loki-mode 8.0.3 → 8.2.0

package/autonomy/lib/proof-template.html

@@ -640,6 +640,23 @@
                 ? " (" + esc(tOutcome) + ")" : "") +
              "</div>";
     }
+    // Name the GATE that stopped the run, with how close it came to its
+    // threshold. "intervention" tells a reader that something blocked them;
+    // "code_review (failed 3 times, threshold 3)" tells them what to fix. The
+    // engine already surfaced this in COMPLETION.txt and PAUSED.md -- the
+    // signed receipt was the only surface that stayed silent about it.
+    // Display-only, and silent when no gate escalation was recorded.
+    var tGate = String(g(p, "facts.execution.blocking_gate", "") || "").trim();
+    if (tGate) {
+      var gFail = g(p, "facts.execution.blocking_gate_failures", null);
+      var gThr = g(p, "facts.execution.blocking_gate_threshold", null);
+      var detail = "";
+      if (typeof gFail === "number" && typeof gThr === "number") {
+        detail = " (failed " + esc(String(gFail)) + " times, threshold " +
+                 esc(String(gThr)) + ")";
+      }
+      term += '<div class="h-sub">Blocked by: ' + esc(tGate) + detail + "</div>";
+    }
     el.className = "honesty " + v.cls;
     el.innerHTML =
       '<span class="h-mark" aria-hidden="true">' + v.mark + "</span>" +
@@ -1100,6 +1117,24 @@
     card.innerHTML = (head ? '<div style="margin-bottom:14px;">' + head + "</div>" : "") + body + link;
   }
 
+  // Render one row of gate chips. Shared by the exogenous and advisory blocks.
+  function gateChips(gates) {
+    var chips = "";
+    if (!Array.isArray(gates)) return "";
+    for (var i = 0; i < gates.length; i++) {
+      var st = String(g(gates[i], "status", "")).toLowerCase();
+      var cls = (st === "pass" || st === "passed") ? "pass" : (st === "skip" || st === "skipped") ? "skip" : "fail";
+      var mark = cls === "pass" ? "OK" : cls === "skip" ? "-" : "X";
+      chips += '<span class="gate ' + cls + '"><span class="mk">' + mark + "</span>" +
+               esc(g(gates[i], "name", "gate")) + "</span>";
+    }
+    return chips ? '<div class="gates">' + chips + "</div>" : "";
+  }
+
+  // TRUST-4: quality gates split by PROVENANCE, not by outcome. The two blocks
+  // read from quality_gates.exogenous / quality_gates.advisory, the exact field
+  // names proof-generator.py writes. Falls back to the flat pre-split list so an
+  // older receipt still renders.
   function renderGates(p) {
     var sec = document.getElementById("secGates");
     var card = document.getElementById("gatesCard");
@@ -1110,18 +1145,34 @@
       sec.classList.add("hide");
       return;
     }
-    var head = '<p class="note" style="margin:0 0 12px;">' + passed + " of " + total + " gates passed.</p>";
-    var chips = "";
-    if (Array.isArray(gates)) {
-      for (var i = 0; i < gates.length; i++) {
-        var st = String(g(gates[i], "status", "")).toLowerCase();
-        var cls = (st === "pass" || st === "passed") ? "pass" : (st === "skip" || st === "skipped") ? "skip" : "fail";
-        var mark = cls === "pass" ? "OK" : cls === "skip" ? "-" : "X";
-        chips += '<span class="gate ' + cls + '"><span class="mk">' + mark + "</span>" +
-                 esc(g(gates[i], "name", "gate")) + "</span>";
-      }
+    var exo = g(p, "quality_gates.exogenous", null);
+    var adv = g(p, "quality_gates.advisory", null);
+    if (!exo && !adv) {
+      // Pre-TRUST-4 receipt: render the flat list exactly as before.
+      card.innerHTML = '<p class="note" style="margin:0 0 12px;">' + passed +
+        " of " + total + " gates passed.</p>" + gateChips(gates);
+      return;
     }
-    card.innerHTML = head + (chips ? '<div class="gates">' + chips + "</div>" : "");
+    var html = "";
+    var eg = g(exo, "gates", []);
+    if (Array.isArray(eg) && eg.length > 0) {
+      html += '<h3 style="margin:0 0 4px;font-size:14px;">Independent checks (count toward the verdict)</h3>' +
+        '<p class="note" style="margin:0 0 10px;">' +
+        num(g(exo, "passed", 0)) + " of " + num(g(exo, "total", 0)) +
+        " passed. These are deterministic programs the agent cannot write the " +
+        "result of, so only these set the verdict above.</p>" + gateChips(eg);
+    }
+    var ag = g(adv, "gates", []);
+    if (Array.isArray(ag) && ag.length > 0) {
+      html += '<h3 style="margin:18px 0 4px;font-size:14px;">Advisory checks (reported, not counted)</h3>' +
+        '<p class="opinion-note"><span aria-hidden="true">!</span>' +
+        num(g(adv, "passed", 0)) + " of " + num(g(adv, "total", 0)) +
+        " passed. These are the agent judging its own work (it wrote both the " +
+        "tests and the code, or a model graded the result), so a model that is " +
+        "confidently wrong scores itself green here. They are shown for context " +
+        "and can never raise or lower the verdict.</p>" + gateChips(ag);
+    }
+    card.innerHTML = html;
   }
 
