loki-mode 7.129.4 → 8.0.0

package/autonomy/lib/prd-enrich.sh

@@ -42,6 +42,40 @@
 # precedent at autonomy/lib/voter-agents.sh:259.
 _loki_prd_enrich_invoke() {
     local prompt="$1"
+    # v8 RAW-SDK TEXT PATH (opt-in LOKI_SDK_PRD_ENRICH=1). Free-form enrichment
+    # via the pure-HTTPS @anthropic-ai/sdk (no claude binary) through the loki-ts
+    # `internal sdk-text` bridge. Runs BEFORE the claude-binary guard so the
+    # no-binary deploy win holds. Fail-closed: on ANY miss (flag off, no key,
+    # bun/entrypoint absent, non-zero, empty) fall straight through to the claude
+    # path below -- zero behavior change when off or unavailable. The output is
+    # free-form text the caller consumes verbatim, same as the claude path.
+    if [ "${LOKI_SDK_PRD_ENRICH:-0}" = "1" ]; then
+        local _pe_root _pe_loki _pe_pf _pe_out _pe_rc
+        _pe_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+        _pe_loki="${_pe_root}/bin/loki"
+        if [ -x "$_pe_loki" ] && command -v bun >/dev/null 2>&1; then
+            _pe_pf="$(mktemp 2>/dev/null)" || _pe_pf=""
+            if [ -n "$_pe_pf" ]; then
+                printf '%s' "$prompt" > "$_pe_pf"
+                _pe_rc=0
+                local _pe_to_s="${LOKI_PRD_ENRICH_TIMEOUT:-180}"
+                local _pe_wrap
+                if command -v timeout >/dev/null 2>&1; then _pe_wrap="timeout $(( _pe_to_s + 15 ))"
+                elif command -v gtimeout >/dev/null 2>&1; then _pe_wrap="gtimeout $(( _pe_to_s + 15 ))"
+                else _pe_wrap=""; fi
+                _pe_out="$($_pe_wrap "$_pe_loki" internal sdk-text \
+                    --prompt-file "$_pe_pf" \
+                    --model "${LOKI_SDK_PRD_ENRICH_MODEL:-claude-sonnet-5}" --effort medium \
+                    --timeout-ms "$(( _pe_to_s * 1000 ))" 2>/dev/null)" || _pe_rc=$?
+                rm -f "$_pe_pf" 2>/dev/null || true
+                if [ "$_pe_rc" -eq 0 ] && [ -n "$_pe_out" ]; then
+                    printf '%s' "$_pe_out"
+                    return 0
+                fi
+            fi
+        fi
+        # fall through to the claude path (fail-closed)
+    fi
     command -v claude >/dev/null 2>&1 || return 1
     local rc=0
     local out=""
@@ -65,6 +99,14 @@ _loki_prd_enrich_invoke() {
 _loki_prd_enrich_provider_ok() {
     [ "${LOKI_PROVIDER:-claude}" = "claude" ] || return 1
     [ "${PROVIDER_DEGRADED:-false}" != "true" ] || return 1
+    # v8: the raw-SDK enrich path (LOKI_SDK_PRD_ENRICH=1) needs no claude binary,
+    # so attempt is viable when that path is usable (bridge + bun). The invoke fn
+    # still fails closed to claude on an SDK miss.
+    if [ "${LOKI_SDK_PRD_ENRICH:-0}" = "1" ] \
+       && [ -x "$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)/bin/loki" ] \
+       && command -v bun >/dev/null 2>&1; then
+        return 0
+    fi
     command -v claude >/dev/null 2>&1 || return 1
     return 0
 }

