loki-mode 9.18.4 → 9.20.0

package/dashboard/server.py

@@ -206,6 +206,7 @@ _SENSITIVE_READ_PREFIXES = (
     "/api/projects",
     "/api/council",
     "/api/proofs",
+    "/api/phases",
     "/api/memory",
     "/api/learnings",
     "/api/learning",
@@ -9976,6 +9977,71 @@ def _build_metrics_text() -> str:
     lines.append(f"loki_uptime_seconds {round(uptime_seconds, 1)}")
     lines.append("")
 
+    # -- Evidence Receipts -----------------------------------------------------
+    # The receipt is the product's differentiator and was INVISIBLE to
+    # monitoring: /metrics emitted 12 lines and none of them were about
+    # verification. An operator could not alert on "builds stopped producing
+    # receipts" or "the unknown-verdict share is climbing", which are the two
+    # failures that make the whole guarantee worthless in production.
+    #
+    # `unknown` IS ITS OWN SERIES, deliberately. The summary endpoint refuses
+    # to count a receipt as verified when it cannot prove it was, and folding
+    # that into either verified or not_verified would launder the distinction
+    # the receipt exists to preserve.
+    #
+    # Bucketed on honesty.headline exactly as proofs_summary does, reading the
+    # same files, so the metric and the API cannot drift.
+    _proof_total = _proof_verified = _proof_gaps = _proof_notver = _proof_unknown = 0
+    _proof_attested = _proof_signed = 0
+    try:
+        _pdir = loki_dir / "proofs"
+        _entries = sorted(_pdir.iterdir()) if _pdir.is_dir() else []
+    except OSError:
+        _entries = []
+    for _entry in _entries:
+        if not _entry.is_dir():
+            continue
+        _pj = _entry / "proof.json"
+        if not _pj.is_file():
+            continue
+        _data = _safe_json_read(_pj, default=None)
+        if not isinstance(_data, dict):
+            continue
+        _proof_total += 1
+        _honesty = _data.get("honesty")
+        _head = _honesty.get("headline") if isinstance(_honesty, dict) else None
+        if _head == "VERIFIED":
+            _proof_verified += 1
+        elif _head == "VERIFIED WITH GAPS":
+            _proof_gaps += 1
+        elif _head == "NOT VERIFIED":
+            _proof_notver += 1
+        else:
+            _proof_unknown += 1
+        _ver = _data.get("verification")
+        if isinstance(_ver, dict):
+            if _ver.get("attestation"):
+                _proof_attested += 1
+            if _ver.get("gpg_signature"):
+                _proof_signed += 1
+
+    lines.append("# HELP loki_receipts_total Evidence Receipts on disk")
+    lines.append("# TYPE loki_receipts_total gauge")
+    lines.append(f"loki_receipts_total {_proof_total}")
+    lines.append("")
+    lines.append("# HELP loki_receipts_by_verdict Receipts bucketed on the recorded honesty headline")
+    lines.append("# TYPE loki_receipts_by_verdict gauge")
+    lines.append(f'loki_receipts_by_verdict{{verdict="verified"}} {_proof_verified}')
+    lines.append(f'loki_receipts_by_verdict{{verdict="with_gaps"}} {_proof_gaps}')
+    lines.append(f'loki_receipts_by_verdict{{verdict="not_verified"}} {_proof_notver}')
+    lines.append(f'loki_receipts_by_verdict{{verdict="unknown"}} {_proof_unknown}')
+    lines.append("")
+    lines.append("# HELP loki_receipts_with_provenance Receipts carrying a checkable provenance record")
+    lines.append("# TYPE loki_receipts_with_provenance gauge")
+    lines.append(f'loki_receipts_with_provenance{{kind="attestation"}} {_proof_attested}')
+    lines.append(f'loki_receipts_with_provenance{{kind="gpg"}} {_proof_signed}')
+    lines.append("")
+
     return "\n".join(lines) + "\n"
 
 
@@ -12226,6 +12292,23 @@ def _proof_pr_url(run_dir: _Path) -> Optional[str]:
     return None
 
 
+@app.get("/api/phases", dependencies=[Depends(auth.require_scope("read"))])
+async def phase_timeline():
+    """Measured phase segments for the active run, from real phase_change events.
