loki-mode 9.17.0 → 9.18.2

package/autonomy/loki

@@ -556,6 +556,338 @@ require_jq() {
     fi
 }
 
+# --- remote submit (loki start --remote <url>) --------------------------------
+#
+# Submits a spec to a deployed trigger-server's POST /jobs instead of building
+# locally, then polls GET /jobs/<id> until the job reaches a terminal state.
+#
+# The bearer token is read from LOKI_REMOTE_TOKEN or LOKI_REMOTE_TOKEN_FILE and
+# is NEVER placed in argv (the process list is world-readable) and never logged.
+# It reaches curl through `--config -` on stdin.
+
+# Extract the host from a URL: strip scheme, userinfo, then cut at the first
+# '/', ':' or '?'. Compared EXACTLY, never by prefix -- "http://localhost*"
+# would happily accept http://localhost.evil.com and leak a bearer token.
+loki_remote_host() {
+    local url="$1"
+    local rest="${url#*://}"
+    rest="${rest##*@}"
+    rest="${rest%%/*}"
+    rest="${rest%%\?*}"
+    # Strip a :port, but keep an [::1] literal intact.
+    case "$rest" in
+        \[*\]*) rest="${rest%%\]*}]" ;;
+        *) rest="${rest%%:*}" ;;
+    esac
+    printf '%s' "$rest"
+}
+
+loki_remote_is_local_host() {
+    case "$(loki_remote_host "$1")" in
+        localhost|127.0.0.1|\[::1\]|::1) return 0 ;;
+        *) return 1 ;;
+    esac
+}
+
+# Read the token from env or a file. Never echoed, never passed as an argument.
+loki_remote_token() {
+    if [ -n "${LOKI_REMOTE_TOKEN:-}" ]; then
+        printf '%s' "$LOKI_REMOTE_TOKEN"
+        return 0
+    fi
+    if [ -n "${LOKI_REMOTE_TOKEN_FILE:-}" ] && [ -f "${LOKI_REMOTE_TOKEN_FILE}" ]; then
+        # Mounted secrets end with a newline; strip it or every compare fails.
+        tr -d '\r\n' < "${LOKI_REMOTE_TOKEN_FILE}"
+        return 0
+    fi
+    return 1
+}
+
+# curl with the Authorization header fed on stdin via --config, so the token
+# never appears in argv. Usage: loki_remote_curl <token> <curl-args...>
+loki_remote_curl() {
+    local _tok="$1"; shift
+    printf 'header = "Authorization: Bearer %s"\n' "$_tok" \
+        | curl --config - "$@"
+}
+
+loki_remote_submit() {
+    local url="$1"
+    local spec="$2"
+
+    url="${url%/}"
+
+    if [ -z "$spec" ]; then
+        echo -e "${RED}loki: --remote needs a spec to submit${NC}" >&2
+        echo "  e.g. loki start ./prd.md --remote $url" >&2
+        return 1
+    fi
+
+    # A bearer token over plaintext to a remote host is a credential leak.
+    # Loopback is exempt (it never leaves the machine); anything else needs an
+    # explicit opt-in so the leak is a decision, not an accident.
+    case "$url" in
+        http://*)
+            if ! loki_remote_is_local_host "$url" && [ "${LOKI_REMOTE_INSECURE:-}" != "1" ]; then
+                echo -e "${RED}loki: refusing to send a bearer token over plaintext http to $(loki_remote_host "$url")${NC}" >&2
+                echo "  Use https://, or set LOKI_REMOTE_INSECURE=1 to override." >&2
+                return 1
+            fi
+            ;;
+    esac
+
+    local token
+    if ! token="$(loki_remote_token)" || [ -z "$token" ]; then
+        echo -e "${RED}loki: no remote token configured${NC}" >&2
+        echo "  Set LOKI_REMOTE_TOKEN or LOKI_REMOTE_TOKEN_FILE (never pass it as an argument)." >&2
+        return 1
+    fi
+
+    require_jq || return 1
+
+    local body resp
+    body="$(jq -nc --arg s "$spec" '{spec:$s}')"
+
+    echo "Submitting to $url ..."
+    if ! resp="$(loki_remote_curl "$token" -fsS --max-time 30 \
+            -H "Content-Type: application/json" \
+            -X POST --data "$body" "$url/jobs" 2>&1)"; then
+        # NEVER fall back to a local run: a user who asked for remote and
+        # silently got a local build would pay local spend they did not ask for.
+        echo -e "${RED}loki: remote submit failed: $url/jobs${NC}" >&2
+        echo "  Is the server reachable, and is LOKI_REMOTE_TOKEN correct?" >&2
+        echo "  Not falling back to a local build (you asked for --remote)." >&2
+        return 1
+    fi
+
+    local job_id
+    job_id="$(printf '%s' "$resp" | jq -r '.id // empty' 2>/dev/null)"
+    if [ -z "$job_id" ]; then
+        echo -e "${RED}loki: remote accepted the request but returned no job id${NC}" >&2
+        return 1
+    fi
+    echo "Job $job_id queued on $url"
+
+    local poll_sec="${LOKI_REMOTE_POLL_SEC:-5}"
+    local max_polls="${LOKI_REMOTE_MAX_POLLS:-720}"
+    local status="" last="" i=0
+    while [ "$i" -lt "$max_polls" ]; do
+        i=$((i+1))
+        if ! resp="$(loki_remote_curl "$token" -fsS --max-time 30 \
+                "$url/jobs/$job_id" 2>&1)"; then
+            echo -e "${RED}loki: lost contact with $url while polling job $job_id${NC}" >&2
+            return 1
+        fi
+        status="$(printf '%s' "$resp" | jq -r '.status // empty' 2>/dev/null)"
+        if [ "$status" != "$last" ]; then
+            echo "  [$job_id] $status"
+            last="$status"
+        fi
+        case "$status" in
+            fired|error|rejected*)
+                break
+                ;;
+        esac
+        sleep "$poll_sec"
+    done
+
+    # A TAMPERED receipt fails the whole submit regardless of the job status:
+    # reporting a build as successful while holding proof that its own receipt
+    # was altered would make the receipt decorative.