package/autonomy/lib/proof-analytics-props.py

@@ -0,0 +1,69 @@
+#!/usr/bin/env python3
+"""Emit the FIXED analytics allowlist from a finished proof.json as key=value
+lines, one per line, for loki_emit_build_verified (autonomy/telemetry.sh).
+
+This is the SINGLE authoritative allowlist for opt-in build-outcome analytics.
+Only already-computed scalars are ever emitted -- never code, spec/PRD text,
+paths, or file names. Anything not named here is never read, so a proof.json
+schema change cannot silently start leaking a new field.
+
+Free-text-shaped fields are excluded on purpose:
+  - headline is a bounded enum (VERIFIED / VERIFIED WITH GAPS / NOT VERIFIED),
+    computed deterministically from facts -- never spec/project text.
+  - files_changed is emitted as a COUNT only, never the paths list.
+
+Usage: proof-analytics-props.py <proof.json>
+Fail-open: any error prints nothing and exits non-zero; the caller drops it.
+"""
+import json
+import sys
+
+
+def main():
+    if len(sys.argv) < 2:
+        return 1
+    try:
+        p = json.load(open(sys.argv[1]))
+    except Exception:
+        return 1
+
+    honesty = p.get("honesty") or {}
+    council = p.get("council") or {}
+    facts = p.get("facts") or {}
+    qg = p.get("quality_gates") or {}
+    fc = p.get("files_changed") or {}
+
+    gates_passed = qg.get("passed")
+    gates_total = qg.get("total")
+    try:
+        rate = round(int(gates_passed) / int(gates_total), 3) if gates_total else None
+    except Exception:
+        rate = None
+
+    out = {
+        "headline": str(honesty.get("headline") or ""),  # bounded enum only
+        "evidence_gate_verdict": str(
+            honesty.get("evidence_gate_verdict")
+            or (facts.get("evidence_gate") or {}).get("verdict")
+            or ""
+        ),
+        "final_verdict": str(council.get("final_verdict") or ""),
+        "iterations": p.get("iterations"),
+        "files_changed_count": fc.get("count") if isinstance(fc, dict) else None,
+        "wall_clock_sec": p.get("wall_clock_sec"),
+        "gates_passed": gates_passed,
+        "gates_total": gates_total,
+        "gate_pass_rate": rate,
+    }
+
+    for k, v in out.items():
+        if v is None or v == "":
+            continue
+        # key=value; sanitize so a value can never inject a second pair or a newline.
+        v = str(v).replace("\n", " ").replace("=", "-")
+        sys.stdout.write("%s=%s\n" % (k, v))
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/autonomy/lib/proof-generator.py

@@ -22,6 +22,7 @@ import hashlib
 import json
 import os
 import random
+import re
 import string
 import subprocess
 import sys
@@ -37,6 +38,8 @@ if _HERE not in sys.path:
 import proof_redact  # noqa: E402
 from efficiency_cost import collect_efficiency as _collect_efficiency  # noqa: E402
 import effort_estimator  # noqa: E402
+from tree_digest import MANIFEST_VERSION, compute_tree_digest  # noqa: E402
+from workspace_diff import collect_workspace_diff  # noqa: E402
 
 
 # ---------------------------------------------------------------------------
@@ -326,6 +329,38 @@ def _collect_quality_gates(loki_dir):
                         {"name": "unit_tests", "status": _norm_gate_status(st)}
                     )
                     total += 1
+    # The iteration loop writes the authoritative unresolved-gate set here.
+    # These failures must be merged even when individual pass markers exist.
+    # Otherwise a run can stop on code_review while the receipt reports only
+    # static_analysis and unit_tests, producing a cryptographically valid but
+    # semantically false green receipt.
+    failure_path = os.path.join(loki_dir, "quality", "gate-failures.txt")
+    try:
+        with open(failure_path, "r", encoding="utf-8") as handle:
+            raw_failures = handle.read(8192)
+    except OSError:
+        raw_failures = ""
+    failed_names = []
+    for token in re.split(r"[,\s]+", raw_failures):
+        name = token.strip()
+        if not name or not re.fullmatch(r"[A-Za-z0-9_.:-]+", name):
+            continue
+        name = re.sub(r"_(PAUSED|ESCALATED)$", "", name,
+                      flags=re.IGNORECASE)
+        if name not in failed_names:
+            failed_names.append(name)
+    if failed_names:
+        by_name = {str(g.get("name") or ""): g for g in gates}
+        for name in failed_names:
+            if name in by_name:
+                by_name[name]["status"] = "failed"
+            else:
+                gate = {"name": name, "status": "failed"}
+                gates.append(gate)
+                by_name[name] = gate
+
+    total = len(gates)
+    passed = sum(1 for gate in gates if gate.get("status") == "passed")
     return {"passed": passed, "total": total, "gates": gates}
 
