loki-mode 9.16.0 → 9.17.0

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: Autonomous spec-driven build system with a built-in trust layer. It does not call work done until it is verified (RARV-C closure loop, 8 quality gates, completion council, verified-completion evidence gate). Triggers on "Loki Mode". Takes a spec (PRD, GitHub issue, OpenAPI doc, etc.) to deployed product with minimal human intervention. Provider-agnostic. Requires --dangerously-skip-permissions flag.
 ---
 
-# Loki Mode v9.16.0
+# Loki Mode v9.17.0
 
 **You are an autonomous agent. You make decisions. You do not ask questions. You do not stop.**
 
@@ -470,4 +470,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v9.16.0 | [Autonomi](https://www.autonomi.dev/) flagship product | ~410 lines core**
+**v9.17.0 | [Autonomi](https://www.autonomi.dev/) flagship product | ~410 lines core**

package/VERSION

@@ -1 +1 @@
-9.16.0
+9.17.0

package/autonomy/issue-providers.sh

@@ -382,23 +382,26 @@ labels_str = ', '.join(labels) if labels else ''
 
 _ac_text = (title + ' ' + body).lower()
 _ac_rules = [
-    (['save', 'persist', 'store', 'databas', 'crud'],
+    (['save', 'persist', 'store', 'databas', 'crud'], 'PERSIST',
      'Data the change writes survives a restart (a real store, not in-memory state).'),
-    (['auth', 'login', 'sign in', 'session', 'permission'],
+    (['auth', 'login', 'sign in', 'session', 'permission'], 'AUTH',
      'The auth path is exercised end to end including the denied case (401/403), not only the happy path.'),
-    (['api', 'endpoint', 'rest', 'graphql', 'route'],
+    (['api', 'endpoint', 'rest', 'graphql', 'route'], 'API',
      'Each affected endpoint returns the documented status codes and is callable without a browser.'),
-    (['payment', 'stripe', 'billing', 'invoice', 'subscription'],
+    (['payment', 'stripe', 'billing', 'invoice', 'subscription'], 'PAY',
      'The payment path runs against provider test mode; no mocked charge stands in for the integration.'),
-    (['bug', 'fix', 'regression', 'broken', 'crash', 'error'],
+    (['bug', 'fix', 'regression', 'broken', 'crash', 'error'], 'REPRO',
      'A test reproduces the reported failure and FAILS before the fix, then passes after it.'),
-    (['perf', 'slow', 'latency', 'timeout', 'memory leak'],
+    (['perf', 'slow', 'latency', 'timeout', 'memory leak'], 'PERF',
      'The improvement is measured before and after, and the numbers appear in the change.'),
-    (['security', 'vulnerab', 'injection', 'xss', 'csrf'],
+    (['security', 'vulnerab', 'injection', 'xss', 'csrf'], 'SEC',
      'A test demonstrates the vulnerable behavior is refused after the change.'),
+
 ]
-_hits = [c for kws, c in _ac_rules if any(k in _ac_text for k in kws)]
-derived_ac = ('\n'.join('- ' + h for h in _hits) + '\n') if _hits else ''
+# Stable, content-derived IDs: the axis comes from WHICH rule fired, so adding
+# a rule never renumbers an existing criterion and a receipt can cite one.
+_hits = [(ax, c) for kws, ax, c in _ac_rules if any(k in _ac_text for k in kws)]
+derived_ac = ('\n'.join(f'- AC-{ax}-001: {c}' for ax, c in _hits) + '\n') if _hits else ''
 
 prd = f'''# PRD: {title}
 

package/autonomy/lib/agent_readiness.py

@@ -186,15 +186,93 @@ def render_text(res):
     return "\n".join(out)
 
