loki-mode 7.87.0 → 7.89.0

package/autonomy/lib/wiki-generator.py

@@ -86,6 +86,180 @@ def _entry_points(root, files):
     return [c for c in candidates if c in fileset]
 
 
+def _mermaid_label(text):
+    """Return a Mermaid-safe node label string (no injection, no parse breaks).
+
+    Mermaid breaks on quotes, brackets, and a handful of metacharacters, and a
+    crafted label could otherwise smuggle node/edge syntax. We keep only a
+    conservative character set (alphanumerics, space, and a few path-safe
+    punctuation marks) and collapse everything else to a space. The result is
+    always wrapped by the caller in double quotes inside ["..."], so the empty
+    string degrades to an empty-but-valid label rather than a syntax error.
+    """
+    safe = []
+    for ch in str(text or ""):
+        if ch.isalnum() or ch in " ._/-":
+            safe.append(ch)
+        else:
+            safe.append(" ")
+    out = "".join(safe).strip()
+    # Collapse runs of whitespace so labels stay compact + deterministic.
+    out = " ".join(out.split())
+    return out or "node"
+
+
+def _classify_data_store(rel):
+    """Return a data-store label for a file that looks like a store, else None.
+
+    Heuristic + deterministic: matches well-known persistence/config surfaces
+    by path substring. Only real indexed files reach here, so any node emitted
+    is cited. Returns None when the file is not a recognizable data store.
+    """
+    low = rel.lower()
+    checks = [
+        ("schema", "Schema"),
+        ("migration", "Migrations"),
+        ("models", "Data Models"),
+        ("model.", "Data Models"),
+        ("storage", "Storage"),
+        ("database", "Database"),
+        ("/db/", "Database"),
+        ("db.", "Database"),
+        ("repository", "Repository"),
+        ("repositories", "Repository"),
+        ("dao", "Data Access"),
+        ("store.", "Store"),
+        (".sql", "SQL"),
+    ]
+    for needle, label in checks:
+        if needle in low:
+            return label
+    return None
+
+
+def _data_stores(files, limit=4):
+    """Pick recognizable data-store files from the indexed set (real files).
+
+    Deterministic: scans files in sorted order (build_index returns them
+    sorted) and returns the first `limit` matches as {file, label}.
+    """
+    stores = []
+    for rel in files:
+        label = _classify_data_store(rel)
+        if label:
+            stores.append({"file": rel, "label": label})
+        if len(stores) >= limit:
+            break
+    return stores
+
+
+def _architecture_diagram(index, modules, entries):
+    """Deterministic Mermaid flowchart: entry points -> modules -> data stores.
+
+    Every node is derived from the real codebase index (entry points, top
+    modules, data-store files) -- nothing is fabricated. Given the same index
+    the output is byte-identical (no Date, no random, fixed iteration order).
+    If the index is too sparse to draw a real graph, a minimal honest
+    single-node flowchart is returned instead of a fake one.
+    """
+    entry_nodes = list(entries[:4])
+    entry_set = set(entry_nodes)
+    # A file that is both an entry point and a top module is drawn once, as an
+    # entry point, so a node is never declared twice and no self-edge appears.
+    mod_nodes = [m["file"] for m in modules[:6] if m["file"] not in entry_set]
+    stores = _data_stores(index["files"])
+
+    # Sparse-index guard: with no entry points and no modules there is nothing
+    # real to draw. Emit a minimal honest diagram rather than inventing nodes.
+    if not entry_nodes and not mod_nodes:
+        return "flowchart TD\n    src[\"Source files\"]"
+
+    lines = ["flowchart TD"]
+    ids = {}
+    counter = 0
+
+    def node_id(key):
+        nonlocal counter
+        if key not in ids:
+            ids[key] = "n%d" % counter