+
+    dashboard/api_phases.py had NO importer and NO consumer: a complete
+    phase-timeline module, tested and unreachable. This route is the wiring.
+
+    The envelope is returned VERBATIM. Reshaping it here would fork the honesty
+    contract the module carries -- an unmeasured start is None (never 0), an
+    unreadable log reads differently from an empty one, and `sampled` says the
+    history can be missing phases shorter than one poll interval. A second
+    format is a second place for those distinctions to die.
+    """
+    from . import api_phases
+    return api_phases.phase_history(str(_get_loki_dir()))
+
+
 @app.get("/api/proofs", dependencies=[Depends(auth.require_scope("read"))])
 async def list_proofs():
     """List proof-of-run artifacts for the active project's .loki/proofs/."""

package/dashboard/static/index.html

@@ -1294,6 +1294,17 @@
           <loki-spec-panel id="spec-panel"></loki-spec-panel>
         </div>
         <loki-overview id="overview"></loki-overview>
+        <!-- PIPELINE. dashboard/api_phases.py parsed real phase_change events
+             into measured segments and had NO importer in server.py and NO
+             consumer here: a user could see a build finish or not, never WHICH
+             PHASE it was in or where it was stuck. Lives on Overview because
+             this SPA has no Activity section (no data-section="activity"), and
+             Overview is the live-run home. Hidden until data arrives. -->
+        <div id="pipeline-panel" style="display:none;margin-bottom:24px;">
+          <h3 style="font-family: var(--loki-font-family, 'Inter', system-ui, -apple-system, sans-serif); font-size: 1.15rem; font-weight: 400; color: var(--loki-text-primary); margin-bottom: 12px;">Pipeline</h3>
+          <div id="pipeline-list"></div>
+          <div id="pipeline-note" style="font-size:11px;color:var(--loki-text-muted);margin-top:8px;"></div>
+        </div>
         <loki-rarv-timeline id="rarv-timeline"></loki-rarv-timeline>
         <loki-session-diff id="session-diff"></loki-session-diff>
         <div style="margin-top: 28px;">
@@ -16184,6 +16195,127 @@ document.addEventListener('DOMContentLoaded', function() {
         .catch(function () { /* leave hidden: no receipt surface is better than a wrong one */ });
     };
 
+    // PIPELINE. The measured phase timeline from /api/phases, which serves
+    // dashboard/api_phases.py's envelope verbatim.
+    //
+    // WHAT IS NOT HERE, DELIBERATELY: a "not started" row. The envelope only
+    // contains phases that HAVE started, and the runtime declares no canonical
+    // ordered phase list -- _advance_current_phase takes any string, and the
+    // envelope's own "sampled" flag says absence of a segment is not evidence
+    // the phase did not occur. Drawing a fixed pipeline and marking the missing
+    // rows "not started" would invent exactly the fiction api_phases.py was
+    // written to replace (the old timeline rotated a hardcoded four-phase list
+    // and gave each invented segment a Math.random() duration). The three
+    // states we CAN measure are rendered distinctly, which is what keeps a
+    // stalled build from reading as a healthy one:
+    //
+    //   ENDED    start and end both measured -- a real duration
+    //   RUNNING  ongoing, no recorded end; elapsed is anchored to the server's
+    //            checked_at, never to the client clock
+    //   FAILED   the phase the runtime itself named FAILED
+    //
+    // and a fourth the envelope reports separately: the leading phase, known to
+    // have run but with no emitted start, so its duration is "not measured".
+    //
+    // An unmeasured duration renders "not measured", NEVER 0. A measured zero
+    // (two events inside one second -- timestamps are second-granular) still
+    // renders as 0s, so the guard is on the ENDPOINTS being absent, never on
+    // the duration being falsy.
