npm - loki-mode - Versions diffs - 7.19.1 → 7.19.3 - Mend

loki-mode 7.19.1 → 7.19.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (15) hide show

package/SKILL.md +2 -2
package/VERSION +1 -1
package/autonomy/completion-council.sh +282 -0
package/autonomy/config.example.yaml +26 -0
package/autonomy/lib/proof-generator.py +20 -1
package/autonomy/lib/proof-template.html +211 -16
package/autonomy/run.sh +55 -0
package/dashboard/__init__.py +1 -1
package/docs/INSTALLATION.md +1 -1
package/docs/SHAREABLE-PROOF-PLAN.md +194 -0
package/docs/UNCERTAINTY-ESCALATION-PLAN.md +396 -0
package/loki-ts/dist/loki.js +2 -2
package/mcp/__init__.py +1 -1
package/package.json +1 -1
package/skills/quality-gates.md +85 -0

package/autonomy/lib/proof-template.html CHANGED Viewed

@@ -89,30 +89,57 @@
   .brand { font-weight: 600; color: var(--text); letter-spacing: 0.2px; }
   .brand .dot { color: var(--accent); }
-  /* HERO */
+  /* HERO (branded proof card) */
   .hero {
-    background: linear-gradient(180deg, var(--panel-2), var(--panel));
+    position: relative; overflow: hidden;
+    background:
+      radial-gradient(900px 300px at 100% -40%, var(--accent-soft), transparent 60%),
+      linear-gradient(180deg, var(--panel-2), var(--panel));
     border: 1px solid var(--border);
-    border-radius: 14px;
+    border-radius: 16px;
     padding: 28px;
     margin-bottom: 22px;
   }
+  .hero-brand {
+    display: flex; align-items: center; gap: 9px; margin-bottom: 18px;
+    color: var(--text);
+  }
+  .hero-brand .mark { display: inline-flex; color: var(--accent); }
+  .hero-brand .name { font-weight: 650; font-size: 15px; letter-spacing: 0.2px; }
+  .hero-brand .by { color: var(--faint); font-size: 12px; }
+  .hero-brand .by b { color: var(--muted); font-weight: 600; }
   .hero h1 {
     font-size: 26px; line-height: 1.25; margin: 0 0 14px;
     font-weight: 650; letter-spacing: -0.2px;
   }
   .hero .sub { color: var(--muted); font-size: 14px; margin: 0; }
-  .hero-actions { margin-top: 18px; display: flex; flex-wrap: wrap; gap: 10px; }
+  .hero-stats {
+    display: grid; grid-template-columns: repeat(auto-fit, minmax(150px, 1fr));
+    gap: 1px; margin-top: 20px; background: var(--border);
+    border: 1px solid var(--border); border-radius: 11px; overflow: hidden;
+  }
+  .hero-stat { background: rgba(20,23,30,0.72); padding: 13px 15px; }
+  .hero-stat .hk { color: var(--faint); font-size: 11px; text-transform: uppercase; letter-spacing: 0.6px; }
+  .hero-stat .hv { font-size: 19px; font-family: var(--mono); margin-top: 5px; color: var(--text); word-break: break-word; }
+  .hero-stat .hv small { font-size: 12px; color: var(--muted); font-family: var(--sans); }
+  .hero-stat .hv.ok { color: var(--green); }
+  .hero-actions { margin-top: 18px; display: flex; flex-wrap: wrap; gap: 10px; align-items: center; }
   /* Buttons */
   .btn {
-    display: inline-block; padding: 9px 15px; border-radius: 9px;
+    display: inline-flex; align-items: center; gap: 7px;
+    padding: 9px 15px; border-radius: 9px;
     font-size: 14px; font-weight: 550; border: 1px solid var(--border);
     background: var(--panel-2); color: var(--text); cursor: pointer;
   }
   .btn.primary { background: var(--accent); border-color: var(--accent); color: #0b0d12; }
   .btn.primary:hover { text-decoration: none; filter: brightness(1.06); }
   .btn:hover { text-decoration: none; border-color: var(--accent); }
+  .btn .ico { display: inline-flex; pointer-events: none; }
+  .share-sep { flex: 1 1 auto; }
+  .share-row { display: inline-flex; flex-wrap: wrap; gap: 8px; align-items: center; }
+  .share-row .lbl { color: var(--faint); font-size: 12px; margin-right: 2px; }
+  .btn.share { padding: 8px 12px; font-size: 13px; }
   /* Sections */
   .section { margin-top: 26px; }
@@ -250,17 +277,29 @@
   .hide { display: none !important; }
 </style>
 </head>
-<body>
