loki-mode 8.0.3 → 8.2.0

package/autonomy/lib/fast_verify.py

@@ -0,0 +1,346 @@
+#!/usr/bin/env python3
+"""fast_verify -- millisecond-scale deterministic verification.
+
+WHY THIS EXISTS
+    Verification that takes minutes does not scale and cannot be embedded. To be
+    pluggable -- into an IDE, an MCP tool, a CI step, or another vendor's agent --
+    a verdict has to come back in the time a human would wait for a keystroke,
+    not a coffee break.
+
+    MEASURED BASELINE on this repo before this module:
+        tests/detect-mock-problems.sh    11,040 ms
+        tests/detect-test-mutations.sh   12,361 ms
+
+    The work itself is not slow. The ARCHITECTURE was:
+      1. FOUR separate full-tree `find` walks in one detector (one walk = 110 ms).
+      2. ~25 subprocess spawns at ~24 ms each of pure interpreter startup.
+      3. Every detector re-discovering the same file set independently.
+
+    `git ls-files` returns the same set in 37 ms, already deduplicated and
+    already gitignore-aware. So the fix is not "optimize the shell" -- it is to
+    stop paying discovery and process tax N times.
+
+THE FIVE DESIGN RULES
+    A. SINGLE PASS      - walk once, classify once, hand each detector its slice.
+    B. ZERO SUBPROCESS  - detectors are pure functions in ONE process. Startup is
+                          paid once, not 25 times.
+    C. CONTENT-ADDRESSED- cache each file's findings by content hash. An unchanged
+                          file is never re-read. Warm runs approach cache-read cost.
+    D. DIFF-SCOPED      - verifying a change needs the changed files, not the repo.
+    E. EXOGENOUS ONLY   - no LLM on this path, ever. Only checks the agent cannot
+                          author or influence: deterministic, reproducible, and
+                          therefore trustworthy. That constraint is what makes the
+                          fast path both fast AND the thing worth trusting.
+
+WHAT THIS DELIBERATELY DOES NOT DO
+    It does not run the test suite, call a model, or render judgment. Those are
+    slower and, in the case of model judgment, not exogenous. This module answers
+    only the question a machine can answer deterministically, which is exactly the
+    question worth answering in milliseconds.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import os
+import re
+import subprocess
+import sys
+import time
+from dataclasses import dataclass, field, asdict
+from pathlib import Path
+from typing import Iterable
+
+SCHEMA_VERSION = 1
+
+# Source extensions worth scanning. Anything else is discovery noise.
+CODE_EXT = {".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs", ".py", ".go", ".rs", ".rb", ".java", ".sh"}
+TEST_RE = re.compile(r"(^|/)(test_[^/]+\.py|[^/]+\.(test|spec)\.(ts|tsx|js|jsx|mjs|cjs))$")
+
+# Excluded even when git tracks them: vendored or generated trees produce findings
+# nobody can act on, and scanning them is pure latency.
+EXCLUDE_RE = re.compile(r"(^|/)(node_modules|dist|build|vendor|\.venv|coverage|__pycache__)(/|$)")
+
+
+# --- Findings ---------------------------------------------------------------
+
+@dataclass
+class Finding:
+    rule: str
+    path: str
+    line: int
+    message: str
+    severity: str = "high"
+
+
+@dataclass
+class Result:
+    verdict: str                      # PASS | FAIL | INCONCLUSIVE
+    findings: list = field(default_factory=list)
+    files_scanned: int = 0
+    files_from_cache: int = 0
+    elapsed_ms: float = 0.0
+    schema_version: int = SCHEMA_VERSION
+    exogenous: bool = True            # never set False; this path admits no LLM
+
+
+# --- Rule A: mock data rendered as if it were real ---------------------------
+# A UI that maps over a hardcoded array and renders it is the "Potemkin
+# interface" failure -- it looks finished and is not wired to anything.
+
+_INLINE_COLLECTION = re.compile(
+    r"""(?:const|let|var)\s+(\w+)\s*=\s*\[\s*\{""", re.M)
+_RENDER_MAP = re.compile(r"""\{?\s*(\w+)\s*(?:\?\.)?\.map\s*\(""")
+_FETCHY = re.compile(r"\b(fetch|axios|useQuery|useSWR|supabase|prisma|createClient)\b")
+
+# Names that are legitimately static content, not stand-ins for a backend.