 
+# What --fix writes for each missing criterion. Only files whose CORRECT content
+# can be derived from the repo itself appear here.
+#
+# test_command and dependency_lock are deliberately absent: guessing a test
+# command writes a line that lies (`npm test` in a repo with no runner exits
+# non-zero forever, and the readiness check would then report "present" for
+# something that does not work), and a lockfile must come from the real package
+# manager or it is worse than none. Those stay REPORTED, never generated.
+#
+# This is the difference between a scorecard and an executable one -- Factory's
+# /readiness-report -> /readiness-fix -- without the failure mode where the fix
+# makes the score green while the underlying capability is still missing.
+FIXABLE = {
+    "gitignore": (".gitignore", "node_modules/\n__pycache__/\n.env\n.venv/\ndist/\n*.log\n"),
+    "readme": ("README.md", None),        # content derived below
+    "agent_brief": ("AGENTS.md", None),   # content derived below
+}
+
+
+def _fix(root, res):
+    """Create the missing files whose content can be derived honestly.
+
+    Returns (written, skipped) where skipped names criteria that a generated
+    file could not honestly satisfy.
+    """
+    written, skipped = [], []
+    project = os.path.basename(os.path.abspath(root)) or "this project"
+    # assess() reports `missing` as a list of criterion IDs (strings), not the
+    # full check dicts. Tolerate both so a later shape change does not silently
+    # fix nothing.
+    for entry in res.get("missing", []):
+        cid = entry["id"] if isinstance(entry, dict) else entry
+        if cid not in FIXABLE:
+            skipped.append((cid, "must come from the real toolchain, not a guess"))
+            continue
+        name, body = FIXABLE[cid]
+        path = os.path.join(root, name)
+        if os.path.exists(path):
+            continue
+        if cid == "readme":
+            body = (f"# {project}\n\n"
+                    "## What this is\n\n_TODO: one paragraph._\n\n"
+                    "## Run it\n\n```sh\n# TODO: the command that starts this project\n```\n\n"
+                    "## Test it\n\n```sh\n# TODO: the command that runs the tests\n```\n")
+        elif cid == "agent_brief":
+            body = (f"# AGENTS.md\n\nBriefing for coding agents working in {project}.\n\n"
+                    "## Commands\n\n- Build: _TODO_\n- Test: _TODO_\n- Lint: _TODO_\n\n"
+                    "## Conventions\n\n_TODO: what a reviewer would flag._\n\n"
+                    "## Do not\n\n_TODO: the things that break this repo._\n")
+        try:
+            with open(path, "w") as fh:
+                fh.write(body)
+            written.append(name)
+        except OSError as exc:
+            skipped.append((cid, f"could not write {name}: {exc}"))
+    return written, skipped
+
+
 def main(argv):
     as_json = "--json" in argv
+    do_fix = "--fix" in argv
     root = "."
     for a in argv:
         if not a.startswith("-"):
             root = a
             break
     res = assess(root)
-    print(json.dumps(res, indent=2) if as_json else render_text(res))
+
+    if do_fix and res.get("status") == "measured":
+        written, skipped = _fix(root, res)
+        res = assess(root)  # re-measure: report what is true AFTER the fix
+        res["fix"] = {"written": written,
+                      "skipped": [{"id": i, "reason": r} for i, r in skipped]}
+
+    if as_json:
+        print(json.dumps(res, indent=2))
+    else:
+        print(render_text(res))
+        if do_fix:
+            fx = res.get("fix", {})
+            print("")
+            for name in fx.get("written", []):
+                print(f"  wrote    {name} (a stub -- fill in the TODOs)")
+            for s in fx.get("skipped", []):
+                print(f"  skipped  {s['id']}: {s['reason']}")
+            if not fx.get("written") and not fx.get("skipped"):
+                print("  nothing to fix.")
     return 0 if res.get("status") == "measured" else 3
 