+    window.loadPhases = function () {
+      var panel = document.getElementById('pipeline-panel');
+      var list = document.getElementById('pipeline-list');
+      var note = document.getElementById('pipeline-note');
+      if (!panel || !list) return;
+      fetch('/api/phases', { headers: { 'Accept': 'application/json' } })
+        .then(function (r) { return r.ok ? r.json() : null; })
+        .then(function (d) {
+          if (!d) return;                      // endpoint absent: leave hidden
+          var rows = (d.segments || []).slice();
+          if (d.leading_phase) rows.unshift(d.leading_phase);
+          if (!rows.length) return;            // no phase history: say nothing
+          var html = '';
+          for (var i = 0; i < rows.length; i++) {
+            var x = rows[i] || {};
+            // ESCAPED, unlike the verdict in loadReceipts. That comes from a
+            // controlled set; a phase name does not -- api_phases.py passes
+            // names through verbatim and _advance_current_phase accepts ANY
+            // string, so the set is open and this is untrusted text going into
+            // innerHTML on a dashboard that can be bound remotely.
+            var raw = String(x.phase || 'UNKNOWN');
+            var _d = document.createElement('div');
+            _d.textContent = raw;
+            var phase = _d.innerHTML;
+            var failed = /^FAIL/i.test(raw);
+            // The end a RUNNING segment is measured against is the server's
+            // own checked_at. A client clock would drift against the log.
+            var end = x.end;
+            if (end === null || end === undefined) {
+              if (x.ongoing) end = d.checked_at;
+            }
+            // Gate on the endpoints, not on the duration: end - start === 0 is
+            // a real measurement (second-granular timestamps), and hiding it
+            // as "-" would be the same lie in the other direction.
+            var measured = (x.start !== null && x.start !== undefined
+                            && end !== null && end !== undefined);
+            var secs = measured ? Math.max(0, Math.round(end - x.start)) : null;
+            var dur = measured
+              ? (secs < 60 ? (secs + 's')
+                 : (Math.floor(secs / 60) + 'm ' + (secs % 60) + 's'))
+              : 'not measured';
+            var state, col;
+            if (failed) {
+              state = 'FAILED'; col = 'var(--loki-error)';
+            } else if (x.ongoing) {
+              state = 'RUNNING'; col = 'var(--loki-warning)';
+            } else if (x.start === null || x.start === undefined) {
+              // The leading phase: it ran, but its start was never emitted, so
+              // it has no coordinate on a time axis. Named, not drawn.
+              state = 'RAN (start not recorded)'; col = 'var(--loki-text-muted)';
+            } else {
+              state = 'ENDED'; col = 'var(--loki-text-muted)';
+            }
+            var iter = (x.iteration === null || x.iteration === undefined)
+              ? '-' : ('iter ' + x.iteration);
+            html += '<div style="display:flex;gap:12px;align-items:center;padding:6px 8px;'
+                 + 'border-bottom:1px solid var(--loki-border);font-size:12px;">'
+                 + '<span style="font-weight:600;min-width:130px;">' + phase + '</span>'
+                 + '<span style="color:' + col + ';min-width:170px;">' + state + '</span>'
+                 + '<span style="min-width:90px;">' + dur + '</span>'
+                 + '<span style="color:var(--loki-text-muted);">' + iter + '</span>'
+                 + '</div>';
+          }
+          list.innerHTML = html;
+          if (note) {
+            // The envelope's own caveats, surfaced. Sampled data presented as
+            // complete is a claim the module explicitly refuses to make.
+            var parts = [];
+            // The VIEW's own age, not just the data's. A one-shot fetch of a
+            // LIVE pipeline freezes: "TESTING RUNNING 1m 40s" would sit there
+            // unchanged an hour later, which is the stalled-build-reads-as-
+            // healthy shape arriving through the view instead of the data.
+            // Polled below, and stamped here so a frozen row is self-labelling
+            // even if the poll dies.