   function renderFlagged(p) {
@@ -1187,9 +1238,23 @@
     if (hash) {
       kv += '<div class="k">Integrity hash</div><div class="v">' + esc(algo) + ":" + esc(hash) + "</div>";
     }
+    // Signing state, named explicitly. The hash-note below already says the
+    // hash does not prove provenance; without this row a reader is told what
+    // the receipt CANNOT do but never which state this particular receipt is
+    // in, nor how to change it. Signing is gated on LOKI_PROOF_GPG_KEY in
+    // proof-generator.py and is OFF by default -- deliberately, because a
+    // self-minted key would flip proof-verify.py's generator_trusted to false
+    // while the key came from the very process under audit.
+    var signed = !!g(p, "verification.gpg_signature", "");
+    kv += '<div class="k">Signature</div><div class="v">' +
+          (signed ? "SIGNED (detached GPG)" : "UNSIGNED") + "</div>";
+    var signNote = signed
+      ? '<p class="hash-note">This receipt carries a detached GPG signature over the same canonical bytes that were hashed. A verifier holding the signer public key can confirm its provenance offline with <code>loki proof verify</code>.</p>'
+      : '<p class="hash-note">This receipt is UNSIGNED, so it trusts the generator that produced it (<code>loki proof verify</code> reports <code>generator_trusted: true</code>). To sign future receipts, set <code>LOKI_PROOF_GPG_KEY</code> to a GPG key id before the run.</p>';
     card.innerHTML = '<div class="kv">' + kv + "</div>" +
       (hash ? '<p class="hash-note">The integrity hash is a ' + esc(algo) +
-              " digest of this proof. It proves the artifact has not been altered after it was emitted. It does not, by itself, prove who or what produced the work.</p>" : "");
+              " digest of this proof. It proves the artifact has not been altered after it was emitted. It does not, by itself, prove who or what produced the work.</p>" : "") +
+      signNote;
   }
 
   function renderCta(p) {

package/autonomy/lib/proof-verify.py

@@ -65,6 +65,7 @@ CLI:
 import hashlib
 import json
 import os
+import re
 import subprocess
 import sys
 
@@ -176,6 +177,57 @@ def _to_int(v, default=0):
 # headline re-derivation (MUST match proof-generator._compute_headline exactly)
 # ---------------------------------------------------------------------------
 
