loki-mode 7.89.1 → 7.90.0

package/README.md

@@ -119,6 +119,21 @@ redacted before it leaves your machine). An optional, off-by-default GPG detache
 signature (`LOKI_PROOF_GPG_KEY`) lets a third party confirm the receipt came from
 you.
 
+### Proven PR
+
+When Loki opens a pull request, the PR body includes the Evidence Receipt
+summary, so a reviewer does not have to take the agent on faith. It shows the
+honest verdict (VERIFIED / VERIFIED WITH GAPS / NOT VERIFIED), the key facts
+(diff hash, tests, secure-gate, cost), and a "verify this yourself" line:
+`loki proof verify <id>` against the recorded base SHA. A green claim appears
+only when the receipt's own headline is VERIFIED. This is on by default whenever
+Loki opens or advises a PR; opt out with `LOKI_PROVEN_PR=0`.
+
+An optional advisory status check (`loki: verified-completion`) maps the verdict
+to a GitHub check-run. It is opt-in (`LOKI_PROVEN_PR_CHECK=1`) and can never block
+a merge on its own. To make verified-completion blocking, add it as a required
+status check in your repository's branch-protection settings.
+
 ---
 
 ## Get Started in 30 Seconds

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: Autonomous spec-driven build system with a built-in trust layer. It does not call work done until it is verified (RARV-C closure loop, 8 quality gates, completion council, verified-completion evidence gate). Triggers on "Loki Mode". Takes a spec (PRD, GitHub issue, OpenAPI doc, etc.) to deployed product with minimal human intervention. Provider-agnostic. Requires --dangerously-skip-permissions flag.
 ---
 
-# Loki Mode v7.89.1
+# Loki Mode v7.90.0
 
 **You are an autonomous agent. You make decisions. You do not ask questions. You do not stop.**
 
@@ -408,4 +408,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v7.89.1 | [Autonomi](https://www.autonomi.dev/) flagship product | ~260 lines core**
+**v7.90.0 | [Autonomi](https://www.autonomi.dev/) flagship product | ~260 lines core**

package/VERSION

@@ -1 +1 @@
-7.89.1
+7.90.0

package/autonomy/lib/proof-check.sh

@@ -0,0 +1,234 @@
+#!/usr/bin/env bash
+# proof-check.sh -- best-effort, advisory GitHub check-run for a Loki run.
+#
+# Posts an ADVISORY check-run named "loki: verified-completion" to a PR's head
+# commit, mapping the deterministic honesty headline from the redacted proof.json
+# 1:1 to a check-run conclusion. This surface is purely advisory.
+#
+# HONEST FRAMING (load-bearing invariant): Loki CANNOT block a merge. This posts
+# an advisory check-run only. It NEVER sets any merge gate, NEVER marks the check
+# as required, NEVER calls any merge-gate API. Requiring this check is the repo
+# owner's setting (add "loki: verified-completion" as a required status check in
+# repository settings). We do not overclaim.
+#
+# HONESTY (single source of truth): the ONLY input that can produce a green
+# (success) conclusion is honesty.headline == "VERIFIED" read from the redacted
+# proof.json. We never recompute a verdict, never read raw .loki state, never
+# infer a conclusion from anything but the headline. A missing/unknown headline
+# posts NOTHING (no fabricated green or red).
+#
+# set -e SAFE: this lib may be sourced under `set -uo pipefail` or
+# `set -euo pipefail`. Every fallible command ends with `|| true` or sits in a
+# guarded `if`; every optional tool is `command -v`-guarded; every var is
+# defaulted with `${VAR:-}`; all paths `return 0` so a sourced call cannot abort
+# the caller. This is pure best-effort: it NEVER fails the caller and NEVER
+# blocks PR creation.
+#
+# This function is only ever called when the operator opted in (the call site
+# guards on LOKI_PROVEN_PR_CHECK=1). It is also safe if called directly.
+
+# Double-source guard.
+[ -n "${_PROOF_CHECK_SH:-}" ] && return 0
+_PROOF_CHECK_SH=1
+
+# _proof_check_net <cmd...>
+# Best-effort timeout wrapper so a hung network call cannot stall the caller.
+# Mirrors the run.sh _loki_net idiom. Never fatal.
+_proof_check_net() {
+    if command -v timeout >/dev/null 2>&1; then
+        timeout 30 "$@"
+    else
+        "$@"
+    fi
+}
+
+# _proof_check_headline <proof_json_path>
+# Echoes the exact honesty.headline string from the redacted proof.json, or an
+# empty string if the file is missing/unreadable/not-a-dict or the headline is
+# absent. Reads ONLY the passed proof.json, NEVER raw .loki state. Best-effort.
+_proof_check_headline() {
+    local proof_path="${1:-}"
+    [ -n "$proof_path" ] || { printf '%s' ""; return 0; }
+    [ -f "$proof_path" ] || { printf '%s' ""; return 0; }
+    command -v python3 >/dev/null 2>&1 || { printf '%s' ""; return 0; }
+
+    local headline=""
+    headline="$(python3 - "$proof_path" <<'PY' 2>/dev/null || true
+import json, sys
+try:
+    with open(sys.argv[1], "r", encoding="utf-8") as fh:
+        data = json.load(fh)
+    if not isinstance(data, dict):
+        sys.exit(0)
+    honesty = data.get("honesty")
+    if not isinstance(honesty, dict):
+        sys.exit(0)
+    h = honesty.get("headline")
+    if isinstance(h, str):
+        sys.stdout.write(h)
+except Exception:
+    sys.exit(0)
+PY
+)"
+    printf '%s' "${headline:-}"
+    return 0
+}
+
+# _proof_check_proof_head_sha <proof_json_path>
+# Echoes facts.git.head_sha from the redacted proof.json (the fallback head sha),
+# or empty string. Reads ONLY the passed proof.json. Best-effort.
+_proof_check_proof_head_sha() {
+    local proof_path="${1:-}"
+    [ -n "$proof_path" ] || { printf '%s' ""; return 0; }
+    [ -f "$proof_path" ] || { printf '%s' ""; return 0; }
+    command -v python3 >/dev/null 2>&1 || { printf '%s' ""; return 0; }
+
+    local sha=""
+    sha="$(python3 - "$proof_path" <<'PY' 2>/dev/null || true
+import json, sys
+try:
