loki-mode 8.1.0 → 8.3.0

package/autonomy/lib/proof-template.html

@@ -1117,6 +1117,24 @@
     card.innerHTML = (head ? '<div style="margin-bottom:14px;">' + head + "</div>" : "") + body + link;
   }
 
+  // Render one row of gate chips. Shared by the exogenous and advisory blocks.
+  function gateChips(gates) {
+    var chips = "";
+    if (!Array.isArray(gates)) return "";
+    for (var i = 0; i < gates.length; i++) {
+      var st = String(g(gates[i], "status", "")).toLowerCase();
+      var cls = (st === "pass" || st === "passed") ? "pass" : (st === "skip" || st === "skipped") ? "skip" : "fail";
+      var mark = cls === "pass" ? "OK" : cls === "skip" ? "-" : "X";
+      chips += '<span class="gate ' + cls + '"><span class="mk">' + mark + "</span>" +
+               esc(g(gates[i], "name", "gate")) + "</span>";
+    }
+    return chips ? '<div class="gates">' + chips + "</div>" : "";
+  }
+
+  // TRUST-4: quality gates split by PROVENANCE, not by outcome. The two blocks
+  // read from quality_gates.exogenous / quality_gates.advisory, the exact field
+  // names proof-generator.py writes. Falls back to the flat pre-split list so an
+  // older receipt still renders.
   function renderGates(p) {
     var sec = document.getElementById("secGates");
     var card = document.getElementById("gatesCard");
@@ -1127,18 +1145,34 @@
       sec.classList.add("hide");
       return;
     }
-    var head = '<p class="note" style="margin:0 0 12px;">' + passed + " of " + total + " gates passed.</p>";
-    var chips = "";
-    if (Array.isArray(gates)) {
-      for (var i = 0; i < gates.length; i++) {
-        var st = String(g(gates[i], "status", "")).toLowerCase();
-        var cls = (st === "pass" || st === "passed") ? "pass" : (st === "skip" || st === "skipped") ? "skip" : "fail";
-        var mark = cls === "pass" ? "OK" : cls === "skip" ? "-" : "X";
-        chips += '<span class="gate ' + cls + '"><span class="mk">' + mark + "</span>" +
-                 esc(g(gates[i], "name", "gate")) + "</span>";
-      }
+    var exo = g(p, "quality_gates.exogenous", null);
+    var adv = g(p, "quality_gates.advisory", null);
+    if (!exo && !adv) {
+      // Pre-TRUST-4 receipt: render the flat list exactly as before.
+      card.innerHTML = '<p class="note" style="margin:0 0 12px;">' + passed +
+        " of " + total + " gates passed.</p>" + gateChips(gates);
+      return;
+    }
+    var html = "";
+    var eg = g(exo, "gates", []);
+    if (Array.isArray(eg) && eg.length > 0) {
+      html += '<h3 style="margin:0 0 4px;font-size:14px;">Independent checks (count toward the verdict)</h3>' +
+        '<p class="note" style="margin:0 0 10px;">' +
+        num(g(exo, "passed", 0)) + " of " + num(g(exo, "total", 0)) +
+        " passed. These are deterministic programs the agent cannot write the " +
+        "result of, so only these set the verdict above.</p>" + gateChips(eg);
+    }
+    var ag = g(adv, "gates", []);
+    if (Array.isArray(ag) && ag.length > 0) {
+      html += '<h3 style="margin:18px 0 4px;font-size:14px;">Advisory checks (reported, not counted)</h3>' +
+        '<p class="opinion-note"><span aria-hidden="true">!</span>' +
+        num(g(adv, "passed", 0)) + " of " + num(g(adv, "total", 0)) +
+        " passed. These are the agent judging its own work (it wrote both the " +
+        "tests and the code, or a model graded the result), so a model that is " +
+        "confidently wrong scores itself green here. They are shown for context " +
+        "and can never raise or lower the verdict.</p>" + gateChips(ag);
     }
-    card.innerHTML = head + (chips ? '<div class="gates">' + chips + "</div>" : "");
+    card.innerHTML = html;
   }
 