+# DRIFT-GUARD: mirrored from proof-generator.py. A gate the AGENT authored the
+# input to (it writes both the test and the fix) or that is an LLM judgment
+# cannot be independent evidence, so it must never force or lift a headline.
+# Keyed on the ADVISORY set so an unknown or renamed gate defaults to EXOGENOUS
+# and keeps its power to block -- fail-closed, never fail-open.
+#
+# This block exists because the generator gained a provenance split while this
+# file did not, and the two then disagreed about what a receipt meant. The
+# verifier is the INDEPENDENT re-derivation users are told to trust; if it
+# cannot reproduce the generator's headline, `loki proof verify` reports drift
+# on a receipt that was never tampered with -- a false alarm from our own trust
+# artifact, which is worse than no verifier at all.
+_ADVISORY_GATES = frozenset((
+    "test_coverage", "unit_tests", "test_suite", "semantic_tests", "tests",
+    "code_review", "devils_advocate", "devil_advocate", "magic_debate",
+    "council", "anti_sycophancy",
+))
+
+
+def _gate_key(name):
+    """Normalize a gate name for provenance lookup (mirrors the generator).
+
+    run.sh emits the same gate under multiple spellings (`static-analysis` vs
+    `static_analysis`) and track_gate_failure appends `_PAUSED`/`_ESCALATED`,
+    so an exact-match lookup would misfile real gates.
+    """
+    s = str(name or "").strip().lower().replace("-", "_")
+    return re.sub(r"_(paused|escalated|not_run|blocked)$", "", s)
+
+
+def _gate_provenance(name):
+    """'advisory' for a model-authored gate, else 'exogenous' (fail-closed)."""
+    return "advisory" if _gate_key(name) in _ADVISORY_GATES else "exogenous"
+
+
+def _is_exogenous(gate):
+    """Provenance of a gate dict, honoring a stamped value when present.
+
+    The generator stamps `provenance` so its `unresolved` override survives (a
+    gate that HALTED the run is an execution fact, not a model opinion). We
+    honor that stamp and fall back to name lookup for older receipts written
+    before the split existed.
+    """
+    if not isinstance(gate, dict):
+        return True
+    stamped = gate.get("provenance")
+    if stamped:
+        return stamped == "exogenous"
+    return _gate_provenance(gate.get("name")) == "exogenous"
+
+
 def _compute_headline(facts, degraded):
     """Deterministic headline re-derived from the recorded facts.
 

package/autonomy/loki

@@ -954,10 +954,20 @@ show_help() {
     echo "  # Providers + model routing"
     echo "  loki provider list            # Show 4 providers (claude/codex/cline/aider)"
     echo "  loki provider set codex       # Switch active provider"
-    echo "  # OpenRouter / Ollama routing (Phase I v7.5.25+):"
-    echo "  export ANTHROPIC_BASE_URL=https://openrouter.ai/api/v1 \\\\"
-    echo "         LOKI_MODEL_OVERRIDE=anthropic/claude-sonnet-4.5"
-    echo "  loki start ./prd.md           # Routes to OpenRouter via Claude Code"
+    echo "  # Cheap / open models (DeepSeek, GLM, MiniMax, Kimi) via OpenRouter:"
+    echo "  loki provider set aider       # aider + cline reach any OpenRouter model"
+    echo "  export OPENROUTER_API_KEY=sk-or-..."
+    echo "  loki start ./prd.md           # defaults to deepseek-v3.2 (open weights)"
+    echo "  # Pick a specific model:"
+    echo "  export LOKI_AIDER_MODEL=openrouter/z-ai/glm-4.6"
+    echo ""
+    echo "  # Anthropic-PROTOCOL gateways (LiteLLM, Bedrock proxies, self-hosted):"
+    echo "  export ANTHROPIC_BASE_URL=https://your-gateway/v1 \\\\"
+    echo "         LOKI_MODEL_OVERRIDE=<model-id-your-gateway-serves>"
+    echo "  # NOTE: this routes Claude Code itself, so the endpoint must speak the"
+    echo "  #       Anthropic /v1/messages API. OpenRouter does NOT -- it serves"
+    echo "  #       only the OpenAI-shaped /v1/chat/completions. Use the aider or"
+    echo "  #       cline route above for OpenRouter."
     echo ""
     echo "  # Cross-project context (Phase F v7.5.23+)"
     echo "  # Drop .loki/app.json with {schema_version:1,app_id:myapp,members:[ui,api]}"
@@ -3871,7 +3881,10 @@ cmd_why() {
     fi
 