+    with open(sys.argv[1], "r", encoding="utf-8") as fh:
+        data = json.load(fh)
+    if not isinstance(data, dict):
+        sys.exit(0)
+    facts = data.get("facts")
+    if not isinstance(facts, dict):
+        sys.exit(0)
+    git = facts.get("git")
+    if not isinstance(git, dict):
+        sys.exit(0)
+    s = git.get("head_sha")
+    if isinstance(s, str):
+        sys.stdout.write(s.strip())
+except Exception:
+    sys.exit(0)
+PY
+)"
+    printf '%s' "${sha:-}"
+    return 0
+}
+
+# _proof_check_run_id <proof_json_path>
+# Echoes run_id from the redacted proof.json (for the verify-yourself hint in the
+# advisory summary), or empty string. Best-effort.
+_proof_check_run_id() {
+    local proof_path="${1:-}"
+    [ -n "$proof_path" ] || { printf '%s' ""; return 0; }
+    [ -f "$proof_path" ] || { printf '%s' ""; return 0; }
+    command -v python3 >/dev/null 2>&1 || { printf '%s' ""; return 0; }
+
+    local rid=""
+    rid="$(python3 - "$proof_path" <<'PY' 2>/dev/null || true
+import json, sys
+try:
+    with open(sys.argv[1], "r", encoding="utf-8") as fh:
+        data = json.load(fh)
+    if not isinstance(data, dict):
+        sys.exit(0)
+    r = data.get("run_id")
+    if isinstance(r, str):
+        sys.stdout.write(r)
+except Exception:
+    sys.exit(0)
+PY
+)"
+    printf '%s' "${rid:-}"
+    return 0
+}
+
+# post_verified_completion_check <proof_json_path> <pr_url_or_empty>
+#
+# Best-effort: post an advisory GitHub check-run "loki: verified-completion" to
+# the PR's head commit. Maps honesty.headline 1:1 to the check-run conclusion:
+#     VERIFIED            -> success
+#     VERIFIED WITH GAPS  -> neutral
+#     NOT VERIFIED        -> failure
+# A missing/unknown headline posts NOTHING. ALWAYS returns 0; NEVER fails the
+# caller; NEVER blocks PR creation. This is advisory only: it NEVER makes the
+# check required and NEVER calls any merge-gate API. Requiring the check is the
+# repo owner's setting.
+post_verified_completion_check() {
+    local proof_path="${1:-}"
+    local pr_url="${2:-}"
+
+    # --- Honesty gate FIRST: read + map the headline before touching gh. -------
+    # A missing/unknown headline must produce NO gh call at all (no fabricated
+    # green or red).
+    local headline=""
+    headline="$(_proof_check_headline "$proof_path")"
+
+    local conclusion=""
+    case "$headline" in
+        "VERIFIED")            conclusion="success" ;;
+        "VERIFIED WITH GAPS")  conclusion="neutral" ;;
+        "NOT VERIFIED")        conclusion="failure" ;;
+        *)
+            # Missing or unknown headline -> do not post anything.
+            return 0
+            ;;
+    esac
+
+    # --- gh availability + auth (best-effort, never fatal). --------------------
+    if ! command -v gh >/dev/null 2>&1; then
+        printf '%s\n' "loki: advisory check-run not posted (gh CLI not found)." || true
+        return 0
+    fi
+    if ! _proof_check_net gh auth status >/dev/null 2>&1; then
+        printf '%s\n' "loki: advisory check-run not posted (gh not authenticated)." || true
+        return 0
+    fi
+
+    # --- Resolve owner/repo (nameWithOwner). ----------------------------------
+    # Prefer the current repo context (Loki's model is same-repo branch PRs).
+    local repo=""
+    repo="$(_proof_check_net gh repo view --json nameWithOwner -q .nameWithOwner 2>/dev/null || true)"
+
+    # --- Resolve head sha: PR head if a pr_url is given, else proof fallback. --
+    local head_sha=""
+    if [ -n "$pr_url" ]; then
+        head_sha="$(_proof_check_net gh pr view "$pr_url" --json headRefOid -q .headRefOid 2>/dev/null || true)"
+    fi
+    if [ -z "$head_sha" ]; then
+        head_sha="$(_proof_check_proof_head_sha "$proof_path")"
+    fi
+
+    # If we cannot identify both the repo and the head commit, do not guess.
+    if [ -z "$repo" ] || [ -z "$head_sha" ]; then
+        printf '%s\n' "loki: advisory check-run not posted (could not resolve repo or head commit)." || true
+        return 0
+    fi
+
+    # --- Build the advisory summary text. -------------------------------------
+    # Plainly states this is advisory and how the OWNER can make it blocking.
+    local run_id=""
+    run_id="$(_proof_check_run_id "$proof_path")"
+
+    local verify_line="Verify it yourself: loki proof verify"
+    if [ -n "$run_id" ]; then
+        verify_line="Verify it yourself: loki proof verify ${run_id}"
+    fi
+
+    local summary=""
+    summary="This is an advisory check posted by Loki. It reports the deterministic verified-completion headline (${headline}) for this run. Loki does not enforce a merge gate and does not make this check required. To make this gate blocking, the repository owner must add \"loki: verified-completion\" as a required status check in repository settings. ${verify_line}"
+
+    # --- Post the advisory check-run (best-effort). ---------------------------
+    # gh api supports nested fields via key[subkey]=value, so conclusion appears
+    # as a direct flat parameter. We POST to the check-runs endpoint only; we
+    # NEVER touch any merge-gate / required-status endpoint.
+    if _proof_check_net gh api \
+        -X POST \
+        "repos/${repo}/check-runs" \
+        -f "name=loki: verified-completion" \
+        -f "head_sha=${head_sha}" \
+        -f "status=completed" \
+        -f "conclusion=${conclusion}" \
+        -f "output[title]=loki: verified-completion" \
+        -f "output[summary]=${summary}" \
+        >/dev/null 2>&1; then
+        printf '%s\n' "loki: posted advisory check-run \"loki: verified-completion\" (${conclusion})." || true
+    else
+        printf '%s\n' "loki: advisory check-run not posted (gh API error or insufficient check permission)." || true
+    fi
+
+    return 0
+}