+            if (d.checked_at) {
+              parts.push('Measured as of '
+                + new Date(d.checked_at * 1000).toISOString().slice(11, 19) + 'Z.');
+            }
+            if (d.sampled) {
+              parts.push('Sampled: the phase recorder polls, so a phase shorter '
+                + 'than one poll interval left no event and is absent here.');
+            }
+            if (d.freshness_s === null || d.freshness_s === undefined) {
+              parts.push('Age of this data: not measured.');
+            } else if (d.freshness_s > 120) {
+              parts.push('STALE: the phase log was last written '
+                + Math.floor(d.freshness_s / 60) + 'm ago.');
+            }
+            note.textContent = parts.join(' ');
+          }
+          panel.style.display = 'block';
+        })
+        .catch(function () { /* leave hidden: no pipeline is better than a wrong one */ });
+    };
+
     function poll() {
       fetch('/api/proofs/summary', { headers: { 'Accept': 'application/json' } })
         .then(function (r) { return r.ok ? r.json() : null; })
@@ -16228,6 +16360,18 @@ document.addEventListener('DOMContentLoaded', function() {
     // document and cannot see the SPA's manual data-loki-theme toggle, so we
     // pass the resolved theme as a query param (?theme=dark|light); the
     // standalone page reads it and matches. v7.18.0.
+    // The pipeline is a LIVE view, so unlike loadReceipts (a history view where
+    // one-shot is correct) it polls. Guarded on the Overview page being the
+    // visible one so a user sitting on another section spends no requests.
+    if (sectionId === 'overview') {
+      loadPhases();
+      if (!window._lokiPhasePoll) {
+        window._lokiPhasePoll = setInterval(function () {
+          var pg = document.getElementById('page-overview');
+          if (pg && pg.classList.contains('active')) loadPhases();
+        }, 15000);
+      }
+    }
     if (sectionId === 'insights') { loadLearnings(); }
     if (sectionId === 'cost') { loadBudget(); }
     if (sectionId === 'trust') {

package/docs/COMPETITIVE-SCORECARD.md

@@ -397,6 +397,82 @@ bash tests/test-competitor-verify-surface.sh               # the installed-CLI a
 loki proof verify <id>                                     # re-hash a receipt, exit 1 on tamper
 ```
 
+### 3d. Our own numbers on the axes people ask about, measured 2026-08-08
+
+These are ABSOLUTE measurements of this product with a CI guard behind each. They
+are deliberately NOT presented as a comparison: no competitor number appears
+here, because three of the four named competitors have no runnable binary on
+this machine and the fourth exposes no equivalent command. A number next to a
+blank is not a ratio.
+
+| Axis | Measured | Budget | Guarded by |
+|---|---|---|---|
+| UI page weight | 787 KB | 1024 KB | `tests/test-dashboard-bundle-budget.sh` |
+| Backend verify latency | 7 ms | under 1000 ms | `tests/test-fast-verify.sh` |
+| Worker horizontal scale | 1..25 replicas render | n/a | `tests/test-helm-worker-scaling.sh` |
+
+Two of those three guards already existed; only the page-weight budget was added
+on 2026-08-08. Recording that because "we measured it" and "we added a
+measurement" are different claims and the difference matters.
+
+What these numbers do NOT establish: they say nothing about output quality,
+which is the axis a user actually cares about, and nothing about how any
+competitor performs on the same axes. A fast gate that verifies the wrong thing
+is worse than a slow one that verifies the right thing.
+
+Reproduce:
+
+```bash
+bash tests/test-dashboard-bundle-budget.sh   # prints the KB and the budget
+bash tests/test-fast-verify.sh               # prints the ms and the budget
+bash tests/test-helm-worker-scaling.sh       # renders 1, 2, 5 and 25 replicas
+```
+
+### 3c. Deploy surface, measured 2026-08-08
+
+Ran on the four competitor CLIs installed on this machine. Method matters here:
+a `--help` grep is NOT sufficient -- an earlier audit in this repo counted
+aider's `--verify-ssl` as a verification capability, which it is not. So each
+CLI was invoked as `<cli> deploy --help` and the result classified as a real
+subcommand only when it exited 0 AND its output named the subcommand, rather
+than falling through to generic help.
