loki-mode 7.15.0 → 7.16.0

package/dashboard/server.py

@@ -460,6 +460,7 @@ async def _push_loki_state_loop() -> None:
     last_mtime: float = 0.0
     _last_skill_hash: str = ""  # Track skill-session state changes
     _last_budget_status: str = ""  # Track budget-status transitions (R3)
+    _last_trust_signature: str = ""  # Track trust-trajectory changes (R4)
     while True:
         try:
             if not manager.active_connections:
@@ -490,6 +491,30 @@ async def _push_loki_state_loop() -> None:
             except (OSError, ValueError, KeyError):
                 pass
 
+            # R4 visible trust trajectory: proactively push a trust_update when
+            # the trajectory's improving/regressing tally changes (e.g. a new
+            # run just landed a council pass), so an open dashboard reflects the
+            # earned-autonomy trend without a manual refresh. Mirrors the R3
+            # budget_status transition push; reuses manager.broadcast (no second
+            # channel). Signature gates the push so we only broadcast on change.
+            try:
+                _tmod = _load_trust_module()
+                if _tmod is not None:
+                    _traj = _tmod.compute_trajectory(str(loki_dir))
+                    _sig = "%d:%d:%d" % (
+                        _traj.get("runs_count", 0),
+                        _traj.get("improving_count", 0),
+                        _traj.get("regressing_count", 0),
+                    )
+                    if _sig != _last_trust_signature:
+                        await manager.broadcast({
+                            "type": "trust_update",
+                            "data": _traj,
+                        })
+                    _last_trust_signature = _sig
+            except (OSError, ValueError, KeyError):
+                pass
+
             _broadcast_sent = False
 
             if state_file.exists():
@@ -4780,6 +4805,81 @@ async def get_cost_timeline():
     }
 
 
+# =============================================================================
+# Trust trajectory API (R4): is the agent earning autonomy on THIS repo?
+# =============================================================================
+
+_TRUST_MODULE = None  # cached import of autonomy/lib/trust_trajectory.py
+
+
+def _load_trust_module():
+    """Import the shared trust-trajectory derivation (single source of truth).
+
+    The derivation lives in autonomy/lib/trust_trajectory.py so the dashboard
+    endpoint, the bash `cmd_trust`, and the test suite all agree. Loaded via
+    importlib because autonomy/lib is not an importable package. Cached after
+    first load. Returns None if the module cannot be found (degraded mode).
+    """
+    global _TRUST_MODULE
+    if _TRUST_MODULE is not None:
+        return _TRUST_MODULE
+    repo_root = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+    mod_path = os.path.join(repo_root, "autonomy", "lib", "trust_trajectory.py")
+    if not os.path.isfile(mod_path):
+        return None
+    try:
+        import importlib.util as _ilu
+        spec = _ilu.spec_from_file_location("trust_trajectory", mod_path)
+        if spec is None or spec.loader is None:
+            return None
+        mod = _ilu.module_from_spec(spec)
+        spec.loader.exec_module(mod)
+        _TRUST_MODULE = mod
+        return mod
+    except Exception:
+        return None
+
+
+@app.get("/api/trust/trajectory")
+async def get_trust_trajectory():
+    """Per-project trust trajectory derived from proof-of-run history.
+
+    Mirrors /api/cost/timeline: reads the persistent per-run records under
+    .loki/proofs/<run_id>/proof.json (the same source R3 cost history uses) and
+    derives whether the agent is earning autonomy on THIS repo over time:
+    council pass-rate, gate pass-rate, iterations-to-completion, and (when
+    recorded) human interventions, each with an up/down/flat direction and an
+    `improving` flag that already accounts for per-axis polarity.
+
+    Honest-data rule: with fewer than 2 recorded runs the response is
+    insufficient=True and NO direction is fabricated. Every number derives from
+    real proof.json values; a missing axis is reported available=False, never a
+    misleading zero. No PII leaves the derivation (only run_id, timestamps, and
+    derived numeric axes).
+    """
+    loki_dir = _get_loki_dir()
+    mod = _load_trust_module()
+    if mod is None:
+        return {
+            "schema_version": 1,
+            "available": False,
+            "error": "trust_trajectory module not found",
+            "runs_count": 0,
+            "insufficient": True,
+            "axes": {},
+            "series": [],
+            "notes": ["trust derivation module unavailable in this install"],
+        }
+    traj = mod.compute_trajectory(str(loki_dir))
+    # Best-effort cache write so other surfaces share one source of truth.
+    try:
+        mod.write_trajectory_cache(str(loki_dir), traj)
+    except Exception:
+        pass
+    traj["available"] = True
+    return traj
+
+
 # =============================================================================
 # Pricing API
 # =============================================================================
@@ -6764,6 +6864,18 @@ async def serve_cost_panel():
     return Response(status_code=404)
 