   function renderFlagged(p) {
@@ -1204,9 +1238,23 @@
     if (hash) {
       kv += '<div class="k">Integrity hash</div><div class="v">' + esc(algo) + ":" + esc(hash) + "</div>";
     }
+    // Signing state, named explicitly. The hash-note below already says the
+    // hash does not prove provenance; without this row a reader is told what
+    // the receipt CANNOT do but never which state this particular receipt is
+    // in, nor how to change it. Signing is gated on LOKI_PROOF_GPG_KEY in
+    // proof-generator.py and is OFF by default -- deliberately, because a
+    // self-minted key would flip proof-verify.py's generator_trusted to false
+    // while the key came from the very process under audit.
+    var signed = !!g(p, "verification.gpg_signature", "");
+    kv += '<div class="k">Signature</div><div class="v">' +
+          (signed ? "SIGNED (detached GPG)" : "UNSIGNED") + "</div>";
+    var signNote = signed
+      ? '<p class="hash-note">This receipt carries a detached GPG signature over the same canonical bytes that were hashed. A verifier holding the signer public key can confirm its provenance offline with <code>loki proof verify</code>.</p>'
+      : '<p class="hash-note">This receipt is UNSIGNED, so it trusts the generator that produced it (<code>loki proof verify</code> reports <code>generator_trusted: true</code>). To sign future receipts, set <code>LOKI_PROOF_GPG_KEY</code> to a GPG key id before the run.</p>';
     card.innerHTML = '<div class="kv">' + kv + "</div>" +
       (hash ? '<p class="hash-note">The integrity hash is a ' + esc(algo) +
-              " digest of this proof. It proves the artifact has not been altered after it was emitted. It does not, by itself, prove who or what produced the work.</p>" : "");
+              " digest of this proof. It proves the artifact has not been altered after it was emitted. It does not, by itself, prove who or what produced the work.</p>" : "") +
+      signNote;
   }
 
   function renderCta(p) {

package/autonomy/lib/proof-verify.py

@@ -65,6 +65,7 @@ CLI:
 import hashlib
 import json
 import os
+import re
 import subprocess
 import sys
 
@@ -176,6 +177,57 @@ def _to_int(v, default=0):
 # headline re-derivation (MUST match proof-generator._compute_headline exactly)
 # ---------------------------------------------------------------------------
 
+# DRIFT-GUARD: mirrored from proof-generator.py. A gate the AGENT authored the
+# input to (it writes both the test and the fix) or that is an LLM judgment
+# cannot be independent evidence, so it must never force or lift a headline.
+# Keyed on the ADVISORY set so an unknown or renamed gate defaults to EXOGENOUS
+# and keeps its power to block -- fail-closed, never fail-open.
+#
+# This block exists because the generator gained a provenance split while this
+# file did not, and the two then disagreed about what a receipt meant. The
+# verifier is the INDEPENDENT re-derivation users are told to trust; if it
+# cannot reproduce the generator's headline, `loki proof verify` reports drift
+# on a receipt that was never tampered with -- a false alarm from our own trust
+# artifact, which is worse than no verifier at all.
+_ADVISORY_GATES = frozenset((
+    "test_coverage", "unit_tests", "test_suite", "semantic_tests", "tests",
+    "code_review", "devils_advocate", "devil_advocate", "magic_debate",
+    "council", "anti_sycophancy",
+))
+
+
+def _gate_key(name):
+    """Normalize a gate name for provenance lookup (mirrors the generator).
+
+    run.sh emits the same gate under multiple spellings (`static-analysis` vs
+    `static_analysis`) and track_gate_failure appends `_PAUSED`/`_ESCALATED`,
+    so an exact-match lookup would misfile real gates.
+    """
+    s = str(name or "").strip().lower().replace("-", "_")
+    return re.sub(r"_(paused|escalated|not_run|blocked)$", "", s)
+
+
+def _gate_provenance(name):
+    """'advisory' for a model-authored gate, else 'exogenous' (fail-closed)."""
+    return "advisory" if _gate_key(name) in _ADVISORY_GATES else "exogenous"
+
+
+def _is_exogenous(gate):
+    """Provenance of a gate dict, honoring a stamped value when present.
+
+    The generator stamps `provenance` so its `unresolved` override survives (a
+    gate that HALTED the run is an execution fact, not a model opinion). We
+    honor that stamp and fall back to name lookup for older receipts written
+    before the split existed.
+    """
+    if not isinstance(gate, dict):
+        return True
+    stamped = gate.get("provenance")
+    if stamped:
+        return stamped == "exogenous"
+    return _gate_provenance(gate.get("name")) == "exogenous"
+
+
 def _compute_headline(facts, degraded):
     """Deterministic headline re-derived from the recorded facts.
 