+            counter += 1
+        return ids[key]
+
+    # Declare nodes in a fixed order (entries, modules, stores) so the diagram
+    # is deterministic for a given index.
+    for e in entry_nodes:
+        lines.append("    %s[\"%s\"]" % (node_id(e), _mermaid_label(e)))
+    for m in mod_nodes:
+        lines.append("    %s[\"%s\"]" % (node_id(m), _mermaid_label(m)))
+    for s in stores:
+        lines.append(
+            "    %s[(\"%s\")]" % (node_id("store:" + s["file"]), _mermaid_label(s["label"]))
+        )
+
+    # Edges: every entry point feeds every top module (a coarse but honest
+    # "entry -> module" relation), and modules feed the data stores. When there
+    # are no entry points, modules stand alone at the top.
+    sources = entry_nodes if entry_nodes else mod_nodes
+    targets = mod_nodes if entry_nodes else []
+    for src in sources:
+        for tgt in targets:
+            lines.append("    %s --> %s" % (node_id(src), node_id(tgt)))
+    if stores:
+        store_sources = mod_nodes if mod_nodes else entry_nodes
+        for src in store_sources[:3]:
+            for s in stores:
+                lines.append(
+                    "    %s --> %s" % (node_id(src), node_id("store:" + s["file"]))
+                )
+    return "\n".join(lines)
+
+
+def _data_flow_diagram(index, modules, entries):
+    """Deterministic Mermaid flowchart for the request/data path.
+
+    Models the path as: entry point -> the top modules in rank order -> data
+    store, using only real indexed files. Same index -> same diagram. Falls
+    back to a minimal honest diagram when the index is too sparse.
+    """
+    entry = entries[0] if entries else None
+    # Drop the entry file from the module chain so it is not visited twice
+    # (which would create a self-edge); the chain stays a simple acyclic path.
+    mod_chain = [m["file"] for m in modules[:4] if m["file"] != entry]
+    stores = _data_stores(index["files"], limit=1)
+
+    if not entry and not mod_chain:
+        return "flowchart LR\n    src[\"Source files\"]"
+
+    lines = ["flowchart LR"]
+    ids = {}
+    counter = 0
+
+    def node_id(key):
+        nonlocal counter
+        if key not in ids:
+            ids[key] = "f%d" % counter
+            counter += 1
+        return ids[key]
+
+    # Build an ordered chain of real nodes: entry -> modules -> store.
+    chain = []
+    if entry:
+        chain.append(("entry", entry, _mermaid_label(entry)))
+    for m in mod_chain:
+        chain.append(("mod", m, _mermaid_label(m)))
+    if stores:
+        chain.append(("store", "store:" + stores[0]["file"], _mermaid_label(stores[0]["label"])))
+
+    for kind, key, label in chain:
+        if kind == "store":
+            lines.append("    %s[(\"%s\")]" % (node_id(key), label))
+        else:
+            lines.append("    %s[\"%s\"]" % (node_id(key), label))
+    for i in range(len(chain) - 1):
+        lines.append("    %s --> %s" % (node_id(chain[i][1]), node_id(chain[i + 1][1])))
+    return "\n".join(lines)
+
+
 def _llm_prose(section, context, fallback):
     """Get prose for a section from the LLM, or use the deterministic fallback."""
     prompt = (
@@ -137,8 +311,11 @@ def _section_overview(root, index, modules, entries, context):
     for m in modules[:4]:
         line = m["defs"][0]["line"] if m["defs"] else 1
         citations.append({"file": m["file"], "line": line})
+    # Mermaid flowchart derived from the real index (entry -> modules -> stores).
+    # Raw mermaid source (no ``` wrapper); the UI wraps/renders it.
+    diagram = _architecture_diagram(index, modules, entries)
     return {"id": "architecture", "title": "Architecture Overview",
-            "body": prose, "citations": citations}
+            "body": prose, "citations": citations, "diagram": diagram}
 