+<body data-share-buttons="__PROOF_SHARE_BUTTONS__">
 <div class="wrap">
   <div class="topbar">
     <span class="brand">Loki Mode<span class="dot">.</span> proof of run</span>
     <span id="runIdTop"></span>
   </div>
-  <!-- HERO -->
+  <!-- HERO (branded proof card; rendered client-side from the redacted dict) -->
   <section class="hero">
+    <div class="hero-brand">
+      <span class="mark" aria-hidden="true">
+        <svg width="22" height="22" viewBox="0 0 24 24" fill="none">
+          <path d="M12 2L4 6.5v6.2c0 4.6 3.3 8 8 9.3 4.7-1.3 8-4.7 8-9.3V6.5L12 2z" fill="currentColor" opacity="0.16"/>
+          <path d="M12 2L4 6.5v6.2c0 4.6 3.3 8 8 9.3 4.7-1.3 8-4.7 8-9.3V6.5L12 2z" stroke="currentColor" stroke-width="1.5" stroke-linejoin="round"/>
+          <path d="M9 12.2l2.1 2.1L15.4 10" stroke="currentColor" stroke-width="1.7" stroke-linecap="round" stroke-linejoin="round"/>
+        </svg>
+      </span>
+      <span class="name">Loki Mode</span>
+      <span class="by">by <b>Autonomi</b></span>
+    </div>
     <h1 id="heroLine"></h1>
     <p class="sub" id="heroSub"></p>
+    <div class="hero-stats" id="heroStats"></div>
     <div class="hero-actions" id="heroActions"></div>
   </section>
@@ -445,6 +484,8 @@
     if (prov || model) sub.push("via " + esc(prov) + (model ? " / " + esc(model) : ""));
     document.getElementById("heroSub").innerHTML = sub.join(" · ");
+    renderHeroStats(p, usdRaw, fc, cs);
     var actions = document.getElementById("heroActions");
     var html = "";
     var deployed = g(p, "deployment.deployed_url", null);
@@ -456,7 +497,101 @@
     if (hasDiffs(p)) {
       html += '<a class="btn" href="#secDiff">View the diff</a>';
     }
-    actions.innerHTML = html || '<span class="note">No live URL recorded for this run.</span>';
+    if (!html) {
+      html = '<span class="note">No live URL recorded for this run.</span>';
+    }
+    // Share row. Honors the LOKI_PROOF_SHARE_BUTTONS opt-out: the generator sets
+    // body[data-share-buttons] to "0" when the operator disabled share buttons,
+    // in which case the entire share row is omitted (the actions show only the
+    // live-URL line, byte-equivalent intent to pre-share-row behavior).
+    // Otherwise: the X/LinkedIn buttons appear only when a public URL exists
+    // (default local runs have public_url=null, so they degrade to copy-only).
+    // The intent URLs are NOT in this markup: they are assembled at click time
+    // in wireShare() from data-share + the parsed proof, so no literal social
+    // URL ever appears in the static page (keeps the self-containment guard
+    // green).
+    var shareEnabled = (document.body.getAttribute("data-share-buttons") !== "0");
+    if (!shareEnabled) {
+      actions.innerHTML = html;
+      return;
+    }
+    var pub = g(p, "deployment.public_url", null);
+    var hasPub = !!pub && !isLocalUrl(pub);
+    var share = '<span class="share-sep"></span><span class="share-row">';
+    share += '<span class="lbl">Share</span>';
+    if (hasPub) {
+      share += '<button class="btn share" type="button" data-share="x" title="Share on X">' +
+               '<span class="ico" aria-hidden="true">' + icoX() + "</span>X</button>";
+      share += '<button class="btn share" type="button" data-share="linkedin" title="Share on LinkedIn">' +
+               '<span class="ico" aria-hidden="true">' + icoIn() + "</span>LinkedIn</button>";
+    }
+    share += '<button class="btn share" type="button" data-share="copy" title="Copy link to this proof">' +
+             '<span class="ico" aria-hidden="true">' + icoLink() + "</span>Copy link</button>";
+    share += "</span>";
+    actions.innerHTML = html + share;
+  }
+  function renderHeroStats(p, usdRaw, fc, cs) {
+    var el = document.getElementById("heroStats");
+    if (!el) return;
+    var cells = [];
+    // Built: files changed + where the spec came from.