+    local _receipt_rc=0
+    loki_remote_fetch_receipt "$url" "$token" "$job_id" || _receipt_rc=$?
+    if [ "$_receipt_rc" -ne 0 ]; then
+        echo -e "${RED}loki: remote job $job_id returned a receipt that failed verification${NC}" >&2
+        return 1
+    fi
+
+    # ponytail: the server reports DISPATCH success ("fired" = the pod launched
+    # the build), not the build's own exit code -- run_loki_command returns true
+    # for a --detach launch and for the detach-timeout path. So a non-"fired"
+    # status is a real failure, but "fired" is not yet proof the build passed.
+    # Upgrade path: have trigger-server record the build's exit code and expose
+    # a terminal status here, then gate CI on that instead.
+    case "$status" in
+        fired) return 0 ;;
+        "")    echo -e "${RED}loki: job $job_id did not reach a terminal status${NC}" >&2; return 1 ;;
+        *)     echo -e "${RED}loki: remote job $job_id failed: $status${NC}" >&2; return 1 ;;
+    esac
+}
+
+# Fetch the Evidence Receipt and write it where a local run puts it, so
+# `loki proof` works on a remote build, then VERIFY it here -- on the machine
+# that did NOT produce it. That is the entire point: a receipt you can only
+# check by asking the builder whether it is good proves nothing.
+#
+# Returns 0 when the receipt verified or is honestly reported as unverifiable,
+# and NON-ZERO when the receipt is TAMPERED. Absence of a receipt is not a
+# failure (a build may legitimately produce none); a receipt that fails its
+# own integrity check is.
+loki_remote_fetch_receipt() {
+    local url="$1" token="$2" job_id="$3"
+    local dir="${LOKI_DIR:-.loki}/proofs/$job_id"
+    local tmp resp
+
+    if ! resp="$(loki_remote_curl "$token" -fsS --max-time 30 \
+            "$url/jobs/$job_id/proof" 2>/dev/null)"; then
+        echo "  (no evidence receipt available from $url for $job_id)" >&2
+        return 0
+    fi
+    # Only write something that parses as JSON: a proxy error page must not
+    # land in .loki/proofs/ looking like a receipt.
+    if ! printf '%s' "$resp" | jq -e . >/dev/null 2>&1; then
+        echo "  (remote returned a non-JSON receipt for $job_id; not written)" >&2
+        return 0
+    fi
+    mkdir -p "$dir"
+    tmp="$dir/.proof.json.$$"
+    printf '%s' "$resp" > "$tmp" && mv "$tmp" "$dir/proof.json"
+    echo "  Evidence Receipt: $dir/proof.json"
+
+    loki_remote_verify_receipt "$dir/proof.json"
+}
+
+# Verify a fetched receipt locally and print exactly what was and was not
+# proven. Exit 1 ONLY on tamper.
+#
+# THREE OUTCOMES, NEVER COLLAPSED INTO TWO:
+#   VERIFIED  a gpg signature is present and valid  -> integrity AND provenance
+#   UNSIGNED  the hash matches, no signature        -> integrity ONLY
+#   TAMPERED  hash mismatch or bad signature        -> exit 1
+#
+# UNSIGNED is not a weaker VERIFIED, it is a different claim. docs/VERIFICATION-COST.md
+# records that the unsigned path is FORGEABLE: whoever rewrites the facts and
+# the headline into a mutually consistent lie and recomputes the hash passes
+# every check here. A user who trusts a "verified" label meaning only "these
+# bytes are self-consistent" is worse off than one who knows they hold no proof,
+# because they will stop looking. So the word "verified" is never printed for an
+# unsigned receipt.
+#
+# There is a FOURTH state and it must not be folded into UNSIGNED: a signature
+# is present but gpg is not installed here, so it could not be checked. Saying
+# UNSIGNED there would be a false statement about the receipt (it IS signed),
+# and saying VERIFIED would be a false statement about this machine (it checked
+# nothing). It gets its own line and never claims verification.
+# Ask gpg WHY a signature failed. Echoes "nopubkey" when the signing key is
+# absent (uncheckable), "" otherwise (a genuinely bad signature, or we could
+# not tell). Fails toward "" so an unclear answer keeps the loud TAMPERED
+# verdict rather than silently downgrading a real forgery to a soft warning.
