires once when a build finishes, reading a FIXED allowlist of already-
+computed scalars from the run's Evidence Receipt (`proof.json`). The allowlist
+(`autonomy/lib/proof-analytics-props.py`) is the single source of truth; any
+field not named there is never read, so a schema change cannot silently start
+sending something new. Fields sent:
+
+- headline (a bounded enum: VERIFIED / VERIFIED WITH GAPS / NOT VERIFIED)
+- evidence_gate_verdict, final_verdict (bounded verdict strings)
+- iterations, files_changed_count (a COUNT -- never the file paths)
+- wall_clock_sec, gates_passed, gates_total, gate_pass_rate
+
+It NEVER sends your spec/PRD text, file paths or names, code, or diffs. Because
+it sits below the base telemetry gate, every telemetry opt-out (`loki telemetry
+off` / `LOKI_TELEMETRY=off` / `DO_NOT_TRACK=1`) also disables it -- opt-out
+always wins.
+
 This document and the first-run notice describe ALL paths. The model is unified:
-one opt-in enables them and one opt-out (which always wins) disables them.
+opt-out always wins and disables everything; crash reporting and usage telemetry
+opt in together (default ON for individuals); build-outcome analytics needs its
+own explicit second opt-in on top (default OFF).
 
 ## What is collected (the whitelist)
 

package/docs/SIGNED-RECEIPTS.md

@@ -0,0 +1,102 @@
+# Signed Evidence Receipts (operator guide)
+
+Status: the signing and verification pipeline is **implemented and working
+today**, gated behind one environment variable. This guide is the missing
+operational half: how to turn it on, what it buys you, and what it does not.
+
+## Why this matters
+
+Loki's Evidence Receipt is checkable by default: `loki proof verify <id>`
+re-hashes the receipt (tamper) and re-derives the diff from the recorded base
+SHA (drift). But on the **unsigned** path the generator is TRUSTED. A forger who
+rewrites both the facts and the headline into a mutually consistent lie and
+recomputes the integrity hash still passes verification, and the verifier
+honestly reports `generator_trusted: true`.
+
+That limitation is deliberately locked into the test suite
+(`tests/test-proof-forgery-defense.sh`, case c) rather than papered over, and in
+v7.111.0 the project removed its own earlier "non-forgeable" claim once it was
+found to be false on that path.
+
+**Signing is what closes that gap.** With a detached GPG signature over the
+same canonical bytes that were hashed, a third party who trusts your key can
+confirm the receipt came from your generator and has not been altered since.
+That is the difference between "defense-in-depth" and neutral non-forgeability,
+and it is the property an auditor or a customer's security team actually needs.
+
+## Turning it on
+
+```bash
+export LOKI_PROOF_GPG_KEY="<key-id-or-fingerprint>"
+loki start ./spec.md
+```
+
+That is the whole switch. Every receipt generated while the variable is set
+carries a `verification.gpg_signature` field (ASCII-armored, detached).
+
+Properties worth knowing before you rely on it:
+
+- **Default OFF.** With `LOKI_PROOF_GPG_KEY` unset, no signature field is
+  emitted and the receipt bytes are byte-identical to before.
+- **Local only.** It shells out to the `gpg` on your PATH
+  (`gpg --batch --yes --armor --detach-sign --local-user <key> --output -`).
+  No network call, no external service, no key ever leaves the machine.
+- **Best effort, never blocking.** If `gpg` is missing, the key is not found, or
+  signing times out (30s), the proof is still emitted, unsigned. Signing must
+  never be able to fail a build.
+- **Signed over the canonical pre-verification bytes**, the same form the
+  verifier reconstructs, so the signature and the integrity hash always cover
+  identical content.
+
+## Verifying a signed receipt
+
+```bash
+loki proof verify <id>
+```
+
+The JSON result carries a `gpg_ok` field with three states, and the tri-state is
+the point:
+
+| `gpg_ok` | Meaning |
+|---|---|
+| `true` | good signature from a key the verifier trusts |
+| `false` | signature present but verification FAILED (treat as tampered) |
+| `"n/a"` | no signature present, or `gpg` unavailable on the verifying machine |
+
+`generator_trusted` is `true` whenever `gpg_ok` is not `true`. Read that field:
+it is the receipt telling you honestly how much it is worth.
+
+A verifying party needs your public key in their keyring. Distribute it however
+you already distribute release-signing keys (a keyserver, your website, your
+release artifacts). Loki deliberately does not invent a key-distribution
+mechanism.
+
+## For enterprises
+
+The combination that matters for an audit trail:
+
+1. Sign receipts with an organization key held in your CI secret store.
+2. Archive `.loki/proofs/<run_id>/` alongside the merged commit.
+3. Any reviewer, auditor, or downstream consumer can then verify offline, with
+   no access to Loki, your CI, or the original machine.
+
+Because verification is fully offline and the receipt separates deterministic
+FACTS from AI ASSESSMENTS, the artifact answers "what was actually checked, on
+which exact code" without asking anyone to trust the agent that produced it.
+
+## Honest limits
+
+- A signature proves **provenance and integrity**, not correctness. It says this
+  receipt came from your generator unaltered. It does not say the code is
+  bug-free. The receipt's own headline (VERIFIED / VERIFIED WITH GAPS / NOT
+  VERIFIED) is computed from facts and remains the correctness statement.
+- Signing does not retroactively protect receipts generated unsigned.
+- If the signing key is compromised, signed receipts from that key are worth
+  exactly what the key is worth. Normal key hygiene applies.
+
+## Source
+
+- Signing: `autonomy/lib/proof-generator.py` (`_gpg_detached_sign`, and the
+  `LOKI_PROOF_GPG_KEY` gate)
+- Verification: `autonomy/lib/proof-verify.py` (`_verify_gpg`)
+- Scope test: `tests/test-proof-forgery-defense.sh`

package/docs/SONNET5-DEFAULT-PLAN.md

@@ -1,6 +1,6 @@
 # Sonnet 5 Default - Implementation Plan
 
-Status: PLAN (no code written). Worktree: `../loki-sonnet5-wt` (branch `feat/sonnet5-default`).
+Status: SHIPPED (v7.104.0; kept as design history). Worktree: `../loki-sonnet5-wt` (branch `feat/sonnet5-default`).
 Board decision: `strategy/roadmap/13-BOARD-2026-06-30.md`. Verified facts: `reference-sonnet5-model-ids` memory.
 Release class: MINOR (new default execution model for every user). Full local-ci + council 3/3 + release ladder.