+    var src = String(g(p, "spec.source", "") || "");
+    var srcLabel = src ? srcLabelFor(src) : "spec";
+    cells.push(["Built",
+      fc + " file" + (fc === 1 ? "" : "s") + " changed",
+      "from " + esc(srcLabel), ""]);
+    // Verified: council ratio (preferred) or quality-gate ratio.
+    var vMain, vSub;
+    if (cs) {
+      vMain = cs.count + "-of-" + cs.total + " approved";
+      vSub = "review council";
+    } else {
+      var gp = num(g(p, "quality_gates.passed", 0));
+      var gt = num(g(p, "quality_gates.total", 0));
+      if (gt > 0) { vMain = gp + "-of-" + gt + " gates"; vSub = "quality gates"; }
+      else { vMain = "not recorded"; vSub = "verification"; }
+    }
+    cells.push(["Verified", vMain, esc(vSub), cs ? "ok" : ""]);
+    // Cost: never render a zero-dollar total when cost was not collected.
+    if (usdRaw !== null) cells.push(["Cost", fmtUsd(usdRaw), "total for this run", ""]);
+    else cells.push(["Cost", "not recorded", "no cost data", ""]);
+    // Duration.
+    var dur = g(p, "wall_clock_sec", null);
+    if (dur !== null) cells.push(["Duration", fmtDuration(dur), "wall clock", ""]);
+    var html = "";
+    for (var i = 0; i < cells.length; i++) {
+      html += '<div class="hero-stat"><div class="hk">' + cells[i][0] +
+              '</div><div class="hv ' + cells[i][3] + '">' + cells[i][1] +
+              (cells[i][2] ? ' <small>' + cells[i][2] + "</small>" : "") + "</div></div>";
+    }
+    el.innerHTML = html;
+  }
+  // Human label for the spec source. owner/repo#123 -> "GitHub issue
+  // owner/repo#123"; codebase-analysis -> "codebase analysis"; otherwise the
+  // raw (already-redacted) source string. esc() is applied by the caller.
+  function srcLabelFor(src) {
+    if (/^[\w.\-]+\/[\w.\-]+#\d+$/.test(src)) return "GitHub issue " + src;
+    if (src === "codebase-analysis") return "codebase analysis";
+    return src;
+  }
+  // Inline brand-tinted glyphs for the share buttons. Pure <svg><path>, no
+  // external refs, no <image>/<img>, no src=. pointer-events are disabled in
+  // CSS so clicks land on the button (wireShare reads data-share).
+  function icoX() {
+    return '<svg width="13" height="13" viewBox="0 0 24 24" fill="currentColor">' +
+      '<path d="M18.244 2.25h3.308l-7.227 8.26 8.502 11.24h-6.66l-5.214-6.817L4.99 21.75H1.68l7.73-8.835L1.254 2.25H8.08l4.713 6.231 5.45-6.231zm-1.161 17.52h1.833L7.084 4.126H5.117L17.083 19.77z"/></svg>';
+  }
+  function icoIn() {
+    return '<svg width="13" height="13" viewBox="0 0 24 24" fill="currentColor">' +
+      '<path d="M20.45 20.45h-3.56v-5.57c0-1.33-.02-3.04-1.85-3.04-1.85 0-2.14 1.45-2.14 2.94v5.67H9.34V9h3.42v1.56h.05c.48-.9 1.64-1.85 3.37-1.85 3.6 0 4.27 2.37 4.27 5.46v6.28zM5.34 7.43a2.06 2.06 0 110-4.13 2.06 2.06 0 010 4.13zM7.12 20.45H3.55V9h3.57v11.45zM22.22.5H1.77C.79.5 0 1.28 0 2.24v19.52C0 22.72.79 23.5 1.77 23.5h20.45c.98 0 1.78-.78 1.78-1.74V2.24C24 1.28 23.2.5 22.22.5z"/></svg>';
+  }
+  function icoLink() {
+    return '<svg width="13" height="13" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round">' +
+      '<path d="M10 13a5 5 0 007.07 0l3-3a5 5 0 00-7.07-7.07l-1.5 1.5"/>' +
+      '<path d="M14 11a5 5 0 00-7.07 0l-3 3a5 5 0 007.07 7.07l1.5-1.5"/></svg>';
   }
   function renderTier1(p) {
@@ -759,21 +894,80 @@
            '</code><button class="copy" data-copy="' + esc(text) + '">Copy</button></div>';
   }
+  // Shared clipboard write (navigator.clipboard with execCommand fallback).
+  // Used by both the command-copy buttons (wireCopy) and the share copy-link
+  // button (wireShare). onDone runs after a best-effort copy.
