loki-mode 7.89.0 → 7.90.0

package/README.md

@@ -119,6 +119,21 @@ redacted before it leaves your machine). An optional, off-by-default GPG detache
 signature (`LOKI_PROOF_GPG_KEY`) lets a third party confirm the receipt came from
 you.
 
+### Proven PR
+
+When Loki opens a pull request, the PR body includes the Evidence Receipt
+summary, so a reviewer does not have to take the agent on faith. It shows the
+honest verdict (VERIFIED / VERIFIED WITH GAPS / NOT VERIFIED), the key facts
+(diff hash, tests, secure-gate, cost), and a "verify this yourself" line:
+`loki proof verify <id>` against the recorded base SHA. A green claim appears
+only when the receipt's own headline is VERIFIED. This is on by default whenever
+Loki opens or advises a PR; opt out with `LOKI_PROVEN_PR=0`.
+
+An optional advisory status check (`loki: verified-completion`) maps the verdict
+to a GitHub check-run. It is opt-in (`LOKI_PROVEN_PR_CHECK=1`) and can never block
+a merge on its own. To make verified-completion blocking, add it as a required
+status check in your repository's branch-protection settings.
+
 ---
 
 ## Get Started in 30 Seconds

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: Autonomous spec-driven build system with a built-in trust layer. It does not call work done until it is verified (RARV-C closure loop, 8 quality gates, completion council, verified-completion evidence gate). Triggers on "Loki Mode". Takes a spec (PRD, GitHub issue, OpenAPI doc, etc.) to deployed product with minimal human intervention. Provider-agnostic. Requires --dangerously-skip-permissions flag.
 ---
 
-# Loki Mode v7.89.0
+# Loki Mode v7.90.0
 
 **You are an autonomous agent. You make decisions. You do not ask questions. You do not stop.**
 
@@ -408,4 +408,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v7.89.0 | [Autonomi](https://www.autonomi.dev/) flagship product | ~260 lines core**
+**v7.90.0 | [Autonomi](https://www.autonomi.dev/) flagship product | ~260 lines core**

