loki-mode 8.1.0 → 8.2.0

package/README.md

@@ -15,7 +15,7 @@ _The free, source-available autonomous coding agent by [Autonomi](https://www.au
 
 [Website](https://www.autonomi.dev/) | [Documentation](wiki/Home.md) | [Installation](docs/INSTALLATION.md) | [Changelog](CHANGELOG.md) | [Purple Lab -- deprecated v7.44.0](#purple-lab)
 
-**Current release: v8.0.0**
+**Current release: v8.2.0**
 
 </div>
 
@@ -25,6 +25,37 @@ _The free, source-available autonomous coding agent by [Autonomi](https://www.au
 
 ---
 
+## Already have a codebase? Start read-only.
+
+Most agents are built to create new apps. The harder, more valuable problem is
+the ten-year-old repo that pays the bills. Loki works on both, and on an
+existing codebase it starts by **changing nothing**:
+
+```bash
+loki modernize heal ./your-repo --assess          # read-only. no writes, no commits.
+loki modernize heal ./your-repo --assess --json   # same, machine-readable
+```
+
+You get a modernization readiness report: language mix, a 4-level maturity
+rating, technical-debt signals (test coverage, TODO density, oversized files,
+dependency staleness), and a **ranked list of where to start** -- ordered by
+blast radius, so the first change is the one least likely to break something.
+
+Then, if you want it to act:
+
+```bash
+loki modernize heal ./your-repo --strict          # block ALL behavioral change without approval
+loki modernize heal ./your-repo --phase archaeology   # extract knowledge only
+loki modernize heal ./your-repo --compliance healthcare   # or fintech | government
+```
+
+The healing pipeline runs in phases -- archaeology, stabilize, isolate,
+modernize, validate -- and the validate phase checks **behavioral equivalence
+against the pre-change baseline**, not just that the tests are green. Friction
+points (the weird code that exists for a reason nobody remembers) are cataloged
+before anything touches them, because in a legacy system the strange code is
+usually load-bearing.
+
 ## The Evidence Receipt: don't trust the agent, check it
 
 Every coding agent tells you it finished. Loki hands you something you can

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: Autonomous spec-driven build system with a built-in trust layer. It does not call work done until it is verified (RARV-C closure loop, 8 quality gates, completion council, verified-completion evidence gate). Triggers on "Loki Mode". Takes a spec (PRD, GitHub issue, OpenAPI doc, etc.) to deployed product with minimal human intervention. Provider-agnostic. Requires --dangerously-skip-permissions flag.
 ---
 
-# Loki Mode v8.1.0
+# Loki Mode v8.2.0
 
 **You are an autonomous agent. You make decisions. You do not ask questions. You do not stop.**
 
@@ -469,4 +469,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v8.1.0 | [Autonomi](https://www.autonomi.dev/) flagship product | ~410 lines core**
+**v8.2.0 | [Autonomi](https://www.autonomi.dev/) flagship product | ~410 lines core**

package/VERSION

@@ -1 +1 @@
-8.1.0
+8.2.0

package/autonomy/completion-council.sh

@@ -2267,11 +2267,17 @@ PYEOF
         if [ -z "$_nm_cc_dir" ] || [ ! -f "$_nm_scanner" ]; then
             _nm_status="INCONCLUSIVE:scanner_unavailable"
         else
+            # STDIN, not an env var: a single env string is capped at
+            # MAX_ARG_STRLEN (131071 bytes) on Linux, so a large changed-file
+            # union makes execve fail with E2BIG and this gate silently
+            # degrades to inconclusive (pass-through). macOS has no per-string
+            # cap, so that failure mode was Linux-only.
             _nm_status=$(
-                _NM_FILES="$_nm_files" \
-                _NM_TREE="." \
-                python3 -I "$_nm_scanner" 2>/dev/null \
-                    || echo "INCONCLUSIVE:detector_error"
+                printf '%s\n' "$_nm_files" | {
+                    _NM_TREE="." \
+                    python3 -I "$_nm_scanner" 2>/dev/null \
+                        || echo "INCONCLUSIVE:detector_error"
+                }
             )
         fi
         case "$_nm_status" in
@@ -3135,6 +3141,25 @@ ISSUES: CRITICAL:description (optional, one per line per issue)"
                 _provider_rc=$?
             fi
             ;;
+        *)
+            # v8.2.0 TIMEOUT SEAM. Any provider exposing provider_invoke_argv can
+            # cast a real council vote instead of falling straight to the
+            # heuristic. argv is a REAL command, so `timeout` bounds it exactly as
+            # it bounds the named arms above (providers/claude.sh:321).
+            #
+            # SEMANTICS PRESERVED: _provider_rc is captured the same way, so the
+            # bash-F4 safe default below still forces a conservative REJECT on a
+            # timeout kill (124/137/143). An empty verdict falls to
+            # council_heuristic_review, identical to a missing CLI today.
+            if type provider_invoke_argv >/dev/null 2>&1; then
+                provider_invoke_argv fast "$prompt"
+                # caveman HARD-SUPPRESS: this vote is parsed for "VOTE:".
+                verdict=$(timeout "${LOKI_COUNCIL_REVIEW_TIMEOUT:-600}" \
+                    env CAVEMAN_DEFAULT_MODE=off \
+                    "${_LOKI_INVOKE_ARGV[@]+"${_LOKI_INVOKE_ARGV[@]}"}" 2>/dev/null)
+                _provider_rc=$?
+            fi
+            ;;
     esac
 
