loki-mode 9.17.0 → 9.17.2

package/autonomy/loki

@@ -1040,15 +1040,15 @@ show_help() {
     echo "  agent analyze api assets audit bench checkpoint (cp) ci cleanup"
     echo "  cluster cockpit code compliance completions compound config context (ctx)"
     echo "  cost council crash dashboard demo deploy docker docs doctor dogfood"
-    echo "  enterprise estimate explain export failover gates github grill heal help"
+    echo "  enterprise estimate explain export failover github grill heal help"
     echo "  import init intent"
     echo "  issue kpis logs magic mcp memory metrics migrate modernize monitor"
     echo "  next notify onboard open optimize otel outcomes own (handoff) pause plan preview"
-    echo "  projects proof (receipt) provider quick quickstart rc readiness remote report reset"
+    echo "  projects proof (receipt) provider quick quickstart rc remote report reset"
     echo "  resume review rollback run sandbox secrets secure self-update sentrux"
     echo "  serve setup-skill share ship spec start state stats status steer stop"
     echo "  syslog telemetry template test tour trigger trust trust-metrics"
-    echo "  ultracode update verdict verify version voice watch watchdog web welcome why"
+    echo "  ultracode update verify version voice watch watchdog web welcome why"
     echo "  wiki worktree (wt)"
     echo ""
     echo "Any command: loki <command> --help"
@@ -11905,14 +11905,7 @@ STALE_DAYS = 90
 p = os.environ['LOKI_CATALOG_PATH']
 try:
     updated = json.load(open(p))['updated']
-    # UTC, matching the --json path below (loki:12337) and the Bun route
-    # (doctor.ts:545). This is the TEXT-mode twin of that computation, and it was
-    # missed when the JSON one was fixed: the parity gate compares BOTH surfaces,
-    # so fixing only --json left doctor text-mode still diverging 5 vs 6 and the
-    # gate still red. Two copies of one calculation is the actual defect here;
-    # they are left as two only because the text path prints and the JSON path
-    # returns a dict.
-    age = (datetime.datetime.now(datetime.timezone.utc).date() - datetime.date.fromisoformat(updated)).days
+    age = (datetime.date.today() - datetime.date.fromisoformat(updated)).days
 except Exception:
     print('warn|Catalog unreadable or missing an ISO \"updated\" date -- cannot determine age')
 else:
@@ -12036,17 +12029,6 @@ else:
             local _blk_key="other"
             case "$_doctor_blockers" in
                 *"No AI provider CLI"*) _blk_key="no_provider" ;;
-                # This doctor DETECTS the logged-out / expired wall above
-                # (:11610, :11615) but had no arm for it, so the single most
-                # common post-install failure was reported as `other` -- the one
-                # bucket that cannot be acted on. not_logged_in is already a
-                # first-class enum value (telemetry.sh:204) and the Bun doctor
-                # already reports it, so without this arm the SAME host answered
-                # `other` on bash and `not_logged_in` on Bun and the two routes'
-                # counts could not be added together. Ordered directly after
-                # no_provider because install-vs-authenticate need opposite fixes
-                # and a missing provider is the earlier wall.
-                *"not logged in"*|*"login has expired"*) _blk_key="not_logged_in" ;;
                 *"Node.js is not installed"*|*"Node.js must be"*) _blk_key="node" ;;
                 *"Python 3 is not installed"*|*"Python 3 must be"*) _blk_key="python3" ;;
                 *"jq is not installed"*) _blk_key="jq" ;;
@@ -12330,18 +12312,7 @@ _cat_path = os.environ['LOKI_CATALOG_PATH']
 try:
     import datetime as _dt
     _cat_updated = json.load(open(_cat_path))['updated']
-    # UTC, not local. date.today() is the HOST's date, while the Bun route parses
-    # both sides at UTC midnight (doctor.ts:545 says so, to keep the day count
-    # from shifting with the host timezone). Anywhere west of UTC the two
-    # disagree for the hours between local midnight and UTC midnight, and
-    # doctor --json is compared BYTE FOR BYTE between routes by bun-parity.
-    #
-    # Measured on this host at 02:45 UTC / 22:45 local: bash reported age_days 5
-    # and Bun reported 6, from the same file at the same instant. It reproduced
-    # across two full gate runs hours apart, so it is not a midnight-rollover
-    # flake. It is a real parity defect that stays invisible while the local date
-    # and the UTC date agree, which is most of the day.
-    _cat_age = (_dt.datetime.now(_dt.timezone.utc).date() - _dt.date.fromisoformat(_cat_updated)).days
+    _cat_age = (_dt.date.today() - _dt.date.fromisoformat(_cat_updated)).days
     if _cat_age > CATALOG_STALE_DAYS:
         # Deliberately NOT counted. The block comment above states catalog age is
         # excluded from pass/fail/warn and from 'ok' so a stale catalog can never
@@ -13803,90 +13774,12 @@ set_ttfv_lightweight_profile() {