     if [ "$as_json" = "1" ]; then
+        local _why_json_head_sha
+        _why_json_head_sha="$(git rev-parse HEAD 2>/dev/null || echo "")"
         _LOKI_WHY_STATE="$state_file" _LOKI_WHY_COMPLETION="$completion_file" \
+        _LOKI_WHY_HEAD_SHA="$_why_json_head_sha" \
         _LOKI_WHY_LAST_ERROR="$loki_dir/state/LAST_ERROR.json" python3 - <<'WHYJSON'
 import json, os
 def load(p):
@@ -3881,7 +3894,26 @@ def load(p):
 state = load(os.environ.get("_LOKI_WHY_STATE", ""))
 comp = load(os.environ.get("_LOKI_WHY_COMPLETION", ""))
 last_error = load(os.environ.get("_LOKI_WHY_LAST_ERROR", ""))
-print(json.dumps({"state": state, "completion": comp, "last_error": last_error}, indent=2))
+
+# The human report labels a stale completion record "(from previous completed
+# run)". The JSON consumer got the same record with NO such marker, so a script
+# reading `completion.branch` or `completion.pr_url` after a crashed run would
+# attribute a PREVIOUS run's branch and PR to the current one -- silently, and
+# with no field to check. Emit the identical determination as explicit fields.
+# Kept byte-identical in logic to the human path below; the two must not drift.
+live_statuses = {"running", "exited"}
+head_sha = os.environ.get("_LOKI_WHY_HEAD_SHA", "")
+comp_head = comp.get("head_sha", "")
+comp_is_stale = bool(state.get("status") in live_statuses) or bool(
+    head_sha and comp_head and comp_head != head_sha
+)
+print(json.dumps({
+    "state": state,
+    "completion": comp,
+    "last_error": last_error,
+    "completion_is_stale": comp_is_stale,
+    "head_sha": head_sha or None,
+}, indent=2))
 WHYJSON
         return 0
     fi
@@ -10561,8 +10593,133 @@ EOF
 }
 