     # bash-F4 (WAVE10 SAFE-DEFAULT): a provider timeout (124, incl. 128+SIGTERM
@@ -3303,6 +3328,22 @@ REASON: your reasoning"
                 verdict=$(timeout "${LOKI_COUNCIL_REVIEW_TIMEOUT:-600}" aider --message "$prompt" --yes-always --no-auto-commits --no-git 2>/dev/null)
             fi
             ;;
+        *)
+            # v8.2.0 TIMEOUT SEAM (contrarian / devil's-advocate vote). Same
+            # rationale as the member vote: a real argv keeps the `timeout`
+            # bound that a shell function would silently remove.
+            #
+            # SEMANTICS PRESERVED: this path tracks no _provider_rc by design --
+            # an empty verdict (timeout or failure) already routes to the
+            # conservative REJECT fallback immediately below.
+            if type provider_invoke_argv >/dev/null 2>&1; then
+                provider_invoke_argv fast "$prompt"
+                # caveman HARD-SUPPRESS: parsed for "VOTE:".
+                verdict=$(timeout "${LOKI_COUNCIL_REVIEW_TIMEOUT:-600}" \
+                    env CAVEMAN_DEFAULT_MODE=off \
+                    "${_LOKI_INVOKE_ARGV[@]+"${_LOKI_INVOKE_ARGV[@]}"}" 2>/dev/null)
+            fi
+            ;;
     esac
 
     if [ -z "$verdict" ]; then

package/autonomy/council-v2.sh

@@ -441,7 +441,29 @@ except Exception:
             fi
             ;;
         *)
-            result='{"verdict":"INCONCLUSIVE","reasoning":"review not supported for this provider (no verdict obtained; NOT a rejection)","issues":[]}'
+            # v8.2.0 TIMEOUT SEAM. A provider exposing provider_invoke_argv gets
+            # a real reviewer instead of an automatic INCONCLUSIVE. The argv is a
+            # REAL command so `timeout` genuinely bounds it (providers/claude.sh:321);
+            # routing this through a shell function would silently drop the bound.
+            #
+            # VERDICT SEMANTICS UNCHANGED: on empty output, non-zero exit, or a
+            # timeout kill (124/137/143) we fall back to the SAME INCONCLUSIVE
+            # string used below -- never REJECT. A judge that produced no
+            # judgement has not rejected anything (v8.1.0 TRUST-3).
+            result=''
+            if type provider_invoke_argv >/dev/null 2>&1; then
+                local _c2_seam_rc=0
+                provider_invoke_argv fast "$full_prompt"
+                # caveman HARD-SUPPRESS: this verdict is parsed for the JSON
+                # "verdict" field; compression would reword it.
+                result="$(timeout "${LOKI_SDK_REVIEW_TIMEOUT:-180}" \
+                    env CAVEMAN_DEFAULT_MODE=off \
+                    "${_LOKI_INVOKE_ARGV[@]+"${_LOKI_INVOKE_ARGV[@]}"}" 2>/dev/null)" || _c2_seam_rc=$?
+                [ "$_c2_seam_rc" -ne 0 ] && result=''
+            fi
+            if [ -z "$result" ]; then
+                result='{"verdict":"INCONCLUSIVE","reasoning":"review not supported for this provider (no verdict obtained; NOT a rejection)","issues":[]}'
+            fi
             ;;
     esac
 