+_STATIC_OK = re.compile(
+    r"^(features?|benefits?|faqs?|steps?|tabs?|nav|navigation|menu|links?|routes?|"
+    r"columns?|options?|plans?|pricing|tiers?|testimonials?|stats?|socials?|icons?)$",
+    re.I)
+
+
+def _rule_mock_render(path: str, text: str) -> list:
+    out = []
+    if not text or "[" not in text:
+        return out
+    declared = {}
+    for m in _INLINE_COLLECTION.finditer(text):
+        declared[m.group(1)] = text[:m.start()].count("\n") + 1
+    if not declared:
+        return out
+    # A real data source in the same file means the array is plausibly a fallback,
+    # not the product. Stay quiet rather than cry wolf: a false BLOCK on a correct
+    # build is worse than a missed warning, because it trains users to ignore us.
+    if _FETCHY.search(text):
+        return out
+    for m in _RENDER_MAP.finditer(text):
+        name = m.group(1)
+        if name in declared and not _STATIC_OK.match(name):
+            out.append(Finding(
+                rule="mock_render",
+                path=path,
+                line=declared[name],
+                message=(f"'{name}' is a hardcoded collection rendered directly; "
+                         "no data source found in this file"),
+            ))
+    return out
+
+
+# --- Rule B: tests that cannot fail ------------------------------------------
+# A test with no assertion is worse than no test: it turns a green suite into a
+# false claim, which is precisely the lie this product exists to prevent.
+
+_SKIPPED = re.compile(r"\b(it|test|describe)\.(skip|todo)\s*\(|@(unittest\.)?skip\b")
+_HAS_ASSERT = re.compile(r"\b(expect|assert|should|chai|sinon\.assert)\b")
+_TEST_BLOCK = re.compile(r"""\b(?:it|test)\s*\(\s*['"`]([^'"`]{1,120})['"`]""")
+
+
+def _rule_toothless_test(path: str, text: str) -> list:
+    out = []
+    if not text:
+        return out
+    for m in _SKIPPED.finditer(text):
+        out.append(Finding(
+            rule="skipped_test", path=path,
+            line=text[:m.start()].count("\n") + 1,
+            message="test is skipped; it cannot fail and cannot verify anything",
+            severity="medium",
+        ))
+    blocks = list(_TEST_BLOCK.finditer(text))
+    for i, m in enumerate(blocks):
+        end = blocks[i + 1].start() if i + 1 < len(blocks) else len(text)
+        body = text[m.end():end]
+        if not _HAS_ASSERT.search(body):
+            out.append(Finding(
+                rule="assertionless_test", path=path,
+                line=text[:m.start()].count("\n") + 1,
+                message=f"test '{m.group(1)[:60]}' contains no assertion; it always passes",
+            ))
+    return out
+
+
+RULES = (_rule_mock_render, _rule_toothless_test)
+
+
+# --- Discovery: one pass, from the git index ---------------------------------
+
+def _git(args: list, cwd: str) -> str:
+    try:
+        p = subprocess.run(["git"] + args, cwd=cwd, capture_output=True,
+                           text=True, timeout=20)
+        return p.stdout if p.returncode == 0 else ""
+    except (OSError, subprocess.SubprocessError):
+        return ""
+
+
+def discover(root: str, diff_base: str = "") -> list:
+    """Return candidate files. ONE listing, no per-detector walk.
+
+    `git ls-files` beats `find` on every axis that matters here: it reads the
+    index instead of stat-ing the tree (37 ms vs 110 ms measured), it is already
+    gitignore-aware, and it never descends into node_modules. When a diff base is
+    given we narrow further -- verifying a change does not require reading the
+    repository.
+    """
+    if diff_base:
+        raw = _git(["diff", "--name-only", diff_base + "...HEAD"], root)
+        if not raw.strip():
+            raw = _git(["diff", "--name-only", diff_base], root)
+    else:
+        raw = _git(["ls-files"], root)
+
+    if not raw:
+        # Not a git repo (or an empty one): fall back to a single os.walk. Still
+        # one pass -- the guarantee holds even off the happy path.
+        files = []
+        for dirpath, dirnames, filenames in os.walk(root):
+            dirnames[:] = [d for d in dirnames
+                           if not EXCLUDE_RE.search(d) and not d.startswith(".")]