+loki_remote_gpg_status() {
+    local pj="$1"
+    local d="${TMPDIR:-/tmp}/loki-sigcheck.$$"
+    mkdir -p "$d" || return 0
+    python3 - "$pj" "$d" <<'PY' 2>/dev/null || { rm -rf "$d"; return 0; }
+import json, sys, os
+proof = json.load(open(sys.argv[1]))
+d = sys.argv[2]
+sig = (proof.get("verification") or {}).get("gpg_signature") or ""
+proof.pop("verification", None)
+open(os.path.join(d, "canon.bin"), "wb").write(
+    json.dumps(proof, sort_keys=True, separators=(",", ":")).encode())
+open(os.path.join(d, "sig.asc"), "w").write(sig)
+PY
+    local st
+    st="$(gpg --status-fd 1 --verify "$d/sig.asc" "$d/canon.bin" 2>/dev/null)"
+    rm -rf "$d"
+    case "$st" in
+        *NO_PUBKEY*) printf 'nopubkey' ;;
+        *) printf '' ;;
+    esac
+}
+
+loki_remote_verify_receipt() {
+    local pj="$1"
+    local verifier="${_LOKI_SCRIPT_DIR}/lib/proof-verify.py"
+
+    if [ ! -f "$verifier" ] || ! command -v python3 >/dev/null 2>&1; then
+        echo "  NOT VERIFIED: no local verifier available (need python3 and lib/proof-verify.py)" >&2
+        return 0
+    fi
+
+    # Whether the receipt CARRIES a signature is read from the receipt itself,
+    # not inferred from the verifier's gpg verdict. proof-verify.py reports
+    # gpg_ok="n/a" for two distinct situations -- no signature present, and gpg
+    # unavailable on this machine -- so gpg_ok alone cannot tell them apart, and
+    # collapsing them is exactly how a signed receipt gets mislabelled UNSIGNED.
+    local signed=0
+    if jq -e '.verification.gpg_signature // empty' "$pj" >/dev/null 2>&1; then
+        signed=1
+    fi
+
+    # Deliberately NOT gated on the verifier's exit code or its `ok` field.
+    # `ok` includes diff_drift, re-derived against the LOCAL repo -- which is
+    # not the machine that produced this build, so an honest remote receipt
+    # drifts by construction and would report TAMPERED on every single run.
+    # A false BLOCK is the more damaging direction (docs/VERIFICATION-COST.md):
+    # a gate that cries wolf every time trains users to ignore the verdict.
+    # Only hash_ok and gpg_ok are load-bearing here; drift is not our verdict.
+    local out hash_ok gpg_ok
+    out="$(python3 "$verifier" "$pj" "${TARGET_DIR:-.}" 2>/dev/null)"
+    hash_ok="$(printf '%s' "$out" | jq -r '.hash_ok // false' 2>/dev/null)"
+    gpg_ok="$(printf '%s' "$out" | jq -r '.gpg_ok | tostring' 2>/dev/null)"
+
+    if [ "$hash_ok" != "true" ]; then
+        echo -e "  ${RED}TAMPERED: the receipt's integrity hash does not match its contents.${NC}" >&2
+        echo "    proof.json was edited after it was written. Do not trust this build." >&2
+        return 1
+    fi
+
+    # gpg_ok=false covers TWO facts that must never be conflated: the signature
+    # is cryptographically bad over this content (the receipt was ALTERED), and
+    # gpg could not evaluate it at all (we do not hold the public key). Only the
+    # first is an accusation. Reporting a missing key as TAMPERED would send a
+    # user hunting a forgery that never happened, and would train them to shrug
+    # at a real TAMPERED -- the same error as calling an unsigned receipt
+    # verified, just pointed the other way.
+    #
+    # proof-verify.py returns a bare boolean, so the distinction is drawn here
+    # from gpg's own status codes: BADSIG = bad over this content, NO_PUBKEY /
+    # ERRSIG = could not be checked.
+    if [ "$signed" -eq 1 ] && [ "$gpg_ok" = "false" ]; then
+        local _why=""
+        if command -v gpg >/dev/null 2>&1; then
+            _why="$(loki_remote_gpg_status "$pj")"
+        fi
+        if [ "$_why" = "nopubkey" ]; then
+            echo -e "  ${YELLOW}NOT CHECKED${NC}: the receipt is signed, but the signing key is not in your keyring." >&2
+            echo "    Nothing is wrong with the contents: the integrity hash matches. The" >&2
+            echo "    signature could not be evaluated, so PROVENANCE is unproven here." >&2
+            echo "    Import the publisher's public key and re-run: loki proof verify $(basename "$(dirname "$pj")")" >&2
+            # Non-zero: a caller who asked for a signed receipt did not get
+            # proof, and in CI that must not pass silently. The message states
+            # plainly that no fault was found in the content, so this is a
+            # missing-proof exit, not an accusation of tampering.
+            return 1
+        fi
+        echo -e "  ${RED}TAMPERED: the receipt carries a gpg signature that does not verify.${NC}" >&2
+        echo "    Either the contents or the signature was altered. Do not trust this build." >&2
+        return 1
+    fi
+
+    if [ "$signed" -eq 1 ] && [ "$gpg_ok" = "true" ]; then
+        echo -e "  ${GREEN}VERIFIED${NC}: integrity hash matches and the gpg signature is valid."
+        echo "    Proven: these receipt bytes are unaltered, and they were signed by the"
+        echo "    holder of the signing key. Verify that key is one you trust."
+        echo "    NOT proven: that the code is correct. A receipt records which checks ran."
+        return 0
+    fi
+
+    if [ "$signed" -eq 1 ]; then
+        # gpg_ok is "n/a" with a signature present: gpg is missing here.
+        echo -e "  ${YELLOW}NOT CHECKED${NC}: the receipt is signed, but gpg is unavailable on this machine."
+        echo "    Its integrity hash matches. The signature was NOT checked, so provenance"
+        echo "    is unproven here. Install gpg and re-run: loki proof verify $(basename "$(dirname "$pj")")"
+        return 0
+    fi
+
+    echo -e "  ${YELLOW}UNSIGNED${NC}: integrity hash matches. This is NOT proof of provenance."
+    echo "    Proven: the receipt is internally consistent with its own hash."
