loki-mode 7.129.5 → 8.0.0

package/autonomy/council-v2.sh

@@ -273,6 +273,45 @@ Respond ONLY with a valid JSON object. No markdown fencing."
     local result
     case "${PROVIDER_NAME:-claude}" in
         claude)
+            # v8 RAW-SDK JUDGE PATH (opt-in LOKI_SDK_COUNCIL_V2=1). Run this
+            # reviewer verdict via the pure-HTTPS @anthropic-ai/sdk (no claude
+            # binary) through the loki-ts `internal sdk-judge` bridge, same schema
+            # (council-v2-schema.json), same JSON output the extractor below
+            # consumes -> parity by construction. Fail-closed: any miss (flag off,
+            # no ANTHROPIC_API_KEY, non-zero, empty) falls through to the claude
+            # path. Runs BEFORE the claude-binary guard so the SDK path is
+            # genuinely binary-free. Default OFF = zero behavior change.
+            if [ "${LOKI_SDK_COUNCIL_V2:-0}" = "1" ]; then
+                local _c2_sdk_root _c2_sdk_loki _c2_sdk_schema _c2_sdk_pf _c2_sdk_out _c2_sdk_rc
+                _c2_sdk_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+                _c2_sdk_loki="${_c2_sdk_root}/bin/loki"
+                _c2_sdk_schema="${_c2_sdk_root}/loki-ts/data/council-v2-schema.json"
+                if [ -x "$_c2_sdk_loki" ] && [ -f "$_c2_sdk_schema" ] && command -v bun >/dev/null 2>&1; then
+                    _c2_sdk_pf="$(mktemp 2>/dev/null)" || _c2_sdk_pf=""
+                    if [ -n "$_c2_sdk_pf" ]; then
+                        printf '%s' "$full_prompt" > "$_c2_sdk_pf"
+                        _c2_sdk_rc=0
+                        # Explicit in-process timeout + OS-level ceiling on the bun
+                        # subprocess (council review: default 120s + maxRetries could
+                        # stack, and a cold-start could hang with no cap). Bound both.
+                        local _c2_to_s="${LOKI_SDK_REVIEW_TIMEOUT:-180}"
+                        local _c2_wrap
+                        if command -v timeout >/dev/null 2>&1; then _c2_wrap="timeout $(( _c2_to_s + 15 ))"
+                        elif command -v gtimeout >/dev/null 2>&1; then _c2_wrap="gtimeout $(( _c2_to_s + 15 ))"
+                        else _c2_wrap=""; fi
+                        _c2_sdk_out="$($_c2_wrap "$_c2_sdk_loki" internal sdk-judge \
+                            --prompt-file "$_c2_sdk_pf" --schema-file "$_c2_sdk_schema" \
+                            --model "${LOKI_SDK_JUDGE_MODEL:-claude-haiku-4-5}" --effort low \
+                            --timeout-ms "$(( _c2_to_s * 1000 ))" 2>/dev/null)" || _c2_sdk_rc=$?
+                        rm -f "$_c2_sdk_pf" 2>/dev/null || true
+                        if [ "$_c2_sdk_rc" -eq 0 ] && [ -n "$_c2_sdk_out" ]; then
+                            echo "$_c2_sdk_out" > "$output_file"
+                            return 0
+                        fi
+                    fi
+                fi
+                # fall through to the claude path (fail-closed)
+            fi
             if command -v claude &>/dev/null; then
                 # EMBED 2 + 3 (v7.33.0). Council-v2 reviewer verdict. $full_prompt
                 # is self-contained (evidence + PRD + strict JSON output, via

package/autonomy/crash.sh

@@ -207,11 +207,12 @@ loki_crash_friction() {
 # Kept as a callable no-op so existing callers (run.sh) do not break, and still
 # records the DISCLOSURE_SHOWN sentinel for back-compat with any reader of it.
 loki_show_disclosure_once() {
-    local config="${HOME}/.loki/config"
+    local config_root="${LOKI_DIR:-${HOME}/.loki}"
+    local config="${config_root}/config"
     if [ -f "$config" ] && grep -q "^DISCLOSURE_SHOWN=true" "$config" 2>/dev/null; then
         return 0
     fi
-    mkdir -p "${HOME}/.loki" 2>/dev/null || return 0
+    mkdir -p "$config_root" 2>/dev/null || return 0
     echo "DISCLOSURE_SHOWN=true" >> "$config" 2>/dev/null || true
     return 0
 }