+            for fn in filenames:
+                rel = os.path.relpath(os.path.join(dirpath, fn), root)
+                if Path(fn).suffix in CODE_EXT and not EXCLUDE_RE.search(rel):
+                    files.append(rel)
+        return files
+
+    return [ln for ln in raw.splitlines()
+            if ln and Path(ln).suffix in CODE_EXT and not EXCLUDE_RE.search(ln)]
+
+
+# --- Content-addressed cache -------------------------------------------------
+
+class Cache:
+    """Findings keyed by content hash, so unchanged files are never re-read.
+
+    Correctness note: the key is the file's CONTENT, not its path or mtime. A
+    file that moves keeps its result; a file that changes gets a new key. There
+    is no staleness window to reason about, which is what makes it safe to trust
+    a cache hit as if the scan had just run.
+    """
+
+    def __init__(self, path: str):
+        self.path = path
+        self.data = {}
+        self.hits = 0
+        try:
+            with open(path, encoding="utf-8") as fh:
+                blob = json.load(fh)
+            if isinstance(blob, dict) and blob.get("schema") == SCHEMA_VERSION:
+                self.data = blob.get("entries", {})
+        except (OSError, ValueError):
+            self.data = {}
+
+    def get(self, key: str):
+        v = self.data.get(key)
+        if v is not None:
+            self.hits += 1
+        return v
+
+    def put(self, key: str, findings: list) -> None:
+        self.data[key] = findings
+
+    def save(self) -> None:
+        try:
+            os.makedirs(os.path.dirname(self.path), exist_ok=True)
+            tmp = self.path + ".tmp"
+            with open(tmp, "w", encoding="utf-8") as fh:
+                json.dump({"schema": SCHEMA_VERSION, "entries": self.data}, fh)
+            os.replace(tmp, self.path)
+        except OSError:
+            pass  # a cache that cannot be written must never break a verdict
+
+
+# --- The entry point ---------------------------------------------------------
+
+def verify(root: str = ".", diff_base: str = "", use_cache: bool = True) -> Result:
+    t0 = time.perf_counter()
+    root = os.path.abspath(root)
+    cache = Cache(os.path.join(root, ".loki", "cache", "fast-verify.json")) if use_cache else None
+
+    findings = []
+    scanned = 0
+
+    for rel in discover(root, diff_base):
+        full = os.path.join(root, rel)
+        try:
+            with open(full, "rb") as fh:
+                raw = fh.read()
+        except OSError:
+            continue
+        scanned += 1
+
+        key = hashlib.blake2b(raw, digest_size=16).hexdigest()
+        if cache is not None:
+            hit = cache.get(key)
+            if hit is not None:
+                for d in hit:
+                    findings.append(Finding(**{**d, "path": rel}))
+                continue
+
+        try:
+            text = raw.decode("utf-8", errors="replace")
+        except Exception:
+            continue
+
+        is_test = bool(TEST_RE.search(rel))
+        got = []
+        for rule in RULES:
+            # Rule B is about tests; rule A is about product code. Running each
+            # only where it applies is not just faster, it removes a whole class
+            # of false positive.
+            if rule is _rule_toothless_test and not is_test:
+                continue
+            if rule is _rule_mock_render and is_test:
+                continue
+            got.extend(rule(rel, text))
+
+        if cache is not None:
+            cache.put(key, [{k: v for k, v in asdict(f).items() if k != "path"} for f in got])
+        findings.extend(got)
+
+    if cache is not None:
+        cache.save()
+
+    blocking = [f for f in findings if f.severity == "high"]
+    verdict = "FAIL" if blocking else ("PASS" if scanned else "INCONCLUSIVE")
+
+    return Result(
+        verdict=verdict,
+        findings=[asdict(f) for f in findings],
+        files_scanned=scanned,
+        files_from_cache=(cache.hits if cache else 0),
+        elapsed_ms=round((time.perf_counter() - t0) * 1000, 2),
+    )
+
+
+def main(argv: list) -> int:
+    root, base, use_cache, as_json = ".", "", True, False
+    i = 0
+    while i < len(argv):
+        a = argv[i]
+        if a == "--diff-base" and i + 1 < len(argv):
+            base = argv[i + 1]; i += 1
+        elif a == "--no-cache":
+            use_cache = False
+        elif a == "--json":
+            as_json = True
+        elif not a.startswith("-"):
+            root = a
+        i += 1
+
+    r = verify(root, base, use_cache)
+    if as_json:
+        print(json.dumps(asdict(r), indent=2))
+    else:
+        print(f"{r.verdict} in {r.elapsed_ms}ms "
+              f"({r.files_scanned} files, {r.files_from_cache} cached)")
+        for f in r.findings[:20]:
+            print(f"  [{f['severity']}] {f['rule']} {f['path']}:{f['line']} - {f['message']}")
+        if len(r.findings) > 20:
+            print(f"  ... and {len(r.findings) - 20} more")
+    return 1 if r.verdict == "FAIL" else 0
+
+
+if __name__ == "__main__":
+    sys.exit(main(sys.argv[1:]))

package/autonomy/lib/no_mock_scan.py

@@ -7,6 +7,7 @@ import hashlib
 import json
 import os
 import re
+import sys
 from dataclasses import dataclass
 from pathlib import Path
 from typing import Iterable
@@ -753,7 +754,26 @@ def scan(files: list[str], tree: Path) -> tuple[int, dict[str, object] | None]:
 
 
 def main() -> int:
-    files = [line.strip() for line in os.environ.get("_NM_FILES", "").splitlines() if line.strip()]
+    # Transport: stdin first, _NM_FILES as fallback. An env string is capped at
+    # MAX_ARG_STRLEN (131071 bytes) on Linux, so a large changed-file list makes
+    # execve fail with E2BIG -- the caller then captures its own
+    # "INCONCLUSIVE:detector_error" fallback and the gate silently passes
+    # through. macOS has no per-string cap, which is why that failure was
+    # Linux-only. stdin has no such limit.
+    # Read defensively: a caller may close stdin (sys.stdin is then None) or
+    # hand over a tty. Either way fall back to the env var rather than raising,
+    # because an uncaught error here reads to the caller as
+    # "INCONCLUSIVE:detector_error" -- the exact silent pass-through this
+    # transport change exists to remove.
+    raw = ""
+    try:
+        if sys.stdin is not None and not sys.stdin.isatty():
+            raw = sys.stdin.read()
+    except (OSError, ValueError):
+        raw = ""
+    if not raw.strip():
+        raw = os.environ.get("_NM_FILES", "")
+    files = [line.strip() for line in raw.splitlines() if line.strip()]
     tree = Path(os.environ.get("_NM_TREE", ".")).resolve()
     output = os.environ.get("_NM_OUT", "")
     scanned, hit = scan(files, tree)

package/autonomy/lib/prd-enrich.sh

@@ -97,8 +97,14 @@ _loki_prd_enrich_invoke() {
 # Decide whether enrichment should even be attempted. Returns 0 (attempt)
 # only when the active provider is claude and not in degraded mode.
 _loki_prd_enrich_provider_ok() {
-    [ "${LOKI_PROVIDER:-claude}" = "claude" ] || return 1
     [ "${PROVIDER_DEGRADED:-false}" != "true" ] || return 1
+    # v8.2.0: capability, not identity. A provider exposing the timeout-able
+    # argv seam can run enrichment regardless of which CLI it is. Mirrors
+    # _loki_done_recog_provider_ok (autonomy/lib/done-recognition.sh).
+    if type provider_invoke_argv >/dev/null 2>&1; then
+        return 0
+    fi
+    [ "${LOKI_PROVIDER:-claude}" = "claude" ] || return 1
     # v8: the raw-SDK enrich path (LOKI_SDK_PRD_ENRICH=1) needs no claude binary,
     # so attempt is viable when that path is usable (bridge + bun). The invoke fn
     # still fails closed to claude on an SDK miss.
@@ -224,6 +230,11 @@ loki_prd_enrich() {
     # improve tasks deterministically (content-derived user_story) so even
     # offline users get informative tasks, then return without a model call.
     if ! _loki_prd_enrich_provider_ok; then
+        # HONESTY: say so. This used to degrade to the deterministic path with no
+        # log line at all, so a user on a non-Claude provider believed their PRD
+        # had been model-enriched when it had not. A capability the run did not
+        # get must never be indistinguishable from one it did.
+        log_warn "PRD enrichment: model-assisted pass SKIPPED (provider='${LOKI_PROVIDER:-claude}'), using the deterministic pass only."
         _loki_prd_enrich_deterministic "$pending_path"
         return 0
     fi

package/autonomy/lib/proof-generator.py

@@ -243,6 +243,70 @@ def _norm_gate_status(raw):
     return "inconclusive"
 
 
+# TRUST-4: gate provenance. The discriminating property of a verification signal
+# is NOT how many checks ran -- it is whether the checker sits OUTSIDE the agent's
+# control. arXiv 2606.28438 shows AI-self-gates "look strong early but later lose
+# their filtering effect", drifting into "a rubber-stamp regime where acceptance
+# scores rise while benchmark correctness falls". arXiv 2607.05904 shows a judge
+# conditioned on a candidate "scores plausibility, not correctness": self-play
+# drove judge pass rate 0.72 -> 0.94 while TRUE accuracy stayed 0.20, and "a
+# strict three-judge ensemble still accepts 55% of them". So a model-coupled gate
+# is REPORTED but may never lift the headline.
+#
+# ADVISORY = the agent (or a model it prompts) authored the verdict. Everything
+# else is EXOGENOUS: a deterministic script whose output the agent cannot write.
+#
+# Membership is keyed on the ADVISORY side only, and an UNKNOWN gate defaults to
+# EXOGENOUS. That direction is load-bearing and must never be inverted: an
+# unrecognized gate then still counts against VERIFIED (fail-closed). Defaulting
+# unknown gates to advisory would let any newly-added or renamed gate silently
+# lose its power to block -- the exact fake-green vector this split exists to
+# close. Names are matched on a normalized key because run.sh emits BOTH
+# spellings for the same gate (static-analysis / static_analysis, test-mutation /
+# mutation_integrity), verified against run.sh's gate_failures writers.
+_ADVISORY_GATES = frozenset((
+    # The agent writes both the test and the fix, so a green suite is a claim
+    # about its own work, not an independent measurement.
+    "test_coverage", "unit_tests", "test_suite", "semantic_tests", "tests",
+    # LLM-judgment gates: blind council, devil's advocate, magic-module debate.
+    "code_review", "devils_advocate", "devil_advocate", "magic_debate",
+    "council", "anti_sycophancy",
+))
+
+
+def _gate_key(name):
+    """Normalize a gate name for provenance lookup.
+
+    run.sh emits the same gate under multiple spellings (`static-analysis` vs
+    `static_analysis`), and track_gate_failure appends `_PAUSED`/`_ESCALATED`
+    /`_not_run` suffixes. Fold all of them onto one key so classification cannot
+    be defeated by a cosmetic rename.
+    """
+    s = str(name or "").strip().lower().replace("-", "_")
+    s = re.sub(r"_(paused|escalated|not_run|blocked)$", "", s)
+    return s
+
+
+def _gate_provenance(name):
+    """'advisory' for a model-authored gate, else 'exogenous' (fail-closed)."""
+    return "advisory" if _gate_key(name) in _ADVISORY_GATES else "exogenous"
+
+
+def _is_exogenous(gate):
+    """Provenance of a collected gate dict, honoring the stamped value.
+
+    Reads the `provenance` key stamped by _collect_quality_gates so the
+    `unresolved` override (a gate that HALTED the run counts as an execution
+    fact) is respected. Falls back to name lookup for a gate dict that never
+    passed through the collector. Fail-closed: anything not positively
+    identified as advisory counts as exogenous.
+    """
+    stamped = gate.get("provenance")
+    if stamped:
+        return stamped == "exogenous"
+    return _gate_provenance(gate.get("name")) == "exogenous"
+
+
 def _collect_quality_gates(loki_dir):
     gates_raw = _read_json(
         os.path.join(loki_dir, "state", "quality-gates.json"), default=None
@@ -354,14 +418,48 @@ def _collect_quality_gates(loki_dir):
         for name in failed_names:
             if name in by_name:
                 by_name[name]["status"] = "failed"
+                by_name[name]["unresolved"] = True
             else:
-                gate = {"name": name, "status": "failed"}
+                gate = {"name": name, "status": "failed", "unresolved": True}
                 gates.append(gate)
                 by_name[name] = gate
 
+    # TRUST-4: stamp provenance on every gate at the single point the list is
+    # finalized, so every downstream reader (headline, template, verifier) sees
+    # the same classification and none can drift.