 # Check system prerequisites
+# _loki_airgap_audit <json?> -- enumerate every network egress this engine can
+# perform, classify each as REQUIRED or optional, and say how to disable it.
+#
+# WHY THIS EXISTS
+#   Air-gapped deployment is a real enterprise requirement and the incumbent
+#   (Tabnine) states it can "be deployed in a completely air-gapped environment"
+#   without publishing WHICH hosts it would otherwise contact. A claim you
+#   cannot audit is a claim you have to take on faith.
+#
+#   Sourcegraph is the honest counter-example: their own whitepaper states that
+#   self-hosted Cody still "sends requests from the Sourcegraph instance to
+#   Anthropic's API". Self-hosted control plane, egressing inference.
+#
+#   So the credible position is not "trust us, we are air-gapped" -- it is here
+#   is every host, here is which ones are required, here is how to turn each one
+#   off, now verify it yourself with tcpdump. We would rather be auditable than
+#   assertive.
+#
+# Exit 0 when no REQUIRED egress remains (air-gap achievable in this config),
+# 1 otherwise. Deterministic: reads configuration, performs NO network calls.
+_loki_airgap_audit() {
+    local as_json="${1:-false}"
+
+    # Provider inference endpoint: the one egress that is genuinely required,
+    # unless the active provider serves weights locally.
+    local provider="${LOKI_PROVIDER:-claude}"
+    local model_host="" model_required="yes" model_note=""
+    case "$provider" in
+        claude)
+            model_host="${ANTHROPIC_BASE_URL:-https://api.anthropic.com}"
+            model_note="Claude Code inference. Set ANTHROPIC_BASE_URL to an in-network gateway, or switch to a local-weights provider."
+            ;;
+        codex)
+            model_host="${OPENAI_BASE_URL:-https://api.openai.com}"
+            model_note="Codex inference. Point at an in-network gateway or switch provider."
+            ;;
+        opencode|cline|aider)
+            model_host="${OPENAI_BASE_URL:-${OPENROUTER_API_KEY:+https://openrouter.ai}}"
+            if [ -z "$model_host" ] || printf '%s' "${LOKI_OPENCODE_MODEL:-}${LOKI_AIDER_MODEL:-}" | grep -qiE 'ollama|localhost|127\.0\.0\.1|lmstudio'; then
+                model_host="local weights"
+                model_required="no"
+                model_note="Local model runtime (Ollama / LM Studio / llama.cpp). No inference egress."
+            else
+                model_note="Remote model gateway. Use an ollama/ model id for zero-egress inference."
+            fi
+            ;;
+        *)
+            model_host="unknown (provider '$provider')"
+            model_note="Unrecognized provider; audit its config manually."
+            ;;
+    esac
+
+    # Optional egress, each individually disableable.
+    local tel_state="off"
+    [ "${LOKI_TELEMETRY:-}" = "on" ] && tel_state="on"
+    local upd_state="on"
+    [ "${LOKI_NO_UPDATE_CHECK:-0}" = "1" ] && upd_state="off"
+
+    if [ "$as_json" = "true" ]; then
+        _AG_PROV="$provider" _AG_HOST="$model_host" _AG_REQ="$model_required" \
+        _AG_NOTE="$model_note" _AG_TEL="$tel_state" _AG_UPD="$upd_state" \
+        python3 -c '
+import json, os
+req = os.environ["_AG_REQ"] == "yes"
+egress = [{
+    "name": "model_inference",
+    "host": os.environ["_AG_HOST"],
+    "required": req,
+    "disable": "use a local-weights provider (ollama/, lmstudio/) or an in-network gateway",
+    "note": os.environ["_AG_NOTE"],
+}, {
+    "name": "telemetry",
+    "host": "telemetry endpoint",
+    "required": False,
+    "enabled": os.environ["_AG_TEL"] == "on",
+    "disable": "loki telemetry off (already the default)",
+}, {
+    "name": "update_check",
+    "host": "registry.npmjs.org",
+    "required": False,
+    "enabled": os.environ["_AG_UPD"] == "on",
+    "disable": "export LOKI_NO_UPDATE_CHECK=1",
+}]
+blockers = [e for e in egress if e.get("required")]
+print(json.dumps({
+    "provider": os.environ["_AG_PROV"],
+    "airgap_ready": not blockers,
+    "required_egress": [e["name"] for e in blockers],
+    "egress": egress,
+}, indent=2))
+'
+        [ "$model_required" = "yes" ] && return 1
+        return 0
+    fi
+
+    echo -e "${BOLD}Network egress audit${NC}"
+    echo ""
+    echo "  Active provider: $provider"
+    echo ""
+    echo -e "${BOLD}Egress points${NC}"
+    if [ "$model_required" = "yes" ]; then
+        echo -e "  ${YELLOW}REQUIRED${NC}  model inference -> $model_host"
+    else
+        echo -e "  ${GREEN}none${NC}      model inference -> $model_host"
+    fi
+    echo "            $model_note"
+    echo -e "  optional  telemetry           [$tel_state]  disable: loki telemetry off (default off)"
+    echo -e "  optional  update check        [$upd_state]  disable: export LOKI_NO_UPDATE_CHECK=1"
+    echo ""
+    if [ "$model_required" = "yes" ]; then
+        echo -e "${YELLOW}Not air-gap ready in this configuration.${NC}"
+        echo "  One required egress remains: model inference."
+        echo "  To close it, serve the model in-network:"
+        echo "    loki provider set opencode"
+        echo "    export LOKI_OPENCODE_MODEL=ollama/qwen2.5-coder"
+        echo ""
+        echo "  Then re-run: loki doctor --airgap"
+        return 1
+    fi
+    echo -e "${GREEN}Air-gap ready: no required egress in this configuration.${NC}"
+    echo "  Verify independently -- run with the interface down, or watch with tcpdump."
+    return 0
+}
+
 cmd_doctor() {
     local json_output=false
+    local airgap_audit=false
 