+    echo "    NOT proven: who produced it. An unsigned receipt is forgeable -- whoever"
+    echo "    controls the builder can rewrite the facts and recompute the hash."
+    echo "    For provenance, the build must set LOKI_PROOF_GPG_KEY (docs/SIGNED-RECEIPTS.md)."
+    return 0
+}
+
 # Emit event (non-blocking)
 # Usage: emit_event <type> <source> <action> [key=value ...]
 emit_event() {
@@ -1040,15 +1372,15 @@ show_help() {
     echo "  agent analyze api assets audit bench checkpoint (cp) ci cleanup"
     echo "  cluster cockpit code compliance completions compound config context (ctx)"
     echo "  cost council crash dashboard demo deploy docker docs doctor dogfood"
-    echo "  enterprise estimate explain export failover gates github grill heal help"
+    echo "  enterprise estimate explain export failover github grill heal help"
     echo "  import init intent"
     echo "  issue kpis logs magic mcp memory metrics migrate modernize monitor"
     echo "  next notify onboard open optimize otel outcomes own (handoff) pause plan preview"
-    echo "  projects proof (receipt) provider quick quickstart rc readiness remote report reset"
+    echo "  projects proof (receipt) provider quick quickstart rc remote report reset"
     echo "  resume review rollback run sandbox secrets secure self-update sentrux"
     echo "  serve setup-skill share ship spec start state stats status steer stop"
     echo "  syslog telemetry template test tour trigger trust trust-metrics"
-    echo "  ultracode update verdict verify version voice watch watchdog web welcome why"
+    echo "  ultracode update verify version voice watch watchdog web welcome why"
     echo "  wiki worktree (wt)"
     echo ""
     echo "Any command: loki <command> --help"
@@ -1495,6 +1827,7 @@ cmd_start() {
     local mirofish_bg=false
     local mirofish_disabled=false
     local no_plan=false  # v6.81.1: --no-plan opts out of auto-plan display
+    local remote_url="${LOKI_REMOTE_URL:-}"   # --remote: submit to a deployed cluster
 
     # v6.84.0: unified entry point -- explicit mode overrides + issue-mode args
     local explicit_mode=""            # "prd" | "issue" | "" (auto-detect)
@@ -1532,6 +1865,10 @@ cmd_start() {
                 echo "  --brief \"TEXT\"        Force zero-config brief mode (fast first run)"
                 echo ""
                 echo "Options:"
+                echo "  --remote URL          Submit to a deployed Loki (POST /jobs) instead of"
+                echo "                        building locally; polls until the job finishes."
+                echo "                        Token from LOKI_REMOTE_TOKEN / LOKI_REMOTE_TOKEN_FILE"
+                echo "                        (never an argument). Env: LOKI_REMOTE_URL."
                 echo "  --provider NAME       AI provider: claude (default), codex, cline, aider"
                 echo "  --parallel            Enable parallel mode with git worktrees"
                 echo "  --allow-haiku         Enable Haiku model for the fast tier (default: disabled)"
@@ -2058,6 +2395,19 @@ cmd_start() {
             --config=*|--vars=*|--env-file=*)
                 shift
                 ;;
+            --remote)
+                if [ "$#" -ge 2 ]; then
+                    remote_url="$2"
+                    shift 2
+                else
+                    echo "loki: --remote requires a URL (e.g. --remote https://loki.example.com)" >&2
+                    exit 1
+                fi
+                ;;
+            --remote=*)
+                remote_url="${1#--remote=}"
+                shift
+                ;;
             --)
                 # End-of-options: everything after is positional. Lets a caller
                 # pass an untrusted spec that might start with '-' safely, e.g.
@@ -2084,6 +2434,18 @@ cmd_start() {
         esac
     done
 
+    # --remote: submit to a deployed cluster instead of building locally.
+    #
+    # Branches HERE, after arg parsing but BEFORE the provider pre-flight and
+    # provider_offer_gate below: those require a provider CLI on PATH, and the
+    # whole point of a remote submit is that this machine is not doing the
+    # work. Gating a remote submit on a local provider install would defeat it.
+    if [ -n "$remote_url" ]; then
+        local _remote_spec="${brief_text:-${prd_file:-$positional_arg}}"
+        loki_remote_submit "$remote_url" "$_remote_spec"
+        return $?
+    fi
+
     # Explicit-provider pre-flight. Runs BEFORE provider_offer_gate below, and
     # is deliberately narrower than it.
     #
@@ -11364,6 +11726,10 @@ cmd_doctor() {
 
     local pass_count=0
     local fail_count=0
+    # Set to 1 when the bundled SDK is the ONLY usable provider (no CLI on PATH).
+    # Declared here, not inside the branch that sets it, so the "Next:" block at
+    # the end of this function always reads an initialized value.
+    local _doctor_sdk_only=0
     # FUNNEL FIX (v8.2.x): collect the NAME + FIX of every hard failure, not just
     # a count. A first-time user on a bare machine sees 15 warnings (sentrux, GPG
     # signing, bash 4, Bun, python3.12, truecolor, inline-image probe -- all
@@ -11528,6 +11894,12 @@ cmd_doctor() {
             echo -e "  ${GREEN}PASS${NC}  Bundled Claude Agent SDK is usable -- 'loki start' needs no separate CLI"
             echo -e "         ${YELLOW}Note: loki demo/quick/quickstart still need a provider CLI on PATH${NC}"
             echo -e "         ${YELLOW}      Install: npm install -g @anthropic-ai/claude-code${NC}"
+            # The note above was only half the fix. The final "Next:" line at the
+            # bottom of this function recommended quickstart unconditionally, so a
+            # user reading a GREEN doctor followed its LAST line straight into
+            # quickstart.sh:476 exit 2. Record the state here (where the predicate
+            # is already evaluated) and let the recommendation read it.