package/autonomy/lib/proof-pr.sh

@@ -0,0 +1,251 @@
+#!/usr/bin/env bash
+# proof-pr.sh -- shared, PRINT-ONLY Evidence Receipt renderer for PR bodies.
+#
+# LOAD-BEARING INVARIANT: this lib is pure and print-only. It NEVER runs
+# `git push`, NEVER runs `gh pr create`, NEVER mutates the repo, NEVER posts a
+# check-run. It reads ONLY the already-redacted proof.json passed to it (past the
+# redaction chokepoint at proof-generator.py:1086) and prints a markdown block
+# that gets appended into a PR body. It is the single source of truth sourced by
+# autonomy/run.sh (the three create_session_pr / body-file / delegate PR sites)
+# and autonomy/loki (cmd_github) so every PR surface renders a byte-identical,
+# correct receipt and cannot drift. Mirrors the contract of git-pr-advisory.sh.
+#
+# HONESTY GATE (R-HON-1): the ONLY input that may produce a green/VERIFIED claim
+# is honesty.headline == "VERIFIED" read from the redacted proof.json. The
+# renderer NEVER recomputes a verdict, NEVER reads council/LLM opinion to turn
+# green, NEVER infers VERIFIED from a bare pass.
+#
+# DETERMINISM (R-DET-2): when an expected_head_sha is supplied AND the proof is
+# VERIFIED, the renderer cross-checks it against facts.git.head_sha; on mismatch
+# it does NOT render green, it prints an honest "does not match this branch head"
+# line. Production callers pass an empty expected_head_sha (the session commit at
+# run.sh sits BETWEEN proof generation and PR creation, so the post-commit branch
+# head is structurally offset from the proof's pre-commit head; feeding it would
+# false-degrade every legitimate receipt). The anti-stale guarantee on the
+# production path is R-DET-1: the persisted run_id pointer (.loki/state/
+# last-proof-id.txt), not a head comparison. The R-DET-2 capability stays intact
+# and is exercised by the SDET fixtures.
+#
+# set -e SAFE: this lib may be sourced under `set -uo pipefail` (run.sh) AND
+# `set -euo pipefail` (loki). Every fallible command ends with `|| true` or sits
+# in a guarded `if`; no bare `((..))`; every var defaulted with `${VAR:-}`;
+# every optional tool is `command -v`-guarded. All print paths `return 0` so a
+# sourced call cannot abort the caller under set -e.
+
+# Double-source guard.
+[ -n "${_PROOF_PR_SH:-}" ] && return 0
+_PROOF_PR_SH=1
+
+# render_evidence_receipt_md <proof_json_path> [expected_head_sha] [expected_base_sha]
+# Prints the Evidence Receipt markdown block for a PR body. PRINT-ONLY: never
+# pushes, never creates a PR, never mutates the repo. Always returns 0. A missing
+# or unreadable proof prints ONE honest "unavailable" line and returns 0 so it
+# can NEVER crash the caller or block PR creation.
+#
+# expected_base_sha is accepted for call-site symmetry but is intentionally
+# unused for any green/red gate: the proof's base is a sha (_LOKI_ITER_START_SHA)
+# while a PR base is a branch NAME, so a base comparison would misfire. The base
+# is informational only and is printed from the proof itself.
+render_evidence_receipt_md() {
+    local proof_json_path="${1:-}"
+    local expected_head_sha="${2:-}"
+    local _expected_base_sha="${3:-}"
+    : "$_expected_base_sha"
+
+    # No python3 -> degrade honestly, never crash.
+    if ! command -v python3 >/dev/null 2>&1; then
+        printf '%s\n' "Evidence Receipt: unavailable for this run."
+        return 0
+    fi
+
+    # Pass every input as argv (sys.argv), NEVER interpolated into the heredoc:
+    # quote-safe and injection-safe against a hostile proof path. The heredoc
+    # delimiter is quoted so bash performs no expansion inside the program.
+    # Capture into a var so a non-zero python exit degrades honestly without a
+    # brace group on the heredoc command (which bash mis-parses). The program
+    # always handles its own errors and prints, so a non-zero exit is a last
+    # resort (interpreter crash) -> print the single honest line.
+    local _receipt_out=""
+    local _receipt_rc=0
+    _receipt_out="$(python3 - "$proof_json_path" "$expected_head_sha" <<'PROOF_PR_PY' 2>/dev/null
+import json
+import sys
+
+
+def _line(s=""):
+    sys.stdout.write(s + "\n")
+
+
+def main():
+    argv = sys.argv[1:]
+    proof_path = argv[0] if len(argv) > 0 else ""
+    expected_head = (argv[1] if len(argv) > 1 else "").strip()
+
+    if not proof_path:
+        _line("Evidence Receipt: unavailable for this run.")
+        return 0
+    try:
+        with open(proof_path, "r") as f:
+            proof = json.load(f)
+    except Exception:
+        _line("Evidence Receipt: unavailable for this run.")
+        return 0
+    if not isinstance(proof, dict):
+        _line("Evidence Receipt: unavailable for this run.")
+        return 0
+
+    honesty = proof.get("honesty")
+    honesty = honesty if isinstance(honesty, dict) else {}
+    headline = str(honesty.get("headline") or "").strip()
+    if not headline:
+        _line("Evidence Receipt: unavailable for this run.")
+        return 0
+
+    facts = proof.get("facts")
+    facts = facts if isinstance(facts, dict) else {}
+    git = facts.get("git") if isinstance(facts.get("git"), dict) else {}
+    tests = facts.get("tests") if isinstance(facts.get("tests"), dict) else {}
+    build = facts.get("build") if isinstance(facts.get("build"), dict) else {}
+    security = facts.get("security") if isinstance(facts.get("security"), dict) else {}
+    cost = facts.get("cost") if isinstance(facts.get("cost"), dict) else {}
+    meta = facts.get("meta") if isinstance(facts.get("meta"), dict) else {}
+
+    diff = git.get("diff") if isinstance(git.get("diff"), dict) else {}
+    diff_count = diff.get("count")
+    diff_sha = str(git.get("diff_sha256") or "")
+    base_sha = str(git.get("base_sha") or "")
+    head_sha = str(git.get("head_sha") or "")
+
+    # run_id: prefer facts.meta.run_id, fall back to the top-level mirror.
+    run_id = str(meta.get("run_id") or proof.get("run_id") or "").strip()
+
+    # R-DET-2 cross-check. Only a supplied expected_head AND a VERIFIED headline
+    # can trigger it. On mismatch we do NOT print a VERIFIED banner; we print an
+    # honest line so a stale / wrong-run proof fails safe, never fake-green.
+    head_mismatch = (
+        bool(expected_head)
+        and headline == "VERIFIED"
+        and head_sha != ""
+        and head_sha != expected_head
+    )
+
+    # ---- Render -----------------------------------------------------------
+    _line("### Evidence Receipt")
+    _line()
+
+    if head_mismatch:
+        _line(
+            "Evidence Receipt: available but does not match this branch head "
+            "(proof head " + (head_sha or "(none)")
+            + ", branch head " + (expected_head or "(none)") + "). Run "
+            "`loki proof verify " + (run_id or "<run_id>") + "` to inspect."
+        )
+        _line()
+        # Fall through: still render facts + verify-yourself so the reviewer can
+        # check, but emit NO green headline label.
+        effective_headline = ""
+    else:
+        # Headline mapped 1:1 from honesty.headline. Plain text label, NO color
+        # codes -- this goes into a PR body. R-HON-1: only VERIFIED is green.
+        effective_headline = headline
+        _line("Headline: " + headline)
+        _line()
+
+    # Facts table. Deterministic, non-LLM facts a skeptic can recompute.
+    def _stat(d):
+        s = str(d.get("status") or "").strip()
+        return s if s else "not_run"
+
+    tests_cell = _stat(tests)
+    tests_cmd = str(tests.get("command") or "").strip()
+    if tests_cmd:
+        tests_cell = tests_cell + " (`" + tests_cmd + "`)"
+    build_cell = _stat(build)
+    build_cmd = str(build.get("command") or "").strip()
+    if build_cmd:
+        build_cell = build_cell + " (`" + build_cmd + "`)"
+
+    sec_cell = _stat(security)
+    if security.get("ran"):
+        ha = security.get("high_active") or 0
+        try:
+            ha = int(ha)
+        except Exception:
+            ha = 0
+        if ha > 0:
+            sec_cell = sec_cell + " (" + str(ha) + " un-waived HIGH)"
+
+    cost_usd = cost.get("usd")
+    cost_cell = "not recorded" if cost_usd is None else ("$" + str(cost_usd))
+
+    files_cell = "0" if diff_count is None else str(diff_count)
+
+    _line("| Fact | Value |")
+    _line("| --- | --- |")
+    _line("| Files changed | " + files_cell + " |")
+    _line("| Diff sha256 | `" + (diff_sha or "(none)") + "` |")
+    _line("| Tests | " + tests_cell + " |")
+    _line("| Build | " + build_cell + " |")
+    _line("| Security | " + sec_cell + " |")
+    _line("| Cost | " + cost_cell + " |")
+    _line("| Base sha | `" + (base_sha or "(none)") + "` |")
+    _line("| Head sha | `" + (head_sha or "(none)") + "` |")
+    _line()
+
+    # Gaps: when headline != VERIFIED, list honesty.degraded[] verbatim. By
+    # _compute_degraded design an empty list with a non-VERIFIED headline is
+    # impossible, but guard anyway (R-HON-2).
+    if effective_headline != "VERIFIED":
+        degraded = honesty.get("degraded")
+        degraded = degraded if isinstance(degraded, list) else []
+        if degraded:
+            _line("Not yet verified:")
+            for d in degraded:
+                if not isinstance(d, dict):
+                    continue
+                item = str(d.get("item") or "").strip()
+                status = str(d.get("status") or "").strip()
+                reason = str(d.get("reason") or "").strip()
+                _line(
+                    "- " + (item or "(item)")
+                    + ": " + (status or "(status)")
+                    + (" -- " + reason if reason else "")
+                )
+            _line()
+
+    # Verify-yourself block. ALWAYS rendered, even on NOT VERIFIED -- the whole
+    # point is that the reviewer can recompute the verdict and does not have to
+    # trust Loki.
+    _line("You do not have to trust this. Verify it yourself:")
+    _line()
+    _line("```")
+    _line(
+        "loki proof verify " + (run_id or "<run_id>")
+        + "  (base " + (base_sha or "(none)") + ")"
+    )
+    _line("```")
+    _line()
+
+    # What the headline means: a first-time reviewer must understand that
+    # VERIFIED WITH GAPS is honest, not a failure.
+    _line(
+        "What the headline means: VERIFIED means every recorded check passed; "
+        "VERIFIED WITH GAPS means the checks that ran passed but some checks "
+        "were not run (listed above); NOT VERIFIED means a check failed or "
+        "nothing could be verified. The headline is computed only from "
+        "deterministic, re-derivable facts, never from an AI opinion."
+    )
+    return 0
+
+
+sys.exit(main())
+PROOF_PR_PY
+    )" || _receipt_rc=$?
+
+    if [ "$_receipt_rc" != "0" ] || [ -z "$_receipt_out" ]; then
+        printf '%s\n' "Evidence Receipt: unavailable for this run."
+        return 0
+    fi
+    printf '%s\n' "$_receipt_out"
+    return 0
+}

package/autonomy/loki

@@ -125,6 +125,14 @@ if [ -f "$_LOKI_SCRIPT_DIR/lib/git-pr-advisory.sh" ]; then
     source "$_LOKI_SCRIPT_DIR/lib/git-pr-advisory.sh"
 fi
 