 

package/autonomy/lib/gate_policy.py

@@ -0,0 +1,166 @@
+#!/usr/bin/env python3
+"""Which gates block, which only advise, and what promoting one would have cost.
+
+Ona's Veto Exec ships an audit-first ladder: "Start with audit rules, review
+matches, then promote confirmed rules to block." The load-bearing part is the
+MIDDLE step. A policy you cannot safely turn on is a policy nobody turns on, so
+before flipping a gate to blocking you get to see what it WOULD have blocked.
+
+We already had both ends and nothing in between: gates are advisory or blocking,
+three promotion knobs exist (LOKI_GATE_MAGIC_DEBATE_BLOCKING, LOKI_COV_ENFORCE,
+LOKI_POLICY_APPROVAL_ENFORCE), and .loki/quality/gate-failure-count.json has
+counted per-gate failures the whole time. Nothing joined them, so an operator
+deciding whether to promote a gate had to guess.
+
+DETERMINISTIC. Reads two files and the environment. No model, no network, no
+spend -- same repo state, same answer, and every number is a count a reader can
+recompute by opening the same file.
+
+NEVER PROMOTES ANYTHING. This reports; it does not change policy. Turning a gate
+blocking stays an explicit operator act via the named environment variable,
+because a tool that silently starts blocking is the thing operators most
+reasonably fear.
+
+Shape (assess() and --json, schema_version 1). This is the contract the
+dashboard endpoint GET /api/gate-policy and tests/test_gate_policy_endpoint.py
+both read against, so field names here are load-bearing:
+
+  schema_version int    1
+  status         str    "measured"
+  ledger         str    "present" | "absent" -- whether the per-gate failure
+                        ledger .loki/quality/gate-failure-count.json was read
+  gates          list   one record per known gate, blocking gates first, each
+                        group sorted by name:
+    gate         str    gate name (e.g. "code_review")
+    mode         str    "blocking" | "advisory" -- for a promotable gate this
+                        depends on the ENVIRONMENT at call time
+    promotable   bool   True when a real promotion knob exists in run.sh
+    audit_hits   int|null  failures counted for this gate. null means
+                        UNMEASURED -- no ledger, or no entry for this gate.
+                        NEVER 0 for an unmeasured gate: 0 is the positive claim
+                        that the gate ran and never fired, which is the false
+                        green an absent measurement always produces.
+    why          str    one-line description of what the gate checks
+    promote_with str|null  "VAR=value" to make an advisory gate blocking; null
+                        when the gate already blocks
+"""
+
+import json
+import os
+import sys
+
+SCHEMA_VERSION = 1
+
+# Gates that can be promoted from advisory to blocking, and the knob that does
+# it. Only gates with a REAL knob in run.sh appear here -- listing an aspiration
+# would tell an operator to set a variable nothing reads.
+PROMOTABLE = {
+    "magic_debate": ("LOKI_GATE_MAGIC_DEBATE_BLOCKING", "true",
+                     "spec-vs-implementation debate on generated modules"),
+    "test_coverage": ("LOKI_COV_ENFORCE", "1",
+                      "project test runner pass/fail"),
+    "policy_approval": ("LOKI_POLICY_APPROVAL_ENFORCE", "1",
+                        "staged-autonomy approval policy"),
+}
+
+# Gates that block unconditionally. Listed so the report is a complete picture
+# rather than only the promotable subset -- an operator asking "what blocks here"
+# should not have to read run.sh to find out.
+ALWAYS_BLOCKING = {