+
+| CLI | `deploy` subcommand |
+|---|---|
+| claude | none `[measured]` |
+| aider | none `[measured]` |
+| opencode | none `[measured]` |
+| codex | none `[measured]` |
+| loki | present, and evidence-gated `[measured]` |
+
+**4 of 4 installed competitor CLIs expose no deploy verb.** Loki's is gated on a
+verified receipt: it refuses on UNSIGNED, TAMPERED, anchor mismatch, or a dirty
+tree, and writes a receipt for the deploy itself naming the authorizing run_id.
+
+Scope limits, same as everywhere else in this file. This covers CLIs INSTALLED
+HERE. Factory, Devin, Replit and 8090 have no runnable binary on this machine
+(`bash benchmarks/head-to-head-readiness.sh` reports 3 ready / 4 blocked), so no
+claim is made about them. A hosted product may deploy without exposing a CLI
+verb -- Replit Agent's documented headline capability is exactly that. This
+measures a CLI surface, not a product capability, and it is not a quality
+comparison.
+
+Reproduce:
+
+```bash
+# Exit code ALONE is not the test: every CLI here exits 0 on `deploy --help`
+# because an unknown subcommand falls through to generic help. The first
+# version of this recipe did exactly that and reported all four as having a
+# deploy command. The output must NAME the subcommand.
+for c in claude aider opencode codex loki; do
+  out="$($c deploy --help 2>&1 | head -3)"
+  printf '%s' "$out" | grep -qiE "$c deploy|deploy -" \
+    && echo "$c: real deploy subcommand" \
+    || echo "$c: no deploy subcommand (fell through to generic help)"
+done
+bash autonomy/loki deploy --execute       # refuses, naming each failed check
+```
+
 ## 4. What we do NOT know
 
 This section is mandatory and is not empty.

package/docs/PROOF-PASSPORT.md

@@ -0,0 +1,29 @@
+# Proof Passport
+
+Proof Passport binds a provider-neutral Outcome Contract to an existing Loki
+receipt. The JSON artifact preserves the exact contract and receipt digests,
+the verifier verdict, executor/verifier separation, and explicit trust
+limitations.
+
+Generate the machine-readable passport and a portable PR/CI summary together:
+
+```bash
+python3 tools/proof-passport.py \
+  outcome-contract.json proof.json proof-passport.json \
+  --repo-dir . \
+  --markdown-output proof-passport.md
+```
+
+The command exits `0` only for `VERIFIED`, `1` for `FAILED`, and `2` for
+`UNVERIFIABLE` or invalid input. Existing output files are never replaced
+unless `--force` is supplied. Both outputs are checked before either is
+written, so a conflicting Markdown path cannot leave a new JSON artifact
+behind.
+
+The Markdown artifact is suitable for a pull-request comment or
+`$GITHUB_STEP_SUMMARY`. It contains the full SHA-256 evidence bindings and
+trust limitations, but no repository or machine-specific paths.
+
+Proof Passport does not currently sign the passport itself. Receipt signature
+status is reported separately and must not be interpreted as a passport
+signature.

package/docs/SIGNED-RECEIPTS.md

@@ -94,9 +94,120 @@ which exact code" without asking anyone to trust the agent that produced it.
 - If the signing key is compromised, signed receipts from that key are worth
   exactly what the key is worth. Normal key hygiene applies.
 
+## Attestation: provenance without a key exchange
+
+gpg settles the local case, where the operator already holds the keyring. It
+does not survive the remote path. A submitter who ran `loki start --remote`
+never had access to the cluster, so "import the publisher's public key" is the
+step where independent verification stops happening in practice.
+
+A receipt served by `trigger-server.py` therefore also carries an **attestation**
+under `verification.attestation`: an Ed25519 JWT signed by the receiver, with
+the signing keys published, unauthenticated, at `/.well-known/jwks.json`.
+
+```bash
+# Third party, offline. Needs proof.json and jwks.json -- nothing else.
+curl -s https://loki.example.com/.well-known/jwks.json > jwks.json
+loki proof verify <id> --jwks ./jwks.json
+
+# Or fetch the key set directly from the server that produced the receipt.