+# Proven PR (Loop 6): shared print-only Evidence Receipt renderer for PR bodies
+# (render_evidence_receipt_md). Sourced so cmd_github can append the receipt to
+# the PR body. Self-guarded against double-source; existence-guarded.
+if [ -f "$_LOKI_SCRIPT_DIR/lib/proof-pr.sh" ]; then
+    # shellcheck source=autonomy/lib/proof-pr.sh
+    source "$_LOKI_SCRIPT_DIR/lib/proof-pr.sh"
+fi
+
 # Unified config-file support (#691). Canonical LOKI_CONFIG_MAP + the config-file
 # loader (loki_maybe_apply_config_file / loki_apply_config_file) and the
 # example/schema/validate generators. Side-effect-free on source: defines the
@@ -7574,7 +7582,37 @@ if [[ "$LOKI_CREATE_PR" == "true" ]]; then
     branch_current=$(git rev-parse --abbrev-ref HEAD 2>/dev/null || echo "")
     if [[ -n "$branch_current" && "$branch_current" != "main" && "$branch_current" != "master" ]]; then
         git push origin "$branch_current" 2>/dev/null || true
-        gh pr create --title "$LOKI_PR_TITLE" --body "Implemented by Loki Mode" --head "$branch_current" 2>/dev/null || true
+        # Proven PR (v7.90.0): render this run's Evidence Receipt into the PR body
+        # so even the detached --pr/--ship path proves itself. The proof + the
+        # run-id pointer (.loki/state/last-proof-id.txt) exist by now (the
+        # `loki start` above generated them). On by default (LOKI_PROVEN_PR=0
+        # opts out); degrades safely to the plain body if anything is missing.
+        # The renderer is print-only + honesty-gated (green only when the proof
+        # headline is VERIFIED); it can never make a receipt-less PR look proven.
+        _pr_body="Implemented by Loki Mode"
+        if [[ "${LOKI_PROVEN_PR:-1}" != "0" ]]; then
+            # Resolve the renderer from the ALREADY-RESOLVED autonomy dir passed
+            # in by the parent (LOKI_SCRIPT_DIR_RESOLVED = _LOKI_SCRIPT_DIR, which
+            # is symlink-safe). Do NOT recompute from `command -v loki` -- on
+            # npm/bun/brew global installs that is an UNRESOLVED bin symlink, so
+            # dirname-based guessing misses the lib and the receipt silently no-ops
+            # on the dominant install channels (council cIb_r2). Fall back to the
+            # old dirname guesses only if the resolved dir was not passed.
+            _pp_lib="${LOKI_SCRIPT_DIR_RESOLVED:-}/lib/proof-pr.sh"
+            [[ -f "$_pp_lib" ]] || _pp_lib="$(dirname "$LOKI_CMD")/../autonomy/lib/proof-pr.sh"
+            [[ -f "$_pp_lib" ]] || _pp_lib="$(dirname "$LOKI_CMD")/autonomy/lib/proof-pr.sh"
+            _pp_id=""
+            [[ -f .loki/state/last-proof-id.txt ]] && _pp_id="$(cat .loki/state/last-proof-id.txt 2>/dev/null)"
+            _pp_proof=".loki/proofs/${_pp_id}/proof.json"
+            if [[ -n "$_pp_id" && -f "$_pp_proof" && -f "$_pp_lib" ]]; then
+                # shellcheck source=/dev/null
+                if source "$_pp_lib" 2>/dev/null && declare -f render_evidence_receipt_md >/dev/null 2>&1; then
+                    _pp_block="$(render_evidence_receipt_md "$_pp_proof" "" "" 2>/dev/null || true)"
+                    [[ -n "$_pp_block" ]] && _pr_body="Implemented by Loki Mode"$'\n\n'"$_pp_block"
+                fi
+            fi
+        fi
+        gh pr create --title "$LOKI_PR_TITLE" --body "$_pr_body" --head "$branch_current" 2>/dev/null || true
     fi
 fi
 # Post-completion: auto-merge if requested
@@ -7592,6 +7630,7 @@ INNER_SCRIPT_EOF
         # Pass all variables safely via environment
         LOKI_RUN_DIR="$(pwd)" \
         LOKI_CMD="$loki_cmd" \
+        LOKI_SCRIPT_DIR_RESOLVED="$_LOKI_SCRIPT_DIR" \
         LOKI_SESSION_ID="$session_id" \
         LOKI_WORKTREE_BRANCH="$branch_name" \
         LOKI_PRD_PATH="$detach_prd" \
@@ -7682,6 +7721,28 @@ Provider: ${issue_provider}
 ## Changes
 $(git log --oneline "main..HEAD" 2>/dev/null || echo "See diff")"
 
+            # Proven PR (Loop 6): append the Evidence Receipt to the body. One
+            # append covers BOTH the gh and glab branches below. Default-on;
+            # LOKI_PROVEN_PR=0 -> body byte-identical to before. The proof lives
+            # under the project .loki resolved from the run_id pointer; empty
+            # expected_head_sha by design (R-DET-1 run_id pointer is the guard).
+            if [ "${LOKI_PROVEN_PR:-1}" != "0" ] && declare -f render_evidence_receipt_md >/dev/null 2>&1; then
+                local _gh_idfile=".loki/state/last-proof-id.txt"
+                if [ -s "$_gh_idfile" ]; then
+                    local _gh_rid=""
+                    _gh_rid="$(cat "$_gh_idfile" 2>/dev/null || true)"
+                    if [ -n "$_gh_rid" ] && [ -f ".loki/proofs/$_gh_rid/proof.json" ]; then
+                        local _gh_receipt=""
+                        _gh_receipt="$(render_evidence_receipt_md ".loki/proofs/$_gh_rid/proof.json" "" "" 2>/dev/null || true)"
+                        if [ -n "$_gh_receipt" ]; then
+                            pr_body="${pr_body}
+
+${_gh_receipt}"
+                        fi
+                    fi
+                fi
+            fi
+
             case "${issue_provider:-github}" in
                 github)
                     if command -v gh &>/dev/null; then

package/autonomy/run.sh

@@ -572,6 +572,25 @@ if [ -f "$GIT_PR_ADVISORY_LIB" ]; then
     source "$GIT_PR_ADVISORY_LIB"
 fi
 
+# Proven PR (Loop 6): shared print-only Evidence Receipt renderer for PR bodies.
+# render_evidence_receipt_md prints the run's honest headline + facts +
+# verify-yourself block into the PR body. Pure, never pushes/PRs/mutates.
+PROOF_PR_LIB="$SCRIPT_DIR/lib/proof-pr.sh"
+if [ -f "$PROOF_PR_LIB" ]; then
+    # shellcheck source=lib/proof-pr.sh
+    source "$PROOF_PR_LIB"
+fi
+
+# Proven PR (Loop 6 / Slice B): optional advisory verified-completion check-run.
+# Owned by Slice B (autonomy/lib/proof-check.sh); sourced guarded so this slice
+# is correct whether or not the file is present in the tree, and the single call
+# site is itself guarded on declare -f + LOKI_PROVEN_PR_CHECK.
+PROOF_CHECK_LIB="$SCRIPT_DIR/lib/proof-check.sh"
+if [ -f "$PROOF_CHECK_LIB" ]; then
+    # shellcheck source=lib/proof-check.sh
+    source "$PROOF_CHECK_LIB"
+fi
+
 # Completion Council (v5.25.0) - Multi-agent completion verification
 # Source completion council module
 COUNCIL_SCRIPT="$SCRIPT_DIR/completion-council.sh"
@@ -2330,6 +2349,19 @@ EOF
         jq -r '.completed_tasks[]? | select(.github_issue) | "Closes #\(.github_issue)"' .loki/ledger.json >> "$pr_body" 2>/dev/null || true
     fi
 
+    # Proven PR (Loop 6): append the Evidence Receipt to the body file before
+    # gh pr create --body-file. Default-on; LOKI_PROVEN_PR=0 -> body file bytes
+    # byte-identical to before. Empty expected_head_sha by design (R-DET-1
+    # run_id pointer is the anti-stale guard; the branch head is offset by the
+    # session commit). Best-effort: a missing proof appends nothing extra here.
+    if [ "${LOKI_PROVEN_PR:-1}" != "0" ] && declare -f render_evidence_receipt_md >/dev/null 2>&1; then
+        local _bf_proof=""
+        _bf_proof="$(_loki_proof_json_for_pr 2>/dev/null || true)"
+        if [ -n "$_bf_proof" ]; then
+            { printf '\n'; render_evidence_receipt_md "$_bf_proof" "" "" 2>/dev/null; } >> "$pr_body" 2>/dev/null || true
+        fi
+    fi
+
     # Build PR create command
     local pr_args=("pr" "create" "--repo" "$repo" "--title" "[Loki Mode] $feature_name" "--body-file" "$pr_body")
 