+    "static_analysis": "CodeQL, ESLint/Pylint, type-checker findings on the diff",
+    "code_review": "3-reviewer blind review; Critical/High = BLOCK",
+    "mock_integrity": "tautological-assertion and mock-ratio detection",
+    "mutation_integrity": "assertion-churn (test-fitting) detection",
+}
+
+
+def _counts(loki_dir):
+    """Per-gate failure counts, or {} when the ledger has not been written."""
+    path = os.path.join(loki_dir, "quality", "gate-failure-count.json")
+    try:
+        with open(path) as fh:
+            data = json.load(fh)
+        return data if isinstance(data, dict) else {}
+    except (OSError, ValueError):
+        return {}
+
+
+def assess(loki_dir=".loki", env=None):
+    env = os.environ if env is None else env
+    counts = _counts(loki_dir)
+    have_ledger = bool(counts)
+
+    gates = []
+    for name, why in sorted(ALWAYS_BLOCKING.items()):
+        gates.append({
+            "gate": name, "mode": "blocking", "promotable": False,
+            "audit_hits": counts.get(name) if have_ledger else None,
+            "why": why, "promote_with": None,
+        })
+    for name, (var, val, why) in sorted(PROMOTABLE.items()):
+        on = str(env.get(var, "")).lower() in ("1", "true", "yes")
+        gates.append({
+            "gate": name,
+            "mode": "blocking" if on else "advisory",
+            "promotable": True,
+            # None, not 0: an absent ledger means UNMEASURED, and reporting 0
+            # would read as "this gate never fired" -- the same false green a
+            # missing measurement always produces.
+            "audit_hits": counts.get(name) if have_ledger else None,
+            "why": why,
+            "promote_with": None if on else f"{var}={val}",
+        })
+
+    return {
+        "schema_version": SCHEMA_VERSION,
+        "status": "measured",
+        "ledger": "present" if have_ledger else "absent",
+        "gates": gates,
+    }
+
+
+def render_text(res):
+    out = ["Gate policy -- what blocks here, and what only advises", ""]
+    for g in res["gates"]:
+        hits = g["audit_hits"]
+        if hits is None:
+            hit_s = "not measured"
+        elif hits == 0:
+            hit_s = "0 hits"
+        else:
+            hit_s = f"{hits} hit{'s' if hits != 1 else ''}"
+        mode = g["mode"].upper()
+        out.append(f"  {mode:9} {g['gate']:20} {hit_s}")
+        out.append(f"            {g['why']}")
+        if g["promote_with"]:
+            verb = "would have blocked" if (hits or 0) > 0 else "has not fired"
+            out.append(f"            advisory: {verb} -- promote with {g['promote_with']}")
+        out.append("")
+
+    if res["ledger"] == "absent":
+        out.append("  No gate ledger yet (.loki/quality/gate-failure-count.json).")
+        out.append("  Counts read 'not measured' rather than 0: an absent")
+        out.append("  measurement is not evidence a gate never fired.")
+    else:
+        out.append("  Hits come from .loki/quality/gate-failure-count.json.")
+        out.append("  Open it and count the same numbers yourself.")
+    out.append("")
+    out.append("  This command never promotes a gate. Promotion is an explicit")
+    out.append("  operator act via the variable named above.")
+    return "\n".join(out)
+
+
+def main(argv):
+    as_json = "--json" in argv
+    loki_dir = ".loki"
+    for a in argv:
+        if not a.startswith("-"):
+            loki_dir = a
+            break
+    res = assess(loki_dir)
+    print(json.dumps(res, indent=2) if as_json else render_text(res))
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main(sys.argv[1:]))