 # never pollutes the v7.8.1 generated-PRD-reuse signature logic. The brief text
 # is the project intent; the rest is a minimal scaffold the agent fills in.
 # Usage: synthesize_brief_prd <output_file> <brief_text>
-# _brief_acceptance_criteria <brief_text>: acceptance criteria derived from what
-# the user ACTUALLY asked for, not constants.
-#
-# WHY. Every one-liner used to get byte-identical Requirements and Success
-# Criteria: "build a todo app" and "build a Stripe billing dashboard" produced
-# the same acceptance criteria, and the user's own words appeared exactly once,
-# under Overview. So the completion council, the checklist and the evidence gate
-# were all checking generic prose rather than the request. That is the weakest
-# input shape getting the least specific help, which is backwards -- a cheap
-# model's output quality depends more on how precisely the target is stated than
-# on the model.
-#
-# DETERMINISTIC ON PURPOSE. No model call: this runs before a provider is even
-# selected, must work with no API key, and must not add latency or cost to the
-# first thing a new user does. It is keyword-to-obligation mapping, which is
-# honest about being shallow -- it turns stated nouns into checkable lines and
-# claims nothing about intent it cannot see. Anything cleverer belongs in the
-# spec-interrogation grill, which already runs after this and does call a model.
-#
-# STABLE IDs. Each criterion is emitted as "AC-<AXIS>-NNN: <text>" rather than a
-# bare bullet. An anonymous bullet cannot be referred to: a receipt can say "3 of
-# 8 gates passed" but never "AC-PERSIST-001 is satisfied by this test", drift
-# cannot be tracked per criterion, and two runs of the same spec produce lists
-# nothing can diff. The ID is what turns a criterion into a citable claim, which
-# is the whole point of shipping a receipt someone can check.
-#
-# The axis is derived from WHICH obligation fired, not from the criterion's
-# position, so IDs are stable across runs: adding a payment criterion never
-# renumbers the persistence one. Same reason we do not use a running counter.
-_brief_acceptance_criteria() {
-    local t
-    t="$(printf '%s' "${1:-}" | tr '[:upper:]' '[:lower:]')"
-    local out=""
-    # _bac <AXIS> <text>. The sequence is per-axis and always 001 today because
-    # each axis fires at most once; the NNN slot exists so a second criterion on
-    # the same axis can be added later without renumbering the first.
-    _bac() { out="${out}- AC-${1}-001: ${2}"$'\n'; }
-
-    # Persistence. The single most common churn report is "I submitted the form
-    # and nothing happened", so a stated store or form becomes an explicit
-    # survives-a-reload obligation rather than an implied one.
-    case "$t" in
-        *save*|*persist*|*store*|*databas*|*crud*|*todo*|*note*|*task*|*record*)
-            _bac PERSIST "Data the user creates survives a page reload and a server restart (it is written to a real store, not held in memory)." ;;
-    esac
-    case "$t" in
-        *form*|*submit*|*signup*|*"sign up"*|*contact*|*upload*|*checkout*)
-            _bac FORM "Every form actually submits: the happy path writes real data and the user sees a confirmation, and a validation failure shows an inline error." ;;
-    esac
-    case "$t" in
-        *auth*|*login*|*"log in"*|*"sign in"*|*account*|*user*|*password*|*session*)
-            _bac AUTH "Authentication works end to end: a real signup, a real login, and a protected route that returns 401 when logged out." ;;
-    esac
-    case "$t" in
-        *api*|*endpoint*|*rest*|*graphql*|*backend*|*server*)
-            _bac API "Each endpoint returns real data with correct status codes, and is callable with curl without a browser." ;;
-    esac
-    case "$t" in
-        *payment*|*stripe*|*billing*|*subscription*|*checkout*|*invoice*)
-            _bac PAY "The payment path is wired to the provider's test mode and a test transaction completes; no mocked charge stands in for the integration." ;;
-    esac
-    case "$t" in
-        *search*|*filter*|*sort*)
-            _bac SEARCH "Search or filtering queries the real dataset and returns different results for different inputs." ;;
-    esac
-    case "$t" in
-        *dashboard*|*chart*|*graph*|*analytic*|*report*|*metric*)
-            _bac DATA "Every figure shown traces to a real query. No hardcoded sample numbers." ;;
-    esac
-    case "$t" in
-        *page*|*landing*|*site*|*website*|*ui*|*app*|*frontend*)
-            _bac UI "The page renders with real content, no lorem ipsum, and no placeholder image where a real asset belongs." ;;
-    esac
-    printf '%s' "$out"
-}
-
 synthesize_brief_prd() {
     local out_file="$1"
     local brief_text="$2"
     local out_dir
     out_dir="$(dirname "$out_file")"
     mkdir -p "$out_dir" 2>/dev/null || true
-    local _derived
-    _derived="$(_brief_acceptance_criteria "$brief_text")"
     cat > "$out_file" << BRIEFEOF
 # Project Brief
 