 
 def _section_modules(root, modules, context):
@@ -165,7 +342,7 @@ def _section_modules(root, modules, context):
             "body": "\n".join(body_parts), "citations": citations}
 
 
-def _section_data_flow(root, index, entries, context):
+def _section_data_flow(root, index, modules, entries, context):
     fallback = (
         "Execution begins at the entry point(s) (%s) and flows through the "
         "key modules. Trace a request from the entry file into the modules it "
@@ -175,8 +352,11 @@ def _section_data_flow(root, index, entries, context):
     citations = [{"file": e, "line": 1} for e in entries[:4]]
     if not citations and index["files"]:
         citations = [{"file": index["files"][0], "line": 1}]
+    # Mermaid data-flow chain derived from the real index (entry -> modules ->
+    # store). Raw mermaid source (no ``` wrapper); the UI wraps/renders it.
+    diagram = _data_flow_diagram(index, modules, entries)
     return {"id": "data-flow", "title": "Data Flow",
-            "body": prose, "citations": citations}
+            "body": prose, "citations": citations, "diagram": diagram}
 
 
 def _validate_citations(root, citations):
@@ -203,6 +383,14 @@ def _validate_citations(root, citations):
 
 def _render_md(section):
     lines = ["## %s" % section["title"], "", section["body"], ""]
+    # Render the Mermaid diagram (when present) as a fenced mermaid block so
+    # the markdown view shows the same visual the dashboard renders.
+    diagram = section.get("diagram")
+    if diagram:
+        lines.append("```mermaid")
+        lines.append(diagram)
+        lines.append("```")
+        lines.append("")
     if section["citations"]:
         lines.append("**Sources:**")
         for c in section["citations"]:
@@ -259,7 +447,7 @@ def main(argv=None):
     sections = [
         _section_overview(root, index, modules, entries, context),
         _section_modules(root, modules, context),
-        _section_data_flow(root, index, entries, context),
+        _section_data_flow(root, index, modules, entries, context),
     ]
 
     # Enforce the grounding contract: validate every citation against disk.

package/autonomy/loki

@@ -5315,14 +5315,17 @@ cmd_welcome_terminal() {
     echo -e "  Quick start:  ${BOLD}loki quickstart${NC} (from your idea) or ${BOLD}loki start ./prd.md${NC} (from a spec)"
     echo -e "  Docs:         ${BOLD}https://www.autonomi.dev/docs${NC}"
     echo ""
+    # One-time honest disclosure (this welcome screen shows once, via the
+    # WELCOME_MARKER). On-by-default anonymous diagnostics must be disclosed
+    # somewhere so collection is never covert; this single line is that
+    # disclosure. It is NOT repeated on later runs. Enterprise/CI/air-gapped
+    # installs auto-disable collection, so the line only appears when it is
+    # actually on. Opt out anytime: loki telemetry off.
     if _loki_welcome_analytics_on; then
-        echo -e "  ${DIM}Anonymous usage analytics are ON (you opted in). We never collect${NC}"
-        echo -e "  ${DIM}prompts, PRDs, or code. Opt out: loki telemetry off${NC}"
-    else
-        echo -e "  ${DIM}Anonymous analytics are off by default. Nothing is sent unless you${NC}"
-        echo -e "  ${DIM}opt in with: loki telemetry on${NC}"
+        echo -e "  ${DIM}Anonymous diagnostics on (os/arch/version/error type only -- never${NC}"
+        echo -e "  ${DIM}code, prompts, or paths). Off: loki telemetry off  -  docs/PRIVACY.md${NC}"
+        echo ""
     fi
-    echo ""
 }
 
 cmd_welcome() {
@@ -5419,7 +5422,7 @@ cmd_web() {
     case "$subcommand" in
         start)
             shift || true
-            cmd_web_start "$@"
+            cmd_web_redirect_to_dashboard "$@"
             ;;
         stop)
             cmd_web_stop
@@ -5449,51 +5452,87 @@ cmd_web() {
         *)
             # Treat unknown args as options to start (e.g., loki web --no-open)
             shift
-            cmd_web_start "$subcommand" "$@"
+            cmd_web_redirect_to_dashboard "$subcommand" "$@"
             ;;
     esac
 }
 
+# v7.x (F55): `loki web` (the command a user intuitively types) used to launch
+# the deprecated Purple Lab, whose '/' redirects to '/lab/' and whose port has
+# none of the real dashboard APIs (/api/status, /trust, etc. all 404). A user
+# typing the obvious command landed on the wrong, broken-looking surface. The
+# value-preserving fix: the START path now launches the real dashboard instead.
+# 'loki web stop|status|logs' still operate on Purple Lab so anyone who started
+# it the old way (or via scripts) is never stranded. The deprecation banner has
+# already printed in cmd_web() before we get here.
+cmd_web_redirect_to_dashboard() {
+    # The dashboard start path does not accept Purple-Lab-only flags
+    # (--no-open, --prd). Filter them so `loki web --no-open` (used in CI) and
+    # `loki web --prd X` keep working instead of erroring on an unknown option.
+    # --port is shared and passes straight through.
+    local orig_args=("$@")
+    local dash_args=()
+    while [[ $# -gt 0 ]]; do
+        case "$1" in
+            --no-open)
+                # Dashboard has no browser-open behavior to suppress; drop it.
+                shift
+                ;;
+            --prd)
+                # Purple-Lab-only prefill; not supported by the dashboard.
+                shift 2 2>/dev/null || shift
+                ;;
+            --prd=*)
+                shift
+                ;;
+            *)
+                dash_args+=("$1")
+                shift
+                ;;
+        esac
+    done
+
+    # Safe empty-array expansion (bash 3.2 + set -u): ${arr[@]+"${arr[@]}"}
+    if ! _deprecated_alias_should_suppress ${orig_args[@]+"${orig_args[@]}"}; then
+        echo "Launching the dashboard (http://localhost:${DASHBOARD_DEFAULT_PORT}) instead of the deprecated Purple Lab." >&2
+    fi
+    cmd_dashboard_start ${dash_args[@]+"${dash_args[@]}"}
+}
+
 cmd_web_help() {
     echo -e "${BOLD}Purple Lab -- Loki Mode Web UI (deprecated -- use the dashboard)${NC}"
     echo ""
     echo "Usage: loki web [command] [options]"
     echo ""
     echo "DEPRECATED as of v7.44.0: Purple Lab is consolidated into the dashboard."
-    echo "  For local build + monitoring, use the dashboard (auto-launches at"
-    echo "  'loki start', http://localhost:${DASHBOARD_DEFAULT_PORT}; or 'loki dashboard')."
-    echo "  For the hosted platform, see Autonomi Cloud."
-    echo "  'loki web' still works for now (it launches after a deprecation notice),"
-    echo "  but it will be removed in a future release. Migrate to the dashboard."
+    echo "  'loki web' (no subcommand) now LAUNCHES THE DASHBOARD"
+    echo "  (http://localhost:${DASHBOARD_DEFAULT_PORT}) instead of the deprecated Purple"
+    echo "  Lab, so the obvious command lands you on the working UI. Use the embedded"
+    echo "  'Lab' tab there to submit a PRD. For the hosted platform, see Autonomi Cloud."
     echo ""
-    echo "Note: 'loki web' is Purple Lab (the PRD-input/build-watch UI, port ${PURPLE_LAB_DEFAULT_PORT})."
-    echo "      It is NOT the same as 'loki dashboard' (operations UI, port ${DASHBOARD_DEFAULT_PORT})."
-    echo "      Use 'loki dashboard' to monitor running agents, tasks, costs, council, escalations."
+    echo "Note: the canonical command is 'loki dashboard' (operations UI, port ${DASHBOARD_DEFAULT_PORT})."
+    echo "      Use it to monitor running agents, tasks, costs, council, escalations."
     echo ""
     echo "Commands:"
-    echo "  start    Start Purple Lab (default)"
-    echo "  stop     Stop Purple Lab server"
+    echo "  start    Launch the dashboard (default; Purple Lab is deprecated)"
+    echo "  stop     Stop the Purple Lab server (if one was started the old way)"
     echo "  status   Show Purple Lab server status"
     echo "  logs     Show Purple Lab server logs"
     echo "  help     Show this help"
     echo ""
     echo "Options (for start):"
-    echo "  --no-open      Don't open browser automatically"
-    echo "  --port PORT    Use custom port (default: ${PURPLE_LAB_DEFAULT_PORT})"
-    echo ""
-    echo "Purple Lab is the product UI where you input PRDs and watch agents build."
-    echo "It runs its own backend (web-app/server.py) on port ${PURPLE_LAB_DEFAULT_PORT}."
+    echo "  --port PORT    Use custom port (default: ${DASHBOARD_DEFAULT_PORT})"
+    echo "  --no-open      Accepted for back-compat; ignored (no-op on the dashboard)"
     echo ""
     echo "Examples:"
-    echo "  loki web                  Start Purple Lab and open in browser"
-    echo "  loki web --no-open        Start without opening browser"
-    echo "  loki web stop             Stop the Purple Lab server"
+    echo "  loki web                  Launch the dashboard"
+    echo "  loki web --no-open        Launch the dashboard (--no-open is a no-op)"
+    echo "  loki web stop             Stop a Purple Lab server started the old way"
     echo ""
     echo "Note (since v7.5.30):"
-    echo "  Purple Lab is also embedded in the Dashboard as a Lab sidebar entry."
-    echo "  Run 'loki dashboard start' and click 'Lab' to use the same UI"
-    echo "  without spawning a second port. 'loki web' standalone remains"
-    echo "  supported (Rule 0); both modes serve the same React bundle."
+    echo "  The same PRD-input UI is embedded in the dashboard as a 'Lab' sidebar entry."
+    echo "  'loki web stop|status|logs' still operate on a standalone Purple Lab"
+    echo "  process so anyone who started one the old way is never stranded."
 }
 
 cmd_web_start() {
@@ -16110,6 +16149,18 @@ worktree wt projects cp rc trust-metrics serve agent code self_update test help
 
 # Main command dispatcher
 main() {
+    # v7.89.0 telemetry TTY fix (council cH_r1 AC1): resolve interactivity EXACTLY
+    # ONCE here, while autonomy/loki main still owns the user's real TTY, and
+    # export the explicit signal that the telemetry/crash gates trust instead of a
+    # late `-t` re-probe. When invoked via the bin/loki shim the var is already
+    # exported (and re-exporting the same value is a no-op); this covers the path
+    # where autonomy/loki is invoked directly (LOKI_LEGACY_BASH, no-Bun, or a
+    # direct call). Only set when a terminal is actually present; leave UNSET
+    # otherwise so isolated gate unit tests fall back to their own `-t` probe.
+    if [ -z "${LOKI_TTY_INTERACTIVE:-}" ] && { [ -t 1 ] || [ -t 0 ]; }; then
+        export LOKI_TTY_INTERACTIVE=1
+    fi
+
     # v7.5.18: early guard -- LOKI_PROVIDER=gemini is no longer supported.
     if [ "${LOKI_PROVIDER:-}" = "gemini" ]; then
         echo -e "${RED}Error: Provider 'gemini' is deprecated as of v7.5.18 and has been removed.${NC}" >&2
@@ -16131,6 +16182,19 @@ main() {
     # v7.4.13: first-run telemetry moved to bin/loki shim so it fires for
     # both Bun-routed and bash-routed commands (autonomy/loki main() never
     # runs for the 8 ported commands). Marker file: ~/.loki-first-run.
+    #
+    # v7.89.0 (council cH_r1 AC4): this is a FOREGROUND egress on the bash route.
+    # Before it can phone home, the user must have seen the disclosure once -- a
+    # bash-routed first command must never be covert. Evaluate the SAME gate the
+    # egress uses, and if collection is genuinely enabled, disclose once (shared
+    # impl from telemetry.sh, keyed on its own marker, so it never double-prints
+    # with the Bun route or repeats). loki_telemetry itself re-checks the gate, so
+    # this only adds the disclosure; it never changes whether we send.
+    if declare -f _loki_telemetry_enabled >/dev/null 2>&1 \
+       && declare -f _loki_disclose_telemetry_once >/dev/null 2>&1 \
+       && _loki_telemetry_enabled; then
+        _loki_disclose_telemetry_once
+    fi
     loki_telemetry "cli_command" "command=$command" 2>/dev/null || true
 