package/autonomy/lib/outcome_ledger.py

@@ -93,6 +93,92 @@ ANCHOR_REASONS = {
     "diff_range_mismatch": "the base..head diff does not match the receipt's file set",
 }
 
+# HISTORICAL vs LIVE: the distinction that stops an old receipt from reading as
+# a regression.
+#
+# `ANCHORED 0 of 9` is alarming until you know WHY. Two very different things
+# produce it, and a flat count of reasons cannot tell them apart:
+#
+#   FROZEN   The receipt file itself lacks the anchor. base_sha was written as
+#            "" and that JSON is on disk forever. No future fix can anchor it,
+#            and rewriting a receipt to make a metric look better is the exact
+#            dishonesty this module exists to refuse. These are HISTORY.
+#   LIVE     The receipt records real shas; only the ENVIRONMENT cannot resolve
+#            them right now -- a shallow clone, an unmerged branch, or a file
+#            set that still has uncommitted edits. These can anchor later, with
+#            no change to the receipt.
+#
+# Measured on this repo: all 9 receipts are frozen (8 base_sha_empty, 1
+# greenfield_no_baseline) and were generated 2026-07-27 and 2026-07-31, BEFORE
+# proof-generator learned to read .loki/state/start-sha (commit 99ce689d,
+# 2026-08-07). So the zero is fully explained by history.
+# Frozen because the GENERATOR failed to record something it should have. These
+# are the only two where recency is meaningful: before the fix they are history,
+# after it they are a live bug in proof-generator.
+FROZEN_GENERATOR_REASONS = frozenset({
+    "head_sha_empty",
+    "base_sha_empty",
+})
+
+# Frozen BY DESIGN, and correct at any date. A genuinely greenfield repo has no
+# earlier commit to diff against, and a receipt written over uncommitted work
+# honestly has base == head. Neither can ever anchor, and neither is a defect --
+# so recency must NOT be applied to them. Calling a correct greenfield receipt a
+# regression would be a false alarm on the signal added to prevent false alarms.
+FROZEN_BY_DESIGN_REASONS = frozenset({
+    "greenfield_no_baseline",
+    "change_not_committed",
+})
+
+FROZEN_REASONS = FROZEN_GENERATOR_REASONS | FROZEN_BY_DESIGN_REASONS
+
+# The two sets must stay disjoint. If a reason appeared in both, classification
+# would depend on which branch is checked first -- and a by-design case that
+# drifted into the generator set would start alarming as a regression the moment
+# someone reordered the checks. Assert the invariant rather than trusting order.
+assert not (FROZEN_GENERATOR_REASONS & FROZEN_BY_DESIGN_REASONS), \
+    "a reason cannot be both a generator failure and correct by design"
+
+# The commit that taught proof-generator to resolve base_sha from
+# .loki/state/start-sha when the env var is absent. A receipt generated at or
+# after this instant should carry a real baseline, so a FROZEN reason on one is
+# NOT history -- it is a live regression in the generator.
+#
+# Recency is the discriminator because it is the only one the receipts actually
+# support: they carry generated_at (verified on all 9), and loki_version tracks
+# releases rather than this fix. A frozen-vs-live split ALONE would file a newly
+# broken receipt under history, which is the green-wash this guards against.
+BASE_SHA_FIX_UTC = "2026-08-07T13:39:32Z"  # 99ce689d, committed 09:39:32 -04:00
+
+
+def classify_unanchored(reason, generated_at):
+    """Bucket an unanchored receipt: historical, regression, or live.
+
+    Returns one of:
+      "by_design"  -- unanchorable and CORRECT: a greenfield run with no earlier
+                      commit, or a receipt over uncommitted work. Never a defect,
+                      at any date, so recency is not applied.
+      "historical" -- the generator failed to record an anchor, in a receipt
+                      written BEFORE the fix. History, and never anchorable now.
+      "regression" -- the same generator failure AFTER the fix. The anchor is
+                      being dropped again. This is the only bucket that alarms.
+      "live"       -- the receipt is fine; the environment cannot resolve it yet.
+    """
+    if reason in FROZEN_BY_DESIGN_REASONS:
+        return "by_design"
+    if reason not in FROZEN_GENERATOR_REASONS:
+        return "live"
+    # No timestamp means we cannot place it relative to the fix. Refuse to call
+    # it history, because that is the direction that hides a regression.
+    #
+    # ponytail: lexicographic compare, correct only for the "...Z" ISO form the
+    # generator writes (verified on all 9 receipts). An offset-form timestamp
+    # would sort below the constant and read as historical -- the hiding
+    # direction. Parse properly only if a generator ever emits offsets.
+    if not generated_at:
+        return "regression"
+    return "historical" if generated_at < BASE_SHA_FIX_UTC else "regression"
+
 