+  function copyText(text, onDone) {
+    if (navigator.clipboard && navigator.clipboard.writeText) {
+      navigator.clipboard.writeText(text).then(onDone, function () {});
+    } else {
+      try {
+        var ta = document.createElement("textarea");
+        ta.value = text; document.body.appendChild(ta); ta.select();
+        document.execCommand("copy"); document.body.removeChild(ta); onDone();
+      } catch (err) {}
+    }
+  }
+  // Flash a transient label on a button, then restore its original content.
+  function flashBtn(btn, label) {
+    if (!btn) return;
+    var o = btn.innerHTML;
+    btn.textContent = label;
+    setTimeout(function () { btn.innerHTML = o; }, 1200);
+  }
   function wireCopy() {
     document.addEventListener("click", function (e) {
       var t = e.target;
       if (!t || !t.getAttribute || t.getAttribute("data-copy") === null) return;
       var text = t.getAttribute("data-copy");
-      var done = function () { var o = t.textContent; t.textContent = "Copied"; setTimeout(function () { t.textContent = o; }, 1200); };
-      if (navigator.clipboard && navigator.clipboard.writeText) {
-        navigator.clipboard.writeText(text).then(done, function () {});
+      copyText(text, function () { flashBtn(t, "Copied"); });
+    });
+  }
+  // Delegated share handler. Mirrors wireCopy: data-share carries only the KIND
+  // ("x" | "linkedin" | "copy"), never a URL. The intent/share URLs are built
+  // here at click time by string concatenation so NO literal social URL appears
+  // anywhere in the static page. public_url comes from the parsed proof closed
+  // over by this IIFE; the hook comes from the og:description meta already in
+  // the page. The host strings are intentionally split across "+" so the source
+  // text contains no contiguous "https://<host>" or bare host literal.
+  function wireShare(proof) {
+    function publicUrl() {
+      var u = g(proof, "deployment.public_url", null);
+      return (u && !isLocalUrl(u)) ? String(u) : "";
+    }
+    function shareHook() {
+      var m = document.querySelector('meta[property="og:description"]');
+      var c = m ? (m.getAttribute("content") || "") : "";
+      return c || "Built and verified autonomously by Loki Mode";
+    }
+    document.addEventListener("click", function (e) {
+      var t = e.target && e.target.closest ? e.target.closest("[data-share]") : null;
+      if (!t) return;
+      var kind = t.getAttribute("data-share");
+      var url = publicUrl();
+      if (kind === "copy") {
+        // Copy the public link when present, else fall back to the hook text.
+        copyText(url || shareHook(), function () { flashBtn(t, "Copied"); });
+        return;
+      }
+      // X / LinkedIn require a public URL. Without one, do nothing (the buttons
+      // are also hidden in that case): never emit a broken url=.
+      if (!url) return;
+      var target;
+      if (kind === "x") {
+        target = "https" + "://twitter" + ".com/intent/tweet?text=" +
+                 encodeURIComponent(shareHook()) + "&url=" + encodeURIComponent(url);
+      } else if (kind === "linkedin") {
+        // LinkedIn ignores prefilled text; URL only.
+        target = "https" + "://www." + "linkedin" + ".com/sharing/share-offsite/?url=" +
+                 encodeURIComponent(url);
       } else {
-        try {
-          var ta = document.createElement("textarea");
-          ta.value = text; document.body.appendChild(ta); ta.select();
-          document.execCommand("copy"); document.body.removeChild(ta); done();
-        } catch (err) {}
+        return;
       }
+      window.open(target, "_blank", "noopener,noreferrer");
     });
   }
@@ -788,6 +982,7 @@
   var proof = parseProof();
   wireCopy();
+  wireShare(proof);
   if (!proof || typeof proof !== "object") {
     renderError();
     return;

package/autonomy/run.sh CHANGED Viewed

@@ -124,6 +124,26 @@
 #   LOKI_NOTIFICATIONS   - Enable desktop notifications (default: true)
 #   LOKI_NOTIFICATION_SOUND - Play sound with notifications (default: true)
 #
+# Uncertainty-Gated Escalation (v7.19.2, default-on):
+#   LOKI_UNCERTAINTY_ESCALATION  - Master on/off for proactive stuck-escalation (default: 1; set 0 to
+#                                  disable; byte-identical when off). Decision lives in
+#                                  completion-council.sh (uncertainty_should_escalate); action in run.sh.
+#                                  NOTE: AUTONOMY_MODE defaults to "perpetual"; in perpetual mode PAUSE
+#                                  is auto-cleared by check_human_intervention, so escalation degrades
+#                                  to notify-only (notification fires, run does NOT halt).