+            _doctor_sdk_only=1
             pass_count=$((pass_count + 1))
         else
             echo -e "  ${RED}FAIL${NC}  No AI provider CLI installed -- at least one is required"
@@ -11905,14 +12277,7 @@ STALE_DAYS = 90
 p = os.environ['LOKI_CATALOG_PATH']
 try:
     updated = json.load(open(p))['updated']
-    # UTC, matching the --json path below (loki:12337) and the Bun route
-    # (doctor.ts:545). This is the TEXT-mode twin of that computation, and it was
-    # missed when the JSON one was fixed: the parity gate compares BOTH surfaces,
-    # so fixing only --json left doctor text-mode still diverging 5 vs 6 and the
-    # gate still red. Two copies of one calculation is the actual defect here;
-    # they are left as two only because the text path prints and the JSON path
-    # returns a dict.
-    age = (datetime.datetime.now(datetime.timezone.utc).date() - datetime.date.fromisoformat(updated)).days
+    age = (datetime.date.today() - datetime.date.fromisoformat(updated)).days
 except Exception:
     print('warn|Catalog unreadable or missing an ISO \"updated\" date -- cannot determine age')
 else:
@@ -12036,17 +12401,6 @@ else:
             local _blk_key="other"
             case "$_doctor_blockers" in
                 *"No AI provider CLI"*) _blk_key="no_provider" ;;
-                # This doctor DETECTS the logged-out / expired wall above
-                # (:11610, :11615) but had no arm for it, so the single most
-                # common post-install failure was reported as `other` -- the one
-                # bucket that cannot be acted on. not_logged_in is already a
-                # first-class enum value (telemetry.sh:204) and the Bun doctor
-                # already reports it, so without this arm the SAME host answered
-                # `other` on bash and `not_logged_in` on Bun and the two routes'
-                # counts could not be added together. Ordered directly after
-                # no_provider because install-vs-authenticate need opposite fixes
-                # and a missing provider is the earlier wall.
-                *"not logged in"*|*"login has expired"*) _blk_key="not_logged_in" ;;
                 *"Node.js is not installed"*|*"Node.js must be"*) _blk_key="node" ;;
                 *"Python 3 is not installed"*|*"Python 3 must be"*) _blk_key="python3" ;;
                 *"jq is not installed"*) _blk_key="jq" ;;
@@ -12068,8 +12422,17 @@ else:
     # on fail_count==0 above, so a failing setup is never told to build. The
     # --json path returns long before this code, so machine output is untouched.
     echo ""
-    echo "Next: loki quickstart (guided first build from your idea, no PRD needed)"
-    echo "      or loki demo (builds a sample todo app end to end) or loki start ./prd.md"
+    if [ "$_doctor_sdk_only" = "1" ]; then
+        # SDK-only host: quickstart and demo stay on the bash route and need a
+        # binary on PATH, so recommending them here is a green doctor pointing at
+        # an exit 2. Recommend only what actually runs, plus the one command that
+        # unlocks the rest.
+        echo "Next: loki start ./prd.md (runs on the bundled SDK, no CLI install needed)"
+        echo "      For loki quickstart/demo: npm install -g @anthropic-ai/claude-code"
+    else
+        echo "Next: loki quickstart (guided first build from your idea, no PRD needed)"
+        echo "      or loki demo (builds a sample todo app end to end) or loki start ./prd.md"
+    fi
     # Best-effort stale-install nudge (stderr only; never blocks; off on
     # non-TTY/CI). Reached only on the human-readable path (--json returns above).
     maybe_print_update_hint
@@ -12330,18 +12693,7 @@ _cat_path = os.environ['LOKI_CATALOG_PATH']
 try:
     import datetime as _dt
     _cat_updated = json.load(open(_cat_path))['updated']
-    # UTC, not local. date.today() is the HOST's date, while the Bun route parses
-    # both sides at UTC midnight (doctor.ts:545 says so, to keep the day count
-    # from shifting with the host timezone). Anywhere west of UTC the two
-    # disagree for the hours between local midnight and UTC midnight, and
-    # doctor --json is compared BYTE FOR BYTE between routes by bun-parity.
-    #
-    # Measured on this host at 02:45 UTC / 22:45 local: bash reported age_days 5
-    # and Bun reported 6, from the same file at the same instant. It reproduced
-    # across two full gate runs hours apart, so it is not a midnight-rollover
-    # flake. It is a real parity defect that stays invisible while the local date
-    # and the UTC date agree, which is most of the day.
-    _cat_age = (_dt.datetime.now(_dt.timezone.utc).date() - _dt.date.fromisoformat(_cat_updated)).days
+    _cat_age = (_dt.date.today() - _dt.date.fromisoformat(_cat_updated)).days
     if _cat_age > CATALOG_STALE_DAYS:
         # Deliberately NOT counted. The block comment above states catalog age is
         # excluded from pass/fail/warn and from 'ok' so a stale catalog can never
@@ -13803,90 +14155,12 @@ set_ttfv_lightweight_profile() {
 # never pollutes the v7.8.1 generated-PRD-reuse signature logic. The brief text
 # is the project intent; the rest is a minimal scaffold the agent fills in.
 # Usage: synthesize_brief_prd <output_file> <brief_text>
-# _brief_acceptance_criteria <brief_text>: acceptance criteria derived from what
-# the user ACTUALLY asked for, not constants.