package/VERSION

@@ -1 +1 @@
-7.89.0
+7.90.0

package/autonomy/lib/proof-check.sh

@@ -0,0 +1,234 @@
+#!/usr/bin/env bash
+# proof-check.sh -- best-effort, advisory GitHub check-run for a Loki run.
+#
+# Posts an ADVISORY check-run named "loki: verified-completion" to a PR's head
+# commit, mapping the deterministic honesty headline from the redacted proof.json
+# 1:1 to a check-run conclusion. This surface is purely advisory.
+#
+# HONEST FRAMING (load-bearing invariant): Loki CANNOT block a merge. This posts
+# an advisory check-run only. It NEVER sets any merge gate, NEVER marks the check
+# as required, NEVER calls any merge-gate API. Requiring this check is the repo
+# owner's setting (add "loki: verified-completion" as a required status check in
+# repository settings). We do not overclaim.
+#
+# HONESTY (single source of truth): the ONLY input that can produce a green
+# (success) conclusion is honesty.headline == "VERIFIED" read from the redacted
+# proof.json. We never recompute a verdict, never read raw .loki state, never
+# infer a conclusion from anything but the headline. A missing/unknown headline
+# posts NOTHING (no fabricated green or red).
+#
+# set -e SAFE: this lib may be sourced under `set -uo pipefail` or
+# `set -euo pipefail`. Every fallible command ends with `|| true` or sits in a
+# guarded `if`; every optional tool is `command -v`-guarded; every var is
+# defaulted with `${VAR:-}`; all paths `return 0` so a sourced call cannot abort
+# the caller. This is pure best-effort: it NEVER fails the caller and NEVER
+# blocks PR creation.
+#
+# This function is only ever called when the operator opted in (the call site
+# guards on LOKI_PROVEN_PR_CHECK=1). It is also safe if called directly.
+
+# Double-source guard.
+[ -n "${_PROOF_CHECK_SH:-}" ] && return 0
+_PROOF_CHECK_SH=1
+
+# _proof_check_net <cmd...>
+# Best-effort timeout wrapper so a hung network call cannot stall the caller.
+# Mirrors the run.sh _loki_net idiom. Never fatal.
+_proof_check_net() {
+    if command -v timeout >/dev/null 2>&1; then
+        timeout 30 "$@"
+    else
+        "$@"
+    fi
+}
+
+# _proof_check_headline <proof_json_path>
+# Echoes the exact honesty.headline string from the redacted proof.json, or an
+# empty string if the file is missing/unreadable/not-a-dict or the headline is
+# absent. Reads ONLY the passed proof.json, NEVER raw .loki state. Best-effort.
+_proof_check_headline() {
+    local proof_path="${1:-}"
+    [ -n "$proof_path" ] || { printf '%s' ""; return 0; }
+    [ -f "$proof_path" ] || { printf '%s' ""; return 0; }
+    command -v python3 >/dev/null 2>&1 || { printf '%s' ""; return 0; }
+
+    local headline=""
+    headline="$(python3 - "$proof_path" <<'PY' 2>/dev/null || true
+import json, sys
+try:
+    with open(sys.argv[1], "r", encoding="utf-8") as fh:
+        data = json.load(fh)
+    if not isinstance(data, dict):
+        sys.exit(0)
+    honesty = data.get("honesty")
+    if not isinstance(honesty, dict):
+        sys.exit(0)
+    h = honesty.get("headline")
+    if isinstance(h, str):
+        sys.stdout.write(h)
+except Exception:
+    sys.exit(0)
+PY
+)"
+    printf '%s' "${headline:-}"
+    return 0
+}
+
+# _proof_check_proof_head_sha <proof_json_path>
+# Echoes facts.git.head_sha from the redacted proof.json (the fallback head sha),
+# or empty string. Reads ONLY the passed proof.json. Best-effort.
+_proof_check_proof_head_sha() {
+    local proof_path="${1:-}"
+    [ -n "$proof_path" ] || { printf '%s' ""; return 0; }
+    [ -f "$proof_path" ] || { printf '%s' ""; return 0; }
+    command -v python3 >/dev/null 2>&1 || { printf '%s' ""; return 0; }
+
+    local sha=""
+    sha="$(python3 - "$proof_path" <<'PY' 2>/dev/null || true
+import json, sys
+try:
+    with open(sys.argv[1], "r", encoding="utf-8") as fh:
+        data = json.load(fh)
+    if not isinstance(data, dict):
+        sys.exit(0)
+    facts = data.get("facts")
+    if not isinstance(facts, dict):
+        sys.exit(0)
+    git = facts.get("git")
+    if not isinstance(git, dict):
+        sys.exit(0)
+    s = git.get("head_sha")
+    if isinstance(s, str):
+        sys.stdout.write(s.strip())
+except Exception:
+    sys.exit(0)
+PY
+)"
+    printf '%s' "${sha:-}"
+    return 0
+}
+
+# _proof_check_run_id <proof_json_path>
+# Echoes run_id from the redacted proof.json (for the verify-yourself hint in the
+# advisory summary), or empty string. Best-effort.
+_proof_check_run_id() {
+    local proof_path="${1:-}"
+    [ -n "$proof_path" ] || { printf '%s' ""; return 0; }
+    [ -f "$proof_path" ] || { printf '%s' ""; return 0; }
+    command -v python3 >/dev/null 2>&1 || { printf '%s' ""; return 0; }
+
+    local rid=""
+    rid="$(python3 - "$proof_path" <<'PY' 2>/dev/null || true
