loki-mode 8.1.0 → 8.2.0

package/autonomy/lib/prd-enrich.sh

@@ -97,8 +97,14 @@ _loki_prd_enrich_invoke() {
 # Decide whether enrichment should even be attempted. Returns 0 (attempt)
 # only when the active provider is claude and not in degraded mode.
 _loki_prd_enrich_provider_ok() {
-    [ "${LOKI_PROVIDER:-claude}" = "claude" ] || return 1
     [ "${PROVIDER_DEGRADED:-false}" != "true" ] || return 1
+    # v8.2.0: capability, not identity. A provider exposing the timeout-able
+    # argv seam can run enrichment regardless of which CLI it is. Mirrors
+    # _loki_done_recog_provider_ok (autonomy/lib/done-recognition.sh).
+    if type provider_invoke_argv >/dev/null 2>&1; then
+        return 0
+    fi
+    [ "${LOKI_PROVIDER:-claude}" = "claude" ] || return 1
     # v8: the raw-SDK enrich path (LOKI_SDK_PRD_ENRICH=1) needs no claude binary,
     # so attempt is viable when that path is usable (bridge + bun). The invoke fn
     # still fails closed to claude on an SDK miss.

package/autonomy/lib/proof-generator.py

@@ -243,6 +243,70 @@ def _norm_gate_status(raw):
     return "inconclusive"
 
 
+# TRUST-4: gate provenance. The discriminating property of a verification signal
+# is NOT how many checks ran -- it is whether the checker sits OUTSIDE the agent's
+# control. arXiv 2606.28438 shows AI-self-gates "look strong early but later lose
+# their filtering effect", drifting into "a rubber-stamp regime where acceptance
+# scores rise while benchmark correctness falls". arXiv 2607.05904 shows a judge
+# conditioned on a candidate "scores plausibility, not correctness": self-play
+# drove judge pass rate 0.72 -> 0.94 while TRUE accuracy stayed 0.20, and "a
+# strict three-judge ensemble still accepts 55% of them". So a model-coupled gate
+# is REPORTED but may never lift the headline.
+#
+# ADVISORY = the agent (or a model it prompts) authored the verdict. Everything
+# else is EXOGENOUS: a deterministic script whose output the agent cannot write.
+#
+# Membership is keyed on the ADVISORY side only, and an UNKNOWN gate defaults to
+# EXOGENOUS. That direction is load-bearing and must never be inverted: an
+# unrecognized gate then still counts against VERIFIED (fail-closed). Defaulting
+# unknown gates to advisory would let any newly-added or renamed gate silently
+# lose its power to block -- the exact fake-green vector this split exists to
+# close. Names are matched on a normalized key because run.sh emits BOTH
+# spellings for the same gate (static-analysis / static_analysis, test-mutation /
+# mutation_integrity), verified against run.sh's gate_failures writers.
+_ADVISORY_GATES = frozenset((
+    # The agent writes both the test and the fix, so a green suite is a claim
+    # about its own work, not an independent measurement.
+    "test_coverage", "unit_tests", "test_suite", "semantic_tests", "tests",
+    # LLM-judgment gates: blind council, devil's advocate, magic-module debate.
+    "code_review", "devils_advocate", "devil_advocate", "magic_debate",
+    "council", "anti_sycophancy",
+))
+
+
+def _gate_key(name):
+    """Normalize a gate name for provenance lookup.
+
+    run.sh emits the same gate under multiple spellings (`static-analysis` vs
+    `static_analysis`), and track_gate_failure appends `_PAUSED`/`_ESCALATED`
+    /`_not_run` suffixes. Fold all of them onto one key so classification cannot
+    be defeated by a cosmetic rename.
+    """
+    s = str(name or "").strip().lower().replace("-", "_")
+    s = re.sub(r"_(paused|escalated|not_run|blocked)$", "", s)
+    return s
+
+
+def _gate_provenance(name):
+    """'advisory' for a model-authored gate, else 'exogenous' (fail-closed)."""
+    return "advisory" if _gate_key(name) in _ADVISORY_GATES else "exogenous"
+
+
+def _is_exogenous(gate):
+    """Provenance of a collected gate dict, honoring the stamped value.
+
+    Reads the `provenance` key stamped by _collect_quality_gates so the
+    `unresolved` override (a gate that HALTED the run counts as an execution
+    fact) is respected. Falls back to name lookup for a gate dict that never
+    passed through the collector. Fail-closed: anything not positively
+    identified as advisory counts as exogenous.
+    """
+    stamped = gate.get("provenance")
+    if stamped:
+        return stamped == "exogenous"
+    return _gate_provenance(gate.get("name")) == "exogenous"
+
+
 def _collect_quality_gates(loki_dir):
     gates_raw = _read_json(
         os.path.join(loki_dir, "state", "quality-gates.json"), default=None
@@ -354,14 +418,48 @@ def _collect_quality_gates(loki_dir):
         for name in failed_names:
             if name in by_name:
                 by_name[name]["status"] = "failed"
+                by_name[name]["unresolved"] = True
             else:
-                gate = {"name": name, "status": "failed"}
+                gate = {"name": name, "status": "failed", "unresolved": True}
                 gates.append(gate)
                 by_name[name] = gate
 