 
+# R4: standalone trust-trajectory page that fetches /api/trust/trajectory.
+# Mirrors the cost.html / /cost pattern: works without the SPA build.
+@app.get("/trust", include_in_schema=False)
+async def serve_trust_panel():
+    """Serve the standalone trust-trajectory HTML panel."""
+    if STATIC_DIR:
+        trust_path = os.path.join(STATIC_DIR, "trust.html")
+        if os.path.isfile(trust_path):
+            return FileResponse(trust_path, media_type="text/html")
+    return Response(status_code=404)
+
+
 # Serve index.html or standalone HTML for root
 @app.get("/", include_in_schema=False)
 async def serve_index():

package/dashboard/static/index.html

@@ -679,6 +679,10 @@
           <svg viewBox="0 0 24 24"><line x1="12" y1="1" x2="12" y2="23"/><path d="M17 5H9.5a3.5 3.5 0 000 7h5a3.5 3.5 0 010 7H6"/></svg>
           Cost
         </button>
+        <button class="nav-link" data-section="trust" id="nav-trust">
+          <svg viewBox="0 0 24 24"><polyline points="3 17 9 11 13 15 21 7" fill="none" stroke="currentColor" stroke-width="2"/><polyline points="15 7 21 7 21 13" fill="none" stroke="currentColor" stroke-width="2"/></svg>
+          Trust
+        </button>
         <button class="nav-link" data-section="checkpoint" id="nav-checkpoint">
           <svg viewBox="0 0 24 24"><path d="M19 21H5a2 2 0 01-2-2V5a2 2 0 012-2h11l5 5v11a2 2 0 01-2 2z"/><polyline points="17 21 17 13 7 13 7 21"/><polyline points="7 3 7 8 15 8"/></svg>
           Checkpoints
@@ -1109,6 +1113,17 @@
         <loki-cost-dashboard id="cost-dashboard"></loki-cost-dashboard>
       </div>
 
+      <!-- Trust Trajectory (R4): embeds the standalone /trust panel so the SPA
+           and the build-free page share one renderer + one /api/trust/trajectory
+           source. Mirrors the cost panel wiring. -->
+      <div class="section-page" id="page-trust">
+        <div class="section-page-header">
+          <h2 class="section-page-title">Trust Trajectory</h2>
+        </div>
+        <iframe id="trust-frame" title="Trust trajectory" src="about:blank"
+          style="width:100%;height:calc(100vh - 160px);border:0;border-radius:8px;background:#0f1115;"></iframe>
+      </div>
+
       <!-- Checkpoints -->
       <div class="section-page" id="page-checkpoint">
         <div class="section-page-header">
@@ -13808,6 +13823,15 @@ document.addEventListener('DOMContentLoaded', function() {
     if (pageEl) {
       pageEl.classList.add('active');
     }
+    // R4: lazy-load the trust panel iframe on first open (avoids a fetch on
+    // every page that the user never visits).
+    if (sectionId === 'trust') {
+      var tframe = document.getElementById('trust-frame');
+      if (tframe && (!tframe.src || tframe.src === 'about:blank' ||
+          tframe.getAttribute('src') === 'about:blank')) {
+        tframe.src = '/trust';
+      }
+    }
     // Update nav active state
     navLinks.forEach(function(link) { link.classList.remove('active'); });
     var navEl = document.querySelector('.nav-link[data-section="' + sectionId + '"]');
@@ -13834,7 +13858,7 @@ document.addEventListener('DOMContentLoaded', function() {
   document.addEventListener('keydown', function(e) {
     if ((e.metaKey || e.ctrlKey) && ((e.key >= '1' && e.key <= '9') || e.key === '0')) {
       e.preventDefault();
-      var sections = ['overview', 'insights', 'prd-checklist', 'app-runner', 'council', 'quality', 'cost', 'checkpoint', 'context', 'notifications', 'migration', 'analytics', 'escalations'];
+      var sections = ['overview', 'insights', 'prd-checklist', 'app-runner', 'council', 'quality', 'cost', 'trust', 'checkpoint', 'context', 'notifications', 'migration', 'analytics', 'escalations'];
       var idx = e.key === '0' ? 9 : parseInt(e.key) - 1;
       if (idx < sections.length) switchSection(sections[idx]);
     }
@@ -13875,7 +13899,7 @@ document.addEventListener('DOMContentLoaded', function() {
     // Skip if modifier keys are held (let browser defaults work)
     if (e.metaKey || e.ctrlKey || e.altKey) return;
 