     # Unified config-file pre-pass (#691). For session commands ONLY, honor
@@ -16504,6 +16568,12 @@ main() {
             # Secure-by-default gate surface: inspect findings + manage waivers.
             cmd_secure "$@"
             ;;
+        own|handoff)
+            # Finish-and-own: a plain-English ownership handoff for a non-technical
+            # owner (what was built, is it working, how to run/deploy, what is left).
+            # `loki handoff` is an alias for `loki own`.
+            cmd_own "$@"
+            ;;
         bench)
             cmd_bench "$@"
             ;;
@@ -21941,13 +22011,32 @@ try {
 
             # Unified collection state (PostHog usage telemetry + crash reporting).
             # loki_collection_enabled is the single source of truth (crash.sh).
-            # Collection is OPT-IN: OFF by default, enabled only after opt-in.
+            # Collection is ON BY DEFAULT for individual interactive installs and
+            # auto-off in enterprise/CI/air-gapped/non-interactive contexts; an
+            # explicit opt-out always wins. AC8 (council cH_r1): the status copy
+            # must distinguish "on by default" from an explicit "you opted in".
             echo ""
             if type loki_collection_enabled &>/dev/null; then
                 if loki_collection_enabled; then
-                    echo -e "  Collection: ${GREEN}enabled${NC} (you opted in; anonymous diagnostics; opt out with: loki telemetry off)"
+                    # Detect an EXPLICIT opt-in (env LOKI_TELEMETRY=on, or the
+                    # persistent ~/.loki/config TELEMETRY_ENABLED=true written by
+                    # `loki telemetry on`). Anything else that is enabled is the
+                    # individual on-by-default path.
+                    local _telem_lower_status
+                    _telem_lower_status="$(printf '%s' "${LOKI_TELEMETRY:-}" | tr '[:upper:]' '[:lower:]')"
+                    local _explicit_optin=false
+                    if [ "$_telem_lower_status" = "on" ]; then
+                        _explicit_optin=true
+                    elif [ -f "$global_config" ] && grep -q "^TELEMETRY_ENABLED=true" "$global_config" 2>/dev/null; then
+                        _explicit_optin=true
+                    fi
+                    if [ "$_explicit_optin" = true ]; then
+                        echo -e "  Collection: ${GREEN}enabled${NC} (you opted in; anonymous diagnostics; opt out with: loki telemetry off)"
+                    else
+                        echo -e "  Collection: ${GREEN}on by default${NC} (anonymous diagnostics; opt out with: loki telemetry off)"
+                    fi
                 else
-                    echo -e "  Collection: ${YELLOW}off by default${NC} (nothing sent; opt in with: loki telemetry on)"
+                    echo -e "  Collection: ${YELLOW}off${NC} (nothing sent; enterprise/CI/air-gapped or opted out; opt in with: loki telemetry on)"
                 fi
             fi
 
@@ -30438,6 +30527,60 @@ cmd_bench() {
     bash "$bench_sh" "$@"
 }
 
+# loki own - finish-and-own (v7.88.0): a plain-English ownership handoff for a
+# NON-technical owner. A pure render (autonomy/lib/own-render.py) over the data
+# Loki already captured -- the Evidence Receipt, the completion summary, and
+# USAGE.md -- so it cannot fabricate: the "is it working?" verdict comes verbatim
+# from the receipt's honest headline and is never green unless the receipt is
+# VERIFIED. Default prints the doc; --md writes HANDOFF.md; --json for tooling.
+# `loki handoff` is an alias.
+cmd_own() {
+    local renderer="${_LOKI_SCRIPT_DIR}/lib/own-render.py"
+    if [ ! -f "$renderer" ]; then
+        echo -e "${RED}Finish-and-own renderer not found (autonomy/lib/own-render.py).${NC}" >&2
+        exit 2
+    fi
+    case "${1:-}" in
+        --help|-h|help)
+            echo -e "${BOLD}loki own${NC} - a plain-English ownership handoff (alias: loki handoff)"
+            echo ""
+            echo "Usage: loki own [--md | --json]"
+            echo ""
+            echo "Explains, in plain language for a non-technical owner: what was"
+            echo "built, whether Loki verified it works, how to run it, how to put"
+            echo "it online, what a developer needs to know, and what is left to do."
+            echo "It reads the last build's Evidence Receipt + completion summary;"
+            echo "the 'is it working' verdict is the receipt's honest headline (never"
+            echo "green unless the build is VERIFIED)."
+            echo ""
+            echo "Options:"
+            echo "  --md     Write HANDOFF.md to the project root"
+            echo "  --json   Emit the structured handoff as JSON"
+            exit 0
+            ;;
+    esac
+    # --md writes HANDOFF.md at the project root (matches the help). The renderer
+    # prints markdown on stdout; the CLI places it as a file, atomically (temp+mv)
+    # so a partial write never leaves a truncated HANDOFF.md. Any other args
+    # (--json, default) pass through and print.
+    if [ "${1:-}" = "--md" ]; then
+        local _handoff="${TARGET_DIR:-.}/HANDOFF.md"
+        local _handoff_tmp="${TARGET_DIR:-.}/.HANDOFF.md.tmp"
+        if python3 "$renderer" --loki-dir "${LOKI_DIR:-.loki}" --md > "$_handoff_tmp" 2>/dev/null; then
+            mv -f "$_handoff_tmp" "$_handoff" && \
+                echo -e "${GREEN}Wrote ${_handoff}${NC} - open it or hand it to whoever owns this build." || \
+                { rm -f "$_handoff_tmp" 2>/dev/null; echo -e "${RED}Could not write HANDOFF.md${NC}" >&2; exit 1; }
+        else
+            rm -f "$_handoff_tmp" 2>/dev/null
+            echo -e "${RED}Could not render the ownership handoff${NC}" >&2
+            exit 1
+        fi
+        exit 0
+    fi
+    python3 "$renderer" --loki-dir "${LOKI_DIR:-.loki}" "$@"
+    exit $?
+}
+
 # loki secure - the secure-by-default gate surface (v7.87.0).
 # Subcommands: list (show findings) | waive <rule> <file> [reason] | unwaive.
 # Waivers are written to .loki/quality/security-waivers.json, which the gate
@@ -30589,7 +30732,7 @@ cmd_proof() {
                 # "No proofs found" line -- matching the Bun route (proof.ts
                 # listProofs, which returns before the header when rows is empty).
                 if [ "$found" -eq 0 ]; then
-                    printf "%-26s  %-20s  %-10s  %-9s  %s\n" "RUN_ID" "GENERATED_AT" "VERDICT" "COST_USD" "FILES"
+                    printf "%-26s  %-20s  %-18s  %-9s  %s\n" "RUN_ID" "GENERATED_AT" "VERDICT" "COST_USD" "FILES"
                 fi
                 found=1
                 LOKI_PROOF_JSON="$pj" python3 - <<'PYEOF'
@@ -30607,10 +30750,14 @@ def s(v):
     return "-" if v is None else str(v)
 run_id = d.get("run_id")
 gen = d.get("generated_at")
-verdict = (d.get("council") or {}).get("final_verdict")
+# The honest verdict lives in honesty.headline (VERIFIED / VERIFIED WITH GAPS /
+# NOT VERIFIED); fall back to legacy council.final_verdict for older proofs.
+verdict = (d.get("honesty") or {}).get("headline")
+if verdict is None:
+    verdict = (d.get("council") or {}).get("final_verdict")
 cost = (d.get("cost") or {}).get("usd")
 files = (d.get("files_changed") or {}).get("count")
-print("{:<26}  {:<20}  {:<10}  {:<9}  {}".format(
+print("{:<26}  {:<20}  {:<18}  {:<9}  {}".format(
     s(run_id), s(gen), s(verdict), s(cost), s(files)))
 PYEOF
             done