 
@@ -378,6 +413,88 @@ def _collect_build(loki_dir):
     return out
 
 
+def _collect_termination(loki_dir, session_exit_code=None):
+    """Read the supervised-process termination marker.
+
+    The marker is written before proof generation when INT or TERM ends a
+    supervised build. File presence is fail-closed: a truncated marker still
+    proves that the process did not complete normally.
+    """
+    path = os.path.join(loki_dir, "state", "termination.json")
+    out = {
+        "terminated": False,
+        "status": "completed",
+        "reason": "",
+        "signal": "",
+        "exit_code": None,
+        "outcome": "",
+        "run_status": "",
+    }
+    state_paths = [os.path.join(loki_dir, "autonomy-state.json")]
+    sessions_dir = os.path.join(loki_dir, "sessions")
+    try:
+        for entry in os.listdir(sessions_dir):
+            state_paths.append(
+                os.path.join(sessions_dir, entry, "autonomy-state.json")
+            )
+    except OSError:
+        pass
+    state_paths = [path for path in state_paths if os.path.isfile(path)]
+    if state_paths:
+        latest_state = max(state_paths, key=os.path.getmtime)
+        state = _read_json(latest_state, default=None)
+        if isinstance(state, dict):
+            out["run_status"] = str(state.get("status") or "").strip().lower()
+    completion = _read_json(
+        os.path.join(loki_dir, "state", "completion.json"), default=None
+    )
+    if isinstance(completion, dict):
+        outcome = str(completion.get("outcome") or "").strip().lower()
+        out["outcome"] = outcome
+        if outcome:
+            out["status"] = outcome
+            if outcome not in ("complete", "completed", "success"):
+                out["reason"] = outcome
+    if session_exit_code is not None:
+        out["exit_code"] = session_exit_code
+        if session_exit_code != 0 and not out["reason"]:
+            out["reason"] = "nonzero_session_exit"
+    if not os.path.exists(path):
+        return out
+    raw = _read_json(path, default=None)
+    out["terminated"] = True
+    out["status"] = "interrupted"
+    if not isinstance(raw, dict):
+        out["reason"] = "invalid_termination_record"
+        return out
+    out["reason"] = str(raw.get("reason") or "supervisor_signal")
+    out["signal"] = str(raw.get("signal") or "")
+    ec = raw.get("exit_code")
+    out["exit_code"] = _to_int(ec, None) if ec is not None else None
+    return out
+
+
+def _collect_model(loki_dir, observed):
+    """Return the dispatched model when recorded, otherwise ``unavailable``."""
+    for value in (
+        observed,
+        os.environ.get("LOKI_CURRENT_MODEL"),
+        os.environ.get("LOKI_SESSION_MODEL"),
+        os.environ.get("SESSION_MODEL"),
+    ):
+        if str(value or "").strip():
+            return str(value).strip()
+    policy = _read_json(
+        os.path.join(loki_dir, "state", "execution-policy.json"), default={}
+    )
+    model = policy.get("model") if isinstance(policy, dict) else None
+    if isinstance(model, dict):
+        value = model.get("sdk_id") or model.get("alias")
+        if str(value or "").strip():
+            return str(value).strip()
+    return "unavailable"
+
+
 def _collect_security(loki_dir):
     """Read .loki/quality/security-findings.json (the secure-by-default gate).
 