package/autonomy/grill.sh

@@ -138,6 +138,14 @@ grill_check_provider() {
     local provider="${LOKI_PROVIDER:-claude}"
     case "$provider" in
         claude)
+            # v8: the raw-SDK grill path (LOKI_SDK_GRILL=1) needs no claude binary,
+            # so the precondition passes when that path is viable (bridge + bun).
+            # grill_invoke_provider still fails closed to claude on an SDK miss.
+            if [ "${LOKI_SDK_GRILL:-0}" = "1" ] \
+               && [ -x "$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)/bin/loki" ] \
+               && command -v bun >/dev/null 2>&1; then
+                return 0
+            fi
             if ! command -v claude >/dev/null 2>&1; then
                 _grill_err "Claude Code CLI not found. Install: https://docs.anthropic.com/en/docs/claude-code"
                 return $GRILL_EXIT_ERROR
@@ -181,6 +189,40 @@ grill_invoke_provider() {
 
     case "$provider" in
         claude)
+            # v8 RAW-SDK TEXT PATH (opt-in LOKI_SDK_GRILL=1). Free-form grill via
+            # the pure-HTTPS @anthropic-ai/sdk (no claude binary) through the
+            # loki-ts `internal sdk-text` bridge. Runs BEFORE the claude-binary
+            # check so the no-binary deploy win holds. Fail-closed: on ANY miss
+            # (flag off, no key, bun/entrypoint absent, non-zero, empty) fall
+            # through to the claude path below. Output is the free-form question
+            # text loki-grill parses, same as the claude path.
+            if [ "${LOKI_SDK_GRILL:-0}" = "1" ]; then
+                local _gs_root _gs_loki _gs_pf _gs_out _gs_rc
+                _gs_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+                _gs_loki="${_gs_root}/bin/loki"
+                if [ -x "$_gs_loki" ] && command -v bun >/dev/null 2>&1; then
+                    _gs_pf="$(mktemp 2>/dev/null)" || _gs_pf=""
+                    if [ -n "$_gs_pf" ]; then
+                        printf '%s' "$prompt" > "$_gs_pf"
+                        _gs_rc=0
+                        local _gs_to_s="${LOKI_GRILL_TIMEOUT:-180}"
+                        local _gs_wrap
+                        if command -v timeout >/dev/null 2>&1; then _gs_wrap="timeout $(( _gs_to_s + 15 ))"
+                        elif command -v gtimeout >/dev/null 2>&1; then _gs_wrap="gtimeout $(( _gs_to_s + 15 ))"
+                        else _gs_wrap=""; fi
+                        _gs_out="$($_gs_wrap "$_gs_loki" internal sdk-text \
+                            --prompt-file "$_gs_pf" \
+                            --model "${LOKI_SDK_GRILL_MODEL:-claude-sonnet-5}" --effort high \
+                            --timeout-ms "$(( _gs_to_s * 1000 ))" 2>/dev/null)" || _gs_rc=$?
+                        rm -f "$_gs_pf" 2>/dev/null || true
+                        if [ "$_gs_rc" -eq 0 ] && [ -n "$_gs_out" ]; then
+                            printf '%s\n' "$_gs_out"
+                            return 0
+                        fi
+                    fi
+                fi
+                # fall through to the claude path (fail-closed)
+            fi
             if ! command -v claude >/dev/null 2>&1; then
                 _grill_err "Claude Code CLI not found. Install: https://docs.anthropic.com/en/docs/claude-code"
                 return $GRILL_EXIT_ERROR