package/autonomy/loki

@@ -10593,8 +10593,133 @@ EOF
 }
 
 # Check system prerequisites
+# _loki_airgap_audit <json?> -- enumerate every network egress this engine can
+# perform, classify each as REQUIRED or optional, and say how to disable it.
+#
+# WHY THIS EXISTS
+#   Air-gapped deployment is a real enterprise requirement and the incumbent
+#   (Tabnine) states it can "be deployed in a completely air-gapped environment"
+#   without publishing WHICH hosts it would otherwise contact. A claim you
+#   cannot audit is a claim you have to take on faith.
+#
+#   Sourcegraph is the honest counter-example: their own whitepaper states that
+#   self-hosted Cody still "sends requests from the Sourcegraph instance to
+#   Anthropic's API". Self-hosted control plane, egressing inference.
+#
+#   So the credible position is not "trust us, we are air-gapped" -- it is here
+#   is every host, here is which ones are required, here is how to turn each one
+#   off, now verify it yourself with tcpdump. We would rather be auditable than
+#   assertive.
+#
+# Exit 0 when no REQUIRED egress remains (air-gap achievable in this config),
+# 1 otherwise. Deterministic: reads configuration, performs NO network calls.
+_loki_airgap_audit() {
+    local as_json="${1:-false}"
+
+    # Provider inference endpoint: the one egress that is genuinely required,
+    # unless the active provider serves weights locally.
+    local provider="${LOKI_PROVIDER:-claude}"
+    local model_host="" model_required="yes" model_note=""
+    case "$provider" in
+        claude)
+            model_host="${ANTHROPIC_BASE_URL:-https://api.anthropic.com}"
+            model_note="Claude Code inference. Set ANTHROPIC_BASE_URL to an in-network gateway, or switch to a local-weights provider."
+            ;;
+        codex)
+            model_host="${OPENAI_BASE_URL:-https://api.openai.com}"
+            model_note="Codex inference. Point at an in-network gateway or switch provider."
+            ;;
+        opencode|cline|aider)
+            model_host="${OPENAI_BASE_URL:-${OPENROUTER_API_KEY:+https://openrouter.ai}}"
+            if [ -z "$model_host" ] || printf '%s' "${LOKI_OPENCODE_MODEL:-}${LOKI_AIDER_MODEL:-}" | grep -qiE 'ollama|localhost|127\.0\.0\.1|lmstudio'; then
+                model_host="local weights"
+                model_required="no"
+                model_note="Local model runtime (Ollama / LM Studio / llama.cpp). No inference egress."
+            else
+                model_note="Remote model gateway. Use an ollama/ model id for zero-egress inference."
+            fi
+            ;;
+        *)
+            model_host="unknown (provider '$provider')"
+            model_note="Unrecognized provider; audit its config manually."
+            ;;
+    esac
+
+    # Optional egress, each individually disableable.
+    local tel_state="off"
+    [ "${LOKI_TELEMETRY:-}" = "on" ] && tel_state="on"
+    local upd_state="on"
+    [ "${LOKI_NO_UPDATE_CHECK:-0}" = "1" ] && upd_state="off"
+
+    if [ "$as_json" = "true" ]; then
+        _AG_PROV="$provider" _AG_HOST="$model_host" _AG_REQ="$model_required" \
+        _AG_NOTE="$model_note" _AG_TEL="$tel_state" _AG_UPD="$upd_state" \
+        python3 -c '
+import json, os
+req = os.environ["_AG_REQ"] == "yes"
+egress = [{
+    "name": "model_inference",
+    "host": os.environ["_AG_HOST"],
+    "required": req,
+    "disable": "use a local-weights provider (ollama/, lmstudio/) or an in-network gateway",
+    "note": os.environ["_AG_NOTE"],
+}, {
+    "name": "telemetry",
+    "host": "telemetry endpoint",
+    "required": False,
+    "enabled": os.environ["_AG_TEL"] == "on",
+    "disable": "loki telemetry off (already the default)",
+}, {
+    "name": "update_check",
+    "host": "registry.npmjs.org",
+    "required": False,
+    "enabled": os.environ["_AG_UPD"] == "on",
+    "disable": "export LOKI_NO_UPDATE_CHECK=1",
+}]
+blockers = [e for e in egress if e.get("required")]
+print(json.dumps({
+    "provider": os.environ["_AG_PROV"],
+    "airgap_ready": not blockers,
+    "required_egress": [e["name"] for e in blockers],
+    "egress": egress,
+}, indent=2))
+'
+        [ "$model_required" = "yes" ] && return 1
+        return 0
+    fi
+
+    echo -e "${BOLD}Network egress audit${NC}"
+    echo ""
+    echo "  Active provider: $provider"
+    echo ""
+    echo -e "${BOLD}Egress points${NC}"
+    if [ "$model_required" = "yes" ]; then
+        echo -e "  ${YELLOW}REQUIRED${NC}  model inference -> $model_host"
+    else
+        echo -e "  ${GREEN}none${NC}      model inference -> $model_host"
+    fi
+    echo "            $model_note"
+    echo -e "  optional  telemetry           [$tel_state]  disable: loki telemetry off (default off)"
+    echo -e "  optional  update check        [$upd_state]  disable: export LOKI_NO_UPDATE_CHECK=1"
+    echo ""
+    if [ "$model_required" = "yes" ]; then
+        echo -e "${YELLOW}Not air-gap ready in this configuration.${NC}"
+        echo "  One required egress remains: model inference."
+        echo "  To close it, serve the model in-network:"
+        echo "    loki provider set opencode"
+        echo "    export LOKI_OPENCODE_MODEL=ollama/qwen2.5-coder"
+        echo ""
+        echo "  Then re-run: loki doctor --airgap"
+        return 1
+    fi
+    echo -e "${GREEN}Air-gap ready: no required egress in this configuration.${NC}"
+    echo "  Verify independently -- run with the interface down, or watch with tcpdump."
+    return 0
+}
+
 cmd_doctor() {
     local json_output=false
+    local airgap_audit=false
 