-#
-# WHY. Every one-liner used to get byte-identical Requirements and Success
-# Criteria: "build a todo app" and "build a Stripe billing dashboard" produced
-# the same acceptance criteria, and the user's own words appeared exactly once,
-# under Overview. So the completion council, the checklist and the evidence gate
-# were all checking generic prose rather than the request. That is the weakest
-# input shape getting the least specific help, which is backwards -- a cheap
-# model's output quality depends more on how precisely the target is stated than
-# on the model.
-#
-# DETERMINISTIC ON PURPOSE. No model call: this runs before a provider is even
-# selected, must work with no API key, and must not add latency or cost to the
-# first thing a new user does. It is keyword-to-obligation mapping, which is
-# honest about being shallow -- it turns stated nouns into checkable lines and
-# claims nothing about intent it cannot see. Anything cleverer belongs in the
-# spec-interrogation grill, which already runs after this and does call a model.
-#
-# STABLE IDs. Each criterion is emitted as "AC-<AXIS>-NNN: <text>" rather than a
-# bare bullet. An anonymous bullet cannot be referred to: a receipt can say "3 of
-# 8 gates passed" but never "AC-PERSIST-001 is satisfied by this test", drift
-# cannot be tracked per criterion, and two runs of the same spec produce lists
-# nothing can diff. The ID is what turns a criterion into a citable claim, which
-# is the whole point of shipping a receipt someone can check.
-#
-# The axis is derived from WHICH obligation fired, not from the criterion's
-# position, so IDs are stable across runs: adding a payment criterion never
-# renumbers the persistence one. Same reason we do not use a running counter.
-_brief_acceptance_criteria() {
-    local t
-    t="$(printf '%s' "${1:-}" | tr '[:upper:]' '[:lower:]')"
-    local out=""
-    # _bac <AXIS> <text>. The sequence is per-axis and always 001 today because
-    # each axis fires at most once; the NNN slot exists so a second criterion on
-    # the same axis can be added later without renumbering the first.
-    _bac() { out="${out}- AC-${1}-001: ${2}"$'\n'; }
-
-    # Persistence. The single most common churn report is "I submitted the form
-    # and nothing happened", so a stated store or form becomes an explicit
-    # survives-a-reload obligation rather than an implied one.
-    case "$t" in
-        *save*|*persist*|*store*|*databas*|*crud*|*todo*|*note*|*task*|*record*)
-            _bac PERSIST "Data the user creates survives a page reload and a server restart (it is written to a real store, not held in memory)." ;;
-    esac
-    case "$t" in
-        *form*|*submit*|*signup*|*"sign up"*|*contact*|*upload*|*checkout*)
-            _bac FORM "Every form actually submits: the happy path writes real data and the user sees a confirmation, and a validation failure shows an inline error." ;;
-    esac
-    case "$t" in
-        *auth*|*login*|*"log in"*|*"sign in"*|*account*|*user*|*password*|*session*)
-            _bac AUTH "Authentication works end to end: a real signup, a real login, and a protected route that returns 401 when logged out." ;;
-    esac
-    case "$t" in
-        *api*|*endpoint*|*rest*|*graphql*|*backend*|*server*)
-            _bac API "Each endpoint returns real data with correct status codes, and is callable with curl without a browser." ;;
-    esac
-    case "$t" in
-        *payment*|*stripe*|*billing*|*subscription*|*checkout*|*invoice*)
-            _bac PAY "The payment path is wired to the provider's test mode and a test transaction completes; no mocked charge stands in for the integration." ;;
-    esac
-    case "$t" in
-        *search*|*filter*|*sort*)
-            _bac SEARCH "Search or filtering queries the real dataset and returns different results for different inputs." ;;
-    esac
-    case "$t" in
-        *dashboard*|*chart*|*graph*|*analytic*|*report*|*metric*)
-            _bac DATA "Every figure shown traces to a real query. No hardcoded sample numbers." ;;
-    esac
-    case "$t" in
-        *page*|*landing*|*site*|*website*|*ui*|*app*|*frontend*)
-            _bac UI "The page renders with real content, no lorem ipsum, and no placeholder image where a real asset belongs." ;;
-    esac
-    printf '%s' "$out"
-}
-
 synthesize_brief_prd() {
     local out_file="$1"
     local brief_text="$2"
     local out_dir
     out_dir="$(dirname "$out_file")"
     mkdir -p "$out_dir" 2>/dev/null || true
-    local _derived
-    _derived="$(_brief_acceptance_criteria "$brief_text")"
     cat > "$out_file" << BRIEFEOF
 # Project Brief
 
@@ -13902,7 +14176,6 @@ $brief_text
 ## Success Criteria
 - A user can run the result and observe the core behavior described above.
 - No errors on a clean start; the happy path works end to end.
-${_derived}
 
 ## Constraints
 - This is a fast first pass (zero-config first run). Keep scope tight.
@@ -14004,10 +14277,6 @@ cmd_quick() {
     find "$LOKI_DIR" -maxdepth 1 -name 'quick-prd-*.md' -mtime +1 -delete 2>/dev/null || true
     find "$LOKI_DIR" -maxdepth 1 -name 'brief-prd-*.md' -mtime +1 -delete 2>/dev/null || true
     local quick_prd="$LOKI_DIR/quick-prd-$$.md"
-    # Same spec-derived criteria as the brief path: a quick task was getting the
-    # identical generic Success Criteria regardless of what was asked.