-    var sections = ['overview', 'insights', 'prd-checklist', 'app-runner', 'council', 'quality', 'cost', 'checkpoint', 'context', 'notifications', 'migration', 'analytics', 'escalations'];
+    var sections = ['overview', 'insights', 'prd-checklist', 'app-runner', 'council', 'quality', 'cost', 'trust', 'checkpoint', 'context', 'notifications', 'migration', 'analytics', 'escalations'];
 
     switch (e.key) {
       // Section navigation: 1-9, 0

package/dashboard/static/trust.html

@@ -0,0 +1,271 @@
+<!DOCTYPE html>
+<!--
+  Loki Mode - Trust trajectory panel (R4, zero-build standalone).
+
+  Self-contained: all CSS + JS inlined, no external resources. Fetches
+  /api/trust/trajectory and renders, per project over runs/time, whether the
+  agent is EARNING autonomy on THIS repo: council pass-rate, gate pass-rate,
+  iterations-to-completion, and (when recorded) human interventions, each with
+  an up/down/flat direction and an inline-SVG sparkline.
+
+  The story no competitor tells. Honest-data rule: with fewer than 2 runs this
+  shows "not enough history yet", never a fabricated trend.
+-->
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>Loki Mode - Trust Trajectory</title>
+<style>
+  :root {
+    --bg: #0f1115; --panel: #171a21; --panel-2: #1d2129; --border: #2a2f3a;
+    --text: #e7e9ee; --muted: #9aa1ad; --faint: #6b7280; --accent: #6f7bf7;
+    --green: #34d399; --red: #f87171; --amber: #fbbf24;
+    --mono: ui-monospace, "SF Mono", "Menlo", "Consolas", monospace;
+    --sans: 'Inter', system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif;
+  }
+  * { box-sizing: border-box; }
+  body { margin: 0; background: var(--bg); color: var(--text); font-family: var(--sans); line-height: 1.5; }
+  a { color: var(--accent); text-decoration: none; }
+  a:hover { text-decoration: underline; }
+  .wrap { max-width: 960px; margin: 0 auto; padding: 40px 20px 80px; }
+  .head { display: flex; align-items: baseline; justify-content: space-between; margin-bottom: 8px; }
+  h1 { font-size: 24px; font-weight: 650; letter-spacing: -0.3px; margin: 0; }
+  h2 { font-size: 15px; font-weight: 600; color: var(--muted); margin: 30px 0 12px; text-transform: uppercase; letter-spacing: 0.5px; }
+  .head a { font-size: 13px; }
+  .sub { color: var(--muted); font-size: 14px; margin: 0 0 26px; }
+  .cards { display: flex; gap: 14px; flex-wrap: wrap; }
+  .card { flex: 1 1 200px; background: var(--panel); border: 1px solid var(--border); border-radius: 12px; padding: 16px 18px; }
+  .card .label { color: var(--muted); font-size: 12px; text-transform: uppercase; letter-spacing: 0.5px; }
+  .card .val { font-family: var(--mono); font-size: 26px; font-weight: 650; margin-top: 6px; }
+  .card .note { color: var(--faint); font-size: 12px; margin-top: 4px; }
+  .axes { display: flex; flex-direction: column; gap: 12px; }
+  .axis { background: var(--panel); border: 1px solid var(--border); border-radius: 12px; padding: 16px 18px; display: flex; align-items: center; gap: 16px; }
+  .axis .meta { flex: 1 1 auto; min-width: 0; }
+  .axis .name { font-size: 14px; font-weight: 600; }
+  .axis .desc { color: var(--faint); font-size: 12px; margin-top: 2px; }
+  .axis .spark { flex: 0 0 200px; }
+  .axis .verdict { flex: 0 0 150px; text-align: right; }
+  .axis .dir { font-family: var(--mono); font-size: 14px; font-weight: 650; }
+  .axis .tag { font-size: 12px; margin-top: 2px; }
+  .dir.up { color: var(--green); }
+  .dir.down { color: var(--green); }
+  .dir.bad { color: var(--red); }
+  .dir.flat { color: var(--muted); }
+  .tag.good { color: var(--green); }