     while [[ $# -gt 0 ]]; do
         case "$1" in
@@ -10570,13 +10727,21 @@ cmd_doctor() {
                 json_output=true
                 shift
                 ;;
+            --airgap)
+                airgap_audit=true
+                shift
+                ;;
             --help|-h)
                 echo -e "${BOLD}loki doctor${NC} - Check system prerequisites"
                 echo ""
-                echo "Usage: loki doctor [--json]"
+                echo "Usage: loki doctor [--json] [--airgap]"
                 echo ""
                 echo "Options:"
                 echo "  --json    Output machine-readable JSON"
+                echo "  --airgap  Audit network egress: list every host this engine"
+                echo "            can contact, whether it is REQUIRED or optional,"
+                echo "            and how to disable it. Exits non-zero if any"
+                echo "            required egress remains."
                 echo ""
                 echo "Checks: node, python3, jq, git, curl, bash version,"
                 echo "        claude/codex CLIs, disk space, and cockpit render capability."
@@ -10584,12 +10749,17 @@ cmd_doctor() {
                 ;;
             *)
                 echo -e "${RED}Unknown option: $1${NC}"
-                echo "Usage: loki doctor [--json]"
+                echo "Usage: loki doctor [--json] [--airgap]"
                 return 1
                 ;;
         esac
     done
 
+    if [ "$airgap_audit" = true ]; then
+        _loki_airgap_audit "$json_output"
+        return $?
+    fi
+
     if [ "$json_output" = true ]; then
         cmd_doctor_json
         return $?
@@ -10975,6 +11145,24 @@ except Exception:
         echo -e "  ${YELLOW}WARN${NC}  sentrux - not installed (optional, brew install sentrux/tap/sentrux)"
         warn_count=$((warn_count + 1))
     fi
+    # Evidence Receipt signing state (optional). Unsigned receipts are the
+    # default and are still checkable (hash + diff re-derivation); what they
+    # cannot prove is PROVENANCE, so proof-verify.py reports
+    # generator_trusted: true. Surface the state here because it is otherwise
+    # invisible until someone reads a receipt. WARN (never FAIL): unsigned is
+    # a supported, documented mode, not a broken install.
+    if [ -n "${LOKI_PROOF_GPG_KEY:-}" ]; then
+        if command -v gpg &>/dev/null; then
+            echo -e "  ${GREEN}PASS${NC}  Receipt signing: LOKI_PROOF_GPG_KEY set and gpg available"
+            pass_count=$((pass_count + 1))
+        else
+            echo -e "  ${YELLOW}WARN${NC}  Receipt signing: LOKI_PROOF_GPG_KEY set but gpg NOT on PATH - receipts will be UNSIGNED"
+            warn_count=$((warn_count + 1))
+        fi
+    else
+        echo -e "  ${YELLOW}WARN${NC}  Receipt signing: UNSIGNED (set LOKI_PROOF_GPG_KEY to a gpg key id; see docs/SIGNED-RECEIPTS.md)"
+        warn_count=$((warn_count + 1))
+    fi
     echo ""
 
     echo -e "${CYAN}System:${NC}"
@@ -11210,6 +11398,23 @@ sentrux = {
     'required': 'optional'
 }
 