-    local _derived
-    _derived="$(_brief_acceptance_criteria "$task_desc")"
     cat > "$quick_prd" << QPRDEOF
 # Quick Task
 
@@ -14024,7 +14293,6 @@ $task_desc
 - Task is completed as described
 - No errors or regressions introduced
 - Code follows project conventions
-${_derived}
 
 ## Constraints
 - This is a quick single-task execution
@@ -19489,20 +19757,6 @@ main() {
             # happened to it afterwards -- reverted, reworked, or survived.
             cmd_outcomes "$@"
             ;;
-        verdict)
-            # All five trust signals in one block. The individual measurements
-            # existed and were unreachable; this is the surface a reviewer reads.
-            cmd_verdict "$@"
-            ;;
-        readiness)
-            # Can an agent verify its own work here? Measured, not LLM-scored.
-            cmd_readiness "$@"
-            ;;
-        gates)
-            # What blocks here vs only advises, and what promoting a gate would
-            # have cost. Reports only; never promotes.
-            cmd_gates "$@"
-            ;;
         secure)
             # Secure-by-default gate surface: inspect findings + manage waivers.
             cmd_secure "$@"
@@ -25167,6 +25421,60 @@ TELEM_DISABLE_PY
             echo "  OTEL tracing can be configured with 'loki telemetry enable [endpoint]'."
             ;;
 
+        analytics)
+            # Opt-in gate for build-outcome analytics (telemetry.sh
+            # _loki_analytics_enabled). That gate reads ANALYTICS_ENABLED=true from
+            # ~/.loki/config, and until now NOTHING in this repo ever wrote that
+            # key -- docs/PRIVACY.md told users to hand-edit the file. So the
+            # first-run funnel (first_start_attempted / first_run_blocked /
+            # build_verified) could not fire for anyone, and drop-off was
+            # structurally unmeasurable.
+            #
+            # Stays STRICTLY OPT-IN and default OFF: this only gives the existing
+            # consent a way to be expressed. Same filter-then-append shape as
+            # start|on above, so it is idempotent and never clobbers other keys.
+            local global_config="${HOME}/.loki/config"
+            local _an_action="${1:-status}"
+            case "$_an_action" in
+                on)
+                    mkdir -p "${HOME}/.loki"
+                    if [ -f "$global_config" ]; then
+                        grep -v "^ANALYTICS_ENABLED=" "$global_config" > "${global_config}.tmp" 2>/dev/null || true
+                        mv "${global_config}.tmp" "$global_config"
+                    fi
+                    echo "ANALYTICS_ENABLED=true" >> "$global_config"
+                    echo -e "${BOLD}Build analytics enabled${NC}"
+                    echo ""
+                    echo "  Opt-in saved to: $global_config"
+                    echo "  Only already-computed scalars are sent -- never code, spec text, or paths."
+                    echo "  Requires telemetry to be on as well (loki telemetry status)."
+                    echo "  Run 'loki telemetry analytics off' to opt back out."
+                    ;;
+                off)
+                    if [ -f "$global_config" ]; then
+                        grep -v "^ANALYTICS_ENABLED=" "$global_config" > "${global_config}.tmp" 2>/dev/null || true
+                        mv "${global_config}.tmp" "$global_config"
+                    fi
+                    echo -e "${BOLD}Build analytics disabled${NC}"
+                    echo ""
+                    echo "  ANALYTICS_ENABLED removed from: $global_config"
+                    echo "  Nothing build-related is sent. This is the default state."
+                    ;;
+                status)
+                    if [ -f "$global_config" ] && grep -q "^ANALYTICS_ENABLED=true" "$global_config" 2>/dev/null; then
+                        echo -e "  Build analytics: ${GREEN}enabled${NC} (you opted in; opt out with: loki telemetry analytics off)"
+                    else
+                        echo -e "  Build analytics: ${YELLOW}off${NC} (the default; opt in with: loki telemetry analytics on)"
+                    fi
+                    ;;
+                *)
+                    echo -e "${RED}Unknown analytics action: $_an_action${NC}"
+                    echo "Usage: loki telemetry analytics on|off|status"
+                    return 1
+                    ;;
+            esac
+            ;;
+
         --help|-h|help)
             echo -e "${BOLD}loki telemetry${NC} - OpenTelemetry management"
             echo ""
@@ -25180,6 +25488,8 @@ TELEM_DISABLE_PY
             echo "  off                 Opt out of all anonymous diagnostics (telemetry + crash)"
             echo "  start               Alias for 'on' (persistent opt-in across all sessions)"
             echo "  stop                Alias for 'off' (persistent opt-out across all sessions)"
+            echo "  analytics on|off|status"
+            echo "                      Opt in/out of build-outcome analytics (off by default)"
             echo ""
             echo "Anonymous diagnostics are OFF by default. Nothing is collected or"
             echo "sent unless you opt in. See docs/PRIVACY.md for the full disclosure."
@@ -30978,136 +31288,6 @@ cmd_outcomes() {
     LOKI_DIR="${LOKI_DIR:-.loki}" python3 "$lib" "$@"
 }
 
-# loki verdict: the five measured trust signals, in one block a reviewer reads
-# in ten seconds.
-#
-# WHY A COMMAND AND NOT JUST A LIBRARY. We measure five things nobody else does
-# -- did the work survive, does the spec still match intent, was this the agent
-# or a human rescue, does the completion claim name real work, which model
-# decided -- and each was correct, tested, and unreachable. A moat nobody can
-# see is not a moat. This is the surface.
-#
-# There is deliberately NO composite score. Averaging a revert count, a hash
-# comparison, a diff hash, a path match and a model id yields a number whose
-# movement nobody can explain, which is what competitors already ship. UNKNOWN
-# is PRINTED, never suppressed: a reviewer must tell "we checked and it is fine"
-# from "we could not check". See autonomy/lib/verdict.py.