+#   LOKI_UNCERTAINTY_ROUNDS      - Consecutive rounds where >=2 of 3 proxies must co-occur before
+#                                  escalating (default: 2; recommended range 2-3). Debounces transient
+#                                  noise: a single hot proxy never escalates alone.
+#   LOKI_UNCERTAINTY_NOCHANGE_MIN - Proxy 1 threshold: consecutive_no_change value that marks p1 hot.
+#                                  (default: COUNCIL_STAGNATION_LIMIT - 1, i.e. one below the circuit-
+#                                  breaker limit so escalation fires before the breaker ends the run).
+#                                  Floored at 1 at runtime.
+#   LOKI_UNCERTAINTY_SPLIT_ROUNDS - Proxy 3 threshold: number of consecutive trailing council verdicts
+#                                  that must be REJECTED-with-approver (split) to mark p3 hot
+#                                  (default: 2). Between council votes p3 may be stale; it is always
+#                                  fresh when proxy 1 is hot because proxy 1 hot forces a circuit-
+#                                  breaker vote that refreshes verdicts.
+#
 # Human Intervention (Auto-Claude pattern):
 #   PAUSE file:          touch .loki/PAUSE - pauses after current session
 #   HUMAN_INPUT.md:      echo "instructions" > .loki/HUMAN_INPUT.md
@@ -286,6 +306,10 @@ parse_simple_yaml() {
     set_from_yaml "$file" "completion.council.check_interval" "LOKI_COUNCIL_CHECK_INTERVAL"
     set_from_yaml "$file" "completion.council.min_iterations" "LOKI_COUNCIL_MIN_ITERATIONS"
     set_from_yaml "$file" "completion.council.stagnation_limit" "LOKI_COUNCIL_STAGNATION_LIMIT"
+    set_from_yaml "$file" "completion.uncertainty.escalation" "LOKI_UNCERTAINTY_ESCALATION"
+    set_from_yaml "$file" "completion.uncertainty.rounds" "LOKI_UNCERTAINTY_ROUNDS"
+    set_from_yaml "$file" "completion.uncertainty.nochange_min" "LOKI_UNCERTAINTY_NOCHANGE_MIN"
+    set_from_yaml "$file" "completion.uncertainty.split_rounds" "LOKI_UNCERTAINTY_SPLIT_ROUNDS"
     # Model
     set_from_yaml "$file" "model.prompt_repetition" "LOKI_PROMPT_REPETITION"
@@ -428,6 +452,10 @@ parse_yaml_with_yq() {
         "completion.council.check_interval:LOKI_COUNCIL_CHECK_INTERVAL"
         "completion.council.min_iterations:LOKI_COUNCIL_MIN_ITERATIONS"
         "completion.council.stagnation_limit:LOKI_COUNCIL_STAGNATION_LIMIT"
+        "completion.uncertainty.escalation:LOKI_UNCERTAINTY_ESCALATION"
+        "completion.uncertainty.rounds:LOKI_UNCERTAINTY_ROUNDS"
+        "completion.uncertainty.nochange_min:LOKI_UNCERTAINTY_NOCHANGE_MIN"
+        "completion.uncertainty.split_rounds:LOKI_UNCERTAINTY_SPLIT_ROUNDS"
         "model.prompt_repetition:LOKI_PROMPT_REPETITION"
         "model.confidence_routing:LOKI_CONFIDENCE_ROUTING"
         "model.autonomy_mode:LOKI_AUTONOMY_MODE"
@@ -12390,6 +12418,33 @@ if __name__ == "__main__":
             council_track_iteration "$log_file"
         fi
+        # Uncertainty-gated escalation (v7.19.2, Slice B action).
+        # The decision lives in completion-council.sh:uncertainty_should_escalate
+        # (pure, debounced once-per-stuck-episode, knob-first on
+        # LOKI_UNCERTAINTY_ESCALATION). This block only ACTS when the function
+        # returns rc 0. The type guard keeps it a silent no-op if the decision
+        # function is not present (byte-identical when the feature is absent/off).
+        if type uncertainty_should_escalate &>/dev/null && uncertainty_should_escalate; then
+            log_error "[Uncertainty] Escalating to human: >=2 of 3 stuck-signals co-occurred for N rounds (no-change / oscillation / council-split). PAUSE written; handoff saved."
+            log_warn  "[Uncertainty] To opt out of proactive escalation: set LOKI_UNCERTAINTY_ESCALATION=0"
+            # Structured handoff doc before the bare PAUSE (mirrors GATE precedent).
