loki-mode 7.85.0 → 7.87.0

package/README.md

@@ -45,6 +45,82 @@ _The free, source-available autonomous coding agent by [Autonomi](https://www.au
 
 ---
 
+## Loki does not lie about "done"
+
+Most coding agents declare a task done by telling you so in a transcript. The
+transcript is the agent's own narration; there is nothing to check. Loki Mode
+takes a different stance: it does not call work done until the work is verified,
+and every build produces an **Evidence Receipt** you can re-verify yourself.
+
+The receipt separates two things most tools blur together:
+
+- **Facts** -- deterministic, non-LLM, and re-derivable by anyone: the git diff
+  (base/head SHAs, file/insertion/deletion counts, a `diff_sha256`), the test
+  command that ran with its exit code, the build command with its exit code, and
+  each quality-gate verdict. A skeptic can recompute every one of these from the
+  same repo state.
+- **Assessments** -- AI judgments such as the review council's verdict. These are
+  labeled explicitly as judgment, not proof, and never make the headline green on
+  their own.
+
+The receipt's headline is computed only from the facts:
+
+- **VERIFIED** -- tests recorded a real command, ran, and exited 0; the diff is
+  non-empty; nothing was skipped.
+- **VERIFIED WITH GAPS** -- some facts checked out, but something was not run or
+  was inconclusive. Every gap is listed by name, so silence never reads as a pass.
+- **NOT VERIFIED** -- a test, build, or gate ran and failed (or there was nothing
+  to verify).
+
+This is honesty-of-done, not a claim of perfection. The receipt proves the
+completion claim is backed by deterministic evidence and is independently
+re-checkable; it does not claim the generated code is bug-free.
+
+### Verify it yourself
+
+Receipts are written to `.loki/proofs/<run_id>/` automatically at run completion
+(opt out with `LOKI_PROOF=0`). Inspect and re-check them with `loki proof`
+(aliased as `loki receipt`):
+
+```bash
+loki proof list              # every receipt: run id, time, council verdict, cost, files
+loki proof show <id>         # the full proof.json (facts, assessments, honesty)
+loki proof verify <id>       # re-check the receipt against the repo (exit 0 clean, 1 tamper/drift)
+```
+
+`loki proof verify` does two independent checks and prints the result as JSON:
+
+- **Tamper check** -- recomputes the receipt's integrity hash and compares it to
+  the recorded one. If anyone edited the receipt after it was written, `hash_ok`
+  is `false`.
+- **Drift check** -- re-runs the diff from the recorded base SHA against the
+  current repo and compares the file/insertion/deletion counts and `diff_sha256`
+  to what the receipt recorded. If the repo no longer matches, `diff_drift` is
+  `true`.
+
+A clean receipt prints `"ok": true` and exits 0. A tampered or drifted receipt
+exits 1. When a check cannot run (for example a receipt with no recorded base
+SHA), the verifier reports it as unverifiable rather than passing it silently.
+
+```json
+{
+  "hash_ok": true,
+  "diff_drift": false,
+  "gpg_ok": "n/a",
+  "degraded": [],
+  "reason": "",
+  "ok": true
+}
+```
+
+You can share a receipt as a self-contained HTML page (`loki proof open <id>`),
+or publish it as a GitHub Gist with `loki proof share <id>` (opt-in; the page is
+redacted before it leaves your machine). An optional, off-by-default GPG detached
+signature (`LOKI_PROOF_GPG_KEY`) lets a third party confirm the receipt came from
+you.
+
+---
+
 ## Get Started in 30 Seconds
 
 ```bash

package/SKILL.md

@@ -3,12 +3,14 @@ name: loki-mode
 description: Autonomous spec-driven build system with a built-in trust layer. It does not call work done until it is verified (RARV-C closure loop, 8 quality gates, completion council, verified-completion evidence gate). Triggers on "Loki Mode". Takes a spec (PRD, GitHub issue, OpenAPI doc, etc.) to deployed product with minimal human intervention. Provider-agnostic. Requires --dangerously-skip-permissions flag.