-cmd_verdict() {
-    local lib="${_LOKI_SCRIPT_DIR}/lib/verdict.py"
-    if [ ! -f "$lib" ]; then
-        echo "verdict renderer is not installed at $lib" >&2
-        return 2
-    fi
-    case "${1:-}" in
-        --help|-h|help)
-            echo -e "${BOLD}loki verdict${NC} - the five measured trust signals, in one readable block"
-            echo ""
-            echo "Usage: loki verdict [--json]"
-            echo ""
-            echo "Prints one line each for outcome, intent, authorship, grounding and"
-            echo "model: what survived, whether the spec still matches intent, whether"
-            echo "this was the agent or a human rescue, whether the completion claim"
-            echo "named real work, and which model decided."
-            echo ""
-            echo "Every line is either a measured fact or an explicit UNKNOWN. There is"
-            echo "no composite score: a number nobody can explain is not evidence."
-            echo "Read-only: it never writes to the repo it analyses."
-            return 0
-            ;;
-    esac
-    LOKI_DIR="${LOKI_DIR:-.loki}" python3 "$lib" "$@"
-}
-
-# loki readiness: can an autonomous agent verify its own work in THIS repo?
-#
-# WHY THIS IS NOT A COPY OF FACTORY AI'S AGENT READINESS MODEL. Theirs is
-# LLM-scored -- their report objects record modelUsed and reasoningEffort, so
-# the number is a model's opinion and two runs can disagree about the same
-# commit. Every criterion here is a file that exists or does not, a command
-# present or absent: same commit, same answer, every machine, no key, no spend.
-#
-# No percentage and no letter grade. A composite invites ranking, ranking
-# invites gaming, and the individual signals are the actionable part -- "there
-# is no test command" tells you what to do, "readiness 62%" does not. Criteria
-# that cannot be determined report UNKNOWN by name rather than counting as
-# failures. See autonomy/lib/agent_readiness.py.
-cmd_gates() {
-    local lib="${_LOKI_SCRIPT_DIR}/lib/gate_policy.py"
-    if [ ! -f "$lib" ]; then
-        echo "gate policy reporter is not installed at $lib" >&2
-        return 2
-    fi
-    case "${1:-}" in
-        --help|-h|help)
-            echo -e "${BOLD}loki gates${NC} - what blocks here, and what only advises"
-            echo ""
-            echo "Usage: loki gates [.loki-dir] [--json]"
-            echo ""
-            echo "Ona's Veto Exec ships an audit-first ladder: start in audit mode,"
-            echo "review what matched, then promote the confirmed rules to block. The"
-            echo "middle step is the load-bearing one -- a policy you cannot safely"
-            echo "turn on is a policy nobody turns on."
-            echo ""
-            echo "We had both ends and nothing between them: gates are advisory or"
-            echo "blocking, three promotion knobs exist, and the failure ledger has"
-            echo "counted per-gate hits all along. Nothing joined them, so deciding"
-            echo "whether to promote a gate meant guessing."
-            echo ""
-            echo "For each gate this prints its mode, how many times it has fired,"
-            echo "and -- for an advisory one -- the exact variable that promotes it."
-            echo ""
-            echo "Deterministic: reads two files and the environment. No model, no"
-            echo "key, no spend. Counts come from"
-            echo ".loki/quality/gate-failure-count.json; open it and count them"
-            echo "yourself."
-            echo ""
-            echo "A gate with no ledger entry reports 'not measured', never 0: an"
-            echo "absent measurement is not evidence a gate never fired."
-            echo ""
-            echo "This command NEVER promotes a gate. Promotion stays an explicit"
-            echo "operator act via the named variable."
-            return 0
-            ;;
-    esac
-    python3 "$lib" "$@"
-}
-
-cmd_readiness() {
-    local lib="${_LOKI_SCRIPT_DIR}/lib/agent_readiness.py"
-    if [ ! -f "$lib" ]; then
-        echo "readiness assessor is not installed at $lib" >&2
-        return 2
-    fi
-    case "${1:-}" in
-        --help|-h|help)
-            echo -e "${BOLD}loki readiness${NC} - can an agent verify its own work in this repo?"
-            echo ""
-            echo "Usage: loki readiness [path] [--json] [--fix]"
-            echo ""
-            echo "Measures whether this repo gives an agent a way to check itself: a"
-            echo "test command, a build, CI config, typed sources, a lockfile. Not"
-            echo "general code quality -- the narrower question every agent depends on."
-            echo ""
-            echo "Deterministic: no model, no key, no spend. Same commit, same answer."
-            echo "Criteria that cannot be determined report UNKNOWN rather than failing."
-            echo ""
-            echo -e "${BOLD}--fix${NC} writes the missing files whose content can be derived"
-            echo "honestly (README.md, AGENTS.md, .gitignore) as TODO stubs, then"
-            echo "re-measures and reports what is true AFTER the change."
-            echo ""
-            echo "It deliberately REFUSES to generate a test command, a lockfile or a"
-            echo "CI config. Guessing one writes a line that lies: an invented"
-            echo "'npm test' in a repo with no runner fails forever, and this check"
-            echo "would then report the criterion present for something that does not"
-            echo "work. Those stay reported, never generated."
-            echo ""
-            echo "Without --fix it is read-only and never writes to the repo."
-            return 0
-            ;;
-    esac
-    python3 "$lib" "$@"
-}
-
 cmd_wiki() {
     local subcmd="${1:-}"
     shift 2>/dev/null || true