loki-mode 7.86.0 → 7.87.0

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: Autonomous spec-driven build system with a built-in trust layer. It does not call work done until it is verified (RARV-C closure loop, 8 quality gates, completion council, verified-completion evidence gate). Triggers on "Loki Mode". Takes a spec (PRD, GitHub issue, OpenAPI doc, etc.) to deployed product with minimal human intervention. Provider-agnostic. Requires --dangerously-skip-permissions flag.
 ---
 
-# Loki Mode v7.86.0
+# Loki Mode v7.87.0
 
 **You are an autonomous agent. You make decisions. You do not ask questions. You do not stop.**
 
@@ -408,4 +408,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v7.86.0 | [Autonomi](https://www.autonomi.dev/) flagship product | ~260 lines core**
+**v7.87.0 | [Autonomi](https://www.autonomi.dev/) flagship product | ~260 lines core**

package/VERSION

@@ -1 +1 @@
-7.86.0
+7.87.0

package/autonomy/lib/proof-generator.py

@@ -253,6 +253,52 @@ def _collect_build(loki_dir):
     return out
 
 
+def _collect_security(loki_dir):
+    """Read .loki/quality/security-findings.json (the secure-by-default gate).
+
+    Deterministic FACT (pattern scan, not an LLM opinion). Tolerates an absent
+    file -> status not_run. Counts only ACTIVE (un-waived) findings; HIGH active
+    findings are the gap signal. Shape:
+    {ran, total, active, waived, high_active, status, findings:[{rule,severity}]}.
+    status: not_run (no scan) | clean (ran, no active findings) | findings
+    (ran, active findings present).
+    """
+    out = {
+        "ran": False, "total": 0, "active": 0, "waived": 0,
+        "high_active": 0, "status": "not_run", "findings": [],
+    }
+    raw = _read_json(
+        os.path.join(loki_dir, "quality", "security-findings.json"), default=None
+    )
+    if not isinstance(raw, dict):
+        return out
+    out["ran"] = True
+    findings = raw.get("findings") if isinstance(raw.get("findings"), list) else []
+    total = active = waived = high_active = 0
+    slim = []
+    for f in findings:
+        if not isinstance(f, dict):
+            continue
+        total += 1
+        is_waived = bool(f.get("waived"))
+        sev = str(f.get("severity") or "").upper()
+        if is_waived:
+            waived += 1
+        else:
+            active += 1
+            if sev == "HIGH":
+                high_active += 1
+        slim.append({"rule": str(f.get("rule") or ""), "severity": sev,
+                     "waived": is_waived})
+    out["total"] = total
+    out["active"] = active
+    out["waived"] = waived
+    out["high_active"] = high_active
+    out["findings"] = slim
+    out["status"] = "findings" if active > 0 else "clean"
+    return out
+
+
 def _norm_tests_status(raw):
     """Map a recorded test status to {verified,failed,inconclusive,not_run}.
 
@@ -578,6 +624,7 @@ def _build_proof(args, loki_dir, target_dir, repo_root):
 
     build = _collect_build(loki_dir)
     tests = _collect_tests(loki_dir)
+    security = _collect_security(loki_dir)
     evidence_gate = _collect_evidence_gate(loki_dir)
 
     deployed_url = os.environ.get("LOKI_DEPLOYED_URL") or None
@@ -611,6 +658,7 @@ def _build_proof(args, loki_dir, target_dir, repo_root):
             {"name": g.get("name", ""), "status": g.get("status", "not_run")}
             for g in (quality_gates.get("gates") or [])
         ],
+        "security": security,
         "cost": cost,
         "meta": {
             "run_id": run_id,
@@ -711,6 +759,15 @@ def _compute_degraded(facts):
             out.append({"item": "quality_gate:%s" % g.get("name", ""),
                         "status": g.get("status"),
                         "reason": "gate %s" % g.get("status")})
+    # Secure-by-default gate: an ACTIVE (un-waived) HIGH security finding is a gap
+    # in the proof of done -- the receipt must surface it, never green-wash an app
+    # that ships a known-bad pattern. Waived findings are NOT a gap (the user
+    # accepted them with intent, recorded in the receipt).
+    sec = facts.get("security") or {}
+    if sec.get("ran") and (sec.get("high_active") or 0) > 0:
+        out.append({"item": "security", "status": "findings",
+                    "reason": "%s un-waived HIGH security finding(s)"
+                              % sec.get("high_active")})
     git = facts.get("git") or {}
     if not (git.get("diff") or {}).get("count"):
         out.append({"item": "git.diff", "status": "not_run",
@@ -736,11 +793,18 @@ def _compute_headline(facts, degraded):
     # negative signal than a not-run one: amber means "we did not check
     # everything", red means "something we checked did not pass". Conflating them
     # would let a failed test render amber, which understates the failure.
+    # An ACTIVE (un-waived) HIGH security finding is a hard failure too: shipping a
+    # known-bad pattern (a committed private key, a world-open datastore) is not a
+    # "gap", it is a verified-NO. Waived findings do not count (accepted with
+    # intent). This keeps the receipt honest about security, not just tests.
+    sec = facts.get("security") or {}
+    sec_high = bool(sec.get("ran") and (sec.get("high_active") or 0) > 0)
     any_failed = (
         tests.get("status") == "failed"
         or build.get("status") == "failed"
         or any(g.get("status") == "failed"
                for g in (facts.get("quality_gates") or []))
+        or sec_high
     )
     if any_failed:
         return "NOT VERIFIED"

package/autonomy/lib/secure-scan.py

@@ -0,0 +1,652 @@
+#!/usr/bin/env python3
+"""Secure-by-default scan engine for Loki Mode (Loop 4, secure-by-default gate).
+
+A standalone, high-precision scanner for a SMALL set of known-bad security
+patterns in a generated app. The entire value of this scanner is precision: a
+security gate that cries wolf is worse than none, because false positives turn
+into friction and users learn to ignore it. So every rule here is written to
+fire on the genuinely dangerous pattern AND to stay silent on the safe
+equivalent. When in doubt we do NOT flag (a missed finding is a known, accepted
+tradeoff for v1 trust; we never invent one).
+
+The scanner is honest by construction:
+  - It never claims an app is "secure". It reports "N known-bad patterns found"
+    (or zero). Absence of these specific findings is not a guarantee of safety.
+  - Each finding carries an actionable fix: what is wrong, where (file:line),
+    and how to fix it.
+  - It scans only text files and skips binaries, vendored trees (node_modules,
+    .git, vendor, bundled dist of dependencies) and oversized files, so it is
+    cheap and deterministic.
+
+The five v1 rules (see internal/LOOP4-SECURE-BY-DEFAULT-PLAN.md):
+  1. private-key-committed   (HIGH)   a PEM private-key block in any text file
+  2. secret-in-client-file   (HIGH)   a real secret literal in a browser-served file
+  3. world-open-datastore    (HIGH)   a literal world-open datastore rule
+  4. debug-in-prod           (MEDIUM) a debug flag enabled in a production-config file
+  5. cors-wildcard-credentials (MEDIUM) ACAO * together with ACAC true
+
+CLI (mirrors dashboard/audit.py / proof-verify.py shim style):
+    python3 autonomy/lib/secure-scan.py <target_dir> [--json]
+  Prints a JSON result:
+    {
+      "rules_version": "1.0",
+      "findings": [
+        {"rule","file","line","severity","message","fix"}, ...
+      ],
+      "summary": {"total": N, "by_severity": {"HIGH": h, "MEDIUM": m}}
+    }
+  Exit codes:
+    0  no findings
+    1  one or more findings
+    2  bad input (target dir missing / unreadable)
+"""
+
+import json
+import os
+import re
+import sys
+
+RULES_VERSION = "1.0"
+
+# --- scan limits -----------------------------------------------------------
+# Cap per-file size so a giant generated bundle cannot stall the gate. 2 MiB is
+# generous for source/config; real secrets live in small files and large minified
+# vendor bundles are skipped anyway via SKIP_DIRS / extension filtering.
+MAX_FILE_BYTES = 2 * 1024 * 1024
+
+# Directories we never descend into: VCS metadata, installed dependencies, and
+# vendored/build trees that are not the user's own authored code. Flagging a
+# dependency's example key is pure noise.
+SKIP_DIRS = {
+    ".git", "node_modules", "vendor", "bower_components",
+    ".venv", "venv", "__pycache__", ".mypy_cache", ".pytest_cache",
+    ".tox", ".idea", ".vscode", ".gradle", ".terraform",
+    "site-packages", ".next", ".nuxt", ".cache",
+}
+
+# Extensions that are unambiguously binary; reading them as text is wasted work
+# and the regexes are meaningless against them.
+BINARY_EXT = {
+    ".png", ".jpg", ".jpeg", ".gif", ".bmp", ".ico", ".webp", ".svg",
+    ".pdf", ".zip", ".gz", ".tar", ".tgz", ".bz2", ".xz", ".7z", ".rar",
+    ".woff", ".woff2", ".ttf", ".otf", ".eot",
+    ".mp3", ".mp4", ".mov", ".avi", ".mkv", ".wav", ".flac",
+    ".so", ".dylib", ".dll", ".exe", ".bin", ".o", ".a", ".class",
+    ".jar", ".war", ".pyc", ".pyo", ".wasm", ".db", ".sqlite", ".sqlite3",
+}
+
+# Web roots: a file under one of these directories is shipped to the browser.
+# We match a path COMPONENT equal to one of these so "src/public/app.js" counts
+# but "publication.js" does not.
+WEB_ROOT_COMPONENTS = {"public", "static", "dist", "www", "build", "assets"}
+
+# Client-side source extensions. A .html is always browser-served; .js / .mjs /
+# .jsx / .ts(x) are browser-served only when they ALSO sit under a web root
+# (server-side Node code is also .js and we must not flag a key in a server file
+# here -- rule 1 covers PEM keys anywhere, but rule 2 is specifically about the
+# leak-to-browser surface).
+CLIENT_ALWAYS_EXT = {".html", ".htm"}
+CLIENT_IF_WEBROOT_EXT = {".js", ".mjs", ".cjs", ".jsx", ".ts", ".tsx"}
+
+
+# ---------------------------------------------------------------------------
+# rule 1: private key committed
+# ---------------------------------------------------------------------------
+# A PEM private-key header is real key material. The false-positive rate is
+# near zero: the literal "-----BEGIN ... PRIVATE KEY-----" framing does not
+# occur in normal source except in actual keys (or a deliberate test fixture,
+# which is exactly what should be flagged anyway).
+_PEM_PRIVATE_KEY = re.compile(
+    r"-----BEGIN (?:RSA |EC |DSA |OPENSSH |ENCRYPTED )?PRIVATE KEY-----"
+)
+
+
+# ---------------------------------------------------------------------------
+# rule 2: secret literal in a browser-served file
+# ---------------------------------------------------------------------------
+# Known-prefix secret shapes. These prefixes are vendor-issued and have a fixed
+# alphabet/length, so matching them is high precision (unlike generic entropy
+# heuristics, which are FP-prone and deliberately NOT used here).
+_SECRET_PATTERNS = [
+    # AWS access key id
+    ("aws-access-key", re.compile(r"\bAKIA[0-9A-Z]{16}\b")),
+    # OpenAI-style secret key (sk- followed by >=20 url-safe chars)
+    ("openai-key", re.compile(r"\bsk-[A-Za-z0-9_-]{20,}\b")),
+    # GitHub personal access token (classic): ghp_ + 36 chars
+    ("github-pat", re.compile(r"\bghp_[A-Za-z0-9]{36}\b")),
+    # Google API key: AIza + 35 url-safe chars
+    ("google-api-key", re.compile(r"\bAIza[0-9A-Za-z_-]{35}\b")),
+    # Slack bot token: xoxb- + token body
+    ("slack-bot-token", re.compile(r"\bxoxb-[0-9A-Za-z-]{10,}\b")),
+]
+
+# Placeholder / example markers. If the matched secret (or its surrounding
+# token) is an obvious placeholder, do NOT flag it. This is the core
+# false-positive guard for rule 2: docs, .env.example files and templates are
+# full of fake keys and flagging them is exactly the cry-wolf failure mode.
+_PLACEHOLDER_TOKENS = (
+    "xxxx", "your-key", "your_key", "yourkey", "example", "examplekey",
+    "changeme", "change-me", "placeholder", "redacted", "dummy", "sample",
+    "test-key", "testkey", "fake", "todo", "replace", "insert",
+)
+_PLACEHOLDER_RE = re.compile(r"<[^>]+>|\{\{[^}]+\}\}|\$\{[^}]+\}")
+
+
+def _is_placeholder_secret(secret):
+    """True if the matched secret literal is an obvious placeholder, not a real
+    credential. Conservative: only the well-known fake markers, plus an
+    all-same-character body (e.g. AKIAXXXXXXXXXXXXXXXX or all zeros)."""
+    low = secret.lower()
+    for tok in _PLACEHOLDER_TOKENS:
+        if tok in low:
+            return True
+    # strip the known prefix so we examine just the secret body
+    body = secret
+    for prefix in ("akia", "sk-", "ghp_", "aiza", "xoxb-"):
+        if low.startswith(prefix):
+            body = secret[len(prefix):]
+            break
+    if body:
+        # all-identical character (XXXX..., 0000..., AAAA...) => placeholder
+        if len(set(body.lower())) <= 1:
+            return True
+        # mostly x or 0 (a common redaction style) => placeholder
+        filler = sum(1 for c in body.lower() if c in "x0")
+        if filler >= max(1, int(len(body) * 0.8)):
+            return True
+    return False
+
+
+def _markup_wraps_match(line, start, end):
+    """True only if a template placeholder (<...>, {{...}}, ${...}) CONTAINS the
+    matched secret span [start,end) -- i.e. the value itself is templated, like
+    key="${SECRET}" or "<YOUR_KEY>". This must NOT suppress a real secret that
+    merely shares a line with an unrelated tag (e.g. an HTML <script>/<meta>
+    element with a baked-in key), which the old whole-line check wrongly hid."""
+    for mm in _PLACEHOLDER_RE.finditer(line):
+        if mm.start() <= start and mm.end() >= end:
+            return True
+    return False
+
+
+def _is_browser_served(rel_path):
+    """True if a file at rel_path is shipped to the browser.
+
+    .html is always browser-served. Client-script extensions count only when a
+    path component is a known web root, so a server-side foo.js does not trip
+    rule 2 (a server file leaking a key to the browser is the thing we are
+    detecting; a key in server-only code is a different, non-client concern)."""
+    ext = os.path.splitext(rel_path)[1].lower()
+    if ext in CLIENT_ALWAYS_EXT:
+        return True
+    if ext in CLIENT_IF_WEBROOT_EXT:
+        parts = {p.lower() for p in rel_path.replace("\\", "/").split("/")}
+        return bool(parts & WEB_ROOT_COMPONENTS)
+    return False
+
+
+# ---------------------------------------------------------------------------
+# rule 3: world-open datastore (literal forms only)
+# ---------------------------------------------------------------------------
+# Firebase realtime/firestore rules granting unconditional read/write.
+# Matches  ".write": true   /   ".read": true   (any whitespace, single or
+# double quotes). This is the literal "anyone can read/write everything" rule.
+# A rule whose value is a string expression (e.g. "auth != null") is NOT
+# matched, because true is the only unconditional-open literal.
+_FIREBASE_OPEN = re.compile(
+    r"""['"]\.(?:read|write)['"]\s*:\s*true\b"""
+)
+# S3 / bucket ACL granting public access.
+_S3_PUBLIC_ACL = re.compile(
+    r"""['"]?(?:acl|ACL)['"]?\s*[:=]\s*['"](?:public-read|public-read-write)['"]"""
+)
+# AWS canned ACL constant used in CDK/SDK code. MUST be QUALIFIED by an AWS/S3
+# context token so it does not fire on an app-domain identifier (e.g. an
+# ACCESS_LEVELS enum, a Visibility enum, a permissions doc) that merely contains
+# the words PUBLIC_READ. We require either a dotted SDK form
+# (CannedAccessControl.PUBLIC_READ, BucketAccessControl.PUBLIC_READ,
+# s3.X.PUBLIC_READ) or PUBLIC_READ adjacent to an s3/bucket/acl/canned token on
+# the same match. Bare `PUBLIC_READ` (a common permission identifier) is ignored.
+_S3_PUBLIC_ENUM = re.compile(
+    r"""(?:
+        (?:Canned[A-Za-z]*|BucketAccessControl|s3|S3)\s*\.\s*
+            (?:[A-Za-z_]+\s*\.\s*)?PUBLIC_READ(?:_WRITE)?\b
+      | \bPUBLIC_READ(?:_WRITE)?\b[^\n]{0,40}?\b(?:acl|ACL|[Bb]ucket|s3|S3|[Cc]anned)\b
+      | \b(?:acl|ACL|[Bb]ucket|s3|S3|[Cc]anned)\b[^\n]{0,40}?\bPUBLIC_READ(?:_WRITE)?\b
+    )""",
+    re.VERBOSE,
+)
+# Lines that are pure comments/docs must never trigger rule 3 (a SECURITY.md or a
+# code comment warning AGAINST PUBLIC_READ is not a vulnerability).
+_COMMENT_OR_DOC_LINE = re.compile(r"""^\s*(?:#|//|\*|<!--|>)""")
+# Supabase: an anon/public policy combined with RLS disabled. We require BOTH
+# the explicit disable AND a public/anon grant in the same file to avoid
+# flagging a legitimately RLS-disabled internal table.
+_SUPABASE_RLS_DISABLE = re.compile(
+    r"DISABLE\s+ROW\s+LEVEL\s+SECURITY", re.IGNORECASE
+)
+_SUPABASE_PUBLIC_GRANT = re.compile(
+    r"\bTO\s+(?:anon|public)\b", re.IGNORECASE
+)
+
+
+# ---------------------------------------------------------------------------
+# rule 4: debug enabled in production config
+# ---------------------------------------------------------------------------
+# Django settings DEBUG = True
+_DJANGO_DEBUG = re.compile(r"^\s*DEBUG\s*=\s*True\b")
+# Flask app.run(debug=True)
+_FLASK_DEBUG = re.compile(r"\.run\s*\([^)]*\bdebug\s*=\s*True\b")
+# FLASK_DEBUG / DEBUG env set to 1 / true (env-file or compose form)
+_ENV_DEBUG = re.compile(
+    r"^\s*(?:FLASK_DEBUG|DJANGO_DEBUG)\s*[:=]\s*['\"]?(?:1|true|True)\b"
+)
+
+# A file is treated as production config when its name/path marks it so. dev /
+# test / local files are excluded: flagging DEBUG=True in settings_dev.py is the
+# cry-wolf failure for rule 4.
+_PROD_NAME_RE = re.compile(
+    r"(?:^|/)(?:settings\.py|prod[._-]?[^/]*\.py|[^/]*\.production[^/]*|"
+    r"settings[._-]?prod[^/]*\.py|production\.py)$",
+    re.IGNORECASE,
+)
+_PROD_ENVFILE_RE = re.compile(r"(?:^|/)\.env\.production$", re.IGNORECASE)
+_DEV_MARKER_RE = re.compile(
+    r"(?:^|/|[._-])(?:dev|development|test|tests|local|staging|sample|example|"
+    r"settings_dev|settings_local|settings_test)(?:[._/-]|$)",
+    re.IGNORECASE,
+)
+
+
+def _is_production_config(rel_path):
+    """True if rel_path looks like a production config file (and NOT a dev/test
+    one). The dev exclusion takes precedence: an explicitly dev-marked path is
+    never production even if it also matches a prod pattern."""
+    norm = rel_path.replace("\\", "/")
+    base = os.path.basename(norm)
+    if _DEV_MARKER_RE.search(norm):
+        # settings.py itself is not dev-marked; but settings_dev.py is excluded
+        return False
+    if _PROD_ENVFILE_RE.search(norm):
+        return True
+    if _PROD_NAME_RE.search(norm):
+        return True
+    # bare settings.py (Django default prod settings module)
+    if base.lower() == "settings.py":
+        return True
+    return False
+
+
+# Rules 3 (world-open datastore) and 5 (CORS) are LITERAL-config rules: the
+# patterns (".write": true, public-read, ACAO * + credentials) are only a
+# vulnerability when they are ACTUAL configuration, never when they appear in
+# prose, a docstring, a comment, or example text. Rather than try to strip every
+# comment/string form out of arbitrary source (fragile, and an attacker can open
+# a fake comment to mask a real finding -- a green-wash), we SCOPE these rules to:
+#   (a) recognized config file types/names, OR
+#   (b) a line that is itself a recognized config-call form (handled inline).
+# A code file's docstring/comment is therefore never scanned for rules 3/5, and
+# there is no block-tracking to evade. (rules 1/2/4 are unaffected and still scan
+# everything: a private key or client secret is a leak in ANY file.)
+_CONFIG_EXT = {
+    ".json", ".yaml", ".yml", ".toml", ".tf", ".tfvars", ".hcl",
+    ".conf", ".cfg", ".ini", ".rules", ".properties", ".env", ".sql",
+}
+_CONFIG_NAME_RE = re.compile(
+    r"""(?:
+        firebase\.json | firestore\.rules | database\.rules\.json
+      | storage\.rules | \.firebaserc
+      | nginx(?:\.conf)? | httpd\.conf | \.htaccess
+      | cors[-_.]? | s3[-_.]?(?:policy|bucket)
+      | serverless\.(?:yml|yaml) | vercel\.json | netlify\.toml
+    )""",
+    re.IGNORECASE | re.VERBOSE,
+)
+
+
+def _is_config_context_file(rel_path):
+    """True if the file is a configuration file (by extension or known name),
+    where a literal datastore/CORS rule is real config rather than prose."""
+    norm = rel_path.replace("\\", "/")
+    base = os.path.basename(norm).lower()
+    _, ext = os.path.splitext(base)
+    if ext in _CONFIG_EXT:
+        return True
+    if _CONFIG_NAME_RE.search(base):
+        return True
+    return False
+
+
+# Recognized config-CALL forms in code files: these ARE configuration even in a
+# .js/.py/.ts source, so rules 3/5 still apply to a line matching one. Kept tight
+# to avoid matching prose: a real cors() middleware call, an nginx add_header, an
+# AWS SDK ACL assignment, a firebase database().setRules-style call.
+_CONFIG_CALL_RE = re.compile(
+    r"""(?:
+        \bcors\s*\( | \badd_header\b | BucketAccessControl | CannedAccessControl
+      | \bAccessControlAllow                       # camelCase header constant
+      # hyphenated header in a real SETTER context (res.setHeader(...),
+      # add_header, headers[...]=). NOT a bare `Header: value` colon form, which
+      # also appears in prose/comments in code files; the bare colon form is only
+      # trusted inside a real config FILE (handled by _file_is_config), never via
+      # this code-line config-call path.
+      | (?:setHeader|set_header|add_header|writeHead|headers?\s*\[)[^\n]{0,40}?Access-Control-Allow-(?:Origin|Credentials)
+      | setRules\s*\( | \bacl\s*[:=]
+    )""",
+    re.IGNORECASE | re.VERBOSE,
+)
+
+
+# ---------------------------------------------------------------------------
+# rule 5: CORS wildcard with credentials
+# ---------------------------------------------------------------------------
+# The dangerous combination is ACAO * AND ACAC true in the same config. A bare
+# ACAO * (without credentials) is a common, intentional public-API setting and
+# is NOT flagged. We require both signals in the same file.
+# Accept the wildcard quoted ('*' / "*") OR bare (the raw nginx/apache header
+# form `add_header Access-Control-Allow-Origin *;` and `... -Origin: *`). Widening
+# to bare * cannot false-positive on its own: rule 5 only fires when ACAC true is
+# ALSO present in the same file (a bare ACAO * without credentials stays allowed).
+_ACAO_WILDCARD = re.compile(
+    r"""Access-Control-Allow-Origin['"]?\s*[:=,]?\s*['"]?\*['"]?""",
+    re.IGNORECASE,
+)
+# Code/framework forms of a wildcard origin: express/cors `origin: "*"` AND
+# flask-cors `origins="*"` (plural, = separator). Either signals an any-origin
+# CORS policy in code.
+_ACAO_WILDCARD_CODE = re.compile(
+    r"""\borigins?\s*[:=]\s*['"]\*['"]""",
+    re.IGNORECASE,
+)
+_ACAC_TRUE = re.compile(
+    r"""Access-Control-Allow-Credentials['"]?\s*[:=,]?\s*['"]?true['"]?""",
+    re.IGNORECASE,
+)
+# Code/framework forms of credentials-enabled: express/cors `credentials: true`
+# AND flask-cors `supports_credentials=True`.
+_ACAC_TRUE_CODE = re.compile(
+    r"""\b(?:credentials\s*[:=]\s*true|supports_credentials\s*=\s*true)\b""",
+    re.IGNORECASE,
+)
+
+
+# ---------------------------------------------------------------------------
+# file walking / reading
+# ---------------------------------------------------------------------------
+
+def _iter_files(target_dir):
+    """Yield (abs_path, rel_path) for each candidate text file under target_dir,
+    skipping VCS/dependency/build trees, binary extensions and oversized files."""
+    for root, dirs, files in os.walk(target_dir):
+        # prune skip dirs in place so os.walk never descends into them
+        dirs[:] = [d for d in dirs if d not in SKIP_DIRS]
+        for name in files:
+            ext = os.path.splitext(name)[1].lower()
+            if ext in BINARY_EXT:
+                continue
+            abs_path = os.path.join(root, name)
+            try:
+                if os.path.islink(abs_path):
+                    continue
+                size = os.path.getsize(abs_path)
+            except OSError:
+                continue
+            if size > MAX_FILE_BYTES:
+                continue
+            rel_path = os.path.relpath(abs_path, target_dir)
+            yield abs_path, rel_path
+
+
+def _read_lines(abs_path):
+    """Read a file as text lines. Returns a list of (lineno, text) or None if the
+    file is not decodable as UTF-8 text (treat as binary, skip)."""
+    try:
+        with open(abs_path, "r", encoding="utf-8") as f:
+            content = f.read()
+    except (UnicodeDecodeError, OSError):
+        return None
+    # A NUL byte is the strongest binary signal that slipped past the extension
+    # filter; skip such files.
+    if "\x00" in content:
+        return None
+    return list(enumerate(content.splitlines(), start=1))
+
+
+# ---------------------------------------------------------------------------
+# per-file scanning
+# ---------------------------------------------------------------------------
+
+def _finding(rule, rel_path, line, severity, message, fix):
+    return {
+        "rule": rule,
+        "file": rel_path,
+        "line": line,
+        "severity": severity,
+        "message": message,
+        "fix": fix,
+    }
+
+
+def _scan_file(rel_path, lines):
+    """Return a list of findings for one file. `lines` is [(lineno, text), ...]."""
+    findings = []
+    browser_served = _is_browser_served(rel_path)
+    prod_config = _is_production_config(rel_path)
+
+    # rule 3 / rule 5 need whole-file context for the AND conditions.
+    saw_rls_disable = None  # lineno of a DISABLE ROW LEVEL SECURITY
+    saw_public_grant = False
+    saw_acao_wildcard = None  # lineno
+    saw_acac_true = False
+
+    # Rules 3/5 (literal datastore/CORS config) are scoped to config CONTEXT, so a
+    # docstring/comment/prose mention in a code or doc file is never scanned for
+    # them (root-level precision; no fragile comment/block stripping to evade).
+    _file_is_config = _is_config_context_file(rel_path)
+
+    for lineno, text in lines:
+        # --- rule 1: private key committed (any text file) ---------------
+        if _PEM_PRIVATE_KEY.search(text):
+            findings.append(_finding(
+                "private-key-committed", rel_path, lineno, "HIGH",
+                "A PEM private key block is present in this file.",
+                "Remove the private key from the repo, rotate the key "
+                "immediately (assume it is compromised), and load it at runtime "
+                "from a secret manager or an untracked file referenced via "
+                "environment variable.",
+            ))
+
+        # --- rule 2: secret literal in a browser-served file -------------
+        if browser_served:
+            for kind, pat in _SECRET_PATTERNS:
+                for m in pat.finditer(text):
+                    secret = m.group(0)
+                    if _is_placeholder_secret(secret):
+                        continue
+                    # Suppress only when template markup WRAPS the matched secret
+                    # (a templated/example value like key="<YOUR_KEY>"), NOT when
+                    # any unrelated tag is elsewhere on the line. The old
+                    # whole-line check let a real secret inside an HTML line with
+                    # any tag (e.g. <script>var k="AKIA...";</script>) slip
+                    # through silently -- the common HTML inline-secret leak.
+                    if _markup_wraps_match(text, m.start(), m.end()):
+                        continue
+                    findings.append(_finding(
+                        "secret-in-client-file", rel_path, lineno, "HIGH",
+                        "A live %s appears in a file served to the browser; "
+                        "anyone who loads the page can read it." % kind,
+                        "Remove the secret from client code, rotate it, and move "
+                        "the call that needs it to a server-side endpoint or a "
+                        "build-time secret that is never shipped to the client.",
+                    ))
+
+        # Rules 3/5 fire ONLY in a real config context: a config file, OR a line
+        # that is itself a recognized config-call form. This makes prose,
+        # docstrings, comments, and example text in code/doc files invisible to
+        # the literal rules at the ROOT (no comment/string stripping to get wrong,
+        # no block-tracking to evade), while a real datastore/CORS misconfig in a
+        # .json/.yaml/.conf or a cors()/add_header/ACL line still fires.
+        # A config-call form makes a CODE line config-context -- but NOT if the
+        # line is a comment (a comment "call cors() with origin * carefully" is
+        # prose, not configuration; firing on it is cry-wolf). Config FILES are
+        # config-context regardless (their lines are data, not prose). A line in a
+        # config file that is a comment is also skipped via _COMMENT_OR_DOC_LINE.
+        _rel_lower = rel_path.lower()
+        _is_doc_file = _rel_lower.endswith((".md", ".mdx", ".rst", ".txt", ".adoc"))
+        _line_is_comment = bool(_COMMENT_OR_DOC_LINE.match(text))
+        # A config-call form makes a line config-context only in a non-doc,
+        # non-comment line (a doc/comment mentioning a header name is prose).
+        _config_call_line = (
+            not _is_doc_file and not _line_is_comment
+            and bool(_CONFIG_CALL_RE.search(text))
+        )
+        _config_ctx = (
+            (_file_is_config and not _is_doc_file and not _line_is_comment)
+            or _config_call_line
+        )
+        _rule3_skip = not _config_ctx
+
+        # --- rule 3a: Firebase world-open rule ---------------------------
+        if not _rule3_skip and _FIREBASE_OPEN.search(text):
+            findings.append(_finding(
+                "world-open-datastore", rel_path, lineno, "HIGH",
+                "A Firebase rule grants unconditional public read/write "
+                "(\".read\"/\".write\": true).",
+                "Replace the literal true with an auth condition, for example "
+                "\"auth != null\" or a per-document ownership check, so only "
+                "authorized users can access the data.",
+            ))
+        # --- rule 3b: S3 / bucket public ACL -----------------------------
+        if not _rule3_skip and (_S3_PUBLIC_ACL.search(text) or _S3_PUBLIC_ENUM.search(text)):
+            findings.append(_finding(
+                "world-open-datastore", rel_path, lineno, "HIGH",
+                "A storage bucket is configured with a public-read(-write) ACL.",
+                "Remove the public ACL, enable block-public-access on the "
+                "bucket, and serve objects through signed URLs or an "
+                "authenticated endpoint instead.",
+            ))
+        # --- rule 3c: Supabase RLS disabled (whole-file AND) -------------
+        # Also config-context gated (skip comments/prose/doc files), consistent
+        # with rules 3a/3b/5: an inline comment naming "DISABLE ROW LEVEL
+        # SECURITY" is prose, not a live migration statement.
+        if not _rule3_skip:
+            if saw_rls_disable is None and _SUPABASE_RLS_DISABLE.search(text):
+                saw_rls_disable = lineno
+            if _SUPABASE_PUBLIC_GRANT.search(text):
+                saw_public_grant = True
+
+        # --- rule 4: debug in production config --------------------------
+        if prod_config:
+            if (_DJANGO_DEBUG.search(text) or _FLASK_DEBUG.search(text)
+                    or _ENV_DEBUG.search(text)):
+                findings.append(_finding(
+                    "debug-in-prod", rel_path, lineno, "MEDIUM",
+                    "Debug mode is enabled in a production configuration file; "
+                    "debug mode leaks stack traces, settings and secrets to "
+                    "users on error.",
+                    "Set debug to False/0 for production (drive it from an "
+                    "environment variable that defaults to off), and keep "
+                    "debug-on only in dev/local config.",
+                ))
+
+        # --- rule 5: CORS wildcard + credentials (whole-file AND) --------
+        # Skip prose/doc lines (_rule3_skip = comment-only line or .md/.rst/.txt
+        # doc file): a README or comment WARNING about ACAO * + credentials is not
+        # a misconfiguration. Same prose-vs-config principle as rule 3.
+        if not _rule3_skip:
+            if saw_acao_wildcard is None and (
+                    _ACAO_WILDCARD.search(text) or _ACAO_WILDCARD_CODE.search(text)):
+                saw_acao_wildcard = lineno
+            if _ACAC_TRUE.search(text) or _ACAC_TRUE_CODE.search(text):
+                saw_acac_true = True
+
+    # whole-file rule 3c verdict
+    if saw_rls_disable is not None and saw_public_grant:
+        findings.append(_finding(
+            "world-open-datastore", rel_path, saw_rls_disable, "HIGH",
+            "Row Level Security is disabled while a public/anon grant exists, "
+            "leaving the table world-accessible.",
+            "Re-enable Row Level Security (ENABLE ROW LEVEL SECURITY) and write "
+            "explicit policies that scope access to authenticated/authorized "
+            "users instead of granting to anon/public.",
+        ))
+
+    # whole-file rule 5 verdict (the dangerous combo, not a bare wildcard)
+    if saw_acao_wildcard is not None and saw_acac_true:
+        findings.append(_finding(
+            "cors-wildcard-credentials", rel_path, saw_acao_wildcard, "MEDIUM",
+            "CORS allows any origin (*) AND allows credentials; this exposes "
+            "authenticated responses to every website.",
+            "Do not combine a wildcard origin with credentials. Echo back a "
+            "specific allowlist of trusted origins when credentials are "
+            "required, or drop Allow-Credentials if the endpoint is truly "
+            "public.",
+        ))
+
+    return findings
+
+
+# ---------------------------------------------------------------------------
+# scan driver
+# ---------------------------------------------------------------------------
+
+def scan(target_dir):
+    """Scan target_dir and return the result dict.
+
+    Raises ValueError if target_dir is not a readable directory (the CLI maps
+    that to exit code 2)."""
+    if not os.path.isdir(target_dir):
+        raise ValueError("not a directory: %s" % target_dir)
+
+    findings = []
+    for abs_path, rel_path in _iter_files(target_dir):
+        lines = _read_lines(abs_path)
+        if lines is None:
+            continue
+        findings.extend(_scan_file(rel_path, lines))
+
+    # deterministic ordering: by file, then line, then rule
+    findings.sort(key=lambda f: (f["file"], f["line"], f["rule"]))
+
+    by_severity = {}
+    for f in findings:
+        by_severity[f["severity"]] = by_severity.get(f["severity"], 0) + 1
+
+    return {
+        "rules_version": RULES_VERSION,
+        "findings": findings,
+        "summary": {
+            "total": len(findings),
+            "by_severity": by_severity,
+        },
+    }
+
+
+# ---------------------------------------------------------------------------
+# CLI shim (mirrors dashboard/audit.py / proof-verify.py style)
+# ---------------------------------------------------------------------------
+
+def _cli(argv=None):
+    argv = list(sys.argv[1:] if argv is None else argv)
+    # --json is accepted for symmetry with the other shims; output is always
+    # JSON, so the flag is a no-op kept for a stable, predictable interface.
+    args = [a for a in argv if a != "--json"]
+    if not args or argv[0] in ("-h", "--help"):
+        print(json.dumps(
+            {"error": "usage: secure-scan.py <target_dir> [--json]"}))
+        return 2
+    target_dir = args[0]
+    try:
+        result = scan(target_dir)
+    except ValueError as exc:
+        print(json.dumps({"error": str(exc)}))
+        return 2
+    except Exception as exc:  # defensive: never a traceback-as-UX
+        print(json.dumps({"error": "scan failed: %s" % exc}))
+        return 2
+    print(json.dumps(result, indent=2))
+    return 1 if result["summary"]["total"] > 0 else 0
+
+
+if __name__ == "__main__":
+    sys.exit(_cli())

package/autonomy/loki

@@ -16500,6 +16500,10 @@ main() {
             # Receipt surface): same subcommands (list/show/verify/open/share).
             cmd_proof "$@"
             ;;
+        secure)
+            # Secure-by-default gate surface: inspect findings + manage waivers.
+            cmd_secure "$@"
+            ;;
         bench)
             cmd_bench "$@"
             ;;
@@ -30434,6 +30438,110 @@ cmd_bench() {
     bash "$bench_sh" "$@"
 }
 
+# loki secure - the secure-by-default gate surface (v7.87.0).
+# Subcommands: list (show findings) | waive <rule> <file> [reason] | unwaive.
+# Waivers are written to .loki/quality/security-waivers.json, which the gate
+# (run.sh run_secure_scan) and the Evidence Receipt both READ + honor. The gate
+# is advisory by default; LOKI_SECURE_GATE=block makes un-waived HIGH findings
+# block. Honest: a waiver is RECORDED in the receipt (accepted with intent), never
+# silently hides a finding.
+cmd_secure() {
+    local loki_dir="${LOKI_DIR:-.loki}"
+    local quality_dir="${loki_dir}/quality"
+    local findings_file="${quality_dir}/security-findings.json"
+    local waivers_file="${quality_dir}/security-waivers.json"
+    local sub="${1:-}"
+    [ $# -gt 0 ] && shift
+    case "$sub" in
+        ""|--help|-h|help)
+            echo -e "${BOLD}loki secure${NC} - secure-by-default gate: findings + waivers"
+            echo ""
+            echo "Usage: loki secure <subcommand> [args]"
+            echo ""
+            echo "Subcommands:"
+            echo "  list                 Show security findings from the last scan"
+            echo "  waive <rule> <file> [reason]   Waive a finding (accepted with intent)"
+            echo "  unwaive <rule> <file>          Remove a waiver"
+            echo ""
+            echo "The gate is advisory by default; set LOKI_SECURE_GATE=block to make"
+            echo "un-waived HIGH findings block completion. Waivers are recorded in the"
+            echo "Evidence Receipt (loki proof show) -- they are never hidden."
+            [ "$sub" = "" ] && exit 1
+            exit 0
+            ;;
+        list)
+            if [ ! -f "$findings_file" ]; then
+                echo -e "${YELLOW}No security scan results yet.${NC} Run 'loki start' (the gate runs in the review phase)."
+                exit 0
+            fi
+            if command -v jq &>/dev/null; then
+                jq '.findings' "$findings_file" 2>/dev/null || cat "$findings_file"
+            else
+                LOKI_SEC_F="$findings_file" python3 -c "import json,os; d=json.load(open(os.environ['LOKI_SEC_F'])); [print('%s [%s] %s%s -- %s' % (f.get('severity','?'), f.get('rule','?'), f.get('file','?'), (':'+str(f['line'])) if f.get('line') else '', f.get('fix',''))) for f in d.get('findings',[])] or print('No findings.')"
+            fi
+            exit 0
+            ;;
+        waive)
+            local rule="${1:-}" file="${2:-}" reason="${3:-waived via loki secure}"
+            if [ -z "$rule" ] || [ -z "$file" ]; then
+                echo -e "${RED}Usage: loki secure waive <rule> <file> [reason]${NC}" >&2
+                exit 2
+            fi
+            mkdir -p "$quality_dir"
+            LOKI_SEC_W="$waivers_file" LOKI_SEC_RULE="$rule" LOKI_SEC_FILE="$file" LOKI_SEC_REASON="$reason" python3 - <<'PYW'
+import json, os
+p = os.environ["LOKI_SEC_W"]
+try:
+    with open(p) as f: data = json.load(f)
+    if not isinstance(data, dict): data = {}
+except Exception:
+    data = {}
+waivers = data.get("waivers")
+if not isinstance(waivers, list): waivers = []
+rule, fl, reason = os.environ["LOKI_SEC_RULE"], os.environ["LOKI_SEC_FILE"], os.environ["LOKI_SEC_REASON"]
+if not any(w.get("rule") == rule and w.get("file") == fl for w in waivers if isinstance(w, dict)):
+    waivers.append({"rule": rule, "file": fl, "reason": reason})
+data["waivers"] = waivers
+tmp = p + ".tmp"
+with open(tmp, "w") as f: json.dump(data, f, indent=2)
+os.replace(tmp, p)
+print("Waived %s on %s (recorded in the Evidence Receipt)." % (rule, fl))
+PYW
+            exit $?
+            ;;
+        unwaive)
+            local rule="${1:-}" file="${2:-}"
+            if [ -z "$rule" ] || [ -z "$file" ]; then
+                echo -e "${RED}Usage: loki secure unwaive <rule> <file>${NC}" >&2
+                exit 2
+            fi
+            [ -f "$waivers_file" ] || { echo "No waivers to remove."; exit 0; }
+            LOKI_SEC_W="$waivers_file" LOKI_SEC_RULE="$rule" LOKI_SEC_FILE="$file" python3 - <<'PYU'
+import json, os
+p = os.environ["LOKI_SEC_W"]
+try:
+    with open(p) as f: data = json.load(f)
+except Exception:
+    data = {}
+waivers = [w for w in (data.get("waivers") or [])
+           if not (isinstance(w, dict) and w.get("rule") == os.environ["LOKI_SEC_RULE"]
+                   and w.get("file") == os.environ["LOKI_SEC_FILE"])]
+data["waivers"] = waivers
+tmp = p + ".tmp"
+with open(tmp, "w") as f: json.dump(data, f, indent=2)
+os.replace(tmp, p)
+print("Removed waiver for %s on %s." % (os.environ["LOKI_SEC_RULE"], os.environ["LOKI_SEC_FILE"]))
+PYU
+            exit $?
+            ;;
+        *)
+            echo -e "${RED}Unknown subcommand: secure $sub${NC}" >&2
+            echo "Try: loki secure --help"
+            exit 2
+            ;;
+    esac
+}
+
 # loki proof - inspect and share proof-of-run artifacts (.loki/proofs/<id>/).
 # Subcommands: list | show <id> | open <id> | share <id>.
 # The proof.json schema is frozen (R1 spec). Reads are tolerant of missing

package/autonomy/run.sh

@@ -7309,6 +7309,157 @@ SAFEOF
     fi
 }
 
+# ============================================================================
+# Secure-by-default scan (v7.87.0 - Loop 4)
+# Runs the high-precision rule engine (autonomy/lib/secure-scan.py) over the
+# generated app and reports known-bad security patterns.
+#
+# ADVISORY BY DEFAULT (mirrors the ktlint/detekt advisory linters above):
+# findings are reported via log_warn + the receipt json, but do NOT block. This
+# guarantees no existing build starts blocking on this new gate.
+#
+# OPT-IN BLOCK: only when LOKI_SECURE_GATE=block do un-waived HIGH findings
+# cause a blocking gate failure (return 1, same mechanism the other gates use).
+#
+# Waivers: .loki/quality/security-waivers.json ({"waivers":[{rule,file},...]})
+# is READ here and honored (matched findings recorded as waived, never counted
+# active). The waiver-write surface is a separate slice.
+#
+# Honest degrade: if python3 or secure-scan.py is absent, pass through cleanly
+# (no crash, no block), exactly like the optional linters.
+# ============================================================================
+run_secure_scan() {
+    local loki_dir="${TARGET_DIR:-.}/.loki"
+    local quality_dir="$loki_dir/quality"
+    mkdir -p "$quality_dir"
+
+    local out_file="$quality_dir/security-findings.json"
+    local waivers_file="$quality_dir/security-waivers.json"
+    local scanner="$SCRIPT_DIR/lib/secure-scan.py"
+
+    # Honest pass-through if the engine or python3 is unavailable. Still write a
+    # valid (empty) receipt so downstream consumers never read malformed JSON.
+    if ! command -v python3 >/dev/null 2>&1 || [ ! -f "$scanner" ]; then
+        cat > "$out_file" << 'SECEMPTY'
+{"rules_version":null,"findings":[],"summary":{"total":0,"by_severity":{}},"skipped":"scanner-unavailable"}
+SECEMPTY
+        log_info "Security scan: secure-scan.py or python3 not available, skipping (pass-through)"
+        return 0
+    fi
+
+    # Run the scanner. exit 0 = no findings, 1 = findings, 2 = bad input.
+    local raw rc=0
+    raw=$(python3 "$scanner" "${TARGET_DIR:-.}" --json 2>/dev/null) || rc=$?
+    if [ "$rc" -eq 2 ] || [ -z "$raw" ]; then
+        cat > "$out_file" << 'SECEMPTY'
+{"rules_version":null,"findings":[],"summary":{"total":0,"by_severity":{}},"skipped":"scanner-error"}
+SECEMPTY
+        log_info "Security scan: scanner returned no parseable output, skipping (pass-through)"
+        return 0
+    fi
+
+    # Apply waivers, build the receipt json, and emit a machine-readable verdict.
+    # All policy lives in this one python pass so the bash stays bash-3.2 safe.
+    # It prints a final line: ACTIVE_HIGH=<n>\tACTIVE_TOTAL=<n>\tWAIVED=<n>
+    # and writes the enriched receipt (findings carry a "waived" bool).
+    local verdict
+    verdict=$(_SEC_RAW="$raw" _SEC_WAIVERS="$waivers_file" _SEC_OUT="$out_file" python3 -c '
+import json, os, sys
+raw = os.environ.get("_SEC_RAW", "")
+waivers_file = os.environ.get("_SEC_WAIVERS", "")
+out_file = os.environ.get("_SEC_OUT", "")
+
+try:
+    data = json.loads(raw)
+except Exception:
+    data = {"rules_version": None, "findings": [], "summary": {"total": 0, "by_severity": {}}}
+
+# Load waivers: {"waivers":[{"rule":..,"file":..}, ...]}. Match on rule+file.
+waived_set = set()
+try:
+    with open(waivers_file) as f:
+        wdoc = json.load(f)
+    for w in wdoc.get("waivers", []):
+        r = w.get("rule"); fl = w.get("file")
+        if r is not None and fl is not None:
+            waived_set.add((r, fl))
+except (OSError, json.JSONDecodeError, AttributeError):
+    pass
+
+findings = data.get("findings", []) or []
+active_high = 0
+active_total = 0
+waived_count = 0
+for fnd in findings:
+    key = (fnd.get("rule"), fnd.get("file"))
+    is_waived = key in waived_set
+    fnd["waived"] = is_waived
+    if is_waived:
+        waived_count += 1
+    else:
+        active_total += 1
+        if str(fnd.get("severity", "")).upper() == "HIGH":
+            active_high += 1
+
+data["waived"] = waived_count
+data["active"] = active_total
+try:
+    with open(out_file, "w") as f:
+        json.dump(data, f, indent=2)
+except OSError:
+    pass
+
+sys.stdout.write("ACTIVE_HIGH=%d\tACTIVE_TOTAL=%d\tWAIVED=%d" % (active_high, active_total, waived_count))
+' 2>/dev/null) || verdict=""
+
+    if [ -z "$verdict" ]; then
+        # python policy pass failed unexpectedly; preserve the raw scan as the
+        # receipt so nothing is lost, and pass through (never crash the gate).
+        printf '%s\n' "$raw" > "$out_file" 2>/dev/null || true
+        log_info "Security scan: result recorded (policy pass unavailable, advisory)"
+        return 0
+    fi
+
+    local active_high active_total waived
+    active_high=$(printf '%s' "$verdict" | sed -n 's/.*ACTIVE_HIGH=\([0-9]*\).*/\1/p')
+    active_total=$(printf '%s' "$verdict" | sed -n 's/.*ACTIVE_TOTAL=\([0-9]*\).*/\1/p')
+    waived=$(printf '%s' "$verdict" | sed -n 's/.*WAIVED=\([0-9]*\).*/\1/p')
+    active_high=${active_high:-0}
+    active_total=${active_total:-0}
+    waived=${waived:-0}
+
+    if [ "$active_total" -eq 0 ]; then
+        log_info "Security scan: no active findings (waived: $waived)"
+        return 0
+    fi
+
+    # Actionable advisory summary: rule + file + fix, from the receipt json.
+    log_warn "Security scan: $active_total active finding(s) (HIGH: $active_high, waived: $waived)"
+    _SEC_OUT="$out_file" python3 -c '
+import json, os
+try:
+    with open(os.environ["_SEC_OUT"]) as f:
+        data = json.load(f)
+except Exception:
+    data = {"findings": []}
+for fnd in data.get("findings", []):
+    if fnd.get("waived"):
+        continue
+    print("  [%s] %s %s:%s -- %s | fix: %s" % (
+        fnd.get("severity", "?"), fnd.get("rule", "?"),
+        fnd.get("file", "?"), fnd.get("line", "?"),
+        fnd.get("message", ""), fnd.get("fix", "")))
+' 2>/dev/null | while IFS= read -r line; do log_warn "$line"; done
+
+    # OPT-IN BLOCK: only un-waived HIGH findings block, and only when explicitly
+    # enabled. Advisory default returns 0 (never surprise-blocks).
+    if [ "${LOKI_SECURE_GATE:-advisory}" = "block" ] && [ "$active_high" -gt 0 ]; then
+        log_warn "Security gate: $active_high un-waived HIGH finding(s) - BLOCK (LOKI_SECURE_GATE=block)"
+        return 1
+    fi
+    return 0
+}
+
 #===============================================================================
 # Gate Failure Tracking (v6.10.0)
 #===============================================================================
@@ -15262,6 +15413,18 @@ if __name__ == "__main__":
                     log_warn "Static analysis FAILED ($sa_count consecutive) - findings injected into next iteration"
                 fi
             fi
+            # Secure-by-default scan (v7.87.0). Advisory by default (never
+            # blocks); records .loki/quality/security-findings.json each
+            # iteration. Blocks only on un-waived HIGH when LOKI_SECURE_GATE=block.
+            log_info "Quality gate: security scan (advisory)..."
+            if run_secure_scan; then
+                clear_gate_failure "security_scan"
+            else
+                local sec_count
+                sec_count=$(track_gate_failure "security_scan")
+                gate_failures="${gate_failures}security_scan,"
+                log_warn "Security gate BLOCKED ($sec_count consecutive) - un-waived HIGH findings (LOKI_SECURE_GATE=block)"
+            fi
             # BUG-ST-002: Check pause signal between quality gates
             if [ -f "${TARGET_DIR:-.}/.loki/PAUSE" ] || [ -f "${TARGET_DIR:-.}/.loki/STOP" ]; then
                 log_warn "Pause/stop signal detected between quality gates - deferring remaining gates"

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "7.86.0"
+__version__ = "7.87.0"
 
 # Expose the control app for easy import
 try:

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 The flagship product of [Autonomi](https://www.autonomi.dev/). Loki Mode is a spec-driven autonomous builder with a built-in trust layer that takes any spec to a deployed product and verifies completion with evidence (quality gates plus a completion council), not just a "done" claim. Complete installation instructions for all platforms and use cases.
 
-**Version:** v7.86.0
+**Version:** v7.87.0
 
 ---
 
@@ -395,7 +395,7 @@ provider works inside the container. Provide auth with your Anthropic API key:
 # Run Loki Mode in Docker (Claude provider, API-key auth)
 docker run --rm -e ANTHROPIC_API_KEY="$ANTHROPIC_API_KEY" \
   -v $(pwd):/workspace -w /workspace \
-  asklokesh/loki-mode:7.86.0 start ./my-spec.md
+  asklokesh/loki-mode:7.87.0 start ./my-spec.md
 ```
 
 ##### docker compose + .env (no host install)

package/loki-ts/dist/loki.js

@@ -1,5 +1,5 @@
 // @bun
-var QQ=Object.defineProperty;var ZQ=($)=>$;function zQ($,Q){this[$]=ZQ.bind(null,Q)}var b=($,Q)=>{for(var Z in Q)QQ($,Z,{get:Q[Z],enumerable:!0,configurable:!0,set:zQ.bind(Q,Z)})};var L=($,Q)=>()=>($&&(Q=$($=0)),Q);var q$=import.meta.require;var h1={};b(h1,{lokiDir:()=>P,homeLokiDir:()=>i$,findRepoRootForVersion:()=>t$,REPO_ROOT:()=>g});import{resolve as a,dirname as r$}from"path";import{fileURLToPath as XQ}from"url";import{existsSync as R$}from"fs";import{homedir as KQ}from"os";function qQ(){let $=b1;for(let Q=0;Q<6;Q++){if(R$(a($,"VERSION"))&&R$(a($,"autonomy/run.sh")))return $;let Z=r$($);if(Z===$)break;$=Z}return a(b1,"..","..","..")}function t$($){let Q=$;for(let Z=0;Z<6;Z++){if(R$(a(Q,"VERSION"))&&R$(a(Q,"autonomy/run.sh")))return Q;let z=r$(Q);if(z===Q)break;Q=z}return a($,"..","..","..")}function P(){return process.env.LOKI_DIR??a(process.cwd(),".loki")}function i$(){return a(KQ(),".loki")}var b1,g;var C=L(()=>{b1=r$(XQ(import.meta.url));g=qQ()});import{readFileSync as VQ}from"fs";import{resolve as JQ,dirname as UQ}from"path";import{fileURLToPath as WQ}from"url";function E$(){if(Q$!==null)return Q$;let $="7.86.0";if(typeof $==="string"&&$.length>0)return Q$=$,Q$;try{let Q=UQ(WQ(import.meta.url)),Z=t$(Q);Q$=VQ(JQ(Z,"VERSION"),"utf-8").trim()}catch{Q$="unknown"}return Q$}var Q$=null;var e$=L(()=>{C()});var g1={};b(g1,{runOrThrow:()=>HQ,run:()=>F,readStreamCapped:()=>m1,commandVersion:()=>BQ,commandExists:()=>f,ShellError:()=>$1,MAX_STDOUT_BYTES:()=>v1});async function m1($,Q=v1){let Z=$.getReader(),z=new TextDecoder,X="",q=0;try{while(q<Q){let{done:K,value:U}=await Z.read();if(K)break;if(!U)continue;if(q+=U.byteLength,q>Q){let J=U.byteLength-(q-Q);X+=z.decode(U.subarray(0,J),{stream:!0});break}X+=z.decode(U,{stream:!0})}X+=z.decode()}finally{try{await Z.cancel()}catch{}Z.releaseLock()}return X}async function F($,Q={}){let Z=Bun.spawn({cmd:[...$],stdout:"pipe",stderr:"pipe",env:Q.env?{...process.env,...Q.env}:process.env,cwd:Q.cwd}),z,X;if(Q.timeoutMs&&Q.timeoutMs>0)z=setTimeout(()=>{try{Z.kill("SIGTERM")}catch{}X=setTimeout(()=>{try{Z.kill("SIGKILL")}catch{}},2000)},Q.timeoutMs);try{let[q,K,U]=await Promise.all([m1(Z.stdout),new Response(Z.stderr).text(),Z.exited]);return{stdout:q,stderr:K,exitCode:U}}finally{if(z)clearTimeout(z);if(X)clearTimeout(X)}}async function HQ($,Q={}){let Z=await F($,Q);if(Z.exitCode!==0)throw new $1(`command failed (${Z.exitCode}): ${$.join(" ")}`,Z.exitCode,Z.stdout,Z.stderr);return Z}async function f($){let Q=GQ($),Z=await F(["sh","-c",`command -v ${Q}`],{timeoutMs:5000});if(Z.exitCode===0)return Z.stdout.trim()||null;return null}function GQ($){if(!/^[A-Za-z0-9._/-]+$/.test($))throw Error(`refused to shell-escape suspect token: ${$}`);return $}async function BQ($,Q="--version"){if(!await f($))return null;let z=await F([$,Q],{timeoutMs:5000});if(z.exitCode!==0)return null;return((z.stdout||z.stderr).split(/\r?\n/)[0]?.trim()??"")||null}var v1=16777216,$1;var d=L(()=>{$1=class $1 extends Error{message;exitCode;stdout;stderr;constructor($,Q,Z,z){super($);this.message=$;this.exitCode=Q;this.stdout=Z;this.stderr=z;this.name="ShellError"}}});function s($){return YQ?"":$}var YQ,O,S,_,_Z,I,k,h,V;var c=L(()=>{YQ=(process.env.NO_COLOR??"").length>0;O=s("\x1B[0;31m"),S=s("\x1B[0;32m"),_=s("\x1B[1;33m"),_Z=s("\x1B[0;34m"),I=s("\x1B[0;36m"),k=s("\x1B[1m"),h=s("\x1B[2m"),V=s("\x1B[0m")});import{existsSync as jQ}from"fs";async function Z$(){if(Y$!==void 0)return Y$;let $="/opt/homebrew/bin/python3.12";if(jQ($))return Y$=$,$;let Q=await f("python3.12");if(Q)return Y$=Q,Q;let Z=await f("python3");return Y$=Z,Z}async function z$($,Q={}){let Z=await Z$();if(!Z)return{stdout:"",stderr:"python3 not found",exitCode:127};return F([Z,"-c",$],Q)}var Y$;var V$=L(()=>{d()});var X0={};b(X0,{runStatus:()=>oQ});import{existsSync as y,readFileSync as U$,readdirSync as r1,statSync as t1}from"fs";import{resolve as D,basename as vQ}from"path";import{homedir as mQ}from"os";function i1($){let Q=Math.trunc($);if(Q>=1e6)return`${(Math.trunc(Q/1e6*10)/10).toFixed(1)}M`;if(Q>=1000)return`${(Math.trunc(Q/1000*10)/10).toFixed(1)}K`;return String(Q)}function e1($,Q,Z){if(Q===0)return null;let z=Math.trunc($*100/Q),X=Math.trunc($*N$/Q);if(X>N$)X=N$;let q=N$-X,K=S;if(z>=80)K=O;else if(z>=50)K=_;let U="=".repeat(Math.max(0,X))+" ".repeat(Math.max(0,q)),J=i1($),W=i1(Q);return`  ${k}${Z}${V} ${K}[${U}]${V} ${z}% (${J} / ${W})`}async function fQ(){if(await f("jq"))return!0;return process.stdout.write(`${O}Error: jq is required but not installed.${V}
+var QQ=Object.defineProperty;var ZQ=($)=>$;function zQ($,Q){this[$]=ZQ.bind(null,Q)}var b=($,Q)=>{for(var Z in Q)QQ($,Z,{get:Q[Z],enumerable:!0,configurable:!0,set:zQ.bind(Q,Z)})};var L=($,Q)=>()=>($&&(Q=$($=0)),Q);var q$=import.meta.require;var h1={};b(h1,{lokiDir:()=>P,homeLokiDir:()=>i$,findRepoRootForVersion:()=>t$,REPO_ROOT:()=>g});import{resolve as a,dirname as r$}from"path";import{fileURLToPath as XQ}from"url";import{existsSync as R$}from"fs";import{homedir as KQ}from"os";function qQ(){let $=b1;for(let Q=0;Q<6;Q++){if(R$(a($,"VERSION"))&&R$(a($,"autonomy/run.sh")))return $;let Z=r$($);if(Z===$)break;$=Z}return a(b1,"..","..","..")}function t$($){let Q=$;for(let Z=0;Z<6;Z++){if(R$(a(Q,"VERSION"))&&R$(a(Q,"autonomy/run.sh")))return Q;let z=r$(Q);if(z===Q)break;Q=z}return a($,"..","..","..")}function P(){return process.env.LOKI_DIR??a(process.cwd(),".loki")}function i$(){return a(KQ(),".loki")}var b1,g;var C=L(()=>{b1=r$(XQ(import.meta.url));g=qQ()});import{readFileSync as VQ}from"fs";import{resolve as JQ,dirname as UQ}from"path";import{fileURLToPath as WQ}from"url";function E$(){if(Q$!==null)return Q$;let $="7.87.0";if(typeof $==="string"&&$.length>0)return Q$=$,Q$;try{let Q=UQ(WQ(import.meta.url)),Z=t$(Q);Q$=VQ(JQ(Z,"VERSION"),"utf-8").trim()}catch{Q$="unknown"}return Q$}var Q$=null;var e$=L(()=>{C()});var g1={};b(g1,{runOrThrow:()=>HQ,run:()=>F,readStreamCapped:()=>m1,commandVersion:()=>BQ,commandExists:()=>f,ShellError:()=>$1,MAX_STDOUT_BYTES:()=>v1});async function m1($,Q=v1){let Z=$.getReader(),z=new TextDecoder,X="",q=0;try{while(q<Q){let{done:K,value:U}=await Z.read();if(K)break;if(!U)continue;if(q+=U.byteLength,q>Q){let J=U.byteLength-(q-Q);X+=z.decode(U.subarray(0,J),{stream:!0});break}X+=z.decode(U,{stream:!0})}X+=z.decode()}finally{try{await Z.cancel()}catch{}Z.releaseLock()}return X}async function F($,Q={}){let Z=Bun.spawn({cmd:[...$],stdout:"pipe",stderr:"pipe",env:Q.env?{...process.env,...Q.env}:process.env,cwd:Q.cwd}),z,X;if(Q.timeoutMs&&Q.timeoutMs>0)z=setTimeout(()=>{try{Z.kill("SIGTERM")}catch{}X=setTimeout(()=>{try{Z.kill("SIGKILL")}catch{}},2000)},Q.timeoutMs);try{let[q,K,U]=await Promise.all([m1(Z.stdout),new Response(Z.stderr).text(),Z.exited]);return{stdout:q,stderr:K,exitCode:U}}finally{if(z)clearTimeout(z);if(X)clearTimeout(X)}}async function HQ($,Q={}){let Z=await F($,Q);if(Z.exitCode!==0)throw new $1(`command failed (${Z.exitCode}): ${$.join(" ")}`,Z.exitCode,Z.stdout,Z.stderr);return Z}async function f($){let Q=GQ($),Z=await F(["sh","-c",`command -v ${Q}`],{timeoutMs:5000});if(Z.exitCode===0)return Z.stdout.trim()||null;return null}function GQ($){if(!/^[A-Za-z0-9._/-]+$/.test($))throw Error(`refused to shell-escape suspect token: ${$}`);return $}async function BQ($,Q="--version"){if(!await f($))return null;let z=await F([$,Q],{timeoutMs:5000});if(z.exitCode!==0)return null;return((z.stdout||z.stderr).split(/\r?\n/)[0]?.trim()??"")||null}var v1=16777216,$1;var d=L(()=>{$1=class $1 extends Error{message;exitCode;stdout;stderr;constructor($,Q,Z,z){super($);this.message=$;this.exitCode=Q;this.stdout=Z;this.stderr=z;this.name="ShellError"}}});function s($){return YQ?"":$}var YQ,O,S,_,_Z,I,k,h,V;var c=L(()=>{YQ=(process.env.NO_COLOR??"").length>0;O=s("\x1B[0;31m"),S=s("\x1B[0;32m"),_=s("\x1B[1;33m"),_Z=s("\x1B[0;34m"),I=s("\x1B[0;36m"),k=s("\x1B[1m"),h=s("\x1B[2m"),V=s("\x1B[0m")});import{existsSync as jQ}from"fs";async function Z$(){if(Y$!==void 0)return Y$;let $="/opt/homebrew/bin/python3.12";if(jQ($))return Y$=$,$;let Q=await f("python3.12");if(Q)return Y$=Q,Q;let Z=await f("python3");return Y$=Z,Z}async function z$($,Q={}){let Z=await Z$();if(!Z)return{stdout:"",stderr:"python3 not found",exitCode:127};return F([Z,"-c",$],Q)}var Y$;var V$=L(()=>{d()});var X0={};b(X0,{runStatus:()=>oQ});import{existsSync as y,readFileSync as U$,readdirSync as r1,statSync as t1}from"fs";import{resolve as D,basename as vQ}from"path";import{homedir as mQ}from"os";function i1($){let Q=Math.trunc($);if(Q>=1e6)return`${(Math.trunc(Q/1e6*10)/10).toFixed(1)}M`;if(Q>=1000)return`${(Math.trunc(Q/1000*10)/10).toFixed(1)}K`;return String(Q)}function e1($,Q,Z){if(Q===0)return null;let z=Math.trunc($*100/Q),X=Math.trunc($*N$/Q);if(X>N$)X=N$;let q=N$-X,K=S;if(z>=80)K=O;else if(z>=50)K=_;let U="=".repeat(Math.max(0,X))+" ".repeat(Math.max(0,q)),J=i1($),W=i1(Q);return`  ${k}${Z}${V} ${K}[${U}]${V} ${z}% (${J} / ${W})`}async function fQ(){if(await f("jq"))return!0;return process.stdout.write(`${O}Error: jq is required but not installed.${V}
 `),process.stdout.write(`Install with:
 `),process.stdout.write(`  brew install jq    (macOS)
 `),process.stdout.write(`  apt install jq     (Debian/Ubuntu)
@@ -796,4 +796,4 @@ Set LOKI_LEGACY_BASH=1 to force the bash CLI for every command.
 `),2}default:return process.stderr.write(`Unknown command: ${Q}
 `),process.stderr.write($Q),2}}s1();process.on("SIGINT",()=>process.exit(130));process.on("SIGTERM",()=>process.exit(143));var qZ=await KZ(Bun.argv.slice(2));process.exit(qZ);
 
-//# debugId=5E11AD9E3DCEB72F64756E2164756E21
+//# debugId=7982E696DB64940A64756E2164756E21

package/mcp/__init__.py

@@ -57,4 +57,4 @@ try:
 except ImportError:
     __all__ = ['mcp']
 
-__version__ = '7.86.0'
+__version__ = '7.87.0'

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "loki-mode",
   "mcpName": "io.github.asklokesh/loki-mode",
-  "version": "7.86.0",
+  "version": "7.87.0",
   "description": "Loki Mode by Autonomi. Autonomous spec-to-product system: takes a PRD, GitHub issue, OpenAPI/JSON/YAML, or one-line brief to a deployed app via the RARV-C closure loop with 8 quality gates. Provider-agnostic (Claude Code, OpenAI Codex, Cline, Aider).",
   "keywords": [
     "agent",

package/plugins/loki-mode/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "loki-mode",
   "displayName": "Loki Mode",
-  "version": "7.86.0",
+  "version": "7.87.0",
   "description": "Autonomous spec-to-product build system with a built-in trust layer (RARV-C closure loop, 8 quality gates, completion council). Ships Loki's spec-hardening, drift-detection, and deterministic PR verification commands plus the Loki MCP server.",
   "author": {
     "name": "Autonomi",