 ---
 
-# Loki Mode v7.85.0
+# Loki Mode v7.87.0
 
 **You are an autonomous agent. You make decisions. You do not ask questions. You do not stop.**
 
 **Spec in, verified product out.** Spec-driven: a "spec" is whatever describes the work -- a Markdown PRD, a GitHub issue, an OpenAPI doc, a Jira ticket (a PRD is one form of spec). The differentiator is the trust layer: Loki does not call work done until it is verified. The RARV-C closure loop, 8 quality gates, the completion council, and the verified-completion evidence gate must all clear before completion is accepted.
 
+**Evidence Receipt (verify it yourself).** Every run writes a receipt to `.loki/proofs/<run_id>/` (opt out with `LOKI_PROOF=0`) that separates deterministic FACTS (git diff with base/head SHAs and a `diff_sha256`, the test command + exit code, the build command + exit code, each gate verdict) from AI ASSESSMENTS (the council verdict, labeled judgment not proof). The headline is computed only from the facts: VERIFIED (tests ran a real command and exited 0, diff non-empty, nothing skipped), VERIFIED WITH GAPS (each gap listed by name), or NOT VERIFIED (a check ran and failed). Inspect and re-check with `loki proof list|show <id>|verify <id>` (aliased `loki receipt`); `loki proof verify` re-hashes the receipt (tamper) and re-derives the diff from the recorded base SHA against the live repo (drift), exiting 0 clean / 1 tamper-or-drift. This is honesty-of-done, not a claim that the code is bug-free.
+
 **Provider-agnostic (stable since v5.0.0):** runs on Claude/Codex/Cline/Aider with abstract model tiers and degraded mode for non-Claude providers; no vendor lock-in. Gemini deprecated v7.5.18. See `skills/providers.md`. **Current track (v7.7.x):** LSP grounding as first-class agent tool (v7.7.0-v7.7.9; lsp_get_diagnostics actually-returns-diagnostics regression fix v7.7.14), provider_source cli (v7.7.11-v7.7.12 bash/bun parity), Docker/bash-3.2 robustness (v7.7.13), audit chain cross-file verification fix (v7.7.15), Phase 1 RARV-C closure (real provider judges, gate-failure flock, synthetic PRD e2e, status `--json`).
 
 **Runtime migration:** Bash-to-Bun migration. Read-only commands (`version`, `status`, `stats`, `doctor`, `provider show/list`, `memory list/index`) flow through Bun runtime via `bin/loki` since v7.3.0. Every other command remains on the Bash runtime (`autonomy/loki`). Rollback: `LOKI_LEGACY_BASH=1`. See `UPGRADING.md` and `docs/architecture/ADR-001-runtime-migration.md`.
@@ -406,4 +408,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v7.85.0 | [Autonomi](https://www.autonomi.dev/) flagship product | ~260 lines core**
+**v7.87.0 | [Autonomi](https://www.autonomi.dev/) flagship product | ~260 lines core**

package/VERSION

@@ -1 +1 @@
-7.85.0
+7.87.0

package/autonomy/lib/proof-generator.py

@@ -253,6 +253,52 @@ def _collect_build(loki_dir):
     return out
 
 
+def _collect_security(loki_dir):
+    """Read .loki/quality/security-findings.json (the secure-by-default gate).
+
+    Deterministic FACT (pattern scan, not an LLM opinion). Tolerates an absent
+    file -> status not_run. Counts only ACTIVE (un-waived) findings; HIGH active
+    findings are the gap signal. Shape:
+    {ran, total, active, waived, high_active, status, findings:[{rule,severity}]}.
+    status: not_run (no scan) | clean (ran, no active findings) | findings
+    (ran, active findings present).