+# Evidence Receipt signing state. Unsigned is the DEFAULT and is a supported
+# mode, so this is never 'fail'. Exposed because signing state is otherwise
+# invisible until someone reads a receipt, and it is exactly what decides
+# whether proof-verify.py reports generator_trusted: true. Sibling of
+# checks/disk/sentrux -- deliberately NOT counted in the summary tally so
+# existing consumers see unchanged numbers.
+signing_key_set = bool(os.environ.get('LOKI_PROOF_GPG_KEY', '').strip())
+signing_gpg_available = shutil.which('gpg') is not None
+signing_enabled = signing_key_set and signing_gpg_available
+receipt_signing = {
+    'enabled': signing_enabled,
+    'key_configured': signing_key_set,
+    'gpg_available': signing_gpg_available,
+    'status': 'pass' if signing_enabled else 'warn',
+    'required': 'optional'
+}
+
 # v7.7.17: memory subsystem health surface. Reports the latest entries
 # from .loki/memory/.errors.log (rotated by memory/error_log.py) so
 # developers see regressions in the previously-silent-fail call sites
@@ -11263,6 +11468,7 @@ result = {
         'status': disk_status
     },
     'sentrux': sentrux,
+    'receipt_signing': receipt_signing,
     'memory': memory,
     'summary': {
         'passed': pass_count,
@@ -14853,6 +15059,33 @@ with open(manifest_path, 'w') as f:
 # usable.
 # ---------------------------------------------------------------------------
 cmd_verify() {
+    # --fast: deterministic checks only, in milliseconds. Measured on this repo
+    # (1,932 tracked files): 298 ms cold, 87 ms warm, 19 ms diff-scoped, against
+    # an 11,040 ms shell-based baseline.
+    #
+    # It runs ONLY exogenous checks -- no model call, no network -- so every
+    # verdict is reproducible by anyone with the same commit. That is the point,
+    # not a limitation: a verdict you can re-derive is a fact, and a fact is what
+    # an IDE, a CI step, or another vendor's agent can safely act on without
+    # trusting our model choices.
+    #
+    # The full `loki verify` remains the deeper, slower path.
+    for _fv_arg in "$@"; do
+        if [ "$_fv_arg" = "--fast" ]; then
+            local _fv_py="$_LOKI_SCRIPT_DIR/lib/fast_verify.py"
+            if [ ! -f "$_fv_py" ]; then
+                echo -e "${RED}Error: fast_verify not found at $_fv_py${NC}" >&2
+                return 3
+            fi
+            local _fv_argv=()
+            for _a in "$@"; do
+                [ "$_a" = "--fast" ] || _fv_argv+=("$_a")
+            done
+            python3 "$_fv_py" "${_fv_argv[@]+"${_fv_argv[@]}"}"
+            return $?
+        fi
+    done
+
     local verify_mod="$_LOKI_SCRIPT_DIR/verify.sh"
     if [ ! -f "$verify_mod" ]; then
         echo -e "${RED}Error: verify module not found at $verify_mod${NC}" >&2
@@ -32282,6 +32515,12 @@ cmd_proof() {
             echo "  --hosted             Publish to LOKI_HOSTED_ENDPOINT (open-core seam; no official backend yet)"
             echo ""
             echo "Proofs are generated automatically at run completion (LOKI_PROOF=0 to opt out)."
+            echo ""
+            echo "Signing (off by default): receipts are UNSIGNED unless LOKI_PROOF_GPG_KEY is"
+            echo "set to a gpg key id. Unsigned, the integrity hash proves the bytes were not"
+            echo "edited after hashing but NOT who produced them, so verify reports"
+            echo "generator_trusted: true. Export LOKI_PROOF_GPG_KEY to close that gap."
+            echo "See docs/SIGNED-RECEIPTS.md."
             [ "$sub" = "" ] && exit 1
             exit 0
             ;;