+import json, sys
+try:
+    with open(sys.argv[1], "r", encoding="utf-8") as fh:
+        data = json.load(fh)
+    if not isinstance(data, dict):
+        sys.exit(0)
+    r = data.get("run_id")
+    if isinstance(r, str):
+        sys.stdout.write(r)
+except Exception:
+    sys.exit(0)
+PY
+)"
+    printf '%s' "${rid:-}"
+    return 0
+}
+
+# post_verified_completion_check <proof_json_path> <pr_url_or_empty>
+#
+# Best-effort: post an advisory GitHub check-run "loki: verified-completion" to
+# the PR's head commit. Maps honesty.headline 1:1 to the check-run conclusion:
+#     VERIFIED            -> success
+#     VERIFIED WITH GAPS  -> neutral
+#     NOT VERIFIED        -> failure
+# A missing/unknown headline posts NOTHING. ALWAYS returns 0; NEVER fails the
+# caller; NEVER blocks PR creation. This is advisory only: it NEVER makes the
+# check required and NEVER calls any merge-gate API. Requiring the check is the
+# repo owner's setting.
+post_verified_completion_check() {
+    local proof_path="${1:-}"
+    local pr_url="${2:-}"
+
+    # --- Honesty gate FIRST: read + map the headline before touching gh. -------
+    # A missing/unknown headline must produce NO gh call at all (no fabricated
+    # green or red).
+    local headline=""
+    headline="$(_proof_check_headline "$proof_path")"
+
+    local conclusion=""
+    case "$headline" in
+        "VERIFIED")            conclusion="success" ;;
+        "VERIFIED WITH GAPS")  conclusion="neutral" ;;
+        "NOT VERIFIED")        conclusion="failure" ;;
+        *)
+            # Missing or unknown headline -> do not post anything.
+            return 0
+            ;;
+    esac
+
+    # --- gh availability + auth (best-effort, never fatal). --------------------
+    if ! command -v gh >/dev/null 2>&1; then
+        printf '%s\n' "loki: advisory check-run not posted (gh CLI not found)." || true
+        return 0
+    fi
+    if ! _proof_check_net gh auth status >/dev/null 2>&1; then
+        printf '%s\n' "loki: advisory check-run not posted (gh not authenticated)." || true
+        return 0
+    fi
+
+    # --- Resolve owner/repo (nameWithOwner). ----------------------------------
+    # Prefer the current repo context (Loki's model is same-repo branch PRs).
+    local repo=""
+    repo="$(_proof_check_net gh repo view --json nameWithOwner -q .nameWithOwner 2>/dev/null || true)"
+
+    # --- Resolve head sha: PR head if a pr_url is given, else proof fallback. --
+    local head_sha=""
+    if [ -n "$pr_url" ]; then
+        head_sha="$(_proof_check_net gh pr view "$pr_url" --json headRefOid -q .headRefOid 2>/dev/null || true)"
+    fi
+    if [ -z "$head_sha" ]; then
+        head_sha="$(_proof_check_proof_head_sha "$proof_path")"
+    fi
+
+    # If we cannot identify both the repo and the head commit, do not guess.
+    if [ -z "$repo" ] || [ -z "$head_sha" ]; then
+        printf '%s\n' "loki: advisory check-run not posted (could not resolve repo or head commit)." || true
+        return 0
+    fi
+
+    # --- Build the advisory summary text. -------------------------------------
+    # Plainly states this is advisory and how the OWNER can make it blocking.
+    local run_id=""
+    run_id="$(_proof_check_run_id "$proof_path")"
+
+    local verify_line="Verify it yourself: loki proof verify"
+    if [ -n "$run_id" ]; then
+        verify_line="Verify it yourself: loki proof verify ${run_id}"
+    fi
+
+    local summary=""
+    summary="This is an advisory check posted by Loki. It reports the deterministic verified-completion headline (${headline}) for this run. Loki does not enforce a merge gate and does not make this check required. To make this gate blocking, the repository owner must add \"loki: verified-completion\" as a required status check in repository settings. ${verify_line}"
+
+    # --- Post the advisory check-run (best-effort). ---------------------------
+    # gh api supports nested fields via key[subkey]=value, so conclusion appears
+    # as a direct flat parameter. We POST to the check-runs endpoint only; we
+    # NEVER touch any merge-gate / required-status endpoint.
+    if _proof_check_net gh api \
+        -X POST \
+        "repos/${repo}/check-runs" \
+        -f "name=loki: verified-completion" \
+        -f "head_sha=${head_sha}" \
+        -f "status=completed" \
+        -f "conclusion=${conclusion}" \
+        -f "output[title]=loki: verified-completion" \
+        -f "output[summary]=${summary}" \
+        >/dev/null 2>&1; then
+        printf '%s\n' "loki: posted advisory check-run \"loki: verified-completion\" (${conclusion})." || true
+    else
+        printf '%s\n' "loki: advisory check-run not posted (gh API error or insufficient check permission)." || true
+    fi
+
+    return 0
+}