+  .tag.bad { color: var(--red); }
+  .tag.flat { color: var(--muted); }
+  .tag.na { color: var(--faint); }
+  svg { display: block; width: 100%; height: 40px; }
+  table { width: 100%; border-collapse: collapse; font-size: 13px; }
+  th, td { text-align: left; padding: 8px 10px; border-bottom: 1px solid var(--border); }
+  th { color: var(--muted); font-weight: 600; font-size: 12px; text-transform: uppercase; letter-spacing: 0.4px; }
+  td.num, th.num { text-align: right; font-family: var(--mono); }
+  .badge { font-size: 12px; font-weight: 600; padding: 2px 8px; border-radius: 6px; border: 1px solid var(--border); }
+  .b-approve { color: var(--green); border-color: rgba(52,211,153,0.4); }
+  .b-reject { color: var(--red); border-color: rgba(248,113,113,0.4); }
+  .empty { color: var(--muted); background: var(--panel); border: 1px solid var(--border); border-radius: 12px; padding: 24px; text-align: center; }
+  .empty code { font-family: var(--mono); color: var(--text); background: var(--panel-2); padding: 2px 6px; border-radius: 5px; }
+  .headline { background: var(--panel); border: 1px solid var(--border); border-radius: 12px; padding: 18px; font-size: 15px; }
+  .headline.good { border-color: rgba(52,211,153,0.4); }
+  .headline.bad { border-color: rgba(248,113,113,0.4); }
+  .mono { font-family: var(--mono); }
+  .muted { color: var(--muted); }
+</style>
+</head>
+<body>
+<div class="wrap">
+  <div class="head">
+    <h1>Trust Trajectory</h1>
+    <a href="/">Back to dashboard</a>
+  </div>
+  <p class="sub">Is the agent earning autonomy on THIS repo? Council pass-rate, gate pass-rate, iterations-to-completion, and human interventions over your run history. Real council and RARV-C data, never a fabricated trend.</p>
+  <div id="content"><p class="sub">Loading...</p></div>
+</div>
+<script>
+(function () {
+  "use strict";
+  function esc(s) {
+    s = (s === null || s === undefined) ? "" : String(s);
+    return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;")
+            .replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+  }
+  function pct(n) {
+    if (n === null || n === undefined) return "n/a";
+    n = Number(n);
+    if (!isFinite(n)) return "n/a";
+    return (n * 100).toFixed(0) + "%";
+  }
+  function num(n) {
+    if (n === null || n === undefined) return "n/a";
+    n = Number(n);
+    if (!isFinite(n)) return "n/a";
+    return String(Math.round(n * 100) / 100);
+  }
+  function badgeClass(v) {
+    v = String(v || "").toUpperCase();
+    if (v.indexOf("APPROVE") === 0 || v.indexOf("COMPLETE") === 0 || v === "PASS" || v === "PASSED") return "b-approve";
+    if (v.indexOf("REJECT") === 0 || v.indexOf("BLOCK") === 0 || v === "FAIL") return "b-reject";
+    return "";
+  }
+  // Arrow glyphs only (no emoji): ^ up, v down, - flat.
+  function arrow(direction) {
+    if (direction === "up") return "^";
+    if (direction === "down") return "v";
+    return "-";
+  }
+  // Build an inline-SVG sparkline from a numeric series (nulls skipped).
+  function sparkline(values, higherIsBetter) {
+    var pts = [];
+    var idx = [];
+    for (var i = 0; i < values.length; i++) {
+      var v = values[i];
+      if (v === null || v === undefined || !isFinite(Number(v))) continue;
+      pts.push(Number(v)); idx.push(i);
+    }
+    if (pts.length === 0) return '<span class="muted" style="font-size:12px;">no data</span>';
+    var W = 200, H = 40, pad = 4;
+    var min = Math.min.apply(null, pts), max = Math.max.apply(null, pts);
+    var range = (max - min) || 1;
+    var coords = [];
+    for (var j = 0; j < pts.length; j++) {
+      var x = pts.length === 1 ? W / 2 : pad + (j / (pts.length - 1)) * (W - 2 * pad);
+      var y = H - pad - ((pts[j] - min) / range) * (H - 2 * pad);
+      coords.push(x.toFixed(1) + "," + y.toFixed(1));
+    }
+    // Color the line by whether the last value is better than the first.
+    var stroke = "#9aa1ad";
+    if (pts.length >= 2) {
+      var rising = pts[pts.length - 1] > pts[0];
+      var falling = pts[pts.length - 1] < pts[0];
+      if ((rising && higherIsBetter) || (falling && !higherIsBetter)) stroke = "#34d399";
+      else if ((rising && !higherIsBetter) || (falling && higherIsBetter)) stroke = "#f87171";
+    }
+    return '<svg viewBox="0 0 ' + W + ' ' + H + '" preserveAspectRatio="none">' +
+      '<polyline fill="none" stroke="' + stroke + '" stroke-width="2" points="' + coords.join(" ") + '"/>' +
+      '</svg>';
+  }
+
+  var AXIS_DESC = {
+    council_pass_rate: "Share of runs the 3-reviewer council approved",
+    gate_pass_rate: "Share of quality gates passed per run",
+    iterations: "RARV iterations needed to complete a run",
+    interventions: "Human interventions needed per run"
+  };
+
+  function renderAxis(key, ax, series) {
+    var label = ax.label || key;
+    var desc = AXIS_DESC[key] || "";
+    var values = series.map(function (s) { return s[key]; });
+    var spark = sparkline(values, !!ax.higher_is_better);
+    var verdict;
+    if (!ax.available) {
+      verdict = '<div class="dir flat">-</div><div class="tag na">no data</div>';
+    } else if (ax.insufficient) {
+      verdict = '<div class="dir flat">-</div><div class="tag na">need 2+ runs</div>';
+    } else {
+      var dir = ax.direction || "flat";
+      var dirClass = dir === "flat" ? "flat" : (ax.improving ? (dir === "up" ? "up" : "down") : "bad");
+      var tagClass = ax.improving === true ? "good" : (ax.improving === false ? "bad" : "flat");
+      var tagText = ax.improving === true ? "improving" : (ax.improving === false ? "regressing" : "stable");
+      var latestStr = ax.higher_is_better ? pct(ax.latest) : num(ax.latest);
+      verdict = '<div class="dir ' + dirClass + '">' + arrow(dir) + ' ' + esc(dir) + '</div>' +
+        '<div class="tag ' + tagClass + '">' + tagText + ' (now ' + esc(latestStr) + ')</div>';
+    }
+    return '<div class="axis">' +
+      '<div class="meta"><div class="name">' + esc(label) + '</div>' +
+        '<div class="desc">' + esc(desc) + (ax.higher_is_better ? " (higher is better)" : " (lower is better)") + '</div></div>' +
+      '<div class="spark">' + spark + '</div>' +
+      '<div class="verdict">' + verdict + '</div>' +
+    '</div>';
+  }
+
+  function renderRuns(series) {
+    var html = '<h2>Run history</h2>';
+    if (!series || series.length === 0) {
+      html += '<div class="empty">No completed runs yet. Trust trajectory comes' +
+        ' from proof-of-run artifacts (<code>.loki/proofs/</code>), written at' +
+        ' the end of each run.</div>';
+      return html;
+    }
+    var rows = "";
+    for (var i = 0; i < series.length; i++) {
+      var s = series[i];
+      var cp = s.council_pass_rate;
+      var verdict = (cp === 1) ? '<span class="badge b-approve">PASS</span>'
+        : (cp === 0 ? '<span class="badge b-reject">FAIL</span>' : '<span class="muted">-</span>');
+      rows += '<tr><td class="mono">' + esc(s.run_id) + '</td>' +
+        '<td class="muted">' + esc(s.generated_at || "") + '</td>' +
+        '<td>' + verdict + '</td>' +
+        '<td class="num">' + (s.gate_pass_rate === null || s.gate_pass_rate === undefined ? "-" : pct(s.gate_pass_rate)) + '</td>' +