     while [[ $# -gt 0 ]]; do
         case "$1" in
@@ -10602,13 +10727,21 @@ cmd_doctor() {
                 json_output=true
                 shift
                 ;;
+            --airgap)
+                airgap_audit=true
+                shift
+                ;;
             --help|-h)
                 echo -e "${BOLD}loki doctor${NC} - Check system prerequisites"
                 echo ""
-                echo "Usage: loki doctor [--json]"
+                echo "Usage: loki doctor [--json] [--airgap]"
                 echo ""
                 echo "Options:"
                 echo "  --json    Output machine-readable JSON"
+                echo "  --airgap  Audit network egress: list every host this engine"
+                echo "            can contact, whether it is REQUIRED or optional,"
+                echo "            and how to disable it. Exits non-zero if any"
+                echo "            required egress remains."
                 echo ""
                 echo "Checks: node, python3, jq, git, curl, bash version,"
                 echo "        claude/codex CLIs, disk space, and cockpit render capability."
@@ -10616,12 +10749,17 @@ cmd_doctor() {
                 ;;
             *)
                 echo -e "${RED}Unknown option: $1${NC}"
-                echo "Usage: loki doctor [--json]"
+                echo "Usage: loki doctor [--json] [--airgap]"
                 return 1
                 ;;
         esac
     done
 