package/autonomy/lib/proof-pr.sh

@@ -0,0 +1,251 @@
+#!/usr/bin/env bash
+# proof-pr.sh -- shared, PRINT-ONLY Evidence Receipt renderer for PR bodies.
+#
+# LOAD-BEARING INVARIANT: this lib is pure and print-only. It NEVER runs
+# `git push`, NEVER runs `gh pr create`, NEVER mutates the repo, NEVER posts a
+# check-run. It reads ONLY the already-redacted proof.json passed to it (past the
+# redaction chokepoint at proof-generator.py:1086) and prints a markdown block
+# that gets appended into a PR body. It is the single source of truth sourced by
+# autonomy/run.sh (the three create_session_pr / body-file / delegate PR sites)
+# and autonomy/loki (cmd_github) so every PR surface renders a byte-identical,
+# correct receipt and cannot drift. Mirrors the contract of git-pr-advisory.sh.
+#
+# HONESTY GATE (R-HON-1): the ONLY input that may produce a green/VERIFIED claim
+# is honesty.headline == "VERIFIED" read from the redacted proof.json. The
+# renderer NEVER recomputes a verdict, NEVER reads council/LLM opinion to turn
+# green, NEVER infers VERIFIED from a bare pass.
+#
+# DETERMINISM (R-DET-2): when an expected_head_sha is supplied AND the proof is
+# VERIFIED, the renderer cross-checks it against facts.git.head_sha; on mismatch
+# it does NOT render green, it prints an honest "does not match this branch head"
+# line. Production callers pass an empty expected_head_sha (the session commit at
+# run.sh sits BETWEEN proof generation and PR creation, so the post-commit branch
+# head is structurally offset from the proof's pre-commit head; feeding it would
+# false-degrade every legitimate receipt). The anti-stale guarantee on the
+# production path is R-DET-1: the persisted run_id pointer (.loki/state/
+# last-proof-id.txt), not a head comparison. The R-DET-2 capability stays intact
+# and is exercised by the SDET fixtures.
+#
+# set -e SAFE: this lib may be sourced under `set -uo pipefail` (run.sh) AND
+# `set -euo pipefail` (loki). Every fallible command ends with `|| true` or sits
+# in a guarded `if`; no bare `((..))`; every var defaulted with `${VAR:-}`;
+# every optional tool is `command -v`-guarded. All print paths `return 0` so a
+# sourced call cannot abort the caller under set -e.
+
+# Double-source guard.
+[ -n "${_PROOF_PR_SH:-}" ] && return 0
+_PROOF_PR_SH=1
+
+# render_evidence_receipt_md <proof_json_path> [expected_head_sha] [expected_base_sha]
+# Prints the Evidence Receipt markdown block for a PR body. PRINT-ONLY: never
+# pushes, never creates a PR, never mutates the repo. Always returns 0. A missing
+# or unreadable proof prints ONE honest "unavailable" line and returns 0 so it
+# can NEVER crash the caller or block PR creation.
+#
+# expected_base_sha is accepted for call-site symmetry but is intentionally
+# unused for any green/red gate: the proof's base is a sha (_LOKI_ITER_START_SHA)
+# while a PR base is a branch NAME, so a base comparison would misfire. The base
+# is informational only and is printed from the proof itself.
+render_evidence_receipt_md() {
+    local proof_json_path="${1:-}"
+    local expected_head_sha="${2:-}"
+    local _expected_base_sha="${3:-}"
+    : "$_expected_base_sha"
+
+    # No python3 -> degrade honestly, never crash.
+    if ! command -v python3 >/dev/null 2>&1; then
+        printf '%s\n' "Evidence Receipt: unavailable for this run."
+        return 0
+    fi
+
+    # Pass every input as argv (sys.argv), NEVER interpolated into the heredoc:
+    # quote-safe and injection-safe against a hostile proof path. The heredoc
+    # delimiter is quoted so bash performs no expansion inside the program.