@@ -452,6 +474,46 @@ except Exception:
         # Try removing markdown fencing
         extracted=$(echo "$result" | sed 's/^```json//;s/^```//' | sed -n '/^{/,/^}/p' | head -50)
     fi
+    # STRUCTURE-TOLERANT RECOVERY (v8.2.0).
+    #
+    # A strict JSON carve is the single most model-sensitive contract in the
+    # engine: schema adherence is exactly what varies most across models, while
+    # every coding model can state a verdict in prose. Measured elsewhere (Forge
+    # replication): scaffolding drove tool-call errors 42 -> 0 while
+    # advanced-reasoning accuracy stayed flat -- i.e. a harness CAN rescue
+    # format compliance but cannot manufacture judgment. So recovering a verdict
+    # the model genuinely expressed is legitimate; inventing one is not.
+    #
+    # This runs ONLY when the JSON carve produced nothing, and it accepts a
+    # verdict only when the model stated it UNAMBIGUOUSLY (exactly one of
+    # APPROVE/REJECT appears as a standalone word). A response mentioning both,
+    # or neither, stays INCONCLUSIVE -- never guessed.
+    if [ -z "$extracted" ] && [ -n "${result:-}" ]; then
+        local _recovered
+        _recovered="$(printf '%s' "$result" | _LOKI_RAW="$result" python3 -c '
+import os, re, sys, json
+raw = os.environ.get("_LOKI_RAW", "")
+# Standalone words only: "APPROVE" not "approved-by", and not inside a URL.
+approve = len(re.findall(r"(?<![A-Za-z0-9_-])APPROVE(?![A-Za-z0-9_-])", raw, re.I))
+reject  = len(re.findall(r"(?<![A-Za-z0-9_-])REJECT(?![A-Za-z0-9_-])",  raw, re.I))
+if approve and not reject:
+    v = "APPROVE"
+elif reject and not approve:
+    v = "REJECT"
+else:
+    sys.exit(1)   # ambiguous or absent -> stay inconclusive
+print(json.dumps({
+    "verdict": v,
+    "reasoning": "recovered from unstructured output (model stated %s in prose)" % v,
+    "issues": [],
+    "recovered": True,
+}))
+' 2>/dev/null)" || _recovered=""
+        if [ -n "$_recovered" ]; then
+            extracted="$_recovered"
+        fi
+    fi
+
     if [ -z "$extracted" ]; then
         # The weak-model case, and the reason this matters most: a model whose
         # prose could not be carved into JSON did not vote REJECT. Recording one

package/autonomy/grill.sh

@@ -158,6 +158,12 @@ grill_check_provider() {
             fi
             ;;
         *)
+            # v8.2.0: capability, not identity. Must stay in lockstep with the
+            # matching arm in grill_invoke_provider -- this gate runs FIRST, so
+            # rejecting here would make that arm dead code.
+            if type provider_invoke_argv >/dev/null 2>&1; then
+                return 0
+            fi
             _grill_err "grill currently supports the claude and codex providers (got: $provider)"
             return $GRILL_EXIT_ERROR
             ;;
@@ -278,6 +284,32 @@ grill_invoke_provider() {
             return 0
             ;;
         *)
+            # v8.2.0 TIMEOUT SEAM. Previously any other provider was a hard
+            # error. A provider exposing provider_invoke_argv builds a REAL argv
+            # (not a shell function), so _grill_with_timeout still bounds it --
+            # the whole reason the seam exists (providers/claude.sh:321).
+            # Nothing to preserve on this arm, so nothing can regress: it
+            # produced no output at all before.
+            #
+            # Deliberate: no --disallowedTools. That flag is claude-specific with
+            # no portable equivalent, so a seam-provider grill CAN write to the
+            # tree. Accepted; the alternative is the hard error below.
+            if type provider_invoke_argv >/dev/null 2>&1; then
+                local out
+                provider_invoke_argv fast "$prompt"
+                # env CAVEMAN_DEFAULT_MODE=off: grill output is parsed downstream
+                # and caveman compression would reword the questions. `env` (not a
+                # bare prefix) because _grill_with_timeout execs its first token.
+                out="$(_grill_with_timeout "${LOKI_GRILL_TIMEOUT:-180}" \
+                    env CAVEMAN_DEFAULT_MODE=off \
+                    "${_LOKI_INVOKE_ARGV[@]+"${_LOKI_INVOKE_ARGV[@]}"}" 2>/dev/null)"
+                if [ -z "$out" ]; then
+                    _grill_err "provider returned no output (timeout or invocation error)"
+                    return $GRILL_EXIT_ERROR
+                fi
+                printf '%s\n' "$out"
+                return 0
+            fi
             _grill_err "grill currently supports the claude and codex providers (got: $provider)"
             return $GRILL_EXIT_ERROR
             ;;