+    # An UNRESOLVED gate (listed in gate-failures.txt) is classified EXOGENOUS
+    # even when the gate itself is model-coupled. The fact being recorded is not
+    # "a judge disliked the code" -- it is "the run halted here and never
+    # cleared this blocker", which is an execution outcome the agent did not
+    # author. Without this, a run stopped dead by an unresolved code_review
+    # would emit a green receipt: the "cryptographically valid but semantically
+    # false green" the gate-failures merge above exists to prevent.
+    for gate in gates:
+        gate["provenance"] = (
+            "exogenous" if gate.get("unresolved")
+            else _gate_provenance(gate.get("name"))
+        )
+
     total = len(gates)
     passed = sum(1 for gate in gates if gate.get("status") == "passed")
-    return {"passed": passed, "total": total, "gates": gates}
+    exo = [g for g in gates if g.get("provenance") == "exogenous"]
+    adv = [g for g in gates if g.get("provenance") == "advisory"]
+    return {
+        "passed": passed,
+        "total": total,
+        "gates": gates,
+        # Pre-split counts so the renderer never has to re-derive provenance.
+        "exogenous": {
+            "passed": sum(1 for g in exo if g.get("status") == "passed"),
+            "total": len(exo),
+            "gates": exo,
+        },
+        "advisory": {
+            "passed": sum(1 for g in adv if g.get("status") == "passed"),
+            "total": len(adv),
+            "gates": adv,
+        },
+    }
 
 
 def _collect_build(loki_dir):
@@ -429,6 +527,19 @@ def _collect_termination(loki_dir, session_exit_code=None):
         "exit_code": None,
         "outcome": "",
         "run_status": "",
+        # Which gate stopped the run, if one did. The receipt previously named
+        # only a bare outcome ("intervention"), so a user reading the artifact
+        # could not tell WHICH gate blocked them or how close it came to its
+        # threshold -- the single most actionable fact about a blocked run. The
+        # engine already writes it to .loki/signals/GATE_ESCALATION.json and
+        # already surfaces it in COMPLETION.txt and PAUSED.md; the signed
+        # receipt was the one surface that stayed silent.
+        #
+        # These are deterministic FACTS read from a file the engine wrote, not
+        # an AI assessment, so they belong in the facts block.
+        "blocking_gate": "",
+        "blocking_gate_failures": None,
+        "blocking_gate_threshold": None,
     }
     state_paths = [os.path.join(loki_dir, "autonomy-state.json")]
     sessions_dir = os.path.join(loki_dir, "sessions")
@@ -455,6 +566,20 @@ def _collect_termination(loki_dir, session_exit_code=None):
             out["status"] = outcome
             if outcome not in ("complete", "completed", "success"):
                 out["reason"] = outcome
+    # Gate escalation: name the gate that stopped the run. Best-effort and
+    # non-fatal -- a missing or corrupt signal simply leaves the fields empty,
+    # which reads as "no gate escalation recorded", never as a false claim.
+    gate = _read_json(
+        os.path.join(loki_dir, "signals", "GATE_ESCALATION.json"), default=None
+    )
+    if isinstance(gate, dict):
+        gate_name = str(gate.get("gate") or "").strip()
+        if gate_name:
+            out["blocking_gate"] = gate_name
+            count = gate.get("count")
+            thr = gate.get("threshold")
+            out["blocking_gate_failures"] = _to_int(count, None)
+            out["blocking_gate_threshold"] = _to_int(thr, None)
     if session_exit_code is not None:
         out["exit_code"] = session_exit_code
         if session_exit_code != 0 and not out["reason"]:
@@ -1005,8 +1130,18 @@ def _build_proof(args, loki_dir, target_dir, repo_root):
         "execution": termination,
         "build": build,
         "tests": tests,
+        # TRUST-4: carry `provenance` into the facts projection. _compute_headline
+        # and _compute_degraded read THIS list, so dropping the field silently
+        # sent them back to name-only lookup -- which mis-classified an
+        # UNRESOLVED code_review (a run-halting execution fact) as advisory and
+        # green-washed a blocked run.