@@ -3184,7 +3216,30 @@ on_run_complete() {
         log_info "LOKI_DELEGATE_PR=1: PR already exists for branch '$branch': $existing_pr (skipping create)."
         return 0
     fi
-    pr_url="$( (cd "${TARGET_DIR:-.}" && _loki_net gh pr create --title "$pr_title" --body "Opened by Loki Mode (delegate mode). Review locally before merge." --head "$branch") 2>/dev/null || true )"
+    # Proven PR (Loop 6): append the Evidence Receipt to the inline body.
+    # Default-on; LOKI_PROVEN_PR=0 -> body byte-identical to before. This path
+    # runs gh from a `cd "${TARGET_DIR:-.}"` subshell, so resolve the proof
+    # relative to TARGET_DIR (not the bare-relative helper). Empty
+    # expected_head_sha by design (R-DET-1 run_id pointer is the anti-stale guard).
+    local _del_body="Opened by Loki Mode (delegate mode). Review locally before merge."
+    if [ "${LOKI_PROVEN_PR:-1}" != "0" ] && declare -f render_evidence_receipt_md >/dev/null 2>&1; then
+        local _del_loki="${TARGET_DIR:-.}/.loki"
+        local _del_idfile="$_del_loki/state/last-proof-id.txt"
+        if [ -s "$_del_idfile" ]; then
+            local _del_rid=""
+            _del_rid="$(cat "$_del_idfile" 2>/dev/null || true)"
+            if [ -n "$_del_rid" ] && [ -f "$_del_loki/proofs/$_del_rid/proof.json" ]; then
+                local _del_receipt=""
+                _del_receipt="$(render_evidence_receipt_md "$_del_loki/proofs/$_del_rid/proof.json" "" "" 2>/dev/null || true)"
+                if [ -n "$_del_receipt" ]; then
+                    _del_body="${_del_body}
+
+${_del_receipt}"
+                fi
+            fi
+        fi
+    fi
+    pr_url="$( (cd "${TARGET_DIR:-.}" && _loki_net gh pr create --title "$pr_title" --body "$_del_body" --head "$branch") 2>/dev/null || true )"
     if [ -n "$pr_url" ]; then
         # Export so build_completion_summary folds the url into the summary.
         _LOKI_DELEGATE_PR_URL="$pr_url"
@@ -5501,6 +5556,46 @@ generate_proof_of_run() {
     local ver provider
     ver="$(get_version 2>/dev/null || echo unknown)"
     provider="${PROVIDER_NAME:-claude}"
+
+    # Proven PR (Loop 6 / Slice A2): resolve a deterministic run_id so the
+    # proof + the PR Evidence Receipt agree, and persist a stable pointer the PR
+    # sites read (never newest-by-mtime). The generator otherwise mints a fresh
+    # _gen_run_id() when LOKI_SESSION_ID is unset (the `loki start ./prd.md`
+    # case), which the later PR step could not know. Gated on the SAME flag as the
+    # receipt so LOKI_PROVEN_PR=0 is a byte-identical no-op (no --run-id passed,
+    # no pointer written): the pointer is only ever READ by the renderer, which
+    # is itself off under that flag.
+    if [ "${LOKI_PROVEN_PR:-1}" != "0" ]; then
+        local _rid=""
+        if declare -f _loki_trust_run_id >/dev/null 2>&1; then
+            _rid="$(_loki_trust_run_id 2>/dev/null || true)"
+        fi
+        # Fall back to a locally minted id when no persisted per-run id exists.
+        # Do NOT call _loki_trust_run_id --new here: that would clobber the
+        # trust-events run-id file; this is a read-or-mint-local resolution.
+        if [ -z "$_rid" ]; then
+            _rid="proof-$(date -u +%Y%m%d%H%M%S 2>/dev/null || echo 0)-$$-${RANDOM:-0}"
+        fi
+        ITERATION_COUNT="${ITERATION_COUNT:-0}" \
+        PROVIDER_NAME="$provider" \
+        PRD_PATH="${prd_path:-}" \
+        python3 "$gen" \
+            --loki-dir "$loki_dir" \
+            --loki-version "$ver" \
+            --provider "$provider" \
+            --run-id "$_rid" \
+            --quiet >/dev/null 2>&1 || true
+        # Persist the resolved run_id atomically (.tmp + mv) so the PR sites read
+        # the exact run the generator wrote, never an mtime guess.
+        local _id_dir="$loki_dir/state"
+        local _id_file="$_id_dir/last-proof-id.txt"
+        mkdir -p "$_id_dir" 2>/dev/null || true
+        if printf '%s' "$_rid" > "${_id_file}.tmp" 2>/dev/null; then
+            mv -f "${_id_file}.tmp" "$_id_file" 2>/dev/null || rm -f "${_id_file}.tmp" 2>/dev/null || true
+        fi
+        return 0
+    fi
+
     ITERATION_COUNT="${ITERATION_COUNT:-0}" \
     PROVIDER_NAME="$provider" \
     PRD_PATH="${prd_path:-}" \
@@ -6327,6 +6422,25 @@ commit_session_changes() {
     return 0
 }
 
+# _loki_proof_json_for_pr
+# Resolve THIS run's proof.json path from the persisted run_id pointer
+# (.loki/state/last-proof-id.txt, written by generate_proof_of_run / Slice A2).
+# Echoes the path when both the pointer and the file exist, else empty. NEVER
+# uses newest-by-mtime (R-DET-1). Best-effort, always returns 0. Uses the bare
+# relative .loki to match the other create_session_pr state reads (cwd==TARGET_DIR
+# at PR time). Returns empty under LOKI_PROVEN_PR=0 (pointer is never written).
+_loki_proof_json_for_pr() {
+    local id_file=".loki/state/last-proof-id.txt"
+    [ -s "$id_file" ] || { printf '%s' ""; return 0; }
+    local rid=""
+    rid="$(cat "$id_file" 2>/dev/null || true)"
+    [ -n "$rid" ] || { printf '%s' ""; return 0; }
+    local p=".loki/proofs/$rid/proof.json"
+    [ -f "$p" ] || { printf '%s' ""; return 0; }
+    printf '%s' "$p"
+    return 0
+}
+
 create_session_pr() {
     # Advise the user how to open a PR for the agent branch. PRINT-ONLY by
     # default (no push, no PR). LOKI_AUTO_PR=1 restores the legacy auto behavior.
@@ -6371,6 +6485,22 @@ create_session_pr() {
         else
             log_info "To open a pull request: git push -u origin ${branch_name}, then open a PR (base: ${base})"
         fi
+        # Proven PR (Loop 6): print the Evidence Receipt block AFTER the push/PR
+        # advice so a user opening a manual PR can paste it into the body. This is
+        # the print-PR-body fallback. Default-on; LOKI_PROVEN_PR=0 -> not invoked
+        # (advisory output byte-identical to before). Production callers pass an
+        # empty expected_head_sha: the session commit lands between proof-gen and
+        # this point, so the branch head is structurally offset from the proof's
+        # head and feeding it would false-degrade every legitimate receipt; the
+        # anti-stale guarantee is the run_id pointer (R-DET-1), not a head match.
+        if [ "${LOKI_PROVEN_PR:-1}" != "0" ] && declare -f render_evidence_receipt_md >/dev/null 2>&1; then
+            local _pr_proof=""
+            _pr_proof="$(_loki_proof_json_for_pr 2>/dev/null || true)"
+            if [ -n "$_pr_proof" ]; then
+                printf '\n'
+                render_evidence_receipt_md "$_pr_proof" "" "" || true
+            fi
+        fi
         return 0
     fi
 
@@ -6395,21 +6525,95 @@ create_session_pr() {
         if [ -n "$existing_pr" ]; then
             log_info "PR already exists for branch $branch_name: $existing_pr (skipping create)"
             audit_log "PR_EXISTS" "branch=$branch_name,url=$existing_pr"
+            # Proven PR (Loop 6, PO-locked Q1): on idempotent reuse, leave the
+            # existing PR untouched (do not rewrite the body, edit the PR, or
+            # post a comment). Just hint that an Evidence Receipt is available.
+            if [ "${LOKI_PROVEN_PR:-1}" != "0" ]; then
+                local _exist_proof=""
+                _exist_proof="$(_loki_proof_json_for_pr 2>/dev/null || true)"
+                if [ -n "$_exist_proof" ]; then
+                    log_info "Evidence Receipt available for this run: loki proof open (run id in .loki/state/last-proof-id.txt)"
+                fi
+            fi
             return 0
         fi
-        pr_url=$(gh pr create \
-            --title "Loki Mode: Agent session changes ($branch_name)" \
-            --body "Automated changes from Loki Mode agent session.
+        # Build the body into a variable so the Proven PR Evidence Receipt can be
+        # appended (Loop 6). Default-on; LOKI_PROVEN_PR=0 -> body bytes are
+        # byte-identical to the legacy inline body. Empty expected_head_sha by
+        # design (see the advisory-branch note: the session commit offsets the
+        # branch head from the proof head; R-DET-1 run_id pointer is the guard).
+        local _auto_body
+        _auto_body="Automated changes from Loki Mode agent session.
 