+    # TRUST-4: stamp provenance on every gate at the single point the list is
+    # finalized, so every downstream reader (headline, template, verifier) sees
+    # the same classification and none can drift.
+    # An UNRESOLVED gate (listed in gate-failures.txt) is classified EXOGENOUS
+    # even when the gate itself is model-coupled. The fact being recorded is not
+    # "a judge disliked the code" -- it is "the run halted here and never
+    # cleared this blocker", which is an execution outcome the agent did not
+    # author. Without this, a run stopped dead by an unresolved code_review
+    # would emit a green receipt: the "cryptographically valid but semantically
+    # false green" the gate-failures merge above exists to prevent.
+    for gate in gates:
+        gate["provenance"] = (
+            "exogenous" if gate.get("unresolved")
+            else _gate_provenance(gate.get("name"))
+        )
+
     total = len(gates)
     passed = sum(1 for gate in gates if gate.get("status") == "passed")
-    return {"passed": passed, "total": total, "gates": gates}
+    exo = [g for g in gates if g.get("provenance") == "exogenous"]
+    adv = [g for g in gates if g.get("provenance") == "advisory"]
+    return {
+        "passed": passed,
+        "total": total,
+        "gates": gates,
+        # Pre-split counts so the renderer never has to re-derive provenance.
+        "exogenous": {
+            "passed": sum(1 for g in exo if g.get("status") == "passed"),
+            "total": len(exo),
+            "gates": exo,
+        },
+        "advisory": {
+            "passed": sum(1 for g in adv if g.get("status") == "passed"),
+            "total": len(adv),
+            "gates": adv,
+        },
+    }
 
 
 def _collect_build(loki_dir):
@@ -1032,8 +1130,18 @@ def _build_proof(args, loki_dir, target_dir, repo_root):
         "execution": termination,
         "build": build,
         "tests": tests,
+        # TRUST-4: carry `provenance` into the facts projection. _compute_headline
+        # and _compute_degraded read THIS list, so dropping the field silently
+        # sent them back to name-only lookup -- which mis-classified an
+        # UNRESOLVED code_review (a run-halting execution fact) as advisory and
+        # green-washed a blocked run.
         "quality_gates": [
-            {"name": g.get("name", ""), "status": g.get("status", "not_run")}
+            {
+                "name": g.get("name", ""),
+                "status": g.get("status", "not_run"),
+                "provenance": g.get("provenance")
+                or _gate_provenance(g.get("name")),
+            }
             for g in (quality_gates.get("gates") or [])
         ],
         "security": security,
@@ -1197,8 +1305,14 @@ def _compute_degraded(facts):
             else ("exit_code=%s" % build.get("exit_code"))
         out.append({"item": "build", "status": build.get("status"),
                     "reason": reason})
+    # TRUST-4: only EXOGENOUS gates enter the degraded ledger, because degraded[]
+    # is an INPUT to the headline (a non-empty ledger blocks VERIFIED). Letting an
+    # advisory gate in here would give a model-authored verdict the power to
+    # downgrade the headline through the back door, which is exactly what this
+    # split forbids. Advisory outcomes are still reported in full -- they render
+    # from quality_gates.advisory, which the template shows verbatim.
     for g in facts.get("quality_gates") or []:
-        if g.get("status") in weak:
+        if g.get("status") in weak and _is_exogenous(g):
             out.append({"item": "quality_gate:%s" % g.get("name", ""),
                         "status": g.get("status"),
                         "reason": "gate %s" % g.get("status")})
@@ -1289,12 +1403,21 @@ def _compute_headline(facts, degraded):
             and execution_outcome not in ("complete", "completed", "success")
         )
     )
+    # TRUST-4: only an EXOGENOUS gate failure forces NOT VERIFIED. An advisory
+    # (model-authored) gate is reported but cannot move the verdict in EITHER
+    # direction -- see _ADVISORY_GATES for the research basis. Note the
+    # asymmetry is deliberate and one-way: advisory results are barred from
+    # UPGRADING a verdict (below, in any_verified), and barred from downgrading
+    # one here, because a judge that scores plausibility is not a measurement.
+    # tests.status keeps its own hard-fail check: it is the recorded suite
+    # outcome (an exit code), not the model's opinion of the suite.
     any_failed = (
         execution_failed
         or tests.get("status") == "failed"
         or build.get("status") == "failed"
         or any(g.get("status") == "failed"
-               for g in (facts.get("quality_gates") or []))
+               for g in (facts.get("quality_gates") or [])
+               if _is_exogenous(g))
         or sec_high
         or fn_failed
     )
@@ -1315,11 +1438,15 @@ def _compute_headline(facts, degraded):
     # produced code emit "VERIFIED WITH GAPS" - a fake-green at the receipt. Only
     # a fact that actually ran and passed (tests/build verified, or a passed gate)
     # may qualify; otherwise the honest headline is NOT VERIFIED.
+    # TRUST-4: an advisory PASS is not positive evidence. A run whose ONLY green
+    # signals are a council vote and a devil's-advocate nod has proven nothing
+    # deterministically, so it must not reach "VERIFIED WITH GAPS" on that basis.
     any_verified = (
         tests.get("status") == "verified"
         or build.get("status") == "verified"
         or any(g.get("status") == "passed"
-               for g in (facts.get("quality_gates") or []))
+               for g in (facts.get("quality_gates") or [])
+               if _is_exogenous(g))
     )
     if any_verified and degraded:
         return "VERIFIED WITH GAPS"
@@ -1481,6 +1608,19 @@ def _render_fallback_html(proof):
     ver = proof.get("verification", {})
     rows.append('<p class="hash">Integrity hash (%s): %s</p>' % (
         esc(ver.get("algo", "sha256")), esc(ver.get("hash", ""))))
+    # Signing state, stated plainly. Mirrors renderProvenance in
+    # proof-template.html (the primary renderer); this fallback path must not
+    # be quieter about provenance than the page it stands in for.
+    if ver.get("gpg_signature"):
+        rows.append("<p>Signature: SIGNED (detached GPG over the canonical "
+                    "bytes). A verifier holding the signer public key can "
+                    "confirm provenance offline: loki proof verify &lt;id&gt;</p>")
+    else:
+        rows.append("<p>Signature: UNSIGNED. The integrity hash proves the "
+                    "bytes were not edited after hashing; it does NOT prove "
+                    "who produced them, so this receipt trusts its generator. "
+                    "To sign future receipts, set LOKI_PROOF_GPG_KEY to a gpg "
+                    "key id (see docs/SIGNED-RECEIPTS.md).</p>")
     red = proof.get("redaction", {})
     rows.append("<p>Redaction applied: %s (%s redactions, rules v%s)</p>" % (
         esc(red.get("applied")), esc(red.get("redactions_count")),

package/autonomy/lib/proof-template.html

@@ -1117,6 +1117,24 @@
     card.innerHTML = (head ? '<div style="margin-bottom:14px;">' + head + "</div>" : "") + body + link;
   }
 
+  // Render one row of gate chips. Shared by the exogenous and advisory blocks.
+  function gateChips(gates) {
+    var chips = "";
+    if (!Array.isArray(gates)) return "";
+    for (var i = 0; i < gates.length; i++) {
+      var st = String(g(gates[i], "status", "")).toLowerCase();
+      var cls = (st === "pass" || st === "passed") ? "pass" : (st === "skip" || st === "skipped") ? "skip" : "fail";
+      var mark = cls === "pass" ? "OK" : cls === "skip" ? "-" : "X";
+      chips += '<span class="gate ' + cls + '"><span class="mk">' + mark + "</span>" +
+               esc(g(gates[i], "name", "gate")) + "</span>";
+    }
+    return chips ? '<div class="gates">' + chips + "</div>" : "";
+  }
+
+  // TRUST-4: quality gates split by PROVENANCE, not by outcome. The two blocks
+  // read from quality_gates.exogenous / quality_gates.advisory, the exact field
+  // names proof-generator.py writes. Falls back to the flat pre-split list so an
+  // older receipt still renders.
   function renderGates(p) {
     var sec = document.getElementById("secGates");
     var card = document.getElementById("gatesCard");
@@ -1127,18 +1145,34 @@
       sec.classList.add("hide");
       return;
     }
-    var head = '<p class="note" style="margin:0 0 12px;">' + passed + " of " + total + " gates passed.</p>";
-    var chips = "";
-    if (Array.isArray(gates)) {
-      for (var i = 0; i < gates.length; i++) {
-        var st = String(g(gates[i], "status", "")).toLowerCase();
-        var cls = (st === "pass" || st === "passed") ? "pass" : (st === "skip" || st === "skipped") ? "skip" : "fail";
-        var mark = cls === "pass" ? "OK" : cls === "skip" ? "-" : "X";
-        chips += '<span class="gate ' + cls + '"><span class="mk">' + mark + "</span>" +
-                 esc(g(gates[i], "name", "gate")) + "</span>";
-      }
+    var exo = g(p, "quality_gates.exogenous", null);
+    var adv = g(p, "quality_gates.advisory", null);
+    if (!exo && !adv) {
+      // Pre-TRUST-4 receipt: render the flat list exactly as before.
+      card.innerHTML = '<p class="note" style="margin:0 0 12px;">' + passed +
+        " of " + total + " gates passed.</p>" + gateChips(gates);
+      return;
+    }
+    var html = "";
+    var eg = g(exo, "gates", []);
+    if (Array.isArray(eg) && eg.length > 0) {
+      html += '<h3 style="margin:0 0 4px;font-size:14px;">Independent checks (count toward the verdict)</h3>' +
+        '<p class="note" style="margin:0 0 10px;">' +
+        num(g(exo, "passed", 0)) + " of " + num(g(exo, "total", 0)) +
+        " passed. These are deterministic programs the agent cannot write the " +
+        "result of, so only these set the verdict above.</p>" + gateChips(eg);
+    }
+    var ag = g(adv, "gates", []);
+    if (Array.isArray(ag) && ag.length > 0) {
+      html += '<h3 style="margin:18px 0 4px;font-size:14px;">Advisory checks (reported, not counted)</h3>' +
+        '<p class="opinion-note"><span aria-hidden="true">!</span>' +
+        num(g(adv, "passed", 0)) + " of " + num(g(adv, "total", 0)) +
+        " passed. These are the agent judging its own work (it wrote both the " +
+        "tests and the code, or a model graded the result), so a model that is " +
+        "confidently wrong scores itself green here. They are shown for context " +
+        "and can never raise or lower the verdict.</p>" + gateChips(ag);
     }
-    card.innerHTML = head + (chips ? '<div class="gates">' + chips + "</div>" : "");
+    card.innerHTML = html;
   }
 