package/autonomy/lib/done-recognition.sh

@@ -159,12 +159,24 @@ except Exception:
     return 0
 }
 
-# Decide whether model verification can be attempted. Returns 0 (ok) only when
-# the active provider is claude and not degraded. Mirrors
-# _loki_prd_enrich_provider_ok (autonomy/lib/prd-enrich.sh:65).
+# Decide whether model verification can be attempted.
+#
+# v8.2.0: this used to require LOKI_PROVIDER=claude specifically, so a user on
+# codex/opencode/cline/aider silently lost done-recognition. That is a
+# CAPABILITY question, not an identity question -- the real requirement is "can
+# we reach a model AND bound the call with a timeout". Any provider exposing the
+# argv seam (provider_invoke_argv, see providers/claude.sh) satisfies both.
+#
+# Falls back to the historical claude-binary check when the seam is absent, so
+# nothing regresses for existing installs.
 _loki_done_recog_provider_ok() {
-    [ "${LOKI_PROVIDER:-claude}" = "claude" ] || return 1
     [ "${PROVIDER_DEGRADED:-false}" != "true" ] || return 1
+    # Preferred: a provider that can build a timeout-able argv.
+    if type provider_invoke_argv >/dev/null 2>&1; then
+        return 0
+    fi
+    # Legacy path: claude binary present.
+    [ "${LOKI_PROVIDER:-claude}" = "claude" ] || return 1
     command -v claude >/dev/null 2>&1 || return 1
     return 0
 }