 Branch: \`$branch_name\`
 Session PID: $$
-Created: $(date -u +%Y-%m-%dT%H:%M:%SZ)" \
+Created: $(date -u +%Y-%m-%dT%H:%M:%SZ)"
+        local _auto_proof=""
+        if [ "${LOKI_PROVEN_PR:-1}" != "0" ] && declare -f render_evidence_receipt_md >/dev/null 2>&1; then
+            _auto_proof="$(_loki_proof_json_for_pr 2>/dev/null || true)"
+            if [ -n "$_auto_proof" ]; then
+                local _auto_receipt=""
+                _auto_receipt="$(render_evidence_receipt_md "$_auto_proof" "" "" 2>/dev/null || true)"
+                if [ -n "$_auto_receipt" ]; then
+                    _auto_body="${_auto_body}
+
+${_auto_receipt}"
+                fi
+            fi
+        fi
+        pr_url=$(gh pr create \
+            --title "Loki Mode: Agent session changes ($branch_name)" \
+            --body "$_auto_body" \
             --base "$base" \
             --head "$branch_name" 2>/dev/null) || true
 
         if [ -n "$pr_url" ]; then
             log_info "PR created: $pr_url"
             audit_log "PR_CREATED" "branch=$branch_name,url=$pr_url"
+            # Proven PR (Loop 6 / Slice D linkage): persist {run_id, pr_url} next
+            # to the proof so the dashboard proofs panel can show "PR #N:
+            # <headline>". Slice D owns the READ; Slice A owns this WRITE. Atomic
+            # .tmp + mv, python3-guarded for correct JSON escaping, only when a
+            # proof for THIS run exists and a pr_url was returned. Best-effort.
+            if [ -n "$_auto_proof" ] && command -v python3 >/dev/null 2>&1; then
+                local _pr_json_dir
+                _pr_json_dir="$(dirname "$_auto_proof" 2>/dev/null || true)"
+                if [ -n "$_pr_json_dir" ] && [ -d "$_pr_json_dir" ]; then
+                    local _pr_run_id
+                    _pr_run_id="$(basename "$_pr_json_dir" 2>/dev/null || true)"
+                    LOKI_PR_JSON_DIR="$_pr_json_dir" \
+                    LOKI_PR_RUN_ID="$_pr_run_id" \
+                    LOKI_PR_URL="$pr_url" \
+                    python3 - <<'PR_JSON_PY' 2>/dev/null || true
+import json
+import os
+
+d = os.environ.get("LOKI_PR_JSON_DIR", "")
+run_id = os.environ.get("LOKI_PR_RUN_ID", "")
+pr_url = os.environ.get("LOKI_PR_URL", "")
+if d and os.path.isdir(d):
+    path = os.path.join(d, "pr.json")
+    tmp = path + ".tmp"
+    try:
+        with open(tmp, "w") as f:
+            json.dump({"run_id": run_id, "pr_url": pr_url}, f)
+        os.replace(tmp, path)
+    except Exception:
+        try:
+            os.remove(tmp)
+        except Exception:
+            pass
+PR_JSON_PY
+                fi
+            fi
+            # Proven PR (Loop 6 / Slice B integration): one guarded call to the
+            # optional advisory verified-completion check-run. Posts NOTHING by
+            # default (LOKI_PROVEN_PR_CHECK unset). Slice B owns proof-check.sh;
+            # guarded on the file being sourced (declare -f) so this slice is
+            # correct whether or not B is integrated. Best-effort, never fails PR.
+            if [ "${LOKI_PROVEN_PR_CHECK:-0}" = "1" ] && declare -f post_verified_completion_check >/dev/null 2>&1; then
+                post_verified_completion_check "${_auto_proof:-}" "$pr_url" || true
+            fi
         else
             log_warn "Failed to create PR - branch pushed to: $branch_name"
         fi

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "7.89.1"
+__version__ = "7.90.0"
 
 # Expose the control app for easy import
 try:

package/dashboard/server.py

@@ -10078,6 +10078,25 @@ def _safe_proof_run_dir(run_id: str) -> _Path:
     return _Path(target)
 
 
+def _proof_pr_url(run_dir: _Path) -> Optional[str]:
+    """Return the PR URL linked to this run, or None.
+
+    Reads the optional <run_dir>/pr.json that the run.sh auto-PR path writes at
+    PR-creation time ({"run_id": "...", "pr_url": "..."}). The file is read only
+    inside the already-validated run dir (the caller passes either an iterdir()
+    entry or a _safe_proof_run_dir result -- never a raw run_id), so there is no
+    additional traversal surface. Missing/unreadable/non-dict pr.json or an
+    empty/non-string pr_url -> None, never an error. Most proofs have no PR.
+    """
+    pr_data = _safe_json_read(run_dir / "pr.json", default=None)
+    if not isinstance(pr_data, dict):
+        return None
+    url = pr_data.get("pr_url")
+    if isinstance(url, str) and url:
+        return url
+    return None
+
+
 @app.get("/api/proofs", dependencies=[Depends(auth.require_scope("read"))])
 async def list_proofs():
     """List proof-of-run artifacts for the active project's .loki/proofs/."""
@@ -10096,6 +10115,11 @@ async def list_proofs():
         data = _safe_json_read(proof_json, default=None)
         if not isinstance(data, dict):
             continue
+        # Deterministic honesty headline (single source of truth, same access as
+        # proofs_summary's bucketing). Read, never recomputed. The list endpoint
+        # surfaces it so the panel can show the verdict without a second fetch.
+        honesty = data.get("honesty")
+        headline = honesty.get("headline") if isinstance(honesty, dict) else None
         items.append({
             "run_id": data.get("run_id", entry.name),
             "generated_at": data.get("generated_at"),
@@ -10103,6 +10127,8 @@ async def list_proofs():
             "cost_usd": (data.get("cost") or {}).get("usd"),
             "files_changed": (data.get("files_changed") or {}).get("count"),
             "final_verdict": (data.get("council") or {}).get("final_verdict"),
+            "headline": headline,
+            "pr_url": _proof_pr_url(entry),
             "has_html": (entry / "index.html").is_file(),
         })
     # Newest first when generated_at is present.
@@ -10176,6 +10202,10 @@ async def get_proof(run_id: str):
     data = _safe_json_read(proof_json, default=None)
     if not isinstance(data, dict):
         raise HTTPException(status_code=500, detail="proof.json unreadable")
+    # Surface the optional PR linkage alongside the proof. The proof.json itself
+    # already carries honesty.headline; we only add pr_url so the panel can show
+    # "PR #N -> <headline>". Absent pr.json -> pr_url null, never an error.
+    data["pr_url"] = _proof_pr_url(run_dir)
     return JSONResponse(content=data)
 
 

package/dashboard/static/proofs.html

@@ -69,12 +69,18 @@
     display: block; background: var(--panel); border: 1px solid var(--border);
     border-radius: 12px; padding: 16px 18px; color: var(--text);
   }
-  .row:hover { border-color: var(--accent); text-decoration: none; }
+  .row:hover { border-color: var(--accent); }
+  .row-main { display: block; color: var(--text); }
+  .row-main:hover { text-decoration: none; }
   .row .top { display: flex; align-items: baseline; gap: 12px; flex-wrap: wrap; }
   .row .rid { font-family: var(--mono); font-size: 14px; font-weight: 600; }
   .row .usd { font-family: var(--mono); font-size: 16px; font-weight: 650; }
   .row .ts { color: var(--faint); font-size: 12px; margin-left: auto; }
   .row .meta { color: var(--muted); font-size: 13px; margin-top: 6px; display: flex; gap: 14px; flex-wrap: wrap; }
+  .row .pr { font-size: 13px; margin-top: 8px; }
+  .row .pr a { font-family: var(--mono); font-weight: 600; }
+  .row .pr .arrow { color: var(--faint); margin: 0 6px; }
+  .row .pr .verdict { color: var(--muted); }
   .badge { font-size: 12px; font-weight: 600; padding: 2px 8px; border-radius: 6px; border: 1px solid var(--border); }
   .b-approve { color: var(--green); border-color: rgba(52,211,153,0.4); }
   .b-reject { color: var(--red); border-color: rgba(248,113,113,0.4); }
@@ -115,6 +121,16 @@
     if (v.indexOf("CONCERN") === 0) return "b-concern";
     return "";
   }
+  // Extract the PR/MR number from a GitHub/GitLab PR URL for the display label.
+  // GitHub: .../pull/123  GitLab: .../merge_requests/123. Falls back to the
+  // trailing numeric path segment. Returns "" when no number can be found.
+  function prNumber(url) {
+    var s = String(url || "");
+    var m = s.match(/\/(?:pull|merge_requests|pulls)\/(\d+)/);
+    if (m) return m[1];
+    m = s.match(/\/(\d+)(?:[/?#]|$)/);
+    return m ? m[1] : "";
+  }
   function render(proofs) {
     var c = document.getElementById("content");
     if (!proofs || proofs.length === 0) {
@@ -133,11 +149,24 @@
       var ts = p.generated_at ? esc(p.generated_at) : "";
       var href = p.has_html ? ("/api/proofs/" + encodeURIComponent(p.run_id) + "/html") : ("/api/proofs/" + encodeURIComponent(p.run_id));
       var meta = [usd ? '<span class="usd">' + usd + "</span>" : "", fc, ver].filter(Boolean).join(" ");
-      rows += '<a class="row" href="' + href + '">' +
+      // PR linkage: render "PR #N -> <headline>" only when a PR is attached. The
+      // headline is the proof's own deterministic honesty.headline (display only,
+      // no client-side verdict logic). No pr_url -> nothing extra is rendered.
+      var prBlock = "";
+      if (p.pr_url) {
+        var num = prNumber(p.pr_url);
+        var label = num ? ("PR #" + esc(num)) : "PR";
+        var hl = p.headline ? ('<span class="arrow">-&gt;</span><span class="verdict">' + esc(p.headline) + "</span>") : "";
+        prBlock = '<div class="pr"><a href="' + esc(p.pr_url) +
+          '" target="_blank" rel="noopener noreferrer">' + label + "</a>" + hl + "</div>";
+      }
+      rows += '<div class="row">' +
+        '<a class="row-main" href="' + href + '">' +
         '<div class="top"><span class="rid">' + rid + "</span>" + verdict +
         (ts ? '<span class="ts">' + ts + "</span>" : "") + "</div>" +
         (meta ? '<div class="meta">' + meta + "</div>" : "") +
-        "</a>";
+        "</a>" + prBlock +
+        "</div>";
     }
     c.innerHTML = '<div class="list">' + rows + "</div>";
   }