+            write_structured_handoff "uncertainty_escalation"
+            notify_intervention_needed "Uncertainty escalation: >=2 of 3 stuck-signals co-occurred for N rounds"
+            # Marker file for dashboard / external consumers. Empty touch has no
+            # partial-write window, so atomic temp+mv is not required here.
+            mkdir -p "${TARGET_DIR:-.}/.loki/signals"
+            touch "${TARGET_DIR:-.}/.loki/signals/UNCERTAINTY_ESCALATION"
+            # PAUSE is consumed by check_human_intervention: it halts in
+            # non-perpetual mode; in perpetual mode it auto-clears + notifies.
+            # That degrade is free; we add no consumer logic here.
+            touch "${TARGET_DIR:-.}/.loki/PAUSE"
+            # Perpetual-mode honesty: detect with the SAME vars the existing PAUSE
+            # consumer uses (run.sh check_human_intervention), print-only.
+            if [ "$AUTONOMY_MODE" = "perpetual" ] || [ "$PERPETUAL_MODE" = "true" ]; then
+                log_warn "[Uncertainty] Perpetual mode: PAUSE will be auto-cleared; this is notify-only and will NOT halt the run."
+            fi
+        fi
         # Check for success - ONLY stop on explicit completion promise
         # There's never a "complete" product - always improvements, bugs, features
         if [ $exit_code -eq 0 ]; then

package/dashboard/__init__.py CHANGED Viewed

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
-__version__ = "7.19.1"
+__version__ = "7.19.3"
 # Expose the control app for easy import
 try:

package/docs/INSTALLATION.md CHANGED Viewed

@@ -2,7 +2,7 @@
 The flagship product of [Autonomi](https://www.autonomi.dev/). Complete installation instructions for all platforms and use cases.
-**Version:** v7.19.1
+**Version:** v7.19.3
 ---

package/docs/SHAREABLE-PROOF-PLAN.md ADDED Viewed

@@ -0,0 +1,194 @@
+# Shareable Proof-of-Run: Implementation Plan (v7.19.3)
+Architect plan for adding opt-in shareability to the proof-of-run artifact
+without breaking the v7.18.2 zero-egress posture. Design only.
+## 1. Verified current state
+All claims read from source.
+**Generator** `autonomy/lib/proof-generator.py` (689 lines)
+- `_build_proof` (line 366) assembles the frozen schema v1.0 dict. `deployment`
+  set at line 401: `{"deployed_url": deployed_url, "public_url": None}`.
+  `public_url` is ALWAYS `None` at generate time. This is the publish-time
+  injection slot the design hangs on.
+- `_build_social_hook` (line 444) computes the one-line hook from already-redacted
+  fields only: `cost.usd` via `_fmt_usd_hook` (line 427), `files_changed.count`,
+  and council ratio via `_council_ratio` (line 406). Cost clause omitted when usd
+  is None (never fabricates `$0.00`).
+- `_render_html` (line 562) loads `proof-template.html`, replaces
+  `__PROOF_OG_DESCRIPTION__` (og + twitter metas) with `_attr_esc(hook)`, then
+  replaces `__PROOF_JSON__` (escaping `<` as `<`). Falls back to
+  `_render_fallback_html` (line 470) when template missing.
+- CHOKEPOINT: `generate` (line 582) calls `proof_redact.redact_tree(proof)` once
+  (line 609), refuses to emit if redaction did not run (line 613), applies length
+  caps AFTER redaction (line 619), then hashes and writes proof.json + index.html.
+**Template** `autonomy/lib/proof-template.html` (803 lines)
+- Self-contained / zero-egress by contract (header comment lines 1-40). Social
+  meta lines 46-55: og:title, og:description, twitter:card=summary,
+  twitter:description. Line 46: "No og:image (would break self-containment)" -
+  preserved by this plan.
+- Hero markup lines 261-265 (`.hero`, `#heroLine`, `#heroSub`, `#heroActions`);
+  `.hero-actions`/`.btn` CSS at 105-115. `renderHero` (line 426) builds the hero
+  client-side. `renderCta` (line 732) emits command blocks with `data-copy`.
+- `wireCopy` (line 762) is a delegated click handler keying off `data-copy`,
+  using `navigator.clipboard` with `execCommand` fallback. PATTERN to mirror for
+  share buttons + copy-link.
+- Template reads `deployment.public_url` at line 466 (`renderTier1`).