package/autonomy/lib/fast_verify.py

@@ -0,0 +1,346 @@
+#!/usr/bin/env python3
+"""fast_verify -- millisecond-scale deterministic verification.
+
+WHY THIS EXISTS
+    Verification that takes minutes does not scale and cannot be embedded. To be
+    pluggable -- into an IDE, an MCP tool, a CI step, or another vendor's agent --
+    a verdict has to come back in the time a human would wait for a keystroke,
+    not a coffee break.
+
+    MEASURED BASELINE on this repo before this module:
+        tests/detect-mock-problems.sh    11,040 ms
+        tests/detect-test-mutations.sh   12,361 ms
+
+    The work itself is not slow. The ARCHITECTURE was:
+      1. FOUR separate full-tree `find` walks in one detector (one walk = 110 ms).
+      2. ~25 subprocess spawns at ~24 ms each of pure interpreter startup.
+      3. Every detector re-discovering the same file set independently.
+
+    `git ls-files` returns the same set in 37 ms, already deduplicated and
+    already gitignore-aware. So the fix is not "optimize the shell" -- it is to
+    stop paying discovery and process tax N times.
+
+THE FIVE DESIGN RULES
+    A. SINGLE PASS      - walk once, classify once, hand each detector its slice.
+    B. ZERO SUBPROCESS  - detectors are pure functions in ONE process. Startup is
+                          paid once, not 25 times.
+    C. CONTENT-ADDRESSED- cache each file's findings by content hash. An unchanged
+                          file is never re-read. Warm runs approach cache-read cost.
+    D. DIFF-SCOPED      - verifying a change needs the changed files, not the repo.
+    E. EXOGENOUS ONLY   - no LLM on this path, ever. Only checks the agent cannot
+                          author or influence: deterministic, reproducible, and
+                          therefore trustworthy. That constraint is what makes the
+                          fast path both fast AND the thing worth trusting.
+
+WHAT THIS DELIBERATELY DOES NOT DO
+    It does not run the test suite, call a model, or render judgment. Those are
+    slower and, in the case of model judgment, not exogenous. This module answers
+    only the question a machine can answer deterministically, which is exactly the
+    question worth answering in milliseconds.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import os
+import re
+import subprocess
+import sys
+import time
+from dataclasses import dataclass, field, asdict
+from pathlib import Path
+from typing import Iterable
+
+SCHEMA_VERSION = 1
+
+# Source extensions worth scanning. Anything else is discovery noise.
+CODE_EXT = {".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs", ".py", ".go", ".rs", ".rb", ".java", ".sh"}
+TEST_RE = re.compile(r"(^|/)(test_[^/]+\.py|[^/]+\.(test|spec)\.(ts|tsx|js|jsx|mjs|cjs))$")
+
+# Excluded even when git tracks them: vendored or generated trees produce findings
+# nobody can act on, and scanning them is pure latency.
+EXCLUDE_RE = re.compile(r"(^|/)(node_modules|dist|build|vendor|\.venv|coverage|__pycache__)(/|$)")
+
+
+# --- Findings ---------------------------------------------------------------
+
+@dataclass
+class Finding:
+    rule: str
+    path: str
+    line: int
+    message: str
+    severity: str = "high"
+
+
+@dataclass
+class Result:
+    verdict: str                      # PASS | FAIL | INCONCLUSIVE
+    findings: list = field(default_factory=list)
+    files_scanned: int = 0
+    files_from_cache: int = 0
+    elapsed_ms: float = 0.0
+    schema_version: int = SCHEMA_VERSION
+    exogenous: bool = True            # never set False; this path admits no LLM
+
+
+# --- Rule A: mock data rendered as if it were real ---------------------------
+# A UI that maps over a hardcoded array and renders it is the "Potemkin
+# interface" failure -- it looks finished and is not wired to anything.
+
+_INLINE_COLLECTION = re.compile(
+    r"""(?:const|let|var)\s+(\w+)\s*=\s*\[\s*\{""", re.M)
+_RENDER_MAP = re.compile(r"""\{?\s*(\w+)\s*(?:\?\.)?\.map\s*\(""")
+_FETCHY = re.compile(r"\b(fetch|axios|useQuery|useSWR|supabase|prisma|createClient)\b")
+
+# Names that are legitimately static content, not stand-ins for a backend.
+_STATIC_OK = re.compile(
+    r"^(features?|benefits?|faqs?|steps?|tabs?|nav|navigation|menu|links?|routes?|"
+    r"columns?|options?|plans?|pricing|tiers?|testimonials?|stats?|socials?|icons?)$",
+    re.I)
+
+
+def _rule_mock_render(path: str, text: str) -> list:
+    out = []
+    if not text or "[" not in text:
+        return out
+    declared = {}
+    for m in _INLINE_COLLECTION.finditer(text):
+        declared[m.group(1)] = text[:m.start()].count("\n") + 1
+    if not declared:
+        return out
+    # A real data source in the same file means the array is plausibly a fallback,
+    # not the product. Stay quiet rather than cry wolf: a false BLOCK on a correct
+    # build is worse than a missed warning, because it trains users to ignore us.
+    if _FETCHY.search(text):
+        return out
+    for m in _RENDER_MAP.finditer(text):
+        name = m.group(1)
+        if name in declared and not _STATIC_OK.match(name):
+            out.append(Finding(
+                rule="mock_render",
+                path=path,
+                line=declared[name],
+                message=(f"'{name}' is a hardcoded collection rendered directly; "
+                         "no data source found in this file"),
+            ))
+    return out
+
+
+# --- Rule B: tests that cannot fail ------------------------------------------
+# A test with no assertion is worse than no test: it turns a green suite into a
+# false claim, which is precisely the lie this product exists to prevent.
+
+_SKIPPED = re.compile(r"\b(it|test|describe)\.(skip|todo)\s*\(|@(unittest\.)?skip\b")
+_HAS_ASSERT = re.compile(r"\b(expect|assert|should|chai|sinon\.assert)\b")
+_TEST_BLOCK = re.compile(r"""\b(?:it|test)\s*\(\s*['"`]([^'"`]{1,120})['"`]""")
+
+
+def _rule_toothless_test(path: str, text: str) -> list:
+    out = []
+    if not text:
+        return out
+    for m in _SKIPPED.finditer(text):
+        out.append(Finding(
+            rule="skipped_test", path=path,
+            line=text[:m.start()].count("\n") + 1,
+            message="test is skipped; it cannot fail and cannot verify anything",
+            severity="medium",
+        ))
+    blocks = list(_TEST_BLOCK.finditer(text))
+    for i, m in enumerate(blocks):
+        end = blocks[i + 1].start() if i + 1 < len(blocks) else len(text)
+        body = text[m.end():end]
+        if not _HAS_ASSERT.search(body):
+            out.append(Finding(
+                rule="assertionless_test", path=path,
+                line=text[:m.start()].count("\n") + 1,