@@ -584,6 +701,53 @@ def _collect_evidence_gate(loki_dir):
     return out
 
 
+def _classify_func_axis(raw):
+    """Map one recorded functional axis {ok, inconclusive, reason} to an HONEST
+    tri-state. This is the trust-critical rule -- get it wrong and the receipt
+    fabricates a green:
+
+      - PROVEN   iff ok is True AND NOT inconclusive (a fresh positive proof:
+                 the record survived / the 401 was observed / the scan was clean).
+      - GAP      iff ok is False AND NOT inconclusive (freshly disproven).
+      - NOT_CHECKED otherwise (inconclusive, or absent). Never a green, never a
+                 gap -- it was not proven and it was not disproven.
+
+    inconclusive DOMINATES ok: an axis flagged inconclusive is never proven even
+    if ok happens to be true (the gate writes ok:true as its non-blocking default
+    when it could not run, so ok alone is not evidence)."""
+    if not isinstance(raw, dict):
+        return "not_checked", ""
+    reason = str(raw.get("reason") or "")
+    if raw.get("inconclusive") is True:
+        return "not_checked", reason
+    if raw.get("ok") is True:
+        return "proven", reason
+    if raw.get("ok") is False:
+        return "gap", reason
+    return "not_checked", reason
+
+
+def _collect_functionality(loki_dir):
+    """Read the nomock/persistence/auth axes from evidence-gate-details.json and
+    surface each as an HONEST proof fact. Deterministic + re-derivable: the values
+    come straight from the recorded axes, no LLM opinion.
+
+    Shape (per axis): {state: proven|gap|not_checked, reason}. Only `proven` is a
+    green receipt row; `gap` is an honest disproven row (lands in degraded[]);
+    `not_checked` is omitted from the receipt's green rows entirely. Absent file
+    or absent axis -> not_checked (the gate did not record it -> nothing proven)."""
+    raw = _read_json(
+        os.path.join(loki_dir, "council", "evidence-gate-details.json"),
+        default=None,
+    )
+    axes = raw if isinstance(raw, dict) else {}
+    out = {}
+    for axis in ("nomock", "persistence", "auth", "authorization"):
+        state, reason = _classify_func_axis(axes.get(axis))
+        out[axis] = {"state": state, "reason": reason}
+    return out
+
+
 def _diff_sha256(files_changed):
     """sha256 of the canonical diff stat (count/insertions/deletions/files).
 
@@ -602,93 +766,12 @@ def _diff_sha256(files_changed):
 
 
 def _git_diffstat(target_dir, include_diffs):
-    """Return (files_changed dict, diffs list|None).
-
-    base = $_LOKI_ITER_START_SHA, else HEAD~1. Non-git -> empty.
-    """
-    empty = {"count": 0, "insertions": 0, "deletions": 0, "files": []}
-
-    def _git(args):
-        try:
-            out = subprocess.run(
-                ["git", "-C", target_dir] + args,
-                capture_output=True, text=True, timeout=30,
-            )
-            if out.returncode != 0:
-                return None
-            return out.stdout
-        except Exception:
-            return None
-
-    # Confirm we are in a git repo.
-    if _git(["rev-parse", "--is-inside-work-tree"]) is None:
-        return empty, (None if not include_diffs else None)
-
-    base = os.environ.get("_LOKI_ITER_START_SHA", "").strip()
-    if not base:
-        base = "HEAD~1"
-
-    numstat = _git(["diff", "--numstat", base, "HEAD"])
-    if numstat is None:
-        # base may be invalid (shallow / first commit); fall back to HEAD only.
-        numstat = _git(["diff", "--numstat", "HEAD"])
-    if numstat is None:
-        return empty, (None if not include_diffs else None)
-
-    files = []
-    ins_total = 0
-    del_total = 0
-    for line in numstat.splitlines():
-        parts = line.split("\t")
-        if len(parts) < 3:
-            continue
-        ins_s, del_s, path = parts[0], parts[1], parts[2]
-        ins = _to_int(ins_s) if ins_s != "-" else 0
-        dele = _to_int(del_s) if del_s != "-" else 0
-        ins_total += ins
-        del_total += dele
-        files.append({
-            "path": path,
-            "insertions": ins,
-            "deletions": dele,
-            "status": "binary" if ins_s == "-" else "modified",
-        })
-
-    files_changed = {
-        "count": len(files),
-        "insertions": ins_total,
-        "deletions": del_total,
-        "files": files,
-    }
-
-    diffs = None
-    if include_diffs:
-        diffs = []
-        patch = _git(["diff", base, "HEAD"])
-        if patch is None:
-            patch = _git(["diff", "HEAD"])
-        if patch:
-            # Split per file on the diff --git markers, preserving the header.
-            chunks = []
-            current = []
-            for line in patch.splitlines(keepends=True):
-                if line.startswith("diff --git ") and current:
-                    chunks.append("".join(current))
-                    current = [line]
-                else:
-                    current.append(line)
-            if current:
-                chunks.append("".join(current))
-            for chunk in chunks:
-                # Best-effort path extraction from the "diff --git a/x b/x" line.
-                p = ""
-                first = chunk.splitlines()[0] if chunk else ""
-                bits = first.split(" b/")
-                if len(bits) == 2:
-                    p = bits[1].strip()
-                diffs.append({"path": p, "patch": chunk})
-
-    return files_changed, diffs
+    """Return the final worktree diff relative to this iteration's base."""
+    return collect_workspace_diff(
+        target_dir,
+        os.environ.get("_LOKI_ITER_START_SHA", "").strip(),
+        include_diffs,
+    )
 
 
 def _collect_iterations(loki_dir):
@@ -823,7 +906,7 @@ def _build_proof(args, loki_dir, target_dir, repo_root):
 
     cost, model_from_eff = _collect_efficiency(loki_dir)
     provider_name = args.provider or os.environ.get("PROVIDER_NAME") or "claude"
-    model = model_from_eff or os.environ.get("SESSION_MODEL") or ""
+    model = _collect_model(loki_dir, model_from_eff)
 
     files_changed, diffs = _git_diffstat(target_dir, args.include_diffs)
     iterations = _collect_iterations(loki_dir)
@@ -832,11 +915,13 @@ def _build_proof(args, loki_dir, target_dir, repo_root):
     quality_gates = _collect_quality_gates(loki_dir)
 
     build = _collect_build(loki_dir)
+    termination = _collect_termination(loki_dir, args.session_exit_code)
     tests = _collect_tests(loki_dir)
     security = _collect_security(loki_dir)
     functional = _collect_functional(loki_dir)  # FV-2 record-half: descriptive only
     healthcheck = _collect_healthcheck(loki_dir)  # Evidence Receipt record-half
     evidence_gate = _collect_evidence_gate(loki_dir)
+    functionality = _collect_functionality(loki_dir)  # func axes as HONEST facts
 
     deployed_url = os.environ.get("LOKI_DEPLOYED_URL") or None
 
@@ -863,9 +948,14 @@ def _build_proof(args, loki_dir, target_dir, repo_root):
         "head_sha": _git_head_sha(target_dir),
         "diff": files_changed,
         "diff_sha256": _diff_sha256(files_changed),
+        # Exact source snapshot verified by this receipt. Dashboard supervisors
+        # recompute it after runner exit to reject proofs followed by code edits.
+        "tree_sha256": compute_tree_digest(target_dir),
+        "tree_manifest_version": MANIFEST_VERSION,
     }
     facts = {
         "git": git_facts,
+        "execution": termination,
         "build": build,
         "tests": tests,
         "quality_gates": [
@@ -878,6 +968,14 @@ def _build_proof(args, loki_dir, target_dir, repo_root):
         # _compute_degraded, so it does not (yet) change the verdict. Wiring it into
         # the green headline is the founder-gated trust-semantics decision.
         "functional": functional,
+        # Functionality-proving axes (nomock / persistence / auth), surfaced as
+        # HONEST facts straight from the recorded evidence-gate axes. Each is
+        # {state: proven|gap|not_checked, reason}. ONLY `proven` (a fresh ok:true)
+        # is a green receipt row; `not_checked` (inconclusive/absent) is never a
+        # green and never a gap; `gap` (a fresh ok:false) is a disproven row and
+        # ALSO lands in degraded[] (below), so it forces VERIFIED WITH GAPS and can
+        # never hide behind a green headline. Deterministic + re-derivable.
+        "functionality": functionality,
         # Evidence Receipt (record half): did the built app come up + respond?
         # Descriptive; NOT read by _compute_headline (gating is founder-gated).
         "healthcheck": healthcheck,
@@ -966,6 +1064,9 @@ def _build_proof(args, loki_dir, target_dir, repo_root):
         "quality_gates": quality_gates,
         "cost": cost,
         "deployment": deployment,
+        # Typed compatibility mirror for consumers that do not traverse facts.
+        "tree_sha256": git_facts["tree_sha256"],
+        "tree_manifest_version": git_facts["tree_manifest_version"],
         # Rank 6: work-based engineering-hours estimate (top-level, NOT a fact).
         "effort_estimate": effort_estimate,
         # v1.1 evidence model (additive).
@@ -988,6 +1089,28 @@ def _compute_degraded(facts):
     # must SHOW it (otherwise a failed test would render an amber banner whose
     # "items below" list is empty -- the exact misleading state we forbid).
     weak = ("not_run", "inconclusive", "skipped", "failed")
+    execution = facts.get("execution") or {}
+    if execution.get("terminated"):
+        signal_name = execution.get("signal") or "unknown"
+        reason = execution.get("reason") or "interrupted"
+        out.append({"item": "execution", "status": "failed",
+                    "reason": "%s (%s)" % (reason, signal_name)})
+    else:
+        outcome = str(execution.get("outcome") or "").lower()
+        run_status = str(execution.get("run_status") or "").lower()
+        if execution.get("exit_code") not in (None, 0):
+            out.append({"item": "execution", "status": "failed",
+                        "reason": "exit_code=%s" % execution.get("exit_code")})
+        elif outcome and outcome not in ("complete", "completed", "success"):
+            out.append({"item": "execution", "status": "failed",
+                        "reason": outcome})
+        elif run_status in {
+            "failed", "force_stopped", "inconclusive_spec_contradiction",
+            "interrupted", "max_iterations_reached", "max_retries_exceeded",
+            "paused", "policy_blocked", "provider_deadline_partial_mutation",
+        }:
+            out.append({"item": "execution", "status": "failed",
+                        "reason": run_status})
     tests = facts.get("tests") or {}
     if tests.get("status") in weak:
         reason = "no test command recorded" if not tests.get("command") \
@@ -1018,6 +1141,19 @@ def _compute_degraded(facts):
     if not (git.get("diff") or {}).get("count"):
         out.append({"item": "git.diff", "status": "not_run",
                     "reason": "no file changes detected"})
+    # Functionality axes: ONLY a freshly-disproven axis (state == gap, i.e. the
+    # gate ran and the axis FAILED -- a record did not survive, auth was NOT
+    # enforced, the diff shipped mock data) is a gap in the proof of done. A
+    # `not_checked` axis (inconclusive / not attempted) is deliberately NOT a gap:
+    # the honesty rule is that not-proven is not the same as disproven, and the
+    # gate already passes those through. Surfacing them here would spam the ledger
+    # with "we didn't check X" for every axis the driver could not exercise.
+    fnc = facts.get("functionality") or {}
+    for axis in ("nomock", "persistence", "auth", "authorization"):
+        rec = fnc.get(axis) or {}
+        if rec.get("state") == "gap":
+            out.append({"item": "functionality:%s" % axis, "status": "failed",
+                        "reason": rec.get("reason") or "axis disproven"})
     return out
 
 
@@ -1057,8 +1193,31 @@ def _compute_headline(facts, degraded):
         and fn.get("ran")
         and fn.get("functional_status") == "failed"
     )
+    execution = facts.get("execution") or {}
+    execution_outcome = str(execution.get("outcome") or "").lower()
+    failed_run_statuses = {
+        "failed",
+        "force_stopped",
+        "inconclusive_spec_contradiction",
+        "interrupted",
+        "max_iterations_reached",
+        "max_retries_exceeded",
+        "paused",
+        "policy_blocked",
+        "provider_deadline_partial_mutation",
+    }
+    execution_failed = bool(
+        execution.get("terminated")
+        or execution.get("exit_code") not in (None, 0)
+        or str(execution.get("run_status") or "").lower() in failed_run_statuses
+        or (
+            execution_outcome
+            and execution_outcome not in ("complete", "completed", "success")
+        )
+    )
     any_failed = (
-        tests.get("status") == "failed"
+        execution_failed
+        or tests.get("status") == "failed"
         or build.get("status") == "failed"
         or any(g.get("status") == "failed"
                for g in (facts.get("quality_gates") or []))
@@ -1165,6 +1324,15 @@ def _build_social_hook(proof):
     return " - ".join(parts)
 
 
+def _receipt_title(proof):
+    """Conservative user-facing verdict label for the rendered receipt."""
+    headline = str((proof.get("honesty") or {}).get("headline") or "").upper()
+    return {
+        "VERIFIED": "Recorded checks passed",
+        "VERIFIED WITH GAPS": "Checks completed with gaps",
+    }.get(headline, "Not verified")
+
+
 def _attr_esc(s):
     """HTML-attribute-escape a string destined for content="...".`"""
     return (str(s).replace("&", "&amp;").replace('"', "&quot;")
@@ -1213,10 +1381,14 @@ def _render_fallback_html(proof):
     rows.append("<ul>")
     rows.append("<li>Cost (USD): %s</li>" % (
         esc(usd_disp) if usd_disp is not None else "not recorded for this run"))
-    rows.append("<li>Input tokens: %s</li>" % esc(cost.get("input_tokens", 0)))
-    rows.append("<li>Output tokens: %s</li>" % esc(cost.get("output_tokens", 0)))
-    rows.append("<li>Cache read tokens: %s</li>" % esc(cost.get("cache_read_tokens", 0)))
-    rows.append("<li>Cache creation tokens: %s</li>" % esc(cost.get("cache_creation_tokens", 0)))
+    def token_value(key):
+        value = cost.get(key)
+        return value if value is not None else "not recorded"
+
+    rows.append("<li>Input tokens: %s</li>" % esc(token_value("input_tokens")))
+    rows.append("<li>Output tokens: %s</li>" % esc(token_value("output_tokens")))
+    rows.append("<li>Cache read tokens: %s</li>" % esc(token_value("cache_read_tokens")))
+    rows.append("<li>Cache creation tokens: %s</li>" % esc(token_value("cache_creation_tokens")))
     rows.append("<li>Wall clock (sec): %s</li>" % esc(proof.get("wall_clock_sec", 0)))
     rows.append("</ul>")
 
@@ -1269,6 +1441,9 @@ def _render_html(proof, repo_root):
     tpl = _read_text(template_path, default="")
     marker = "__PROOF_JSON__"
     if tpl and marker in tpl:
+        receipt_title = _receipt_title(proof)
+        tpl = tpl.replace("__PROOF_RECEIPT_TITLE__", _attr_esc(receipt_title))
+        tpl = tpl.replace("__PROOF_RECEIPT_TITLE_JSON__", json.dumps(receipt_title))
         # Substitute the dynamic social hook BEFORE the JSON payload, so a proof
         # value that happens to contain the hook token cannot get clobbered.
         # The hook embeds the real measured cost + files-changed + council ratio
@@ -1406,7 +1581,14 @@ def generate(args):
     return out_dir
 
 
-def main(argv=None):
+def build_parser():
+    """The generator's CLI parser.
+
+    Split out of main() so callers (notably the tests, which drive generate()
+    directly with a synthetic args object) can obtain every argument at its
+    declared default instead of hand-listing fields that go stale whenever a new
+    argument lands here.
+    """
     parser = argparse.ArgumentParser(description="Loki Mode proof-of-run generator")
     parser.add_argument("--loki-dir", default=".loki")
     parser.add_argument("--out-dir", default="")
@@ -1414,8 +1596,13 @@ def main(argv=None):
     parser.add_argument("--run-id", default="")
     parser.add_argument("--loki-version", default="")
     parser.add_argument("--provider", default="")
+    parser.add_argument("--session-exit-code", type=int, default=None)
     parser.add_argument("--quiet", action="store_true")
-    args = parser.parse_args(argv)
+    return parser
+
+
+def main(argv=None):
+    args = build_parser().parse_args(argv)
 
     try:
         generate(args)