+    if [ "$airgap_audit" = true ]; then
+        _loki_airgap_audit "$json_output"
+        return $?
+    fi
+
     if [ "$json_output" = true ]; then
         cmd_doctor_json
         return $?
@@ -10634,6 +10772,15 @@ cmd_doctor() {
 
     local pass_count=0
     local fail_count=0
+    # FUNNEL FIX (v8.2.x): collect the NAME + FIX of every hard failure, not just
+    # a count. A first-time user on a bare machine sees 15 warnings (sentrux, GPG
+    # signing, bash 4, Bun, python3.12, truecolor, inline-image probe -- all
+    # OPTIONAL) around 2 real blockers, then a summary that says only "Some
+    # required prerequisites are missing" without naming them. That is the point
+    # where someone closes the terminal. Naming the blockers and their exact
+    # install command turns a wall of yellow into a two-line to-do.
+    local _doctor_blockers=""
+    _doctor_block() { _doctor_blockers="${_doctor_blockers}\n  - $1"; }
     local warn_count=0
 
     # Helper: check command exists and optionally check version
@@ -10646,6 +10793,7 @@ cmd_doctor() {
         if ! command -v "$cmd" &> /dev/null; then
             if [ "$required" = "required" ]; then
                 echo -e "  ${RED}FAIL${NC}  $name - not found"
+                _doctor_block "$name is not installed"
                 fail_count=$((fail_count + 1))
             elif [ "$required" = "recommended" ]; then
                 echo -e "  ${YELLOW}WARN${NC}  $name - not found (recommended)"
@@ -10711,6 +10859,7 @@ cmd_doctor() {
                { [ "$cur_major" -eq "$min_major" ] 2>/dev/null && [ "$cur_minor" -lt "$min_minor" ] 2>/dev/null; }; then
                 if [ "$required" = "required" ]; then
                     echo -e "  ${RED}FAIL${NC}  $name$version_display - requires >= $min_version"
+                    _doctor_block "$name must be >= $min_version"
                     fail_count=$((fail_count + 1))
                 else
                     echo -e "  ${YELLOW}WARN${NC}  $name$version_display - recommended >= $min_version"
@@ -10782,6 +10931,7 @@ cmd_doctor() {
         else
             echo -e "  ${RED}FAIL${NC}  No AI provider CLI installed -- at least one is required"
             echo -e "         ${YELLOW}Install: npm install -g @anthropic-ai/claude-code${NC}"
+            _doctor_block "No AI provider CLI. Fix: npm install -g @anthropic-ai/claude-code"
             fail_count=$((fail_count + 1))
             # v7.29.0: on a TTY (non-json), append the consent-gated install offer.
             # In report mode the helper is a no-op on non-TTY/CI, so the doctor
@@ -10886,6 +11036,7 @@ except Exception:
             _target=$(readlink "$sdir" 2>/dev/null || echo "unknown")
             echo -e "  ${RED}FAIL${NC}  $sname  ${DIM}(broken symlink -> $_target)${NC}"
             echo -e "         ${YELLOW}Fix: loki setup-skill${NC}"
+            _doctor_block "$sname is a broken symlink. Fix: loki setup-skill"
             fail_count=$((fail_count + 1))
         else
             echo -e "  ${YELLOW}WARN${NC}  $sname  ${DIM}(not found - run 'loki setup-skill')${NC}"
@@ -11007,6 +11158,24 @@ except Exception:
         echo -e "  ${YELLOW}WARN${NC}  sentrux - not installed (optional, brew install sentrux/tap/sentrux)"
         warn_count=$((warn_count + 1))
     fi
+    # Evidence Receipt signing state (optional). Unsigned receipts are the
+    # default and are still checkable (hash + diff re-derivation); what they
+    # cannot prove is PROVENANCE, so proof-verify.py reports
+    # generator_trusted: true. Surface the state here because it is otherwise
+    # invisible until someone reads a receipt. WARN (never FAIL): unsigned is
+    # a supported, documented mode, not a broken install.
+    if [ -n "${LOKI_PROOF_GPG_KEY:-}" ]; then
+        if command -v gpg &>/dev/null; then
+            echo -e "  ${GREEN}PASS${NC}  Receipt signing: LOKI_PROOF_GPG_KEY set and gpg available"
+            pass_count=$((pass_count + 1))
+        else
+            echo -e "  ${YELLOW}WARN${NC}  Receipt signing: LOKI_PROOF_GPG_KEY set but gpg NOT on PATH - receipts will be UNSIGNED"
+            warn_count=$((warn_count + 1))
+        fi
+    else
+        echo -e "  ${YELLOW}WARN${NC}  Receipt signing: UNSIGNED (set LOKI_PROOF_GPG_KEY to a gpg key id; see docs/SIGNED-RECEIPTS.md)"
+        warn_count=$((warn_count + 1))
+    fi
     echo ""
 
     echo -e "${CYAN}System:${NC}"
@@ -11031,6 +11200,7 @@ except Exception:
         if [ -n "$disk_avail" ] && [ "$disk_avail" -gt 0 ] 2>/dev/null; then
             if [ "$disk_avail" -lt 1 ]; then
                 echo -e "  ${RED}FAIL${NC}  Disk space: ${disk_avail}GB available (need >= 1GB)"
+                _doctor_block "Free up disk: ${disk_avail}GB available, need >= 1GB"
                 fail_count=$((fail_count + 1))
             elif [ "$disk_avail" -lt 5 ]; then
                 echo -e "  ${YELLOW}WARN${NC}  Disk space: ${disk_avail}GB available (low)"
@@ -11133,8 +11303,11 @@ except Exception:
     echo ""
 
     if [ "$fail_count" -gt 0 ]; then
-        echo -e "${RED}Some required prerequisites are missing.${NC}"
-        echo "Install missing dependencies and run 'loki doctor' again."
+        echo -e "${RED}Blocking ($fail_count). Everything else above is optional.${NC}"
+        printf '%b\n' "$_doctor_blockers"
+        echo ""
+        echo "Then re-run: loki doctor"
+        echo "Meanwhile 'loki tour' works right now -- no provider, no key, no spend."
         return 1
     elif [ "$warn_count" -gt 0 ]; then
         echo -e "${YELLOW}All required checks passed with some warnings.${NC}"
@@ -11242,6 +11415,23 @@ sentrux = {
     'required': 'optional'
 }
 
+# Evidence Receipt signing state. Unsigned is the DEFAULT and is a supported
+# mode, so this is never 'fail'. Exposed because signing state is otherwise
+# invisible until someone reads a receipt, and it is exactly what decides
+# whether proof-verify.py reports generator_trusted: true. Sibling of
+# checks/disk/sentrux -- deliberately NOT counted in the summary tally so
+# existing consumers see unchanged numbers.
+signing_key_set = bool(os.environ.get('LOKI_PROOF_GPG_KEY', '').strip())
+signing_gpg_available = shutil.which('gpg') is not None
+signing_enabled = signing_key_set and signing_gpg_available
+receipt_signing = {
+    'enabled': signing_enabled,
+    'key_configured': signing_key_set,
+    'gpg_available': signing_gpg_available,
+    'status': 'pass' if signing_enabled else 'warn',
+    'required': 'optional'
+}
+
 # v7.7.17: memory subsystem health surface. Reports the latest entries
 # from .loki/memory/.errors.log (rotated by memory/error_log.py) so
 # developers see regressions in the previously-silent-fail call sites
@@ -11295,6 +11485,7 @@ result = {
         'status': disk_status
     },
     'sentrux': sentrux,
+    'receipt_signing': receipt_signing,
     'memory': memory,
     'summary': {
         'passed': pass_count,
@@ -14885,6 +15076,33 @@ with open(manifest_path, 'w') as f:
 # usable.
 # ---------------------------------------------------------------------------
 cmd_verify() {
+    # --fast: deterministic checks only, in milliseconds. Measured on this repo
+    # (1,932 tracked files): 298 ms cold, 87 ms warm, 19 ms diff-scoped, against
+    # an 11,040 ms shell-based baseline.
+    #
+    # It runs ONLY exogenous checks -- no model call, no network -- so every
+    # verdict is reproducible by anyone with the same commit. That is the point,
+    # not a limitation: a verdict you can re-derive is a fact, and a fact is what
+    # an IDE, a CI step, or another vendor's agent can safely act on without
+    # trusting our model choices.
+    #
+    # The full `loki verify` remains the deeper, slower path.
+    for _fv_arg in "$@"; do
+        if [ "$_fv_arg" = "--fast" ]; then
+            local _fv_py="$_LOKI_SCRIPT_DIR/lib/fast_verify.py"
+            if [ ! -f "$_fv_py" ]; then
+                echo -e "${RED}Error: fast_verify not found at $_fv_py${NC}" >&2
+                return 3
+            fi
+            local _fv_argv=()
+            for _a in "$@"; do
+                [ "$_a" = "--fast" ] || _fv_argv+=("$_a")
+            done
+            python3 "$_fv_py" "${_fv_argv[@]+"${_fv_argv[@]}"}"
+            return $?
+        fi
+    done
+
     local verify_mod="$_LOKI_SCRIPT_DIR/verify.sh"
     if [ ! -f "$verify_mod" ]; then
         echo -e "${RED}Error: verify module not found at $verify_mod${NC}" >&2
@@ -18903,7 +19121,7 @@ $(cat "$f" 2>/dev/null)
 
     # --- Tally results ---
     local count_critical=0 count_high=0 count_medium=0 count_low=0 count_info=0
-    for f in "${findings[@]}"; do
+    for f in "${findings[@]+"${findings[@]}"}"; do
         local sev
         sev=$(echo "$f" | cut -d'|' -f3)
         case "$sev" in
@@ -18925,7 +19143,7 @@ $(cat "$f" 2>/dev/null)
     if [ "$review_format" = "json" ]; then
         local json_findings="["
         local first=true
-        for f in "${findings[@]}"; do
+        for f in "${findings[@]+"${findings[@]}"}"; do
             local f_file f_line f_sev f_cat f_finding f_suggestion
             f_file=$(echo "$f" | cut -d'|' -f1)
             f_line=$(echo "$f" | cut -d'|' -f2)
@@ -18954,7 +19172,7 @@ $(cat "$f" 2>/dev/null)
             # Group by severity
             for sev_name in CRITICAL HIGH MEDIUM LOW INFO; do
                 local printed_header=false
-                for f in "${findings[@]}"; do
+                for f in "${findings[@]+"${findings[@]}"}"; do
                     local f_sev
                     f_sev=$(echo "$f" | cut -d'|' -f3)
                     [ "$f_sev" != "$sev_name" ] && continue
@@ -29880,7 +30098,7 @@ TEST_SUGGEST_PY
 