   function renderFlagged(p) {
@@ -1204,9 +1238,23 @@
     if (hash) {
       kv += '<div class="k">Integrity hash</div><div class="v">' + esc(algo) + ":" + esc(hash) + "</div>";
     }
+    // Signing state, named explicitly. The hash-note below already says the
+    // hash does not prove provenance; without this row a reader is told what
+    // the receipt CANNOT do but never which state this particular receipt is
+    // in, nor how to change it. Signing is gated on LOKI_PROOF_GPG_KEY in
+    // proof-generator.py and is OFF by default -- deliberately, because a
+    // self-minted key would flip proof-verify.py's generator_trusted to false
+    // while the key came from the very process under audit.
+    var signed = !!g(p, "verification.gpg_signature", "");
+    kv += '<div class="k">Signature</div><div class="v">' +
+          (signed ? "SIGNED (detached GPG)" : "UNSIGNED") + "</div>";
+    var signNote = signed
+      ? '<p class="hash-note">This receipt carries a detached GPG signature over the same canonical bytes that were hashed. A verifier holding the signer public key can confirm its provenance offline with <code>loki proof verify</code>.</p>'
+      : '<p class="hash-note">This receipt is UNSIGNED, so it trusts the generator that produced it (<code>loki proof verify</code> reports <code>generator_trusted: true</code>). To sign future receipts, set <code>LOKI_PROOF_GPG_KEY</code> to a GPG key id before the run.</p>';
     card.innerHTML = '<div class="kv">' + kv + "</div>" +
       (hash ? '<p class="hash-note">The integrity hash is a ' + esc(algo) +
-              " digest of this proof. It proves the artifact has not been altered after it was emitted. It does not, by itself, prove who or what produced the work.</p>" : "");
+              " digest of this proof. It proves the artifact has not been altered after it was emitted. It does not, by itself, prove who or what produced the work.</p>" : "") +
+      signNote;
   }
 
   function renderCta(p) {

package/autonomy/lib/proof-verify.py

@@ -65,6 +65,7 @@ CLI:
 import hashlib
 import json
 import os
+import re
 import subprocess
 import sys
 
@@ -176,6 +177,57 @@ def _to_int(v, default=0):
 # headline re-derivation (MUST match proof-generator._compute_headline exactly)
 # ---------------------------------------------------------------------------
 
+# DRIFT-GUARD: mirrored from proof-generator.py. A gate the AGENT authored the
+# input to (it writes both the test and the fix) or that is an LLM judgment
+# cannot be independent evidence, so it must never force or lift a headline.
+# Keyed on the ADVISORY set so an unknown or renamed gate defaults to EXOGENOUS
+# and keeps its power to block -- fail-closed, never fail-open.
+#
+# This block exists because the generator gained a provenance split while this
+# file did not, and the two then disagreed about what a receipt meant. The
+# verifier is the INDEPENDENT re-derivation users are told to trust; if it
+# cannot reproduce the generator's headline, `loki proof verify` reports drift
+# on a receipt that was never tampered with -- a false alarm from our own trust
+# artifact, which is worse than no verifier at all.
+_ADVISORY_GATES = frozenset((
+    "test_coverage", "unit_tests", "test_suite", "semantic_tests", "tests",
+    "code_review", "devils_advocate", "devil_advocate", "magic_debate",
+    "council", "anti_sycophancy",
+))
+
+
+def _gate_key(name):
+    """Normalize a gate name for provenance lookup (mirrors the generator).
+
+    run.sh emits the same gate under multiple spellings (`static-analysis` vs
+    `static_analysis`) and track_gate_failure appends `_PAUSED`/`_ESCALATED`,
+    so an exact-match lookup would misfile real gates.
+    """
+    s = str(name or "").strip().lower().replace("-", "_")
+    return re.sub(r"_(paused|escalated|not_run|blocked)$", "", s)
+
+
+def _gate_provenance(name):
+    """'advisory' for a model-authored gate, else 'exogenous' (fail-closed)."""
+    return "advisory" if _gate_key(name) in _ADVISORY_GATES else "exogenous"
+
+
+def _is_exogenous(gate):
+    """Provenance of a gate dict, honoring a stamped value when present.
+
+    The generator stamps `provenance` so its `unresolved` override survives (a
+    gate that HALTED the run is an execution fact, not a model opinion). We
+    honor that stamp and fall back to name lookup for older receipts written
+    before the split existed.
+    """
+    if not isinstance(gate, dict):
+        return True
+    stamped = gate.get("provenance")
+    if stamped:
+        return stamped == "exogenous"
+    return _gate_provenance(gate.get("name")) == "exogenous"
+
+
 def _compute_headline(facts, degraded):
     """Deterministic headline re-derived from the recorded facts.