+                message=f"test '{m.group(1)[:60]}' contains no assertion; it always passes",
+            ))
+    return out
+
+
+RULES = (_rule_mock_render, _rule_toothless_test)
+
+
+# --- Discovery: one pass, from the git index ---------------------------------
+
+def _git(args: list, cwd: str) -> str:
+    try:
+        p = subprocess.run(["git"] + args, cwd=cwd, capture_output=True,
+                           text=True, timeout=20)
+        return p.stdout if p.returncode == 0 else ""
+    except (OSError, subprocess.SubprocessError):
+        return ""
+
+
+def discover(root: str, diff_base: str = "") -> list:
+    """Return candidate files. ONE listing, no per-detector walk.
+
+    `git ls-files` beats `find` on every axis that matters here: it reads the
+    index instead of stat-ing the tree (37 ms vs 110 ms measured), it is already
+    gitignore-aware, and it never descends into node_modules. When a diff base is
+    given we narrow further -- verifying a change does not require reading the
+    repository.
+    """
+    if diff_base:
+        raw = _git(["diff", "--name-only", diff_base + "...HEAD"], root)
+        if not raw.strip():
+            raw = _git(["diff", "--name-only", diff_base], root)
+    else:
+        raw = _git(["ls-files"], root)
+
+    if not raw:
+        # Not a git repo (or an empty one): fall back to a single os.walk. Still
+        # one pass -- the guarantee holds even off the happy path.
+        files = []
+        for dirpath, dirnames, filenames in os.walk(root):
+            dirnames[:] = [d for d in dirnames
+                           if not EXCLUDE_RE.search(d) and not d.startswith(".")]
+            for fn in filenames:
+                rel = os.path.relpath(os.path.join(dirpath, fn), root)
+                if Path(fn).suffix in CODE_EXT and not EXCLUDE_RE.search(rel):
+                    files.append(rel)
+        return files
+
+    return [ln for ln in raw.splitlines()
+            if ln and Path(ln).suffix in CODE_EXT and not EXCLUDE_RE.search(ln)]
+
+
+# --- Content-addressed cache -------------------------------------------------
+
+class Cache:
+    """Findings keyed by content hash, so unchanged files are never re-read.
+
+    Correctness note: the key is the file's CONTENT, not its path or mtime. A
+    file that moves keeps its result; a file that changes gets a new key. There
+    is no staleness window to reason about, which is what makes it safe to trust
+    a cache hit as if the scan had just run.
+    """
+
+    def __init__(self, path: str):
+        self.path = path
+        self.data = {}
+        self.hits = 0
+        try:
+            with open(path, encoding="utf-8") as fh:
+                blob = json.load(fh)
+            if isinstance(blob, dict) and blob.get("schema") == SCHEMA_VERSION:
+                self.data = blob.get("entries", {})
+        except (OSError, ValueError):
+            self.data = {}
+
+    def get(self, key: str):
+        v = self.data.get(key)
+        if v is not None:
+            self.hits += 1
+        return v
+
+    def put(self, key: str, findings: list) -> None:
+        self.data[key] = findings
+
+    def save(self) -> None:
+        try:
+            os.makedirs(os.path.dirname(self.path), exist_ok=True)
+            tmp = self.path + ".tmp"
+            with open(tmp, "w", encoding="utf-8") as fh:
+                json.dump({"schema": SCHEMA_VERSION, "entries": self.data}, fh)
+            os.replace(tmp, self.path)
+        except OSError:
+            pass  # a cache that cannot be written must never break a verdict
+
+
+# --- The entry point ---------------------------------------------------------
+
+def verify(root: str = ".", diff_base: str = "", use_cache: bool = True) -> Result:
+    t0 = time.perf_counter()
+    root = os.path.abspath(root)
+    cache = Cache(os.path.join(root, ".loki", "cache", "fast-verify.json")) if use_cache else None
+
+    findings = []
+    scanned = 0
+
+    for rel in discover(root, diff_base):
+        full = os.path.join(root, rel)
+        try:
+            with open(full, "rb") as fh:
+                raw = fh.read()
+        except OSError:
+            continue
+        scanned += 1
+
+        key = hashlib.blake2b(raw, digest_size=16).hexdigest()
+        if cache is not None:
+            hit = cache.get(key)
+            if hit is not None:
+                for d in hit:
+                    findings.append(Finding(**{**d, "path": rel}))
+                continue
+
+        try:
+            text = raw.decode("utf-8", errors="replace")
+        except Exception:
+            continue
+
+        is_test = bool(TEST_RE.search(rel))
+        got = []
+        for rule in RULES:
+            # Rule B is about tests; rule A is about product code. Running each
+            # only where it applies is not just faster, it removes a whole class
+            # of false positive.
+            if rule is _rule_toothless_test and not is_test:
+                continue
+            if rule is _rule_mock_render and is_test:
+                continue
+            got.extend(rule(rel, text))
+
+        if cache is not None:
+            cache.put(key, [{k: v for k, v in asdict(f).items() if k != "path"} for f in got])
+        findings.extend(got)
+
+    if cache is not None:
+        cache.save()
+
+    blocking = [f for f in findings if f.severity == "high"]
+    verdict = "FAIL" if blocking else ("PASS" if scanned else "INCONCLUSIVE")
+
+    return Result(
+        verdict=verdict,
+        findings=[asdict(f) for f in findings],
+        files_scanned=scanned,
+        files_from_cache=(cache.hits if cache else 0),
+        elapsed_ms=round((time.perf_counter() - t0) * 1000, 2),
+    )
+
+
+def main(argv: list) -> int:
+    root, base, use_cache, as_json = ".", "", True, False
+    i = 0
+    while i < len(argv):
+        a = argv[i]
+        if a == "--diff-base" and i + 1 < len(argv):
+            base = argv[i + 1]; i += 1
+        elif a == "--no-cache":
+            use_cache = False
+        elif a == "--json":
+            as_json = True
+        elif not a.startswith("-"):
+            root = a
+        i += 1
+
+    r = verify(root, base, use_cache)
+    if as_json:
+        print(json.dumps(asdict(r), indent=2))
+    else:
+        print(f"{r.verdict} in {r.elapsed_ms}ms "
+              f"({r.files_scanned} files, {r.files_from_cache} cached)")
+        for f in r.findings[:20]:
+            print(f"  [{f['severity']}] {f['rule']} {f['path']}:{f['line']} - {f['message']}")
+        if len(r.findings) > 20:
+            print(f"  ... and {len(r.findings) - 20} more")
+    return 1 if r.verdict == "FAIL" else 0
+
+
+if __name__ == "__main__":
+    sys.exit(main(sys.argv[1:]))