+    # Capture into a var so a non-zero python exit degrades honestly without a
+    # brace group on the heredoc command (which bash mis-parses). The program
+    # always handles its own errors and prints, so a non-zero exit is a last
+    # resort (interpreter crash) -> print the single honest line.
+    local _receipt_out=""
+    local _receipt_rc=0
+    _receipt_out="$(python3 - "$proof_json_path" "$expected_head_sha" <<'PROOF_PR_PY' 2>/dev/null
+import json
+import sys
+
+
+def _line(s=""):
+    sys.stdout.write(s + "\n")
+
+
+def main():
+    argv = sys.argv[1:]
+    proof_path = argv[0] if len(argv) > 0 else ""
+    expected_head = (argv[1] if len(argv) > 1 else "").strip()
+
+    if not proof_path:
+        _line("Evidence Receipt: unavailable for this run.")
+        return 0
+    try:
+        with open(proof_path, "r") as f:
+            proof = json.load(f)
+    except Exception:
+        _line("Evidence Receipt: unavailable for this run.")
+        return 0
+    if not isinstance(proof, dict):
+        _line("Evidence Receipt: unavailable for this run.")
+        return 0
+
+    honesty = proof.get("honesty")
+    honesty = honesty if isinstance(honesty, dict) else {}
+    headline = str(honesty.get("headline") or "").strip()
+    if not headline:
+        _line("Evidence Receipt: unavailable for this run.")
+        return 0
+
+    facts = proof.get("facts")
+    facts = facts if isinstance(facts, dict) else {}
+    git = facts.get("git") if isinstance(facts.get("git"), dict) else {}
+    tests = facts.get("tests") if isinstance(facts.get("tests"), dict) else {}
+    build = facts.get("build") if isinstance(facts.get("build"), dict) else {}
+    security = facts.get("security") if isinstance(facts.get("security"), dict) else {}
+    cost = facts.get("cost") if isinstance(facts.get("cost"), dict) else {}
+    meta = facts.get("meta") if isinstance(facts.get("meta"), dict) else {}
+
+    diff = git.get("diff") if isinstance(git.get("diff"), dict) else {}
+    diff_count = diff.get("count")
+    diff_sha = str(git.get("diff_sha256") or "")
+    base_sha = str(git.get("base_sha") or "")
+    head_sha = str(git.get("head_sha") or "")
+
+    # run_id: prefer facts.meta.run_id, fall back to the top-level mirror.
+    run_id = str(meta.get("run_id") or proof.get("run_id") or "").strip()
+
+    # R-DET-2 cross-check. Only a supplied expected_head AND a VERIFIED headline
+    # can trigger it. On mismatch we do NOT print a VERIFIED banner; we print an
+    # honest line so a stale / wrong-run proof fails safe, never fake-green.
+    head_mismatch = (
+        bool(expected_head)
+        and headline == "VERIFIED"
+        and head_sha != ""
+        and head_sha != expected_head
+    )
+
+    # ---- Render -----------------------------------------------------------
+    _line("### Evidence Receipt")
+    _line()
+
+    if head_mismatch:
+        _line(
+            "Evidence Receipt: available but does not match this branch head "
+            "(proof head " + (head_sha or "(none)")
+            + ", branch head " + (expected_head or "(none)") + "). Run "
+            "`loki proof verify " + (run_id or "<run_id>") + "` to inspect."
+        )
+        _line()
+        # Fall through: still render facts + verify-yourself so the reviewer can
+        # check, but emit NO green headline label.
+        effective_headline = ""
+    else:
+        # Headline mapped 1:1 from honesty.headline. Plain text label, NO color
+        # codes -- this goes into a PR body. R-HON-1: only VERIFIED is green.
+        effective_headline = headline
+        _line("Headline: " + headline)
+        _line()
+