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 The flagship product of [Autonomi](https://www.autonomi.dev/). Loki Mode is a spec-driven autonomous builder with a built-in trust layer that takes any spec to a deployed product and verifies completion with evidence (quality gates plus a completion council), not just a "done" claim. Complete installation instructions for all platforms and use cases.
 
-**Version:** v7.89.1
+**Version:** v7.90.0
 
 ---
 
@@ -395,7 +395,7 @@ provider works inside the container. Provide auth with your Anthropic API key:
 # Run Loki Mode in Docker (Claude provider, API-key auth)
 docker run --rm -e ANTHROPIC_API_KEY="$ANTHROPIC_API_KEY" \
   -v $(pwd):/workspace -w /workspace \
-  asklokesh/loki-mode:7.89.1 start ./my-spec.md
+  asklokesh/loki-mode:7.90.0 start ./my-spec.md
 ```
 
 ##### docker compose + .env (no host install)

package/loki-ts/dist/loki.js

@@ -1,5 +1,5 @@
 // @bun
-var z8=Object.defineProperty;var X8=($)=>$;function K8($,Q){this[$]=X8.bind(null,Q)}var b=($,Q)=>{for(var Z in Q)z8($,Z,{get:Q[Z],enumerable:!0,configurable:!0,set:K8.bind(Q,Z)})};var L=($,Q)=>()=>($&&(Q=$($=0)),Q);var J$=import.meta.require;var y1={};b(y1,{lokiDir:()=>P,homeLokiDir:()=>T$,findRepoRootForVersion:()=>e$,REPO_ROOT:()=>h});import{resolve as t,dirname as i$}from"path";import{fileURLToPath as q8}from"url";import{existsSync as E$}from"fs";import{homedir as J8}from"os";function V8(){let $=h1;for(let Q=0;Q<6;Q++){if(E$(t($,"VERSION"))&&E$(t($,"autonomy/run.sh")))return $;let Z=i$($);if(Z===$)break;$=Z}return t(h1,"..","..","..")}function e$($){let Q=$;for(let Z=0;Z<6;Z++){if(E$(t(Q,"VERSION"))&&E$(t(Q,"autonomy/run.sh")))return Q;let z=i$(Q);if(z===Q)break;Q=z}return t($,"..","..","..")}function P(){return process.env.LOKI_DIR??t(process.cwd(),".loki")}function T$(){return t(J8(),".loki")}var h1,h;var C=L(()=>{h1=i$(q8(import.meta.url));h=V8()});import{readFileSync as W8}from"fs";import{resolve as U8,dirname as H8}from"path";import{fileURLToPath as G8}from"url";function N$(){if(Q$!==null)return Q$;let $="7.89.1";if(typeof $==="string"&&$.length>0)return Q$=$,Q$;try{let Q=H8(G8(import.meta.url)),Z=e$(Q);Q$=W8(U8(Z,"VERSION"),"utf-8").trim()}catch{Q$="unknown"}return Q$}var Q$=null;var $1=L(()=>{C()});var u1={};b(u1,{runOrThrow:()=>x8,run:()=>F,readStreamCapped:()=>f1,commandVersion:()=>N8,commandExists:()=>f,ShellError:()=>Q1,MAX_STDOUT_BYTES:()=>m1});async function f1($,Q=m1){let Z=$.getReader(),z=new TextDecoder,X="",q=0;try{while(q<Q){let{done:K,value:W}=await Z.read();if(K)break;if(!W)continue;if(q+=W.byteLength,q>Q){let V=W.byteLength-(q-Q);X+=z.decode(W.subarray(0,V),{stream:!0});break}X+=z.decode(W,{stream:!0})}X+=z.decode()}finally{try{await Z.cancel()}catch{}Z.releaseLock()}return X}async function F($,Q={}){let Z=Bun.spawn({cmd:[...$],stdout:"pipe",stderr:"pipe",env:Q.env?{...process.env,...Q.env}:process.env,cwd:Q.cwd}),z,X;if(Q.timeoutMs&&Q.timeoutMs>0)z=setTimeout(()=>{try{Z.kill("SIGTERM")}catch{}X=setTimeout(()=>{try{Z.kill("SIGKILL")}catch{}},2000)},Q.timeoutMs);try{let[q,K,W]=await Promise.all([f1(Z.stdout),new Response(Z.stderr).text(),Z.exited]);return{stdout:q,stderr:K,exitCode:W}}finally{if(z)clearTimeout(z);if(X)clearTimeout(X)}}async function x8($,Q={}){let Z=await F($,Q);if(Z.exitCode!==0)throw new Q1(`command failed (${Z.exitCode}): ${$.join(" ")}`,Z.exitCode,Z.stdout,Z.stderr);return Z}async function f($){let Q=E8($),Z=await F(["sh","-c",`command -v ${Q}`],{timeoutMs:5000});if(Z.exitCode===0)return Z.stdout.trim()||null;return null}function E8($){if(!/^[A-Za-z0-9._/-]+$/.test($))throw Error(`refused to shell-escape suspect token: ${$}`);return $}async function N8($,Q="--version"){if(!await f($))return null;let z=await F([$,Q],{timeoutMs:5000});if(z.exitCode!==0)return null;return((z.stdout||z.stderr).split(/\r?\n/)[0]?.trim()??"")||null}var m1=16777216,Q1;var d=L(()=>{Q1=class Q1 extends Error{message;exitCode;stdout;stderr;constructor($,Q,Z,z){super($);this.message=$;this.exitCode=Q;this.stdout=Z;this.stderr=z;this.name="ShellError"}}});function r($){return S8?"":$}var S8,T,S,_,lZ,I,k,y,J;var c=L(()=>{S8=(process.env.NO_COLOR??"").length>0;T=r("\x1B[0;31m"),S=r("\x1B[0;32m"),_=r("\x1B[1;33m"),lZ=r("\x1B[0;34m"),I=r("\x1B[0;36m"),k=r("\x1B[1m"),y=r("\x1B[2m"),J=r("\x1B[0m")});import{existsSync as u8}from"fs";async function Z$(){if(A$!==void 0)return A$;let $="/opt/homebrew/bin/python3.12";if(u8($))return A$=$,$;let Q=await f("python3.12");if(Q)return A$=Q,Q;let Z=await f("python3");return A$=Z,Z}async function z$($,Q={}){let Z=await Z$();if(!Z)return{stdout:"",stderr:"python3 not found",exitCode:127};return F([Z,"-c",$],Q)}var A$;var V$=L(()=>{d()});var q0={};b(q0,{runStatus:()=>W3});import{existsSync as v,readFileSync as U$,readdirSync as i1,statSync as e1}from"fs";import{resolve as D,basename as $3}from"path";import{homedir as Q3}from"os";function $0($){let Q=Math.trunc($);if(Q>=1e6)return`${(Math.trunc(Q/1e6*10)/10).toFixed(1)}M`;if(Q>=1000)return`${(Math.trunc(Q/1000*10)/10).toFixed(1)}K`;return String(Q)}function Q0($,Q,Z){if(Q===0)return null;let z=Math.trunc($*100/Q),X=Math.trunc($*D$/Q);if(X>D$)X=D$;let q=D$-X,K=S;if(z>=80)K=T;else if(z>=50)K=_;let W="=".repeat(Math.max(0,X))+" ".repeat(Math.max(0,q)),V=$0($),U=$0(Q);return`  ${k}${Z}${J} ${K}[${W}]${J} ${z}% (${V} / ${U})`}async function z3(){if(await f("jq"))return!0;return process.stdout.write(`${T}Error: jq is required but not installed.${J}