 def _git(args, cwd, timeout=30):
     """Run a git command read-only. Returns (rc, stdout). Never raises.
@@ -315,6 +401,9 @@ def outcome_for_receipt(proof_path, cwd):
     state, reason = resolve_anchor(base_sha, head_sha, files, cwd)
     rec["anchor"] = {"state": state, "reason": reason}
     if state != "anchored":
+        # An old receipt is not a regression. Classify so a reader can tell a
+        # frozen pre-fix receipt from a generator that started dropping anchors.
+        rec["anchor"]["klass"] = classify_unanchored(reason, rec["generated_at"])
         rec["outcome"] = UNKNOWN
         rec["reason"] = ANCHOR_REASONS.get(reason, reason or "not anchored")
         rec["commands"] = [
@@ -381,11 +470,15 @@ def summarize(records):
     # as "no data" instead of "your receipts are not recording a landed sha",
     # which is an actionable defect.
     reasons = {}
+    klasses = {"by_design": 0, "historical": 0, "regression": 0, "live": 0}
     for r in records:
         a = r.get("anchor") or {}
         if a.get("state") and a["state"] != "anchored":
             key = a.get("reason") or "unknown"
             reasons[key] = reasons.get(key, 0) + 1
+            k = a.get("klass")
+            if k in klasses:
+                klasses[k] += 1
 
     summary = {
         "receipts_total": total,
@@ -393,6 +486,12 @@ def summarize(records):
         "receipts_unknown": len(unknown),
         "reverted": len(reverted),
         "unanchored_reasons": reasons,
+        # The count that turns an alarming zero into an explained one. A
+        # regression here is the only bucket that warrants action.
+        "unanchored_by_design": klasses["by_design"],
+        "unanchored_historical": klasses["historical"],
+        "unanchored_regression": klasses["regression"],
+        "unanchored_live": klasses["live"],
     }
     if measured:
         summary["change_failure_rate"] = round(len(reverted) / len(measured), 4)
@@ -442,6 +541,29 @@ def render_text(records, summary, note=None):
         out.append("  Why not anchored (a receipt must prove base..head IS the change):")
         for k, n in sorted(reasons.items(), key=lambda kv: -kv[1]):
             out.append(f"    {k:24} {n:3}   {ANCHOR_REASONS.get(k, '')}")
+
+    # Without this, ANCHORED 0 of N reads as a regression when it is history.
+    hist = summary.get("unanchored_historical", 0)
+    regr = summary.get("unanchored_regression", 0)
+    live = summary.get("unanchored_live", 0)
+    design = summary.get("unanchored_by_design", 0)
+    if hist or regr or live or design:
+        out.append("")
+        if design:
+            out.append(f"    {design} by design: a greenfield run or uncommitted"
+                       f" work has no baseline to diff against. Correct, not a"
+                       f" defect, and never anchorable.")
+        if hist:
+            out.append(f"    {hist} historical: written before the base_sha fix"
+                       f" ({BASE_SHA_FIX_UTC[:10]}); the receipt itself has no"
+                       f" baseline, so these can never anchor. Not a defect.")
+        if live:
+            out.append(f"    {live} live: the receipt records real shas; this"
+                       f" clone cannot resolve them yet. May anchor later.")
+        if regr:
+            out.append(f"    {regr} REGRESSION: written AFTER the fix and still"
+                       f" missing a baseline. The generator is dropping the"
+                       f" anchor -- this one is a defect.")
     out.append("")
     cfr = summary.get("change_failure_rate")
     if cfr == UNKNOWN:

package/autonomy/lib/proof-generator.py

@@ -943,12 +943,46 @@ def _git_diffstat(target_dir, include_diffs):
 