+    # Facts table. Deterministic, non-LLM facts a skeptic can recompute.
+    def _stat(d):
+        s = str(d.get("status") or "").strip()
+        return s if s else "not_run"
+
+    tests_cell = _stat(tests)
+    tests_cmd = str(tests.get("command") or "").strip()
+    if tests_cmd:
+        tests_cell = tests_cell + " (`" + tests_cmd + "`)"
+    build_cell = _stat(build)
+    build_cmd = str(build.get("command") or "").strip()
+    if build_cmd:
+        build_cell = build_cell + " (`" + build_cmd + "`)"
+
+    sec_cell = _stat(security)
+    if security.get("ran"):
+        ha = security.get("high_active") or 0
+        try:
+            ha = int(ha)
+        except Exception:
+            ha = 0
+        if ha > 0:
+            sec_cell = sec_cell + " (" + str(ha) + " un-waived HIGH)"
+
+    cost_usd = cost.get("usd")
+    cost_cell = "not recorded" if cost_usd is None else ("$" + str(cost_usd))
+
+    files_cell = "0" if diff_count is None else str(diff_count)
+
+    _line("| Fact | Value |")
+    _line("| --- | --- |")
+    _line("| Files changed | " + files_cell + " |")
+    _line("| Diff sha256 | `" + (diff_sha or "(none)") + "` |")
+    _line("| Tests | " + tests_cell + " |")
+    _line("| Build | " + build_cell + " |")
+    _line("| Security | " + sec_cell + " |")
+    _line("| Cost | " + cost_cell + " |")
+    _line("| Base sha | `" + (base_sha or "(none)") + "` |")
+    _line("| Head sha | `" + (head_sha or "(none)") + "` |")
+    _line()
+
+    # Gaps: when headline != VERIFIED, list honesty.degraded[] verbatim. By
+    # _compute_degraded design an empty list with a non-VERIFIED headline is
+    # impossible, but guard anyway (R-HON-2).
+    if effective_headline != "VERIFIED":
+        degraded = honesty.get("degraded")
+        degraded = degraded if isinstance(degraded, list) else []
+        if degraded:
+            _line("Not yet verified:")
+            for d in degraded:
+                if not isinstance(d, dict):
+                    continue
+                item = str(d.get("item") or "").strip()
+                status = str(d.get("status") or "").strip()
+                reason = str(d.get("reason") or "").strip()
+                _line(
+                    "- " + (item or "(item)")
+                    + ": " + (status or "(status)")
+                    + (" -- " + reason if reason else "")
+                )
+            _line()
+
+    # Verify-yourself block. ALWAYS rendered, even on NOT VERIFIED -- the whole
+    # point is that the reviewer can recompute the verdict and does not have to
+    # trust Loki.
+    _line("You do not have to trust this. Verify it yourself:")
+    _line()
+    _line("```")
+    _line(
+        "loki proof verify " + (run_id or "<run_id>")
+        + "  (base " + (base_sha or "(none)") + ")"
+    )
+    _line("```")
+    _line()
+
+    # What the headline means: a first-time reviewer must understand that
+    # VERIFIED WITH GAPS is honest, not a failure.
+    _line(
+        "What the headline means: VERIFIED means every recorded check passed; "
+        "VERIFIED WITH GAPS means the checks that ran passed but some checks "
+        "were not run (listed above); NOT VERIFIED means a check failed or "
+        "nothing could be verified. The headline is computed only from "
+        "deterministic, re-derivable facts, never from an AI opinion."
+    )
+    return 0
+
+
+sys.exit(main())
+PROOF_PR_PY
+    )" || _receipt_rc=$?
+
+    if [ "$_receipt_rc" != "0" ] || [ -z "$_receipt_out" ]; then
+        printf '%s\n' "Evidence Receipt: unavailable for this run."
+        return 0
+    fi
+    printf '%s\n' "$_receipt_out"
+    return 0
+}