+        '<td class="num">' + (s.iterations === null || s.iterations === undefined ? "-" : esc(s.iterations)) + '</td>' +
+        '<td class="num">' + (s.interventions === null || s.interventions === undefined ? "-" : esc(s.interventions)) + '</td></tr>';
+    }
+    html += '<table><thead><tr>' +
+      '<th>Run</th><th>When</th><th>Council</th><th class="num">Gates</th>' +
+      '<th class="num">Iters</th><th class="num">Interv.</th>' +
+      '</tr></thead><tbody>' + rows + '</tbody></table>';
+    return html;
+  }
+
+  function render(d) {
+    var c = document.getElementById("content");
+    if (d && d.available === false) {
+      c.innerHTML = '<div class="empty">Trust trajectory is unavailable in this' +
+        ' install. ' + esc((d.notes && d.notes[0]) || "") + '</div>';
+      return;
+    }
+    var series = d.series || [];
+    if (d.insufficient) {
+      var msg = '<div class="headline"><strong>Not enough history yet.</strong><br>' +
+        'Trust trajectory needs 2 or more recorded runs to show a direction. ' +
+        esc(d.runs_count || 0) + ' run(s) recorded so far. Run <code>loki start</code> again' +
+        ' and the trend appears here, derived from real council and gate results.</div>';
+      c.innerHTML = msg + renderRuns(series);
+      return;
+    }
+    var axes = d.axes || {};
+    var imp = d.improving_count || 0, reg = d.regressing_count || 0;
+    var hClass = (imp && !reg) ? "good" : (reg && !imp ? "bad" : "");
+    var headline;
+    if (imp && !reg) headline = "Trending more trustworthy: " + imp + " axis improving, none regressing on this repo.";
+    else if (reg && !imp) headline = "Trust regressing: " + reg + " axis regressing. Review recent runs.";
+    else if (imp || reg) headline = "Mixed: " + imp + " improving, " + reg + " regressing.";
+    else headline = "Stable: no significant change across axes yet.";
+
+    var cards = '<div class="cards">' +
+      '<div class="card"><div class="label">Runs analyzed</div>' +
+        '<div class="val">' + esc(d.runs_count || 0) + '</div>' +
+        '<div class="note">from .loki/proofs/</div></div>' +
+      '<div class="card"><div class="label">Improving axes</div>' +
+        '<div class="val" style="color:var(--green);">' + esc(imp) + '</div>' +
+        '<div class="note">good direction</div></div>' +
+      '<div class="card"><div class="label">Regressing axes</div>' +
+        '<div class="val" style="color:' + (reg ? 'var(--red)' : 'var(--muted)') + ';">' + esc(reg) + '</div>' +
+        '<div class="note">needs attention</div></div>' +
+      '</div>';
+
+    var axesHtml = '<h2>Earned-autonomy signals</h2><div class="axes">';
+    var order = ["council_pass_rate", "gate_pass_rate", "iterations", "interventions"];
+    for (var k = 0; k < order.length; k++) {
+      if (axes[order[k]]) axesHtml += renderAxis(order[k], axes[order[k]], series);
+    }
+    axesHtml += '</div>';
+
+    c.innerHTML = cards +
+      '<div class="headline ' + hClass + '" style="margin-top:14px;">' + esc(headline) + '</div>' +
+      axesHtml +
+      renderRuns(series);
+  }
+  function renderError(msg) {
+    document.getElementById("content").innerHTML =
+      '<div class="empty">Could not load trust data. ' + esc(msg || "") + "</div>";
+  }
+  fetch("/api/trust/trajectory", { headers: { "Accept": "application/json" } })
+    .then(function (r) { if (!r.ok) throw new Error("HTTP " + r.status); return r.json(); })
+    .then(function (d) { render(d || {}); })
+    .catch(function (e) { renderError(e && e.message); });
+})();
+</script>
+</body>
+</html>