+**CLI** `autonomy/loki`
+- `cmd_proof` (line 26277): list/show/open/share. `share` (26393) gates
+  `--hosted` to `_loki_hosted_publish_proof` (26113, posts redacted bytes to
+  `LOKI_HOSTED_ENDPOINT`, honest "no backend yet" otherwise), else uploads
+  index.html AS-IS to a gist via `_loki_gist_upload` (26021, `gh gist create`,
+  exposes `LOKI_LAST_GIST_URL`). The default gist path never fills public_url or
+  re-renders.
+- Social hook is reimplemented inline in Python at 26503-26553 (duplicates
+  `_build_social_hook`). This plan adds no third copy.
+**Dashboard** `dashboard/server.py`: `_proofs_dir` (7668), `_safe_proof_run_dir`
+(7672, realpath-contained), `GET /api/proofs` (7689). Read-only consumer;
+untouched.
+**Redaction** `autonomy/lib/proof_redact.py`: `redact_tree` (266),
+`redact_value` (260), `set_context`/`reset_context` (37/51), `RULES_VERSION =
+"1.0"` (29). Reused, never reinvented.
+**Existing tests**: `tests/test_proof_html.py` (`test_no_external_resource_refs`
+forbids `src=`, `@import`, `url(http`, any non-allowlisted `https?://`; allowlist
+only `github.com/asklokesh/loki-mode`; plus null-cost-never-renders-$0.00),
+`tests/test_proof_redaction.py` (secret-class + e2e), `tests/cli/test-proof-command.sh`,
+`tests/dashboard/test_proofs_routes.py`.
+**Dependency posture**: no Pillow/cairo/cairosvg. Local PNG rasterization would
+add a dependency and break the zero-dep local posture - ruled out.
+## 2. The og:image decision
+CHOSEN: keep the local proof zero-egress with NO og:image; add a branded in-page
+card rendered from the redacted dict; inject og:image and share-target URLs ONLY
+at publish time via the existing `deployment.public_url` slot, on an
+HTML-serving host.
+- Option (a) data-URI og:image: REJECTED. og:image is spec'd as a URL; scrapers
+  do not reliably honor data-URI og:image. Bloat for zero benefit.
+- Option (b) separate card file referenced only at publish: PARTIALLY ADOPTED. A
+  real og:image needs a public URL, absent at generate time. Reference no image
+  at generate; at publish (only if the proof reaches an HTML-serving host
+  returning a public URL) that host is where og:image is set.
+- Option (c) branded in-page card: ADOPTED as the always-on self-contained
+  visual. Inline CSS / inline SVG, rendered client-side from the redacted dict.
+  Zero egress, zero new deps, redaction-safe.
+HONEST GIST LIMITATION: `loki proof share <id>` publishes to a GitHub Gist. The
+gist page serves GitHub's own og tags (profile picture), not the uploaded HTML's
+og tags; `raw.githubusercontent.com` serves `text/plain`, not scraped. So the
+gist path does NOT produce a rich preview of the proof card. Only an
+HTML-serving host returning a real public URL served as `text/html` (the
+`LOKI_HOSTED_ENDPOINT` seam) can. Stated plainly in docs + CLI output.
+UNIFYING INSIGHT: og:image, share-button `url=`, and copy-link all need a public
+URL absent at `file://` generate time. All three key off
+`deployment.public_url`: null at generate (share degrades to text-only/hidden),
+populated at publish.
+## 3. Disjoint dev slices
+Binding constraints (every slice): no VERSION bump; no commits; no emojis; no em
+or en dashes (ASCII hyphen only); no new runtime dependencies; the default
+generate path stays byte-for-byte zero network calls.
+**Slice A - Template: branded card + JS-click share buttons**
+(`autonomy/lib/proof-template.html` only)
+- Style the hero (261-265) into a branded card: what was built (files_changed +
+  spec source), verified (council verdict/ratio + gates), cost (cost.usd),
+  duration (wall_clock_sec), plus Loki/Autonomi branding. Inline CSS / inline SVG.
+  Rendered by `renderHero` from the redacted dict; no new schema fields.
+- Add a share row in `.hero-actions` using `data-share` attributes (mirror
+  `data-copy`): X/Twitter, LinkedIn, Copy link. NO literal `https://` href in
+  static HTML (keeps `test_no_external_resource_refs` green). A new delegated
+  handler assembles the intent URL at click time:
+  - X: `https://twitter.com/intent/tweet?text=<hook>&url=<public_url>` (hook from
+    og:description meta; public_url from parsed proof).
+  - LinkedIn: `https://www.linkedin.com/sharing/share-offsite/?url=<public_url>`
+    (URL only; LinkedIn ignores prefilled text).