package/autonomy/lib/no_mock_scan.py

@@ -7,6 +7,7 @@ import hashlib
 import json
 import os
 import re
+import sys
 from dataclasses import dataclass
 from pathlib import Path
 from typing import Iterable
@@ -753,7 +754,26 @@ def scan(files: list[str], tree: Path) -> tuple[int, dict[str, object] | None]:
 
 
 def main() -> int:
-    files = [line.strip() for line in os.environ.get("_NM_FILES", "").splitlines() if line.strip()]
+    # Transport: stdin first, _NM_FILES as fallback. An env string is capped at
+    # MAX_ARG_STRLEN (131071 bytes) on Linux, so a large changed-file list makes
+    # execve fail with E2BIG -- the caller then captures its own
+    # "INCONCLUSIVE:detector_error" fallback and the gate silently passes
+    # through. macOS has no per-string cap, which is why that failure was
+    # Linux-only. stdin has no such limit.
+    # Read defensively: a caller may close stdin (sys.stdin is then None) or
+    # hand over a tty. Either way fall back to the env var rather than raising,
+    # because an uncaught error here reads to the caller as
+    # "INCONCLUSIVE:detector_error" -- the exact silent pass-through this
+    # transport change exists to remove.
+    raw = ""
+    try:
+        if sys.stdin is not None and not sys.stdin.isatty():
+            raw = sys.stdin.read()
+    except (OSError, ValueError):
+        raw = ""
+    if not raw.strip():
+        raw = os.environ.get("_NM_FILES", "")
+    files = [line.strip() for line in raw.splitlines() if line.strip()]
     tree = Path(os.environ.get("_NM_TREE", ".")).resolve()
     output = os.environ.get("_NM_OUT", "")
     scanned, hit = scan(files, tree)