package/autonomy/loki

@@ -125,6 +125,14 @@ if [ -f "$_LOKI_SCRIPT_DIR/lib/git-pr-advisory.sh" ]; then
     source "$_LOKI_SCRIPT_DIR/lib/git-pr-advisory.sh"
 fi
 
+# Proven PR (Loop 6): shared print-only Evidence Receipt renderer for PR bodies
+# (render_evidence_receipt_md). Sourced so cmd_github can append the receipt to
+# the PR body. Self-guarded against double-source; existence-guarded.
+if [ -f "$_LOKI_SCRIPT_DIR/lib/proof-pr.sh" ]; then
+    # shellcheck source=autonomy/lib/proof-pr.sh
+    source "$_LOKI_SCRIPT_DIR/lib/proof-pr.sh"
+fi
+
 # Unified config-file support (#691). Canonical LOKI_CONFIG_MAP + the config-file
 # loader (loki_maybe_apply_config_file / loki_apply_config_file) and the
 # example/schema/validate generators. Side-effect-free on source: defines the
@@ -1017,29 +1025,35 @@ detect_arg_type() {
         return 0
     fi
 
-    # Path-like (contains / or starts with . or /) -> treat as PRD
-    if [[ "$arg" == */* ]] || [[ "$arg" == .* ]] || [[ "$arg" == /* ]]; then
-        echo "prd"
-        return 0
-    fi
-
-    # Existing file on disk -> PRD
+    # An existing file on disk is unambiguously a PRD, even if its name has
+    # spaces -- a real path the user pointed at wins over the brief heuristic.
     if [ -e "$arg" ]; then
         echo "prd"
         return 0
     fi
 
     # R7 (zero-config first run): a one-line brief. An arg that contains
-    # whitespace and matched none of the file/issue/path patterns above is a
-    # natural-language brief (e.g. "build a todo app"), NOT a PRD path. This is
-    # additive: a single-token arg with no whitespace still falls through to
-    # "unknown" (PRD-path back-compat) below. The `--brief` flag is the
-    # deterministic escape hatch for the rare single-word brief.
+    # WHITESPACE and is not an existing file is a natural-language brief, NOT a
+    # path -- a real PRD path argument essentially never contains spaces, whereas
+    # a brief routinely contains slashes/punctuation ("add/list/done", "CI/CD",
+    # "input/output"). This MUST come before the path-like (contains "/")
+    # heuristic below, else a brief like "a todo app with add/list/done" is
+    # misrouted to PRD mode and dies with "PRD file not found" (W1 E2E bug,
+    # v7.89.1). The `--brief` flag remains the escape hatch for a single-word
+    # brief with no whitespace.
     if [[ "$arg" == *[[:space:]]* ]]; then
         echo "brief"
         return 0
     fi
 