+  - Copy link: writes public_url via the clipboard path wireCopy uses.
+- When public_url is null (default local case): share buttons hide or fall back
+  to copy-the-hook-text; never emit a broken `url=`.
+- og:image meta only as empty/absent default; populated by the publish path.
+**Slice B - Generator: hook plumbing + public_url passthrough**
+(`autonomy/lib/proof-generator.py` only)
+- Add `LOKI_PROOF_SHARE_BUTTONS` (default ON; justified below) conditionally
+  including the share-row markers. Reuse `_build_social_hook`.
+- public_url stays None at generate. Optional `LOKI_PROOF_PUBLIC_URL` env, when
+  set, threads into deployment.public_url BEFORE the redaction chokepoint.
+  Default None. No og:image here. No network calls.
+**Slice C - CLI: publish-time re-render + og:image/public_url injection**
+(`autonomy/loki` only; OWNS the re-render)
+- Hosted path (`_loki_hosted_publish_proof`, 26113): after the host returns a
+  public URL, re-render with deployment.public_url set + og:image set to the
+  host-minted card URL, then upload. Re-render reuses the generator (env var) so
+  redaction runs again over the URL-injected dict - never a hand-built body.
+- Gist path: byte-for-byte unchanged EXCEPT one honest stdout note (gist previews
+  show GitHub's og tags, not the proof card; point to --hosted). Do not fabricate
+  a public_url for gist.
+**Slice D - Docs** (this file + a short note in proof docs / wiki): zero-egress
+invariant, opt-in publish path, gist-vs-hosted preview reality, LinkedIn text
+limitation.
+Recommended parallelism: A, B, D in parallel; C after B's flag contract is
+agreed.
+## 4. Test plan
+Model on `tests/test_proof_html.py`, `tests/test_proof_redaction.py`.
+1. Default generate path zero-egress: extend `test_no_external_resource_refs` -
+   generate with share buttons ON, assert NO `src=`, no `@import`, no `url(http`,
+   no `https?://` URL except the github.com/asklokesh/loki-mode allowlist. The
+   load-bearing guard that the JS-click design adds no literal share URLs.
+2. Redaction holds on card + share text: reuse the e2e pattern - plant secrets in
+   council summaries / spec / diffs, generate, assert none survive anywhere in
+   index.html incl. card markup + og:description. Card renders ONLY redacted
+   fields.
+3. Share button URLs well-formed + prefilled: unit-test the JS URL assembly -
+   given public_url, X intent contains URL-encoded hook + url=<public_url>;
+   LinkedIn contains url=<public_url> no text; copy-link copies public_url. Null
+   public_url -> no malformed url=.
+4. og:image populated ONLY on publish: default page has no og:image; simulate
+   hosted re-render with a public URL, assert og:image + public_url populated and
+   re-redacted; gist path leaves page unchanged + prints the note.
+5. Null-cost credibility preserved: card never shows `$0.00` when cost uncollected.
+## 5. Honest limits
+- Data-URI og:image not reliably scraped (og:image is spec'd as a URL); not used.
+- GitHub gist yields no rich preview of the proof card (gist page = GitHub og
+  tags; raw = text/plain).
+- A rich social preview requires an HTML-serving host returning a public URL (the
+  LOKI_HOSTED_ENDPOINT seam or any static HTML host the user configures). No
+  official Loki hosted backend yet; the seam is honest about this.
+- LinkedIn share ignores prefilled text; it scrapes the destination og tags, so
+  LinkedIn previews depend on the hosted og:image. X intent carries the hook.
+- Sharing is manual / opt-in: a button is inert until clicked; no auto egress.
+- No hosted gallery / discovery feed in this release.
+Share-buttons default ON: with JS-click construction there is no literal external
+URL in the static page and no network call until the user clicks. The buttons are
+inert markup until acted on, so they cannot violate the default zero-egress
+invariant. Default ON maximizes the word-of-mouth lever at zero cost to the
+posture; `LOKI_PROOF_SHARE_BUTTONS=0` opts out.
+## Zero-egress invariant (precise)
+- STAYS zero-egress (byte-for-byte zero network calls): generating a proof and
+  opening the local index.html. No og:image, no src=, no @import, no web fonts,
+  no literal share URLs. Card + hook render from the embedded redacted JSON.
+  Share buttons present but inert.
+- OPT-IN egress (only on explicit user action): clicking a share button, copying
+  the link, and `loki proof share <id>` / `--hosted`. og:image and
+  deployment.public_url are populated only on the hosted publish re-render.