package/autonomy/hooks/validate-bash.sh

@@ -5,8 +5,306 @@
 set -uo pipefail
 
 INPUT=$(cat)
-COMMAND=$(echo "$INPUT" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('tool_input',{}).get('command',''))")
-CWD=$(echo "$INPUT" | python3 -c "import sys,json; print(json.load(sys.stdin).get('cwd',''))")
+
+deny() {
+    local reason="${1:-Blocked by Loki command policy}"
+    if command -v python3 >/dev/null 2>&1; then
+        printf '%s' "$reason" | python3 -c '
+import json, sys
+print(json.dumps({"hookSpecificOutput": {
+    "hookEventName": "PreToolUse",
+    "permissionDecision": "deny",
+    "permissionDecisionReason": sys.stdin.read(),
+}}))
+'
+    else
+        printf '%s' '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"deny","permissionDecisionReason":"Blocked by Loki command policy"}}'
+    fi
+    exit 2
+}
+
+HOST_GUARD=false
+case "${LOKI_HOST_GUARD:-0}" in
+    1|true|yes|on) HOST_GUARD=true ;;
+esac
+
+if ! command -v python3 >/dev/null 2>&1; then
+    "$HOST_GUARD" && deny "LOKI_HOST_GUARD: python3 is unavailable, so the Bash command cannot be inspected safely."
+    printf '%s' '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"allow"}}'
+    exit 0
+fi
+
+if ! COMMAND=$(printf '%s' "$INPUT" | python3 -c '
+import json, sys
+try:
+    data = json.load(sys.stdin)
+    command = (data.get("tool_input") or {}).get("command")
+except Exception:
+    raise SystemExit(2)
+if not isinstance(command, str) or not command.strip():
+    raise SystemExit(2)
+sys.stdout.write(command)
+'); then
+    "$HOST_GUARD" && deny "LOKI_HOST_GUARD: malformed or missing Bash command input was denied."
+    printf '%s' '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"allow"}}'
+    exit 0
+fi
+
+CWD=$(printf '%s' "$INPUT" | python3 -c '
+import json, sys
+try:
+    cwd = json.load(sys.stdin).get("cwd", "")
+except Exception:
+    cwd = ""
+sys.stdout.write(cwd if isinstance(cwd, str) else "")
+' 2>/dev/null || true)
+
+if "$HOST_GUARD"; then
+    GUARD_ROOT="${LOKI_TARGET_DIR:-$PWD}"
+    if [ -z "$CWD" ] || ! _LOKI_GUARD_CWD="$CWD" _LOKI_GUARD_ROOT="$GUARD_ROOT" python3 -c '
+import os
+cwd = os.path.realpath(os.environ["_LOKI_GUARD_CWD"])
+root = os.path.realpath(os.environ["_LOKI_GUARD_ROOT"])
+raise SystemExit(0 if cwd == root or cwd.startswith(root + os.sep) else 1)
+'; then
+        deny "LOKI_HOST_GUARD: Bash command cwd is outside the assigned workspace."
+    fi
+fi
+CWD="${CWD:-${LOKI_TARGET_DIR:-$PWD}}"
+
+# Hosted builds run on a shared host. This guard prevents recognizable direct
+# command mistakes involving host containers, processes, and listening ports.
+# It is not process isolation: an allowed package script or interpreter can
+# perform the same operations internally. Production builds still require a
+# separate container or microVM with no host Docker socket, restricted
+# credentials, and network policy. This parser only inspects text.
+if "$HOST_GUARD"; then
+    HOST_GUARD_REASON=$(_LOKI_GUARD_COMMAND="$COMMAND" python3 - <<'PY'
+import os
+import re
+import shlex
+
+command = os.environ.get("_LOKI_GUARD_COMMAND", "")
+blocked = {
+    "docker": "host Docker access",
+    "docker-compose": "host Docker access",
+    "kill": "host process control",
+    "killall": "host process control",
+    "pkill": "host process control",
+    "sudo": "host privilege escalation",
+    "doas": "host privilege escalation",
+    "launchctl": "host service control",
+    "service": "host service control",
+    "systemctl": "host service control",
+}
+wrappers = {"command", "env", "exec", "nohup", "time"}
+wrapper_value_options = {
+    "env": {"-u", "--unset", "-C", "--chdir"},
+    "exec": {"-a"},
+    "time": {"-f", "--format", "-o", "--output"},
+}
+shells = {"bash", "dash", "ksh", "sh", "zsh"}
+separators = {";", "&", "&&", "|", "||", "(", ")"}
+assignment = re.compile(r"^[A-Za-z_][A-Za-z0-9_]*=.*$", re.S)
+
+
+def basename(value):
+    return value.rstrip("/").rsplit("/", 1)[-1]
+
+
+def words(value):
+    lexer = shlex.shlex(value.replace("\n", " ; "), posix=True,
+                        punctuation_chars=";&|()")
+    lexer.whitespace_split = True
+    lexer.commenters = ""
+    return list(lexer)
+
+
+def first_command(segment):
+    index = 0
+    while index < len(segment) and assignment.match(segment[index]):
+        index += 1
+    while index < len(segment):
+        name = basename(segment[index])
+        if name not in wrappers:
+            return name, index
+        index += 1
+        while index < len(segment):
+            token = segment[index]
+            if assignment.match(token):
+                index += 1
+                continue
+            if token == "--":
+                index += 1
+                break
+            if name == "env" and token in {"-S", "--split-string"}:
+                return "__uninspectable_wrapper__", index
+            if token in wrapper_value_options.get(name, set()):
+                index += 2
+                continue
+            if token.startswith("-"):
+                index += 1
+                continue
+            break
+    return "", index
+
+
+def classify(value, depth=0):
+    if depth > 2:
+        return "command nesting exceeds the safe inspection limit"
+    try:
+        tokens = words(value)
+    except ValueError:
+        return "command text could not be parsed safely"
+
+    segment = []
+    segments = []
+    for token in tokens:
+        if token in separators:
+            if segment:
+                segments.append(segment)
+                segment = []
+        else:
+            segment.append(token)
+    if segment:
+        segments.append(segment)
+
+    for part in segments:
+        name, index = first_command(part)
+        if name == "__uninspectable_wrapper__":
+            return "command wrapper cannot be inspected safely"
+        if name in blocked:
+            return blocked[name]
+
+        args = part[index + 1:]
+        if name in shells:
+            for pos, arg in enumerate(args[:-1]):
+                if arg.startswith("-") and "c" in arg:
+                    nested = classify(args[pos + 1], depth + 1)
+                    if nested:
+                        return nested
+
+        if name == "xargs":
+            for arg in args:
+                if arg.startswith("-"):
+                    continue
+                target = basename(arg)
+                if target in blocked:
+                    return blocked[target]
+                break
+
+        if name == "find":
+            for pos, arg in enumerate(args[:-1]):
+                if arg in {"-exec", "-execdir", "-ok", "-okdir"}:
+                    target = basename(args[pos + 1])
+                    if target in blocked:
+                        return blocked[target]
+
+        if name in {"bunx", "npx"} and args:
+            target = basename(next((arg for arg in args if not arg.startswith("-")), ""))
+            if target in blocked:
+                return blocked[target]
+        if name in {"npm", "pnpm", "yarn"} and args and args[0] in {"exec", "x"}:
+            target = basename(next((arg for arg in args[1:] if not arg.startswith("-")), ""))
+            if target in blocked:
+                return blocked[target]
+
+        if name == "brew" and args and args[0] == "services":
+            return "host service control"
+        if name in {"nc", "ncat", "netcat"} and any(arg == "-l" or arg.startswith("-l") for arg in args):
+            return "host port listener"
+        if name == "socat" and any("LISTEN:" in arg.upper() for arg in args):
+            return "host port listener"
+
+    port_assignment = re.search(
+        r"(?<![A-Za-z0-9_])(?:PORT|HOST_PORT|LISTEN_PORT)\s*=\s*['\"]?([0-9]+)",
+        command,
+    )
+    if port_assignment and int(port_assignment.group(1)) != 0:
+        return "explicit host port claim"
+
+    port_flag = re.search(
+        r"(?:^|\s)(?:--port|--publish)(?:=|\s+)([0-9]+)",
+        command,
+    )
+    if port_flag and int(port_flag.group(1)) != 0:
+        return "explicit host port claim"
+
+    http_server = re.search(r"\bhttp\.server\s+([0-9]+)", command)
+    if http_server and int(http_server.group(1)) != 0:
+        return "host port listener"
+    return ""
+
+
+reason = classify(command)
+if reason:
+    print("LOKI_HOST_GUARD: refusing " + reason + ". Use the platform sandbox and lifecycle APIs instead.")
+PY
+    )
+    if [ -n "$HOST_GUARD_REASON" ]; then
+        deny "$HOST_GUARD_REASON"
+    fi
+fi
+
+# The supervised simple-web worker prepares dependencies and owns preview,
+# browser, proof, and process lifecycle. Model-launched installs, watchers, dev
+# servers, and Git loops only add latency or escape the bounded execution plan.
+# Enforce that contract at the command boundary so it applies to every model,
+# not only to models that follow the prompt perfectly.
+if [ "${LOKI_SUPERVISED_BUILD:-0}" = "1" ] \
+   && [ "${LOKI_BUILD_PROFILE:-}" = "simple-web" ]; then
+    SIMPLE_WEB_GUARD_REASON=$(_LOKI_SIMPLE_COMMAND="$COMMAND" \
+        _LOKI_SIMPLE_CWD="$CWD" python3 - <<'PY'
+import json
+import os
+import re
+
+command = os.environ.get("_LOKI_SIMPLE_COMMAND", "")
+cwd = os.environ.get("_LOKI_SIMPLE_CWD", "")
+
+rules = (
+    (
+        re.compile(r"(?:^|[;&|()]|&&|\|\|)\s*(?:env\s+[^;&|()]*\s+)?(?:npm|pnpm|yarn|bun)\s+(?:i|install|add|update|upgrade)\b", re.I),
+        "dependency changes are owned by the prepared scaffold",
+    ),
+    (
+        re.compile(r"(?:^|[;&|()]|&&|\|\|)\s*(?:npm\s+run\s+dev|pnpm\s+(?:run\s+)?dev|yarn\s+dev|bun\s+run\s+dev|next\s+dev|vite(?:\s|$))", re.I),
+        "development servers are owned by the preview harness",
+    ),
+    (
+        re.compile(r"(?:^|[;&|()]|&&|\|\|)\s*git(?:\s|$)", re.I),
+        "Git operations are outside the hosted simple-web implementation step",
+    ),
+    (
+        re.compile(r"(?:^|\s)--watch(?:All)?(?:=\S+)?(?:\s|$)", re.I),
+        "watch-mode tests do not terminate",
+    ),
+)
+
+for pattern, reason in rules:
+    if pattern.search(command):
+        print(reason)
+        raise SystemExit(0)
+
+# `npm test` can hide a watcher in package.json. Inspect only the assigned
+# workspace manifest and direct the model to a one-shot script when available.
+if re.search(r"(?:^|[;&|()]|&&|\|\|)\s*npm\s+(?:run\s+)?test(?:\s|$)", command, re.I):
+    try:
+        with open(os.path.join(cwd, "package.json"), encoding="utf-8") as handle:
+            script = str((json.load(handle).get("scripts") or {}).get("test") or "")
+    except (OSError, ValueError, TypeError):
+        script = ""
+    if re.search(r"(?:^|\s)--watch(?:All)?(?:=\S+)?(?:\s|$)", script, re.I):
+        print("the package test script starts a watcher; use test:ci or a one-shot runner")
+        raise SystemExit(0)
+
+print("")
+PY
+    )
+    if [ -n "$SIMPLE_WEB_GUARD_REASON" ]; then
+        deny "LOKI_SIMPLE_WEB_GUARD: ${SIMPLE_WEB_GUARD_REASON}."
+    fi
+fi
 
 # Dangerous command patterns (matched anywhere in the command string)
 # Safe paths like /tmp/ and relative paths (./) are excluded below
@@ -62,8 +360,7 @@ for pattern in "${BLOCKED_PATTERNS[@]}"; do
             fi
         done
         "$is_safe" && continue
-        printf '%s' '{"hookSpecificOutput": {"hookEventName": "PreToolUse", "permissionDecision": "deny", "permissionDecisionReason": "Blocked: potentially dangerous command pattern detected"}}'
-        exit 2
+        deny "Blocked: potentially dangerous command pattern detected"
     fi
 done
 

package/autonomy/lib/cockpit-render.sh

@@ -373,12 +373,18 @@ PYEV
 
 # Print a steering hint for the focused run. Steering is opt-in prompt injection;
 # this only tells the operator how, it does not inject anything.
+# RUN-25 iter 22 (Wave D #3): the hint used to name .loki/steering.md, which
+# NOTHING reads -- a control the UI advertised silently no-op'd (a quiet lie to
+# the operator). The file the loop actually reads is .loki/HUMAN_INPUT.md, gated
+# behind LOKI_PROMPT_INJECTION=1. Name the REAL file + flag (or the `loki steer`
+# helper) so the advertised control genuinely steers the run.
 cockpit_steer_hint() {
     local focus_repo="$1"
     local repo="${focus_repo:-$(pwd)}"
     printf '\n'
     echo "Steer this run"
-    echo "  Drop a note the next iteration will read:"
-    echo "    echo 'your guidance' > $repo/.loki/steering.md"
+    echo "  Drop a note the next iteration will read (needs LOKI_PROMPT_INJECTION=1):"
+    echo "    loki steer 'your guidance'            # writes it for you"
+    echo "    echo 'your guidance' > $repo/.loki/HUMAN_INPUT.md"
     echo "  Or open the dashboard chat: loki dashboard"
 }