@@ -13902,7 +13795,6 @@ $brief_text
 ## Success Criteria
 - A user can run the result and observe the core behavior described above.
 - No errors on a clean start; the happy path works end to end.
-${_derived}
 
 ## Constraints
 - This is a fast first pass (zero-config first run). Keep scope tight.
@@ -14004,10 +13896,6 @@ cmd_quick() {
     find "$LOKI_DIR" -maxdepth 1 -name 'quick-prd-*.md' -mtime +1 -delete 2>/dev/null || true
     find "$LOKI_DIR" -maxdepth 1 -name 'brief-prd-*.md' -mtime +1 -delete 2>/dev/null || true
     local quick_prd="$LOKI_DIR/quick-prd-$$.md"
-    # Same spec-derived criteria as the brief path: a quick task was getting the
-    # identical generic Success Criteria regardless of what was asked.
-    local _derived
-    _derived="$(_brief_acceptance_criteria "$task_desc")"
     cat > "$quick_prd" << QPRDEOF
 # Quick Task
 
@@ -14024,7 +13912,6 @@ $task_desc
 - Task is completed as described
 - No errors or regressions introduced
 - Code follows project conventions
-${_derived}
 
 ## Constraints
 - This is a quick single-task execution
@@ -19489,20 +19376,6 @@ main() {
             # happened to it afterwards -- reverted, reworked, or survived.
             cmd_outcomes "$@"
             ;;
-        verdict)
-            # All five trust signals in one block. The individual measurements
-            # existed and were unreachable; this is the surface a reviewer reads.
-            cmd_verdict "$@"
-            ;;
-        readiness)
-            # Can an agent verify its own work here? Measured, not LLM-scored.
-            cmd_readiness "$@"
-            ;;
-        gates)
-            # What blocks here vs only advises, and what promoting a gate would
-            # have cost. Reports only; never promotes.
-            cmd_gates "$@"
-            ;;
         secure)
             # Secure-by-default gate surface: inspect findings + manage waivers.
             cmd_secure "$@"
@@ -30978,136 +30851,6 @@ cmd_outcomes() {
     LOKI_DIR="${LOKI_DIR:-.loki}" python3 "$lib" "$@"
 }
 