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 The flagship product of [Autonomi](https://www.autonomi.dev/). Complete installation instructions for all platforms and use cases.
 
-**Version:** v7.15.0
+**Version:** v7.16.0
 
 ---
 

package/docs/R4-TRUST-TRAJECTORY-DESIGN.md

@@ -0,0 +1,127 @@
+# R4: Visible Trust Trajectory - Design Note
+
+Status: implemented in worktree (not yet merged). Author: R4 release team.
+Verified against live source on 2026-06-03 (v7.8.3 worktree base; R1/R3/R5
+already shipped, so the arc is further along than the loki-plan doc states).
+
+## The story no competitor tells
+
+Devin, Cursor, Windsurf, Claude Code, Aider et al. show you a single run.
+None show you whether the agent is getting more trustworthy on YOUR repo over
+time. Loki already runs a 3-reviewer council + RARV-C closure on every run and
+persists the result. R4 makes the resulting TRUST TRAJECTORY visible:
+
+- council approve-rate trending UP
+- gate pass-rate trending UP
+- iterations-to-completion trending DOWN
+- human interventions trending DOWN
+
+If the agent is earning autonomy on this repo, the trajectory shows it. That is
+compounding, repo-specific proof of trust -> stickiness.
+
+## Honest-data rule (non-negotiable)
+
+Every number derives from REAL persisted run records. Never fabricate a trend.
+With fewer than 2 runs, the trajectory is reported as "not enough history yet"
+(insufficient=true), never a fake direction.
+
+## Data source (REUSED, not new)
+
+R3 already established `.loki/proofs/<run_id>/proof.json` as the persistent,
+one-per-run history record (written by `autonomy/lib/proof-generator.py` at run
+completion, on both success and failure, unless `LOKI_PROOF=0`). The R3 cost
+timeline endpoint (`dashboard/server.py` `/api/cost/timeline`) already mines
+this exact directory for per-run cost history.
+
+R4 mines the SAME directory for the trust signals already present in each
+proof.json:
+
+| Trust signal            | proof.json path                          | Notes |
+|-------------------------|------------------------------------------|-------|
+| council pass (per run)  | `council.final_verdict`                  | APPROVE/APPROVED/COMPLETE => pass |
+| council ratio (per run) | `council.reviewers[].vote` (APPROVE/...) | secondary signal when verdict absent |
+| gate pass-rate (per run)| `quality_gates.passed` / `.total`        | already aggregated by generator |
+| iterations (per run)    | `iterations` (int or {count})            | iterations-to-completion |
+| files changed (per run) | `files_changed.count`                    | context, not a trust axis |
+| timestamp               | `generated_at` (ISO 8601)                | ordering axis |
+
+Human interventions: there is no per-run intervention counter persisted in
+proof.json today. Rather than fabricate one or add new instrumentation in this
+slice, R4 reports interventions as a derived best-effort signal ONLY when the
+proof carries it (`council.interventions` or top-level `interventions`), and
+otherwise marks that axis `available=false` with an honest note. This keeps the
+honest-data rule intact and leaves a clean seam for a future per-run
+intervention counter (a one-line add in proof-generator.py).
+
+## Direction calculation (up / down / flat)
+
+For each numeric axis across the time-ordered run series:
+
+1. Split the series into an earlier half and a later half (median split; odd
+   counts drop the middle point so the two halves never overlap).
+2. Compare the mean of the later half vs the earlier half.