+    # Path-like (contains / or starts with . or /) -> treat as PRD. Reached only
+    # for a NO-WHITESPACE arg (a brief with spaces was already handled above), so
+    # this is a genuine file path like ./prd.md or docs/spec.md.
+    if [[ "$arg" == */* ]] || [[ "$arg" == .* ]] || [[ "$arg" == /* ]]; then
+        echo "prd"
+        return 0
+    fi
+
     # Fallback: unknown. Caller treats as PRD for backward compat.
     echo "unknown"
 }
@@ -7568,7 +7582,37 @@ if [[ "$LOKI_CREATE_PR" == "true" ]]; then
     branch_current=$(git rev-parse --abbrev-ref HEAD 2>/dev/null || echo "")
     if [[ -n "$branch_current" && "$branch_current" != "main" && "$branch_current" != "master" ]]; then
         git push origin "$branch_current" 2>/dev/null || true
-        gh pr create --title "$LOKI_PR_TITLE" --body "Implemented by Loki Mode" --head "$branch_current" 2>/dev/null || true
+        # Proven PR (v7.90.0): render this run's Evidence Receipt into the PR body
+        # so even the detached --pr/--ship path proves itself. The proof + the
+        # run-id pointer (.loki/state/last-proof-id.txt) exist by now (the
+        # `loki start` above generated them). On by default (LOKI_PROVEN_PR=0
+        # opts out); degrades safely to the plain body if anything is missing.
+        # The renderer is print-only + honesty-gated (green only when the proof
+        # headline is VERIFIED); it can never make a receipt-less PR look proven.
+        _pr_body="Implemented by Loki Mode"
+        if [[ "${LOKI_PROVEN_PR:-1}" != "0" ]]; then
+            # Resolve the renderer from the ALREADY-RESOLVED autonomy dir passed
+            # in by the parent (LOKI_SCRIPT_DIR_RESOLVED = _LOKI_SCRIPT_DIR, which
+            # is symlink-safe). Do NOT recompute from `command -v loki` -- on
+            # npm/bun/brew global installs that is an UNRESOLVED bin symlink, so
+            # dirname-based guessing misses the lib and the receipt silently no-ops
+            # on the dominant install channels (council cIb_r2). Fall back to the
+            # old dirname guesses only if the resolved dir was not passed.
+            _pp_lib="${LOKI_SCRIPT_DIR_RESOLVED:-}/lib/proof-pr.sh"
+            [[ -f "$_pp_lib" ]] || _pp_lib="$(dirname "$LOKI_CMD")/../autonomy/lib/proof-pr.sh"
+            [[ -f "$_pp_lib" ]] || _pp_lib="$(dirname "$LOKI_CMD")/autonomy/lib/proof-pr.sh"
+            _pp_id=""
+            [[ -f .loki/state/last-proof-id.txt ]] && _pp_id="$(cat .loki/state/last-proof-id.txt 2>/dev/null)"
+            _pp_proof=".loki/proofs/${_pp_id}/proof.json"
+            if [[ -n "$_pp_id" && -f "$_pp_proof" && -f "$_pp_lib" ]]; then
+                # shellcheck source=/dev/null
+                if source "$_pp_lib" 2>/dev/null && declare -f render_evidence_receipt_md >/dev/null 2>&1; then
+                    _pp_block="$(render_evidence_receipt_md "$_pp_proof" "" "" 2>/dev/null || true)"
+                    [[ -n "$_pp_block" ]] && _pr_body="Implemented by Loki Mode"$'\n\n'"$_pp_block"
+                fi
+            fi
+        fi
+        gh pr create --title "$LOKI_PR_TITLE" --body "$_pr_body" --head "$branch_current" 2>/dev/null || true
     fi
 fi
 # Post-completion: auto-merge if requested
@@ -7586,6 +7630,7 @@ INNER_SCRIPT_EOF
         # Pass all variables safely via environment
         LOKI_RUN_DIR="$(pwd)" \
         LOKI_CMD="$loki_cmd" \
+        LOKI_SCRIPT_DIR_RESOLVED="$_LOKI_SCRIPT_DIR" \
         LOKI_SESSION_ID="$session_id" \
         LOKI_WORKTREE_BRANCH="$branch_name" \
         LOKI_PRD_PATH="$detach_prd" \
@@ -7676,6 +7721,28 @@ Provider: ${issue_provider}
 ## Changes
 $(git log --oneline "main..HEAD" 2>/dev/null || echo "See diff")"
 
+            # Proven PR (Loop 6): append the Evidence Receipt to the body. One
+            # append covers BOTH the gh and glab branches below. Default-on;
+            # LOKI_PROVEN_PR=0 -> body byte-identical to before. The proof lives
+            # under the project .loki resolved from the run_id pointer; empty
+            # expected_head_sha by design (R-DET-1 run_id pointer is the guard).
+            if [ "${LOKI_PROVEN_PR:-1}" != "0" ] && declare -f render_evidence_receipt_md >/dev/null 2>&1; then
+                local _gh_idfile=".loki/state/last-proof-id.txt"
+                if [ -s "$_gh_idfile" ]; then
+                    local _gh_rid=""
+                    _gh_rid="$(cat "$_gh_idfile" 2>/dev/null || true)"
+                    if [ -n "$_gh_rid" ] && [ -f ".loki/proofs/$_gh_rid/proof.json" ]; then
+                        local _gh_receipt=""
+                        _gh_receipt="$(render_evidence_receipt_md ".loki/proofs/$_gh_rid/proof.json" "" "" 2>/dev/null || true)"
+                        if [ -n "$_gh_receipt" ]; then
+                            pr_body="${pr_body}
+
+${_gh_receipt}"
+                        fi
+                    fi
+                fi
+            fi
+
             case "${issue_provider:-github}" in
                 github)
                     if command -v gh &>/dev/null; then