-# loki verdict: the five measured trust signals, in one block a reviewer reads
-# in ten seconds.
-#
-# WHY A COMMAND AND NOT JUST A LIBRARY. We measure five things nobody else does
-# -- did the work survive, does the spec still match intent, was this the agent
-# or a human rescue, does the completion claim name real work, which model
-# decided -- and each was correct, tested, and unreachable. A moat nobody can
-# see is not a moat. This is the surface.
-#
-# There is deliberately NO composite score. Averaging a revert count, a hash
-# comparison, a diff hash, a path match and a model id yields a number whose
-# movement nobody can explain, which is what competitors already ship. UNKNOWN
-# is PRINTED, never suppressed: a reviewer must tell "we checked and it is fine"
-# from "we could not check". See autonomy/lib/verdict.py.
-cmd_verdict() {
-    local lib="${_LOKI_SCRIPT_DIR}/lib/verdict.py"
-    if [ ! -f "$lib" ]; then
-        echo "verdict renderer is not installed at $lib" >&2
-        return 2
-    fi
-    case "${1:-}" in
-        --help|-h|help)
-            echo -e "${BOLD}loki verdict${NC} - the five measured trust signals, in one readable block"
-            echo ""
-            echo "Usage: loki verdict [--json]"
-            echo ""
-            echo "Prints one line each for outcome, intent, authorship, grounding and"
-            echo "model: what survived, whether the spec still matches intent, whether"
-            echo "this was the agent or a human rescue, whether the completion claim"
-            echo "named real work, and which model decided."
-            echo ""
-            echo "Every line is either a measured fact or an explicit UNKNOWN. There is"
-            echo "no composite score: a number nobody can explain is not evidence."
-            echo "Read-only: it never writes to the repo it analyses."
-            return 0
-            ;;
-    esac
-    LOKI_DIR="${LOKI_DIR:-.loki}" python3 "$lib" "$@"
-}
-
-# loki readiness: can an autonomous agent verify its own work in THIS repo?
-#
-# WHY THIS IS NOT A COPY OF FACTORY AI'S AGENT READINESS MODEL. Theirs is
-# LLM-scored -- their report objects record modelUsed and reasoningEffort, so
-# the number is a model's opinion and two runs can disagree about the same
-# commit. Every criterion here is a file that exists or does not, a command
-# present or absent: same commit, same answer, every machine, no key, no spend.
-#
-# No percentage and no letter grade. A composite invites ranking, ranking
-# invites gaming, and the individual signals are the actionable part -- "there
-# is no test command" tells you what to do, "readiness 62%" does not. Criteria
-# that cannot be determined report UNKNOWN by name rather than counting as
-# failures. See autonomy/lib/agent_readiness.py.
-cmd_gates() {
-    local lib="${_LOKI_SCRIPT_DIR}/lib/gate_policy.py"
-    if [ ! -f "$lib" ]; then
-        echo "gate policy reporter is not installed at $lib" >&2
-        return 2
-    fi
-    case "${1:-}" in
-        --help|-h|help)
-            echo -e "${BOLD}loki gates${NC} - what blocks here, and what only advises"
-            echo ""
-            echo "Usage: loki gates [.loki-dir] [--json]"
-            echo ""
-            echo "Ona's Veto Exec ships an audit-first ladder: start in audit mode,"
-            echo "review what matched, then promote the confirmed rules to block. The"
-            echo "middle step is the load-bearing one -- a policy you cannot safely"
-            echo "turn on is a policy nobody turns on."
-            echo ""
-            echo "We had both ends and nothing between them: gates are advisory or"
-            echo "blocking, three promotion knobs exist, and the failure ledger has"
-            echo "counted per-gate hits all along. Nothing joined them, so deciding"
-            echo "whether to promote a gate meant guessing."
-            echo ""
-            echo "For each gate this prints its mode, how many times it has fired,"
-            echo "and -- for an advisory one -- the exact variable that promotes it."
-            echo ""
-            echo "Deterministic: reads two files and the environment. No model, no"
-            echo "key, no spend. Counts come from"
-            echo ".loki/quality/gate-failure-count.json; open it and count them"
-            echo "yourself."
-            echo ""
-            echo "A gate with no ledger entry reports 'not measured', never 0: an"
-            echo "absent measurement is not evidence a gate never fired."
-            echo ""
-            echo "This command NEVER promotes a gate. Promotion stays an explicit"
-            echo "operator act via the named variable."
-            return 0
-            ;;
-    esac
-    python3 "$lib" "$@"
-}
-
-cmd_readiness() {
-    local lib="${_LOKI_SCRIPT_DIR}/lib/agent_readiness.py"
-    if [ ! -f "$lib" ]; then
-        echo "readiness assessor is not installed at $lib" >&2
-        return 2
-    fi
-    case "${1:-}" in
-        --help|-h|help)
-            echo -e "${BOLD}loki readiness${NC} - can an agent verify its own work in this repo?"
-            echo ""
-            echo "Usage: loki readiness [path] [--json] [--fix]"
-            echo ""
-            echo "Measures whether this repo gives an agent a way to check itself: a"
-            echo "test command, a build, CI config, typed sources, a lockfile. Not"
-            echo "general code quality -- the narrower question every agent depends on."
-            echo ""
-            echo "Deterministic: no model, no key, no spend. Same commit, same answer."
-            echo "Criteria that cannot be determined report UNKNOWN rather than failing."
-            echo ""
-            echo -e "${BOLD}--fix${NC} writes the missing files whose content can be derived"
-            echo "honestly (README.md, AGENTS.md, .gitignore) as TODO stubs, then"
-            echo "re-measures and reports what is true AFTER the change."
-            echo ""
-            echo "It deliberately REFUSES to generate a test command, a lockfile or a"
-            echo "CI config. Guessing one writes a line that lies: an invented"
-            echo "'npm test' in a repo with no runner fails forever, and this check"
-            echo "would then report the criterion present for something that does not"
-            echo "work. Those stay reported, never generated."
-            echo ""
-            echo "Without --fix it is read-only and never writes to the repo."
-            return 0
-            ;;
-    esac
-    python3 "$lib" "$@"
-}
-
 cmd_wiki() {
     local subcmd="${1:-}"
     shift 2>/dev/null || true