+var z8=Object.defineProperty;var X8=($)=>$;function K8($,Q){this[$]=X8.bind(null,Q)}var b=($,Q)=>{for(var Z in Q)z8($,Z,{get:Q[Z],enumerable:!0,configurable:!0,set:K8.bind(Q,Z)})};var L=($,Q)=>()=>($&&(Q=$($=0)),Q);var J$=import.meta.require;var y1={};b(y1,{lokiDir:()=>P,homeLokiDir:()=>T$,findRepoRootForVersion:()=>e$,REPO_ROOT:()=>h});import{resolve as t,dirname as i$}from"path";import{fileURLToPath as q8}from"url";import{existsSync as E$}from"fs";import{homedir as J8}from"os";function V8(){let $=h1;for(let Q=0;Q<6;Q++){if(E$(t($,"VERSION"))&&E$(t($,"autonomy/run.sh")))return $;let Z=i$($);if(Z===$)break;$=Z}return t(h1,"..","..","..")}function e$($){let Q=$;for(let Z=0;Z<6;Z++){if(E$(t(Q,"VERSION"))&&E$(t(Q,"autonomy/run.sh")))return Q;let z=i$(Q);if(z===Q)break;Q=z}return t($,"..","..","..")}function P(){return process.env.LOKI_DIR??t(process.cwd(),".loki")}function T$(){return t(J8(),".loki")}var h1,h;var C=L(()=>{h1=i$(q8(import.meta.url));h=V8()});import{readFileSync as W8}from"fs";import{resolve as U8,dirname as H8}from"path";import{fileURLToPath as G8}from"url";function N$(){if(Q$!==null)return Q$;let $="7.90.0";if(typeof $==="string"&&$.length>0)return Q$=$,Q$;try{let Q=H8(G8(import.meta.url)),Z=e$(Q);Q$=W8(U8(Z,"VERSION"),"utf-8").trim()}catch{Q$="unknown"}return Q$}var Q$=null;var $1=L(()=>{C()});var u1={};b(u1,{runOrThrow:()=>x8,run:()=>F,readStreamCapped:()=>f1,commandVersion:()=>N8,commandExists:()=>f,ShellError:()=>Q1,MAX_STDOUT_BYTES:()=>m1});async function f1($,Q=m1){let Z=$.getReader(),z=new TextDecoder,X="",q=0;try{while(q<Q){let{done:K,value:W}=await Z.read();if(K)break;if(!W)continue;if(q+=W.byteLength,q>Q){let V=W.byteLength-(q-Q);X+=z.decode(W.subarray(0,V),{stream:!0});break}X+=z.decode(W,{stream:!0})}X+=z.decode()}finally{try{await Z.cancel()}catch{}Z.releaseLock()}return X}async function F($,Q={}){let Z=Bun.spawn({cmd:[...$],stdout:"pipe",stderr:"pipe",env:Q.env?{...process.env,...Q.env}:process.env,cwd:Q.cwd}),z,X;if(Q.timeoutMs&&Q.timeoutMs>0)z=setTimeout(()=>{try{Z.kill("SIGTERM")}catch{}X=setTimeout(()=>{try{Z.kill("SIGKILL")}catch{}},2000)},Q.timeoutMs);try{let[q,K,W]=await Promise.all([f1(Z.stdout),new Response(Z.stderr).text(),Z.exited]);return{stdout:q,stderr:K,exitCode:W}}finally{if(z)clearTimeout(z);if(X)clearTimeout(X)}}async function x8($,Q={}){let Z=await F($,Q);if(Z.exitCode!==0)throw new Q1(`command failed (${Z.exitCode}): ${$.join(" ")}`,Z.exitCode,Z.stdout,Z.stderr);return Z}async function f($){let Q=E8($),Z=await F(["sh","-c",`command -v ${Q}`],{timeoutMs:5000});if(Z.exitCode===0)return Z.stdout.trim()||null;return null}function E8($){if(!/^[A-Za-z0-9._/-]+$/.test($))throw Error(`refused to shell-escape suspect token: ${$}`);return $}async function N8($,Q="--version"){if(!await f($))return null;let z=await F([$,Q],{timeoutMs:5000});if(z.exitCode!==0)return null;return((z.stdout||z.stderr).split(/\r?\n/)[0]?.trim()??"")||null}var m1=16777216,Q1;var d=L(()=>{Q1=class Q1 extends Error{message;exitCode;stdout;stderr;constructor($,Q,Z,z){super($);this.message=$;this.exitCode=Q;this.stdout=Z;this.stderr=z;this.name="ShellError"}}});function r($){return S8?"":$}var S8,T,S,_,lZ,I,k,y,J;var c=L(()=>{S8=(process.env.NO_COLOR??"").length>0;T=r("\x1B[0;31m"),S=r("\x1B[0;32m"),_=r("\x1B[1;33m"),lZ=r("\x1B[0;34m"),I=r("\x1B[0;36m"),k=r("\x1B[1m"),y=r("\x1B[2m"),J=r("\x1B[0m")});import{existsSync as u8}from"fs";async function Z$(){if(A$!==void 0)return A$;let $="/opt/homebrew/bin/python3.12";if(u8($))return A$=$,$;let Q=await f("python3.12");if(Q)return A$=Q,Q;let Z=await f("python3");return A$=Z,Z}async function z$($,Q={}){let Z=await Z$();if(!Z)return{stdout:"",stderr:"python3 not found",exitCode:127};return F([Z,"-c",$],Q)}var A$;var V$=L(()=>{d()});var q0={};b(q0,{runStatus:()=>W3});import{existsSync as v,readFileSync as U$,readdirSync as i1,statSync as e1}from"fs";import{resolve as D,basename as $3}from"path";import{homedir as Q3}from"os";function $0($){let Q=Math.trunc($);if(Q>=1e6)return`${(Math.trunc(Q/1e6*10)/10).toFixed(1)}M`;if(Q>=1000)return`${(Math.trunc(Q/1000*10)/10).toFixed(1)}K`;return String(Q)}function Q0($,Q,Z){if(Q===0)return null;let z=Math.trunc($*100/Q),X=Math.trunc($*D$/Q);if(X>D$)X=D$;let q=D$-X,K=S;if(z>=80)K=T;else if(z>=50)K=_;let W="=".repeat(Math.max(0,X))+" ".repeat(Math.max(0,q)),V=$0($),U=$0(Q);return`  ${k}${Z}${J} ${K}[${W}]${J} ${z}% (${V} / ${U})`}async function z3(){if(await f("jq"))return!0;return process.stdout.write(`${T}Error: jq is required but not installed.${J}
 `),process.stdout.write(`Install with:
 `),process.stdout.write(`  brew install jq    (macOS)
 `),process.stdout.write(`  apt install jq     (Debian/Ubuntu)
@@ -802,4 +802,4 @@ Set LOKI_LEGACY_BASH=1 to force the bash CLI for every command.
 `),2}default:return process.stderr.write(`Unknown command: ${Q}
 `),process.stderr.write(Z8),2}}r1();process.on("SIGINT",()=>process.exit(130));process.on("SIGTERM",()=>process.exit(143));var FZ=await jZ(Bun.argv.slice(2));process.exit(FZ);
 
-//# debugId=9515D49AFAC4515364756E2164756E21
+//# debugId=BB4B923236A077B864756E2164756E21

package/mcp/__init__.py

@@ -57,4 +57,4 @@ try:
 except ImportError:
     __all__ = ['mcp']
 
-__version__ = '7.89.1'
+__version__ = '7.90.0'

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "loki-mode",
   "mcpName": "io.github.asklokesh/loki-mode",
-  "version": "7.89.1",
+  "version": "7.90.0",
   "description": "Loki Mode by Autonomi. Autonomous spec-to-product system: takes a PRD, GitHub issue, OpenAPI/JSON/YAML, or one-line brief to a deployed app via the RARV-C closure loop with 8 quality gates. Provider-agnostic (Claude Code, OpenAI Codex, Cline, Aider).",
   "keywords": [
     "agent",

package/plugins/loki-mode/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "loki-mode",
   "displayName": "Loki Mode",
-  "version": "7.89.1",
+  "version": "7.90.0",
   "description": "Autonomous spec-to-product build system with a built-in trust layer (RARV-C closure loop, 8 quality gates, completion council). Ships Loki's spec-hardening, drift-detection, and deterministic PR verification commands plus the Loki MCP server.",
   "author": {
     "name": "Autonomi",