+3. delta = later_mean - earlier_mean. Direction:
+   - `flat` if |delta| <= epsilon (epsilon scaled per axis; rates use 0.01).
+   - `up` / `down` by sign of delta.
+4. "Good direction" is axis-specific: higher is better for council/gate pass
+   rates; lower is better for iterations + interventions. The `improving`
+   boolean encodes whether the direction is the good one, so the UI can color
+   green/red without re-encoding the per-axis polarity.
+
+Rationale for half-split vs least-squares slope: half-split is robust to a
+single noisy run, needs no float regression in bash, and is trivially testable
+with fixtures. A 2-run series degrades to last-vs-first, which is correct.
+
+## Persistence (under .loki/metrics/, REUSED dir)
+
+The aggregated trajectory is persisted to
+`.loki/metrics/trust-trajectory.json` (schema_version 1). This is a derived
+cache, written by the `loki trust` command and the dashboard endpoint so other
+surfaces can read a single source of truth. It is NOT authoritative state: it
+is always recomputable from `.loki/proofs/`. Deleting it loses nothing.
+
+## Surfaces
+
+1. CLI: `loki trust [--json]` (NEW Bun-native command, mirrors `loki kpis`
+   exactly). Falls through to a bash `cmd_trust` when bun is absent (kpis had
+   no bash fallback; R4 adds one because the Python derivation is shared and
+   trivial to call from bash, giving real bash+Bun parity).
+   - `loki kpis` stays a single-run snapshot. R4 does NOT duplicate it; `trust`
+     is the across-runs trajectory view. `loki kpis` output gains a one-line
+     pointer to `loki trust` (no behavior change).
+
+2. Dashboard endpoint: `GET /api/trust/trajectory` (NEW, mirrors
+   `/api/cost/timeline`). Reads `.loki/proofs/*/proof.json`, returns the
+   per-run series + per-axis direction + insufficient flag.
+
+3. Dashboard panel: standalone `dashboard/static/trust.html` + `/trust` route
+   (mirrors `cost.html` + `/cost`), plus a nav entry and SPA section in
+   `build-standalone.js` (mirrors the cost panel wiring exactly).
+
+4. WS push: the `_push_loki_state_loop` broadcasts a `trust_update` message
+   when the trajectory's overall improving-count changes (mirrors the R3
+   `budget_status` transition push). No new channel; reuses manager.broadcast.
+
+## Parity + no-duplication audit
+
+- Data: reuses `.loki/proofs/` (R1/R3). No new run-time instrumentation.
+- Endpoint: new route, but copies the `/api/cost/timeline` read pattern and
+  the `_proofs_dir()` / `_safe_json_read` helpers verbatim in spirit.
+- Panel: new `trust.html`, structurally a sibling of `cost.html`.
+- CLI: new `trust`, structurally a sibling of `kpis`. `kpis` unchanged except a
+  one-line see-also.
+- Shared derivation: a single Python module
+  (`autonomy/lib/trust_trajectory.py`) is the source of truth; the dashboard
+  endpoint imports it, and the bash `cmd_trust` shells out to it. The Bun
+  command reimplements the same pure logic in TS (parity-tested), matching how
+  `kpis` has both a TS derivation and reads the same JSON the bash side writes.
+
+## Test plan
+
+- Python: `tests/test_trust_trajectory.py` - aggregation from fixture
+  proof.json files, direction calc (up/down/flat) per axis polarity, the
+  insufficient-history (<2 runs) case, no-PII (only derived numbers + run_id +
+  timestamps leave the function), malformed proof.json skipped not fatal.
+- TS: `loki-ts/tests/metrics/trust.test.ts` - same aggregation + direction
+  parity on identical fixtures, insufficient case, JSON/human formatting.
+- All mocked from on-disk fixtures. No provider calls, no paid calls.