package/autonomy/notify.sh

@@ -86,68 +86,6 @@ _get_discord_color() {
 # Slack Notifications
 #===============================================================================
 
-# Verdict fields for a Slack card, from the newest Evidence Receipt.
-#
-# Roadmap item 9: "put the receipt where review already happens". Slack
-# notifications carried the event name and the project name and nothing else --
-# grep for receipt/verdict/proof in this file returned 0. A team watching a
-# channel saw "build finished" and had to go somewhere else to learn whether it
-# was verified, which is the surface problem item 9 names: verification nobody
-# sees does not build trust.
-#
-# Emits Slack `fields` entries (the payload already has that array), so this
-# adds to the card rather than restructuring it.
-#
-# SILENT AND EMPTY ON ANY DOUBT. No receipt, unreadable JSON, no python -- emit
-# nothing. A notification is a side channel; it must never fail a build, and it
-# must never guess a verdict. An absent receipt yields no verdict field at all
-# rather than a reassuring default.
-_slack_verdict_fields() {
-    local loki_dir="${LOKI_DIR:-.loki}"
-    [ -d "$loki_dir/proofs" ] || return 0
-    command -v python3 >/dev/null 2>&1 || return 0
-    python3 - "$loki_dir" <<'PY' 2>/dev/null || true
-import glob, json, os, sys
-d = sys.argv[1]
-paths = sorted(glob.glob(os.path.join(d, "proofs", "*", "proof.json")))
-if not paths:
-    sys.exit(0)
-try:
-    r = json.load(open(paths[-1]))
-except (OSError, ValueError):
-    sys.exit(0)
-
-def esc(s):
-    return json.dumps(str(s))[1:-1]
-
-out = []
-qg = r.get("quality_gates") or {}
-gates = qg.get("gates") or []
-if gates:
-    passed = sum(1 for g in gates if str(g.get("status", "")).startswith("pass"))
-    out.append(("Gates", f"{passed}/{len(gates)} passed"))
-
-git = (r.get("facts") or {}).get("git") or {}
-# base_sha empty means the receipt cannot be anchored, so it cannot be
-# verified. Say that plainly rather than showing a diff count that implies it.
-if not git.get("base_sha"):
-    out.append(("Verified", "no (unanchored receipt)"))
-else:
-    diff = git.get("diff") or {}
-    if diff.get("count") is not None:
-        out.append(("Files changed", str(diff["count"])))
-
-run_id = r.get("run_id")
-if run_id:
-    out.append(("Receipt", esc(run_id)))
-
-print(",".join(
-    '{"title": "%s", "value": "%s", "short": true}' % (esc(t), esc(v))
-    for t, v in out
-))
-PY
-}
-
 _notify_slack() {
     local event="$1"
     local title="$2"
@@ -168,13 +106,6 @@ _notify_slack() {
     escaped_event="$(_json_escape "$event")"
     escaped_project="$(_json_escape "$project")"
 
-    # Receipt-derived fields. Empty on any doubt, and the ${var:+,...} expansion
-    # below means an empty value adds no trailing comma -- a malformed payload
-    # would make Slack reject the whole card, so the failure mode of "no receipt"
-    # must be a card without verdict fields, never a card that does not send.
-    local verdict_fields
-    verdict_fields="$(_slack_verdict_fields 2>/dev/null || true)"
-
     # Build Slack payload with attachment
     local payload
     payload=$(cat <<PAYLOAD
@@ -185,7 +116,7 @@ _notify_slack() {
         "text": "$escaped_message",
         "fields": [
             {"title": "Event", "value": "$escaped_event", "short": true},
-            {"title": "Project", "value": "$escaped_project", "short": true}${verdict_fields:+,$verdict_fields}
+            {"title": "Project", "value": "$escaped_project", "short": true}
         ],
         "footer": "Loki Mode",
         "ts": $(date +%s)