package/autonomy/run.sh

@@ -22823,6 +22823,8 @@ check_human_intervention() {
                 log_warn "PAUSE file created by budget limit - NOT auto-clearing in perpetual mode"
                 log_warn "Budget limit reached. Remove .loki/signals/BUDGET_EXCEEDED and .loki/PAUSE to continue."
                 notify_intervention_needed "Budget limit reached - execution paused" 2>/dev/null || true
+                # Same-instant snapshot as COMPLETION.txt (see the PAUSE-file site).
+                (cd "${TARGET_DIR:-.}" && update_status_file) 2>/dev/null || true
                 # Genuinely blocking pause: write the durable intervention record
                 # now (state-only; the ping above already fired). This is the
                 # correct site for the durable file because the run actually halts
@@ -22835,6 +22837,7 @@ check_human_intervention() {
                 if [ "$pause_result" -eq 1 ]; then
                     # STOP requested DURING the pause: relabel the durable record
                     # as stopped (state-only; the user typed STOP and is aware).
+                    (cd "${TARGET_DIR:-.}" && update_status_file) 2>/dev/null || true
                     build_completion_summary stopped 2>/dev/null || true
                     return 2
                 fi
@@ -22849,6 +22852,13 @@ check_human_intervention() {
         fi
         log_warn "PAUSE file detected - pausing execution"
         notify_intervention_needed "Execution paused via PAUSE file"
+        # Refresh STATUS.txt from the queue BEFORE writing the durable record, so
+        # the two files snapshot the same instant. The status monitor refreshes
+        # every 2s but is not running by the time we block here, so STATUS.txt
+        # was frozen at its last tick: measured on a real paused run reporting
+        # "Failed: 0" while COMPLETION.txt -- written now, from the same
+        # queue/failed.json -- reported failed=1. Same source, different age.
+        (cd "${TARGET_DIR:-.}" && update_status_file) 2>/dev/null || true
         # Genuinely blocking pause: write the durable intervention record now
         # (state-only; the ping above already fired).
         build_completion_summary intervention 2>/dev/null || true
@@ -22859,6 +22869,7 @@ check_human_intervention() {
         if [ "$pause_result" -eq 1 ]; then
             # STOP was requested during pause: relabel the durable record as
             # stopped (state-only; the user typed STOP and is aware).
+            (cd "${TARGET_DIR:-.}" && update_status_file) 2>/dev/null || true
             build_completion_summary stopped 2>/dev/null || true
             return 2
         fi
@@ -22872,6 +22883,8 @@ check_human_intervention() {
             rm -f "$loki_dir/PAUSE_AT_CHECKPOINT"
             notify_intervention_needed "Execution paused at checkpoint"
             touch "$loki_dir/PAUSE"
+            # Same-instant snapshot as COMPLETION.txt (see the PAUSE-file site).
+            (cd "${TARGET_DIR:-.}" && update_status_file) 2>/dev/null || true
             # Genuinely blocking pause: write the durable intervention record now
             # (state-only; the ping above already fired).
             build_completion_summary intervention 2>/dev/null || true
@@ -22881,6 +22894,7 @@ check_human_intervention() {
             rm -f "$loki_dir/PAUSE"
             if [ "$pause_result" -eq 1 ]; then
                 # STOP requested during pause: relabel as stopped (state-only).
+                (cd "${TARGET_DIR:-.}" && update_status_file) 2>/dev/null || true
                 build_completion_summary stopped 2>/dev/null || true
                 return 2
             fi

package/autonomy/verify.sh

@@ -781,13 +781,19 @@ verify_gate_nomock() {
         return 0
     fi
     local status_line
+    # The changed-file list goes over STDIN, not an env var. A single env string
+    # is capped at MAX_ARG_STRLEN (131071 bytes) on Linux; a large changed set
+    # (e.g. a generated source tree) makes execve fail with E2BIG, the fallback
+    # below fires, and the gate silently degrades to inconclusive. macOS has no
+    # per-string cap, so that failure was Linux-only.
     status_line=$(
-        _NM_FILES="$changed" \
-        _NM_TREE="$tree" \
-        _NM_OUT="$scan_file" \
-        _NM_BASE="${VERIFY_MERGE_BASE:-}" \
-        python3 -I "$scanner" 2>/dev/null \
-            || echo "INCONCLUSIVE:detector_error"
+        printf '%s\n' "$changed" | {
+            _NM_TREE="$tree" \
+            _NM_OUT="$scan_file" \
+            _NM_BASE="${VERIFY_MERGE_BASE:-}" \
+            python3 -I "$scanner" 2>/dev/null \
+                || echo "INCONCLUSIVE:detector_error"
+        }
     )
 
     case "$status_line" in

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "8.0.3"
+__version__ = "8.2.0"
 
 # Expose the control app for easy import
 try: