loki-mode 8.83.0 → 8.85.0

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: Autonomous spec-driven build system with a built-in trust layer. It does not call work done until it is verified (RARV-C closure loop, 8 quality gates, completion council, verified-completion evidence gate). Triggers on "Loki Mode". Takes a spec (PRD, GitHub issue, OpenAPI doc, etc.) to deployed product with minimal human intervention. Provider-agnostic. Requires --dangerously-skip-permissions flag.
 ---
 
-# Loki Mode v8.83.0
+# Loki Mode v8.85.0
 
 **You are an autonomous agent. You make decisions. You do not ask questions. You do not stop.**
 
@@ -469,4 +469,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v8.83.0 | [Autonomi](https://www.autonomi.dev/) flagship product | ~410 lines core**
+**v8.85.0 | [Autonomi](https://www.autonomi.dev/) flagship product | ~410 lines core**

package/VERSION

@@ -1 +1 @@
-8.83.0
+8.85.0

package/autonomy/loki

@@ -33749,6 +33749,21 @@ PYEOF
             # inconsistent edit is caught. It does NOT prove non-forgeability on
             # the unsigned path (a hand-forger can rewrite facts and re-hash);
             # neutral non-forgeability requires the signed record.
+            # --human renders the verdict plus every failure reason as prose.
+            # JSON stays the DEFAULT so machine consumers, which pipe this
+            # stdout verbatim, are unaffected. The flag is STRIPPED from the
+            # positional args rather than assumed at a fixed index, so it works
+            # before or after the id.
+            local _pv_human=0 _pv_args=()
+            local _pv_a
+            for _pv_a in "$@"; do
+                case "$_pv_a" in
+                    --human) _pv_human=1 ;;
+                    *) _pv_args+=("$_pv_a") ;;
+                esac
+            done
+            set -- "${_pv_args[@]+"${_pv_args[@]}"}"
+
             local id="${1:-}"
             if [ -z "$id" ]; then
                 echo -e "${RED}Missing proof id.${NC} Use 'loki proof list'."
@@ -33767,7 +33782,11 @@ PYEOF
                 echo -e "${RED}Verifier not found (autonomy/lib/proof-verify.py).${NC}"
                 exit 2
             fi
-            python3 "$verifier" "$pj" "${TARGET_DIR:-.}"
+            if [ "$_pv_human" -eq 1 ]; then
+                python3 "$verifier" --human "$pj" "${TARGET_DIR:-.}"
+            else
+                python3 "$verifier" "$pj" "${TARGET_DIR:-.}"
+            fi
             exit $?
             ;;
         open)

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "8.83.0"
+__version__ = "8.85.0"
 
 # Expose the control app for easy import
 try:

package/loki-ts/dist/loki.js

@@ -1,5 +1,5 @@
 // @bun
-var m_=Object.create;var{getPrototypeOf:u_,defineProperty:eK,getOwnPropertyNames:p_}=Object;var d_=Object.prototype.hasOwnProperty;function c_(Z){return this[Z]}var l_,i_,a_=(Z,X,Q)=>{var Y=Z!=null&&typeof Z==="object";if(Y){var J=X?l_??=new WeakMap:i_??=new WeakMap,z=J.get(Z);if(z)return z}Q=Z!=null?m_(u_(Z)):{};let K=X||!Z||!Z.__esModule?eK(Q,"default",{value:Z,enumerable:!0}):Q;for(let $ of p_(Z))if(!d_.call(K,$))eK(K,$,{get:c_.bind(Z,$),enumerable:!0});if(Y)J.set(Z,K);return K};var HQ=(Z,X)=>()=>(X||Z((X={exports:{}}).exports,X),X.exports);var s_=(Z)=>Z;function n_(Z,X){this[Z]=s_.bind(null,X)}var l0=(Z,X)=>{for(var Q in X)eK(Z,Q,{get:X[Q],enumerable:!0,configurable:!0,set:n_.bind(X,Q)})};var p=(Z,X)=>()=>(Z&&(X=Z(Z=0)),X);var e0=import.meta.require;var kO={};l0(kO,{lokiDir:()=>j0,homeLokiDir:()=>R4,findRepoRootForVersion:()=>X$,REPO_ROOT:()=>i0});import{resolve as n7,dirname as Z$}from"path";import{fileURLToPath as o_}from"url";import{existsSync as UQ}from"fs";import{homedir as r_}from"os";function t_(){let Z=RO;for(let X=0;X<6;X++){if(UQ(n7(Z,"VERSION"))&&UQ(n7(Z,"autonomy/run.sh")))return Z;let Q=Z$(Z);if(Q===Z)break;Z=Q}return n7(RO,"..","..","..")}function X$(Z){let X=Z;for(let Q=0;Q<6;Q++){if(UQ(n7(X,"VERSION"))&&UQ(n7(X,"autonomy/run.sh")))return X;let Y=Z$(X);if(Y===X)break;X=Y}return n7(Z,"..","..","..")}function j0(){return process.env.LOKI_DIR??n7(process.cwd(),".loki")}function R4(){return n7(r_(),".loki")}var RO,i0;var H8=p(()=>{RO=Z$(o_(import.meta.url));i0=t_()});import{readFileSync as e_}from"fs";import{resolve as Zf,dirname as Xf}from"path";import{fileURLToPath as Qf}from"url";function h3(){if(h5!==null)return h5;let Z="8.83.0";if(typeof Z==="string"&&Z.length>0)return h5=Z,h5;try{let X=Xf(Qf(import.meta.url)),Q=X$(X);h5=e_(Zf(Q,"VERSION"),"utf-8").trim()}catch{h5="unknown"}return h5}var h5=null;var BQ=p(()=>{H8()});var bO={};l0(bO,{runOrThrow:()=>jf,run:()=>E0,readStreamCapped:()=>NQ,commandVersion:()=>Tf,commandExists:()=>X9,ShellError:()=>Q$,MAX_STDOUT_BYTES:()=>yO});async function NQ(Z,X=yO){let Q=Z.getReader(),Y=new TextDecoder,J="",z=0;try{while(z<X){let{done:K,value:$}=await Q.read();if(K)break;if(!$)continue;if(z+=$.byteLength,z>X){let W=$.byteLength-(z-X);J+=Y.decode($.subarray(0,W),{stream:!0});break}J+=Y.decode($,{stream:!0})}J+=Y.decode()}finally{try{await Q.cancel()}catch{}Q.releaseLock()}return J}async function E0(Z,X={}){let Q=Bun.spawn({cmd:[...Z],stdout:"pipe",stderr:"pipe",env:X.env?{...process.env,...X.env}:process.env,cwd:X.cwd}),Y,J;if(X.timeoutMs&&X.timeoutMs>0)Y=setTimeout(()=>{try{Q.kill("SIGTERM")}catch{}J=setTimeout(()=>{try{Q.kill("SIGKILL")}catch{}},2000)},X.timeoutMs);try{let[z,K,$]=await Promise.all([NQ(Q.stdout),new Response(Q.stderr).text(),Q.exited]);return{stdout:z,stderr:K,exitCode:$}}finally{if(Y)clearTimeout(Y);if(J)clearTimeout(J)}}async function jf(Z,X={}){let Q=await E0(Z,X);if(Q.exitCode!==0)throw new Q$(`command failed (${Q.exitCode}): ${Z.join(" ")}`,Q.exitCode,Q.stdout,Q.stderr);return Q}async function X9(Z){let X=Mf(Z),Q=await E0(["sh","-c",`command -v ${X}`],{timeoutMs:5000});if(Q.exitCode===0)return Q.stdout.trim()||null;return null}function Mf(Z){if(!/^[A-Za-z0-9._/-]+$/.test(Z))throw Error(`refused to shell-escape suspect token: ${Z}`);return Z}async function Tf(Z,X="--version"){if(!await X9(Z))return null;let Y=await E0([Z,X],{timeoutMs:5000});if(Y.exitCode!==0)return null;return((Y.stdout||Y.stderr).split(/\r?\n/)[0]?.trim()??"")||null}var yO=16777216,Q$;var x9=p(()=>{Q$=class Q$ extends Error{message;exitCode;stdout;stderr;constructor(Z,X,Q,Y){super(Z);this.message=Z;this.exitCode=X;this.stdout=Q;this.stderr=Y;this.name="ShellError"}}});function o7(Z){return wf?"":Z}var wf,L0,F8,p0,zV0,a0,W8,Q9,v;var S6=p(()=>{wf=(process.env.NO_COLOR??"").length>0;L0=o7("\x1B[0;31m"),F8=o7("\x1B[0;32m"),p0=o7("\x1B[1;33m"),zV0=o7("\x1B[0;34m"),a0=o7("\x1B[0;36m"),W8=o7("\x1B[1m"),Q9=o7("\x1B[2m"),v=o7("\x1B[0m")});import{existsSync as bf}from"fs";async function E7(){if(x4!==void 0)return x4;let Z="/opt/homebrew/bin/python3.12";if(bf(Z))return x4=Z,Z;let X=await X9("python3.12");if(X)return x4=X,X;let Q=await X9("python3");return x4=Q,Q}async function Y7(Z,X={}){let Q=await E7();if(!Q)return{stdout:"",stderr:"python3 not found",exitCode:127};return E0([Q,"-c",Z],X)}var x4;var r7=p(()=>{x9()});var ZL={};l0(ZL,{runStatus:()=>Kh});import{existsSync as Y9,readFileSync as g3,readdirSync as iO,statSync as aO}from"fs";import{resolve as h8,basename as rf}from"path";import{homedir as tf}from"os";function sO(Z){let X=Math.trunc(Z);if(X>=1e6)return`${(Math.trunc(X/1e6*10)/10).toFixed(1)}M`;if(X>=1000)return`${(Math.trunc(X/1000*10)/10).toFixed(1)}K`;return String(X)}function nO(Z,X,Q){if(X===0)return null;let Y=Math.trunc(Z*100/X),J=Math.trunc(Z*LQ/X);if(J>LQ)J=LQ;let z=LQ-J,K=F8;if(Y>=80)K=L0;else if(Y>=50)K=p0;let $="=".repeat(Math.max(0,J))+" ".repeat(Math.max(0,z)),W=sO(Z),V=sO(X);return`  ${W8}${Q}${v} ${K}[${$}]${v} ${Y}% (${W} / ${V})`}async function Zh(){if(await X9("jq"))return!0;return process.stdout.write(`${L0}Error: jq is required but not installed.${v}
+var m_=Object.create;var{getPrototypeOf:u_,defineProperty:eK,getOwnPropertyNames:p_}=Object;var d_=Object.prototype.hasOwnProperty;function c_(Z){return this[Z]}var l_,i_,a_=(Z,X,Q)=>{var Y=Z!=null&&typeof Z==="object";if(Y){var J=X?l_??=new WeakMap:i_??=new WeakMap,z=J.get(Z);if(z)return z}Q=Z!=null?m_(u_(Z)):{};let K=X||!Z||!Z.__esModule?eK(Q,"default",{value:Z,enumerable:!0}):Q;for(let $ of p_(Z))if(!d_.call(K,$))eK(K,$,{get:c_.bind(Z,$),enumerable:!0});if(Y)J.set(Z,K);return K};var HQ=(Z,X)=>()=>(X||Z((X={exports:{}}).exports,X),X.exports);var s_=(Z)=>Z;function n_(Z,X){this[Z]=s_.bind(null,X)}var l0=(Z,X)=>{for(var Q in X)eK(Z,Q,{get:X[Q],enumerable:!0,configurable:!0,set:n_.bind(X,Q)})};var p=(Z,X)=>()=>(Z&&(X=Z(Z=0)),X);var e0=import.meta.require;var kO={};l0(kO,{lokiDir:()=>j0,homeLokiDir:()=>R4,findRepoRootForVersion:()=>X$,REPO_ROOT:()=>i0});import{resolve as n7,dirname as Z$}from"path";import{fileURLToPath as o_}from"url";import{existsSync as UQ}from"fs";import{homedir as r_}from"os";function t_(){let Z=RO;for(let X=0;X<6;X++){if(UQ(n7(Z,"VERSION"))&&UQ(n7(Z,"autonomy/run.sh")))return Z;let Q=Z$(Z);if(Q===Z)break;Z=Q}return n7(RO,"..","..","..")}function X$(Z){let X=Z;for(let Q=0;Q<6;Q++){if(UQ(n7(X,"VERSION"))&&UQ(n7(X,"autonomy/run.sh")))return X;let Y=Z$(X);if(Y===X)break;X=Y}return n7(Z,"..","..","..")}function j0(){return process.env.LOKI_DIR??n7(process.cwd(),".loki")}function R4(){return n7(r_(),".loki")}var RO,i0;var H8=p(()=>{RO=Z$(o_(import.meta.url));i0=t_()});import{readFileSync as e_}from"fs";import{resolve as Zf,dirname as Xf}from"path";import{fileURLToPath as Qf}from"url";function h3(){if(h5!==null)return h5;let Z="8.85.0";if(typeof Z==="string"&&Z.length>0)return h5=Z,h5;try{let X=Xf(Qf(import.meta.url)),Q=X$(X);h5=e_(Zf(Q,"VERSION"),"utf-8").trim()}catch{h5="unknown"}return h5}var h5=null;var BQ=p(()=>{H8()});var bO={};l0(bO,{runOrThrow:()=>jf,run:()=>E0,readStreamCapped:()=>NQ,commandVersion:()=>Tf,commandExists:()=>X9,ShellError:()=>Q$,MAX_STDOUT_BYTES:()=>yO});async function NQ(Z,X=yO){let Q=Z.getReader(),Y=new TextDecoder,J="",z=0;try{while(z<X){let{done:K,value:$}=await Q.read();if(K)break;if(!$)continue;if(z+=$.byteLength,z>X){let W=$.byteLength-(z-X);J+=Y.decode($.subarray(0,W),{stream:!0});break}J+=Y.decode($,{stream:!0})}J+=Y.decode()}finally{try{await Q.cancel()}catch{}Q.releaseLock()}return J}async function E0(Z,X={}){let Q=Bun.spawn({cmd:[...Z],stdout:"pipe",stderr:"pipe",env:X.env?{...process.env,...X.env}:process.env,cwd:X.cwd}),Y,J;if(X.timeoutMs&&X.timeoutMs>0)Y=setTimeout(()=>{try{Q.kill("SIGTERM")}catch{}J=setTimeout(()=>{try{Q.kill("SIGKILL")}catch{}},2000)},X.timeoutMs);try{let[z,K,$]=await Promise.all([NQ(Q.stdout),new Response(Q.stderr).text(),Q.exited]);return{stdout:z,stderr:K,exitCode:$}}finally{if(Y)clearTimeout(Y);if(J)clearTimeout(J)}}async function jf(Z,X={}){let Q=await E0(Z,X);if(Q.exitCode!==0)throw new Q$(`command failed (${Q.exitCode}): ${Z.join(" ")}`,Q.exitCode,Q.stdout,Q.stderr);return Q}async function X9(Z){let X=Mf(Z),Q=await E0(["sh","-c",`command -v ${X}`],{timeoutMs:5000});if(Q.exitCode===0)return Q.stdout.trim()||null;return null}function Mf(Z){if(!/^[A-Za-z0-9._/-]+$/.test(Z))throw Error(`refused to shell-escape suspect token: ${Z}`);return Z}async function Tf(Z,X="--version"){if(!await X9(Z))return null;let Y=await E0([Z,X],{timeoutMs:5000});if(Y.exitCode!==0)return null;return((Y.stdout||Y.stderr).split(/\r?\n/)[0]?.trim()??"")||null}var yO=16777216,Q$;var x9=p(()=>{Q$=class Q$ extends Error{message;exitCode;stdout;stderr;constructor(Z,X,Q,Y){super(Z);this.message=Z;this.exitCode=X;this.stdout=Q;this.stderr=Y;this.name="ShellError"}}});function o7(Z){return wf?"":Z}var wf,L0,F8,p0,zV0,a0,W8,Q9,v;var S6=p(()=>{wf=(process.env.NO_COLOR??"").length>0;L0=o7("\x1B[0;31m"),F8=o7("\x1B[0;32m"),p0=o7("\x1B[1;33m"),zV0=o7("\x1B[0;34m"),a0=o7("\x1B[0;36m"),W8=o7("\x1B[1m"),Q9=o7("\x1B[2m"),v=o7("\x1B[0m")});import{existsSync as bf}from"fs";async function E7(){if(x4!==void 0)return x4;let Z="/opt/homebrew/bin/python3.12";if(bf(Z))return x4=Z,Z;let X=await X9("python3.12");if(X)return x4=X,X;let Q=await X9("python3");return x4=Q,Q}async function Y7(Z,X={}){let Q=await E7();if(!Q)return{stdout:"",stderr:"python3 not found",exitCode:127};return E0([Q,"-c",Z],X)}var x4;var r7=p(()=>{x9()});var ZL={};l0(ZL,{runStatus:()=>Kh});import{existsSync as Y9,readFileSync as g3,readdirSync as iO,statSync as aO}from"fs";import{resolve as h8,basename as rf}from"path";import{homedir as tf}from"os";function sO(Z){let X=Math.trunc(Z);if(X>=1e6)return`${(Math.trunc(X/1e6*10)/10).toFixed(1)}M`;if(X>=1000)return`${(Math.trunc(X/1000*10)/10).toFixed(1)}K`;return String(X)}function nO(Z,X,Q){if(X===0)return null;let Y=Math.trunc(Z*100/X),J=Math.trunc(Z*LQ/X);if(J>LQ)J=LQ;let z=LQ-J,K=F8;if(Y>=80)K=L0;else if(Y>=50)K=p0;let $="=".repeat(Math.max(0,J))+" ".repeat(Math.max(0,z)),W=sO(Z),V=sO(X);return`  ${W8}${Q}${v} ${K}[${$}]${v} ${Y}% (${W} / ${V})`}async function Zh(){if(await X9("jq"))return!0;return process.stdout.write(`${L0}Error: jq is required but not installed.${v}
 `),process.stdout.write(`Install with:
 `),process.stdout.write(`  brew install jq    (macOS)
 `),process.stdout.write(`  apt install jq     (Debian/Ubuntu)
@@ -1232,4 +1232,4 @@ Set LOKI_LEGACY_BASH=1 to force the bash CLI for every command.
 `),2}case"start":{let{runStart:Y}=await Promise.resolve().then(() => (h_(),f_));return Y(Q)}default:return process.stderr.write(`Unknown command: ${X}
 `),process.stderr.write(v_),2}}cO();process.on("SIGINT",()=>process.exit(130));process.on("SIGTERM",()=>process.exit(143));var uW0=await mW0(Bun.argv.slice(2));process.exit(uW0);
 
-//# debugId=89896C957C47360064756E2164756E21
+//# debugId=4F01D2A6D41F31AE64756E2164756E21

package/mcp/__init__.py

@@ -75,4 +75,4 @@ try:
 except ImportError:
     __all__ = ['mcp']
 
-__version__ = '8.83.0'
+__version__ = '8.85.0'

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "loki-mode",
   "mcpName": "io.github.asklokesh/loki-mode",
-  "version": "8.83.0",
+  "version": "8.85.0",
   "description": "Loki Mode by Autonomi. Autonomous spec-to-product system: takes a PRD, GitHub issue, OpenAPI/JSON/YAML, or one-line brief to a deployed app via the RARV-C closure loop with 8 quality gates. Provider-agnostic (Claude Code, OpenAI Codex, Cline, Aider).",
   "keywords": [
     "agent",

package/plugins/loki-mode/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "loki-mode",
   "displayName": "Loki Mode",
-  "version": "8.83.0",
+  "version": "8.85.0",
   "description": "Autonomous spec-to-product build system with a built-in trust layer (RARV-C closure loop, 8 quality gates, completion council). Ships Loki's spec-hardening, drift-detection, and deterministic PR verification commands plus the Loki MCP server.",
   "author": {
     "name": "Autonomi",

package/tools/receipt-diff.py

@@ -0,0 +1,302 @@
+#!/usr/bin/env python3
+"""Compare two Evidence Receipts and report what actually changed between runs.
+
+Verification of ONE receipt already exists (autonomy/lib/proof-verify.py).
+This is the missing half: two runs, side by side. "Did the change make it
+cheaper?" is the question a cost receipt exists to answer, and it cannot be
+answered from a single receipt.
+
+THREE RULES, and they are the whole point of this file:
+
+1. A delta against an UNMEASURED value is UNKNOWN, never a number. If run A
+   measured cost and run B did not, "-$0.42" is a fabricated saving. The
+   measured/unmeasured predicate is record_is_measured() in
+   autonomy/lib/efficiency_cost.py -- imported, never restated, because a
+   second copy of that predicate is precisely how the honesty rule drifts.
+
+2. A genuinely measured ZERO delta reads 0. Zero is falsy, so every guard in
+   this file is an explicit `is None` check. A falsy guard turns a real
+   "identical cost" finding into UNKNOWN, which is the same lie pointed the
+   other way.
+
+3. Integrity comes FIRST. A tampered receipt must not silently supply half a
+   delta, so verify_integrity() runs on both before anything is compared.
+
+Non-comparable receipts (different specs) are REFUSED rather than diffed. The
+delta between a landing page and a compiler is arithmetic, not information.
+"""
+
+import argparse
+import importlib.util
+import json
+import os
+import sys
+
+_HERE = os.path.dirname(os.path.abspath(__file__))
+_LIB = os.path.join(os.path.dirname(_HERE), "autonomy", "lib")
+sys.path.insert(0, _LIB)
+
+from efficiency_cost import record_is_measured  # noqa: E402
+
+# proof-verify.py has a hyphen and is not importable as a module; load it by
+# path the same way tests/test_cost_honesty_end_to_end.py does.
+_spec = importlib.util.spec_from_file_location(
+    "proof_verify", os.path.join(_LIB, "proof-verify.py"))
+_pv = importlib.util.module_from_spec(_spec)
+_spec.loader.exec_module(_pv)
+
+verify_integrity = _pv.verify_integrity
+
+UNKNOWN = "UNKNOWN"
+
+
+class NotComparable(Exception):
+    """Raised when two receipts must not be diffed at all."""
+
+
+def delta(a, b):
+    """b - a, or UNKNOWN when either side was never measured.
+
+    `is None` is load-bearing: a measured 0.0 on either side is a real
+    observation and must survive as a number.
+    """
+    if a is None or b is None:
+        return UNKNOWN
+    return b - a
+
+
+def _num(v):
+    """A number as itself, anything else (None, "", bool) as None."""
+    if isinstance(v, bool) or not isinstance(v, (int, float)):
+        return None
+    return v
+
+
+def measured_cost(proof):
+    """The cost block as {usd, tokens...}, or None when never measured.
+
+    cost.available is NOT trusted on its own. A real receipt shipped
+    available=true with every field zero (fixed v8.52.0), so the flag is a
+    claim, not evidence. record_is_measured reads the VALUES, under the
+    per-iteration key names, so the receipt's `usd` is mapped to `cost_usd`.
+    """
+    cost = proof.get("cost")
+    if not isinstance(cost, dict):
+        return None
+    rec = {
+        "cost_usd": _num(cost.get("usd")),
+        "input_tokens": _num(cost.get("input_tokens")),
+        "output_tokens": _num(cost.get("output_tokens")),
+        "cache_read_tokens": _num(cost.get("cache_read_tokens")),
+        "cache_creation_tokens": _num(cost.get("cache_creation_tokens")),
+    }
+    return rec if record_is_measured(rec) else None
+
+
+def cache_hit_ratio(cost):
+    """cache_read / (cache_read + input): the metric that dominates cost.
+
+    None when unmeasured OR when the denominator is zero -- no tokens read
+    means no ratio was observed, which is not a 0% hit rate.
+    """
+    if cost is None:
+        return None
+    read = _num(cost.get("cache_read_tokens"))
+    fresh = _num(cost.get("input_tokens"))
+    if read is None or fresh is None:
+        return None
+    total = read + fresh
+    if total == 0:
+        return None
+    return read / total
+
+
+def gate_map(proof):
+    """{gate name: status} from the facts projection, falling back to flat."""
+    facts = proof.get("facts")
+    gates = facts.get("quality_gates") if isinstance(facts, dict) else None
+    if not isinstance(gates, list):
+        qg = proof.get("quality_gates")
+        gates = qg.get("gates") if isinstance(qg, dict) else None
+    out = {}
+    for g in gates or []:
+        if isinstance(g, dict) and g.get("name"):
+            out[str(g["name"])] = str(g.get("status", "not_run"))
+    return out
+
+
+def _spec_id(proof):
+    spec = proof.get("spec")
+    return str(spec.get("source") or "") if isinstance(spec, dict) else ""
+
+
+def compare(a, b, a_path="A", b_path="B"):
+    """Diff two verified receipts. Raises NotComparable when they must not be.
+
+    Integrity first: a receipt that fails verify_integrity never reaches the
+    arithmetic.
+    """
+    for proof, path in ((a, a_path), (b, b_path)):
+        v = verify_integrity(proof)
+        if not v["ok"]:
+            raise NotComparable(
+                "receipt failed integrity verification: %s\n  %s"
+                % (path, "\n  ".join(v["reasons"] or [v["reason"]])))
+
+    spec_a, spec_b = _spec_id(a), _spec_id(b)
+    if spec_a and spec_b and spec_a != spec_b:
+        raise NotComparable(
+            "receipts are for different specs, so no delta between them is "
+            "meaningful:\n  %s: %s\n  %s: %s" % (a_path, spec_a, b_path, spec_b))
+
+    cost_a, cost_b = measured_cost(a), measured_cost(b)
+    # WHY each field is unavailable, so a reader never has to guess whether
+    # UNKNOWN means "not measured" or "tool could not read it".
+    incomparable = []
+    if cost_a is None or cost_b is None:
+        incomparable.append({
+            "field": "cost",
+            "why": "cost was not measured in %s" % (
+                " and ".join(
+                    [p for p, c in ((a_path, cost_a), (b_path, cost_b))
+                     if c is None])),
+        })
+
+    ratio_a, ratio_b = cache_hit_ratio(cost_a), cache_hit_ratio(cost_b)
+    if ratio_a is None or ratio_b is None:
+        incomparable.append({
+            "field": "cache_hit_ratio",
+            "why": "no cached-plus-fresh input tokens recorded, so no ratio "
+                   "was observed (this is not a 0% hit rate)",
+        })
+
+    def iters(p):
+        it = p.get("iterations")
+        return _num(it.get("count")) if isinstance(it, dict) else None
+
+    it_a, it_b = iters(a), iters(b)
+    if it_a is None or it_b is None:
+        incomparable.append(
+            {"field": "iterations", "why": "iteration count not recorded"})
+
+    dur_a, dur_b = _num(a.get("wall_clock_sec")), _num(b.get("wall_clock_sec"))
+    if dur_a is None or dur_b is None:
+        incomparable.append(
+            {"field": "duration_sec", "why": "wall clock not recorded"})
+
+    ga, gb = gate_map(a), gate_map(b)
+    gates = {"regressed": [], "fixed": [], "added": [], "removed": []}
+    for name in sorted(set(ga) | set(gb)):
+        sa, sb = ga.get(name), gb.get(name)
+        if sa is None:
+            # Absent in A is ADDED, never a pass that broke.
+            gates["added"].append({"gate": name, "status": sb})
+        elif sb is None:
+            gates["removed"].append({"gate": name, "status": sa})
+        elif sa != sb:
+            bucket = "fixed" if sb == "passed" else "regressed"
+            gates[bucket].append({"gate": name, "from": sa, "to": sb})
+
+    return {
+        "comparable": True,
+        "a": a_path,
+        "b": b_path,
+        "spec": spec_a or spec_b,
+        "cost_usd": {
+            "a": cost_a["cost_usd"] if cost_a else None,
+            "b": cost_b["cost_usd"] if cost_b else None,
+            "delta": delta(cost_a["cost_usd"] if cost_a else None,
+                           cost_b["cost_usd"] if cost_b else None),
+        },
+        "cache_hit_ratio": {
+            "a": ratio_a, "b": ratio_b, "delta": delta(ratio_a, ratio_b),
+        },
+        "iterations": {"a": it_a, "b": it_b, "delta": delta(it_a, it_b)},
+        "duration_sec": {"a": dur_a, "b": dur_b, "delta": delta(dur_a, dur_b)},
+        "gates": gates,
+        "not_comparable": incomparable,
+    }
+
+
+def _fmt(value, unit=""):
+    if value == UNKNOWN or value is None:
+        return UNKNOWN
+    if unit == "$":
+        return "%s$%.4f" % ("+" if value >= 0 else "-", abs(value))
+    if unit == "%":
+        return "%+.1f%%" % (value * 100)
+    return "%+g%s" % (value, unit)
+
+
+def render(d):
+    lines = ["Evidence Receipt diff", "  A: %s" % d["a"], "  B: %s" % d["b"]]
+    if d["spec"]:
+        lines.append("  spec: %s" % d["spec"])
+    lines.append("")
+    for label, key, unit in (
+        ("cost", "cost_usd", "$"),
+        ("cache hit ratio", "cache_hit_ratio", "%"),
+        ("iterations", "iterations", ""),
+        ("duration", "duration_sec", "s"),
+    ):
+        f = d[key]
+        a = UNKNOWN if f["a"] is None else (
+            "%.4f" % f["a"] if unit == "%" else f["a"])
+        b = UNKNOWN if f["b"] is None else (
+            "%.4f" % f["b"] if unit == "%" else f["b"])
+        lines.append("  %-16s %s -> %s   delta %s"
+                     % (label, a, b, _fmt(f["delta"], unit)))
+
+    g = d["gates"]
+    lines.append("")
+    if any(g.values()):
+        for gate in g["regressed"]:
+            lines.append("  REGRESSED  %s: %s -> %s"
+                         % (gate["gate"], gate["from"], gate["to"]))
+        for gate in g["fixed"]:
+            lines.append("  FIXED      %s: %s -> %s"
+                         % (gate["gate"], gate["from"], gate["to"]))
+        for gate in g["added"]:
+            lines.append("  ADDED      %s (%s), absent in A"
+                         % (gate["gate"], gate["status"]))
+        for gate in g["removed"]:
+            lines.append("  REMOVED    %s (was %s), absent in B"
+                         % (gate["gate"], gate["status"]))
+    else:
+        lines.append("  gates       no verdict changes")
+
+    if d["not_comparable"]:
+        lines.append("")
+        lines.append("  NOT COMPARABLE (reported UNKNOWN, not zero):")
+        for item in d["not_comparable"]:
+            lines.append("    %s: %s" % (item["field"], item["why"]))
+    return "\n".join(lines)
+
+
+def main(argv=None):
+    ap = argparse.ArgumentParser(
+        description="Compare two Evidence Receipts (proof.json).")
+    ap.add_argument("a", help="baseline proof.json")
+    ap.add_argument("b", help="proof.json to compare against the baseline")
+    ap.add_argument("--json", action="store_true", dest="as_json",
+                    help="emit the diff as JSON")
+    args = ap.parse_args(argv)
+
+    try:
+        pa = _pv._load_proof(args.a)
+        pb = _pv._load_proof(args.b)
+        d = compare(pa, pb, args.a, args.b)
+    except (NotComparable, _pv.ProofLoadError) as exc:
+        payload = {"comparable": False, "reason": str(exc)}
+        if args.as_json:
+            print(json.dumps(payload, indent=2))
+        else:
+            print("REFUSED: %s" % exc)
+        return 2
+
+    print(json.dumps(d, indent=2) if args.as_json else render(d))
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())