+    """
+    out = {
+        "ran": False, "total": 0, "active": 0, "waived": 0,
+        "high_active": 0, "status": "not_run", "findings": [],
+    }
+    raw = _read_json(
+        os.path.join(loki_dir, "quality", "security-findings.json"), default=None
+    )
+    if not isinstance(raw, dict):
+        return out
+    out["ran"] = True
+    findings = raw.get("findings") if isinstance(raw.get("findings"), list) else []
+    total = active = waived = high_active = 0
+    slim = []
+    for f in findings:
+        if not isinstance(f, dict):
+            continue
+        total += 1
+        is_waived = bool(f.get("waived"))
+        sev = str(f.get("severity") or "").upper()
+        if is_waived:
+            waived += 1
+        else:
+            active += 1
+            if sev == "HIGH":
+                high_active += 1
+        slim.append({"rule": str(f.get("rule") or ""), "severity": sev,
+                     "waived": is_waived})
+    out["total"] = total
+    out["active"] = active
+    out["waived"] = waived
+    out["high_active"] = high_active
+    out["findings"] = slim
+    out["status"] = "findings" if active > 0 else "clean"
+    return out
+
+
 def _norm_tests_status(raw):
     """Map a recorded test status to {verified,failed,inconclusive,not_run}.
 
@@ -578,6 +624,7 @@ def _build_proof(args, loki_dir, target_dir, repo_root):
 
     build = _collect_build(loki_dir)
     tests = _collect_tests(loki_dir)
+    security = _collect_security(loki_dir)
     evidence_gate = _collect_evidence_gate(loki_dir)
 
     deployed_url = os.environ.get("LOKI_DEPLOYED_URL") or None
@@ -611,6 +658,7 @@ def _build_proof(args, loki_dir, target_dir, repo_root):
             {"name": g.get("name", ""), "status": g.get("status", "not_run")}
             for g in (quality_gates.get("gates") or [])
         ],
+        "security": security,
         "cost": cost,
         "meta": {
             "run_id": run_id,
@@ -711,6 +759,15 @@ def _compute_degraded(facts):
             out.append({"item": "quality_gate:%s" % g.get("name", ""),
                         "status": g.get("status"),
                         "reason": "gate %s" % g.get("status")})
+    # Secure-by-default gate: an ACTIVE (un-waived) HIGH security finding is a gap
+    # in the proof of done -- the receipt must surface it, never green-wash an app
+    # that ships a known-bad pattern. Waived findings are NOT a gap (the user
+    # accepted them with intent, recorded in the receipt).
+    sec = facts.get("security") or {}
+    if sec.get("ran") and (sec.get("high_active") or 0) > 0:
+        out.append({"item": "security", "status": "findings",
+                    "reason": "%s un-waived HIGH security finding(s)"
+                              % sec.get("high_active")})
     git = facts.get("git") or {}
     if not (git.get("diff") or {}).get("count"):
         out.append({"item": "git.diff", "status": "not_run",
@@ -736,11 +793,18 @@ def _compute_headline(facts, degraded):
     # negative signal than a not-run one: amber means "we did not check
     # everything", red means "something we checked did not pass". Conflating them
     # would let a failed test render amber, which understates the failure.
+    # An ACTIVE (un-waived) HIGH security finding is a hard failure too: shipping a
+    # known-bad pattern (a committed private key, a world-open datastore) is not a
+    # "gap", it is a verified-NO. Waived findings do not count (accepted with
+    # intent). This keeps the receipt honest about security, not just tests.
+    sec = facts.get("security") or {}
+    sec_high = bool(sec.get("ran") and (sec.get("high_active") or 0) > 0)
     any_failed = (
         tests.get("status") == "failed"
         or build.get("status") == "failed"
         or any(g.get("status") == "failed"
                for g in (facts.get("quality_gates") or []))
+        or sec_high
     )
     if any_failed:
         return "NOT VERIFIED"