     Order of preference:
       1. _LOKI_RUN_START_SHA -- the run's own baseline (run.sh exports it).
-      2. The empty tree -- correct for a GREENFIELD run (a repo with no commits
+      2. .loki/state/start-sha -- the SAME baseline, persisted to disk. The env
+         var is only exported inside run_autonomous (run.sh:21690), so a receipt
+         generated outside that scope -- `loki proof` run by hand, a resumed
+         run, a receipt written after the runner exited -- saw an empty env var
+         and fell straight through to the empty tree.
+      3. The empty tree -- correct for a GREENFIELD run (a repo with no commits
          at start), where "everything that now exists" IS the run's output and
          there is no earlier commit to diff against.
-      3. Empty string -- let workspace_diff apply its own fallbacks.
+      4. Empty string -- let workspace_diff apply its own fallbacks.
+
+    WHY STEP 2 EXISTS. Without it every receipt on this repo recorded
+    base_sha="" -- measured: 9 of 9 receipts in .loki/proofs/, and the dashboard
+    correctly reported "9 receipts, 0 verified". An empty base is unanchorable,
+    so outcome_ledger.resolve_anchor() returns unanchored/base_sha_empty and NO
+    receipt can be verified. The persisted file already existed and both other
+    consumers already read it (run.sh:7779, completion-council.sh:1834); this
+    reader was the only one that did not, so it silently lost the anchor.
+
+    The greenfield fallback is deliberately kept BELOW the file: falling back to
+    the empty tree when a real baseline exists would attest to "everything in
+    the repo" as this run's output, which is a much worse lie than an empty
+    base_sha. Order matters more than the addition.
     """
     base = os.environ.get("_LOKI_RUN_START_SHA", "").strip()
+    if not base:
+        # Same baseline, read from disk. Mirrors run.sh:7779 and
+        # completion-council.sh:1834 rather than inventing a third convention.
+        try:
+            with open(os.path.join(target_dir, ".loki", "state", "start-sha")) as fh:
+                _persisted = fh.read().strip()
+            # Only trust it if it names a commit that actually exists HERE. A
+            # stale or foreign SHA would produce a diff against nothing and an
+            # integrity hash nobody can recompute.
+            if _persisted and subprocess.run(
+                ["git", "cat-file", "-e", _persisted + "^{commit}"],
+                cwd=target_dir, capture_output=True, timeout=10,
+            ).returncode == 0:
+                base = _persisted
+        except (OSError, subprocess.SubprocessError, ValueError):
+            pass
     if not base:
         # Greenfield: no baseline commit existed when the run started.
         base = _empty_tree_sha(target_dir)
@@ -990,8 +1024,33 @@ def _collect_iterations(loki_dir):
     return {"count": count, "succeeded": n_completed, "failed": n_failed}
 
 
+# Acceptance-criterion ids as minted at intake ("- AC-<AXIS>-NNN: <text>", see
+# _brief_acceptance_criteria in autonomy/loki). Anchored and strict on purpose:
+# a loose pattern would count prose that merely mentions an id, and the whole
+# value of the id is that a citation points at exactly one criterion.
+_AC_ID_RE = re.compile(r"^- (AC-[A-Z]+-[0-9]{3}): ", re.MULTILINE)
+
+
+def _spec_criteria_declared(text):
+    """Return the acceptance-criterion ids the spec DECLARES, in spec order.
+
+    DECLARED, NOT SATISFIED. This records which criteria exist in the spec and
+    nothing more -- no check runs here, and no field in the receipt asserts that
+    any of these was met. Naming it criteria_met would be a lie we cannot back.
+
+    Empty list when the spec declares none (an older PRD, a hand-written spec,
+    or a run with no spec file at all). Never invented, never a placeholder.
+    """
+    if not text:
+        return []
+    # Deduped: an id is a citation target, so each must resolve to one criterion.
+    # A repeated id is a spec bug; counting it twice would not make it citable.
+    return list(dict.fromkeys(_AC_ID_RE.findall(text)))
+
+
 def _collect_spec(loki_dir, target_dir):
-    """Return spec dict {source, brief}. brief truncated to 600 chars."""
+    """Return spec dict {source, brief, criteria_declared}. brief truncated to
+    600 chars."""
     prd_path = os.environ.get("PRD_PATH", "").strip()
     source = ""
     brief = ""
@@ -1018,7 +1077,15 @@ def _collect_spec(loki_dir, target_dir):
     # Full brief here; the <=600 cap is applied AFTER redaction in generate()
     # so a secret straddling the cap cannot be sliced into an under-length
     # fragment that bypasses the redactor.
-    return {"source": source, "brief": brief}
+    #
+    # Criteria are parsed from the FULL spec text, not from the 600-char display
+    # cap: a PRD's acceptance-criteria block sits well past char 600, so parsing
+    # the capped brief would silently drop most of them.
+    return {
+        "source": source,
+        "brief": brief,
+        "criteria_declared": _spec_criteria_declared(brief),
+    }
 
 
 def _self_version():