     # --- Tally findings ---
     local count_critical=0 count_high=0 count_medium=0 count_low=0 count_info=0
-    for f in "${findings[@]}"; do
+    for f in "${findings[@]+"${findings[@]}"}"; do
         local sev
         sev=$(echo "$f" | cut -d'|' -f3)
         case "$sev" in
@@ -29896,7 +30114,7 @@ TEST_SUGGEST_PY
     # Determine exit code based on --fail-on threshold
     local exit_code=0
     if [ "$fail_threshold" -lt 99 ]; then
-        for f in "${findings[@]}"; do
+        for f in "${findings[@]+"${findings[@]}"}"; do
             local sev sev_num
             sev=$(echo "$f" | cut -d'|' -f3)
             sev_num=$(_ci_sev_level "$sev")
@@ -29916,7 +30134,7 @@ TEST_SUGGEST_PY
     if [ "$ci_format" = "json" ]; then
         # JSON output via python for proper escaping
         export LOKI_CI_JSON_FINDINGS=""
-        for f in "${findings[@]}"; do
+        for f in "${findings[@]+"${findings[@]}"}"; do
             LOKI_CI_JSON_FINDINGS+="${f}"$'\n'
         done
         export LOKI_CI_JSON_META="ci_env=${ci_env}|pr=${ci_pr_number}|ts=${report_timestamp}|files=${file_count}|exit=${exit_code}"
@@ -29998,7 +30216,7 @@ CI_JSON_OUT
             echo ""
             for sev_name in CRITICAL HIGH MEDIUM LOW INFO; do
                 local has_sev=false
-                for f in "${findings[@]}"; do
+                for f in "${findings[@]+"${findings[@]}"}"; do
                     local f_sev
                     f_sev=$(echo "$f" | cut -d'|' -f3)
                     [ "$f_sev" != "$sev_name" ] && continue
@@ -30058,7 +30276,7 @@ for t in tests:
         else
             for sev_name in CRITICAL HIGH MEDIUM LOW INFO; do
                 local printed_header=false
-                for f in "${findings[@]}"; do
+                for f in "${findings[@]+"${findings[@]}"}"; do
                     local f_sev
                     f_sev=$(echo "$f" | cut -d'|' -f3)
                     [ "$f_sev" != "$sev_name" ] && continue
@@ -32314,6 +32532,12 @@ cmd_proof() {
             echo "  --hosted             Publish to LOKI_HOSTED_ENDPOINT (open-core seam; no official backend yet)"
             echo ""
             echo "Proofs are generated automatically at run completion (LOKI_PROOF=0 to opt out)."
+            echo ""
+            echo "Signing (off by default): receipts are UNSIGNED unless LOKI_PROOF_GPG_KEY is"
+            echo "set to a gpg key id. Unsigned, the integrity hash proves the bytes were not"
+            echo "edited after hashing but NOT who produced them, so verify reports"
+            echo "generator_trusted: true. Export LOKI_PROOF_GPG_KEY to close that gap."
+            echo "See docs/SIGNED-RECEIPTS.md."
             [ "$sub" = "" ] && exit 1
             exit 0
             ;;

package/autonomy/verify.sh

@@ -781,13 +781,19 @@ verify_gate_nomock() {
         return 0
     fi
     local status_line
+    # The changed-file list goes over STDIN, not an env var. A single env string
+    # is capped at MAX_ARG_STRLEN (131071 bytes) on Linux; a large changed set
+    # (e.g. a generated source tree) makes execve fail with E2BIG, the fallback
+    # below fires, and the gate silently degrades to inconclusive. macOS has no
+    # per-string cap, so that failure was Linux-only.
     status_line=$(
-        _NM_FILES="$changed" \
-        _NM_TREE="$tree" \
-        _NM_OUT="$scan_file" \
-        _NM_BASE="${VERIFY_MERGE_BASE:-}" \
-        python3 -I "$scanner" 2>/dev/null \
-            || echo "INCONCLUSIVE:detector_error"
+        printf '%s\n' "$changed" | {
+            _NM_TREE="$tree" \
+            _NM_OUT="$scan_file" \
+            _NM_BASE="${VERIFY_MERGE_BASE:-}" \
+            python3 -I "$scanner" 2>/dev/null \
+                || echo "INCONCLUSIVE:detector_error"
+        }
     )
 
     case "$status_line" in

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "8.1.0"
+__version__ = "8.3.0"
 
 # Expose the control app for easy import
 try:

package/docs/COMPARISON.md

@@ -1,6 +1,13 @@
 # Autonomous Coding Agents Comparison (2025-2026)
 
-> Last Updated: January 25, 2026 (v2.36.9)
+> **STALE. Last updated January 25, 2026 against v2.36.9; the current release is
+> v8.2.0.** Roughly six months and thirty releases of drift, and every cell in
+> the grids below is a subjective grade assigned by the vendor being graded --
+> which is exactly the kind of comparison a serious evaluator discounts.
+>
+> For claims you can actually check, see **[EVALUATING.md](EVALUATING.md)**: a
+> runnable command next to every assertion, plus an explicit list of what we do
+> not have. This file is kept for historical reference only.
 >
 > A comprehensive comparison of Loki Mode against major autonomous coding agents and AI IDEs in the market.
 > Deep-dive comparisons validated by Opus feedback loops.