         "quality_gates": [
-            {"name": g.get("name", ""), "status": g.get("status", "not_run")}
+            {
+                "name": g.get("name", ""),
+                "status": g.get("status", "not_run"),
+                "provenance": g.get("provenance")
+                or _gate_provenance(g.get("name")),
+            }
             for g in (quality_gates.get("gates") or [])
         ],
         "security": security,
@@ -1170,8 +1305,14 @@ def _compute_degraded(facts):
             else ("exit_code=%s" % build.get("exit_code"))
         out.append({"item": "build", "status": build.get("status"),
                     "reason": reason})
+    # TRUST-4: only EXOGENOUS gates enter the degraded ledger, because degraded[]
+    # is an INPUT to the headline (a non-empty ledger blocks VERIFIED). Letting an
+    # advisory gate in here would give a model-authored verdict the power to
+    # downgrade the headline through the back door, which is exactly what this
+    # split forbids. Advisory outcomes are still reported in full -- they render
+    # from quality_gates.advisory, which the template shows verbatim.
     for g in facts.get("quality_gates") or []:
-        if g.get("status") in weak:
+        if g.get("status") in weak and _is_exogenous(g):
             out.append({"item": "quality_gate:%s" % g.get("name", ""),
                         "status": g.get("status"),
                         "reason": "gate %s" % g.get("status")})
@@ -1262,12 +1403,21 @@ def _compute_headline(facts, degraded):
             and execution_outcome not in ("complete", "completed", "success")
         )
     )
+    # TRUST-4: only an EXOGENOUS gate failure forces NOT VERIFIED. An advisory
+    # (model-authored) gate is reported but cannot move the verdict in EITHER
+    # direction -- see _ADVISORY_GATES for the research basis. Note the
+    # asymmetry is deliberate and one-way: advisory results are barred from
+    # UPGRADING a verdict (below, in any_verified), and barred from downgrading
+    # one here, because a judge that scores plausibility is not a measurement.
+    # tests.status keeps its own hard-fail check: it is the recorded suite
+    # outcome (an exit code), not the model's opinion of the suite.
     any_failed = (
         execution_failed
         or tests.get("status") == "failed"
         or build.get("status") == "failed"
         or any(g.get("status") == "failed"
-               for g in (facts.get("quality_gates") or []))
+               for g in (facts.get("quality_gates") or [])
+               if _is_exogenous(g))
         or sec_high
         or fn_failed
     )
@@ -1288,11 +1438,15 @@ def _compute_headline(facts, degraded):
     # produced code emit "VERIFIED WITH GAPS" - a fake-green at the receipt. Only
     # a fact that actually ran and passed (tests/build verified, or a passed gate)
     # may qualify; otherwise the honest headline is NOT VERIFIED.
+    # TRUST-4: an advisory PASS is not positive evidence. A run whose ONLY green
+    # signals are a council vote and a devil's-advocate nod has proven nothing
+    # deterministically, so it must not reach "VERIFIED WITH GAPS" on that basis.
     any_verified = (
         tests.get("status") == "verified"
         or build.get("status") == "verified"
         or any(g.get("status") == "passed"
-               for g in (facts.get("quality_gates") or []))
+               for g in (facts.get("quality_gates") or [])
+               if _is_exogenous(g))
     )
     if any_verified and degraded:
         return "VERIFIED WITH GAPS"
@@ -1454,6 +1608,19 @@ def _render_fallback_html(proof):
     ver = proof.get("verification", {})
     rows.append('<p class="hash">Integrity hash (%s): %s</p>' % (
         esc(ver.get("algo", "sha256")), esc(ver.get("hash", ""))))
+    # Signing state, stated plainly. Mirrors renderProvenance in
+    # proof-template.html (the primary renderer); this fallback path must not
+    # be quieter about provenance than the page it stands in for.
+    if ver.get("gpg_signature"):
+        rows.append("<p>Signature: SIGNED (detached GPG over the canonical "
+                    "bytes). A verifier holding the signer public key can "
+                    "confirm provenance offline: loki proof verify &lt;id&gt;</p>")
+    else:
+        rows.append("<p>Signature: UNSIGNED. The integrity hash proves the "
+                    "bytes were not edited after hashing; it does NOT prove "
+                    "who produced them, so this receipt trusts its generator. "
+                    "To sign future receipts, set LOKI_PROOF_GPG_KEY to a gpg "
+                    "key id (see docs/SIGNED-RECEIPTS.md).</p>")
     red = proof.get("redaction", {})
     rows.append("<p>Redaction applied: %s (%s redactions, rules v%s)</p>" % (
         esc(red.get("applied")), esc(red.get("redactions_count")),