package/autonomy/lib/cr-rematerialize.py

@@ -32,8 +32,13 @@ import sys
 _BLOCKING = {"CRITICAL", "HIGH"}
 
 
-def rematerialize(raw):
-    """Return legacy VERDICT/FINDINGS text, or raise ValueError(exit_code)."""
+def _payload(raw):
+    """Return the structured payload from a CLI envelope or bare SDK result."""
+    raw = raw.strip()
+    if raw.startswith("```") and raw.endswith("```"):
+        first_newline = raw.find("\n")
+        if first_newline != -1:
+            raw = raw[first_newline + 1 : -3].strip()
     try:
         env = json.loads(raw)
     except Exception:
@@ -54,14 +59,92 @@ def rematerialize(raw):
                 payload = json.loads(res)
             except Exception:
                 payload = None
+    # v8 raw-SDK path: `loki internal sdk-judge` emits the BARE payload object
+    # (no CLI envelope), so there is no 'structured_output'/'result' wrapper. If
+    # the top-level dict itself carries the payload's 'verdict' key, it IS the
+    # payload. The stop_reason guard above already passes for a bare object
+    # (no 'stop_reason' key -> None -> allowed).
+    if not isinstance(payload, dict) and "verdict" in env:
+        payload = env
     if not isinstance(payload, dict):
         raise ValueError(5)
 
+    return payload
+
+
+def _requirement_contract(payload, manifest_source):
+    if isinstance(manifest_source, dict):
+        manifest = manifest_source
+    else:
+        try:
+            with open(manifest_source, encoding="utf-8") as handle:
+                manifest = json.load(handle)
+        except (OSError, json.JSONDecodeError):
+            raise ValueError(8)
+    if not isinstance(manifest, dict):
+        raise ValueError(8)
+    expected = manifest.get("requirements")
+    actual = payload.get("requirements")
+    findings = payload.get("findings")
+    if (
+        set(payload)
+        != {"schema", "spec_sha256", "verdict", "requirements", "findings"}
+        or manifest.get("schema") != "loki-requirements-manifest/v1"
+        or payload.get("schema") != "loki-requirements-verdict/v1"
+        or payload.get("spec_sha256") != manifest.get("spec_sha256")
+        or not isinstance(expected, list)
+        or not expected
+        or not isinstance(actual, list)
+        or len(actual) != len(expected)
+        or not isinstance(findings, list)
+    ):
+        raise ValueError(8)
+
+    expected_ids = [item.get("id") for item in expected if isinstance(item, dict)]
+    actual_ids = [item.get("id") for item in actual if isinstance(item, dict)]
+    if len(expected_ids) != len(expected) or actual_ids != expected_ids:
+        raise ValueError(8)
+    for item in actual:
+        if (
+            set(item) != {"id", "status", "evidence"}
+            or item.get("status") not in ("PASS", "FAIL")
+            or not isinstance(item.get("evidence"), str)
+            or not item["evidence"].strip()
+            or len(item["evidence"]) > 2000
+        ):
+            raise ValueError(8)
+
+    for finding in findings:
+        if (
+            not isinstance(finding, dict)
+            or set(finding) != {"severity", "description"}
+            or finding.get("severity")
+            not in ("Critical", "High", "Medium", "Low")
+            or not isinstance(finding.get("description"), str)
+            or not finding["description"].strip()
+            or len(finding["description"]) > 2000
+        ):
+            raise ValueError(8)
+
     verdict = str(payload.get("verdict", "")).strip().upper()
     if verdict not in ("PASS", "FAIL"):
         raise ValueError(6)
+    if findings or any(item["status"] != "PASS" for item in actual):
+        verdict = "FAIL"
+    return verdict, findings
+
+
+def rematerialize(raw, manifest_source=""):
+    """Return legacy VERDICT/FINDINGS text, or raise ValueError(exit_code)."""
+    payload = _payload(raw)
+    if manifest_source:
+        verdict, findings = _requirement_contract(payload, manifest_source)
+    else:
+        verdict = str(payload.get("verdict", "")).strip().upper()
+        findings = payload.get("findings")
+    if verdict not in ("PASS", "FAIL"):
+        raise ValueError(6)
 
-    findings = payload.get("findings")
     if not isinstance(findings, list):
         findings = []
 
@@ -101,7 +184,21 @@ def main():
         return 2
 
     try:
-        text = rematerialize(raw)
+        manifest_source = os.environ.get(
+            "_LOKI_CR_REQUIREMENTS_MANIFEST_JSON", ""
+        )
+        if manifest_source:
+            try:
+                manifest_source = json.loads(manifest_source)
+            except json.JSONDecodeError:
+                return 8
+        else:
+            manifest_source = os.environ.get(
+                "_LOKI_CR_REQUIREMENTS_MANIFEST", ""
+            )
+        text = rematerialize(
+            raw, manifest_source
+        )
     except ValueError as e:
         return int(e.args[0])