+loki proof verify <id> --jwks https://loki.example.com
+```
+
+Four outcomes, deliberately kept distinct:
+
+| Verdict | Meaning |
+|---|---|
+| `VERIFIED` | The token is valid **and** covers these exact bytes. |
+| `FAILED` | The token does not cover these bytes: altered after signing, or lifted from another run. |
+| `ABSENT` | This receipt carries no attestation. A fact about the receipt. |
+| `NOT CHECKED` | The key set could not be read. **Not** a verdict, in either direction. |
+
+`ABSENT` and `NOT CHECKED` are never collapsed. One is a property of the
+receipt; the other is an absent measurement, and reporting an unchecked receipt
+as merely unattested would overstate what was established.
+
+The JWT binds `job_id`, `run_id` and `receipt_sha256`, and the verifier
+**recomputes** that digest from the receipt body rather than trusting the
+recorded `verification.hash`. Editing the body and rewriting the hash to match
+therefore still fails: the signed claim is the anchor, not the field in the file.
+
+### Key rotation
+
+Every token carries a `kid`, and JWKS serves the active key plus any retired
+ones (`LOKI_RECEIPT_RETIRED_PUBKEYS`, a colon-separated list of PEM paths). This
+is required rather than optional: with a single unlabeled key, the first
+rotation would make every previously-issued receipt fail verification -- and a
+receipt that stops verifying is indistinguishable from a tampered one.
+
+### In a Kubernetes cluster
+
+The Helm chart wires this for you. Generate a key and pass it as a file:
+
+```bash
+openssl genpkey -algorithm ed25519 -out receipt-signing-key.pem
+helm upgrade --install loki ./helm/loki-mode \
+  --set-file secrets.receiptSigningKey=receipt-signing-key.pem
+```
+
+The chart mounts it **into the receiver only**, read-only at mode `0400`, and
+sets `LOKI_RECEIPT_SIGNING_KEY_FILE` to the projected path. The worker never
+receives it, and that asymmetry is enforced by the chart rather than left to
+convention: a worker runs model-directed code, so a key there would let a build
+sign its own receipt.
+
+Left unset, the receiver serves receipts unsigned and `/.well-known/jwks.json`
+returns an empty key set -- honest, but a `--remote` submitter then has no way
+to prove who produced their receipt without an out-of-band key import.
+
+### With docker-compose
+
+Opt-in, and deliberately shipped commented out. Docker has no optional bind
+mount: a bind to a missing path is a hard container start failure, so enabling
+it by default would stop the receiver from starting for everyone who has not
+generated a key.
+
+```bash
+openssl genpkey -algorithm ed25519 -out ./receipt-signing-key.pem
+```
+
+Then uncomment the two lines the compose file points at (the
+`LOKI_RECEIPT_SIGNING_KEY_FILE` env var and the `receipt-signing-key.pem`
+mount) on the `receiver` service. Never commit that key file.
+
+### Configuration
+
+| Variable | Effect |
+|---|---|
+| `LOKI_RECEIPT_SIGNING_KEY_FILE` | PEM path to the Ed25519 private key (normal Kubernetes mounted-secret path). |
+| `LOKI_RECEIPT_SIGNING_KEY` | The PEM inline, for non-Kubernetes deployments. |
+| `LOKI_RECEIPT_RETIRED_PUBKEYS` | Colon-separated PEM paths for retired public keys. |
+
+Unset means unsigned: no attestation is attached and the receipt keeps its
+existing verdict.
+
+The same two variables also work for a **local** build. Set
+`LOKI_RECEIPT_SIGNING_KEY_FILE` before `loki start` and the generator attests
+the receipt directly, so a laptop or CI receipt is checkable by the same
+`--jwks` path a cluster receipt uses. Publish the matching JWKS wherever your
+consumers can reach it (or hand them `jwks.json` alongside the receipt).
+
+**In a cluster, the receiver signs -- never the worker.** A worker runs
+model-directed code and already holds provider credentials, so a key there would
+let a build sign its own receipt, which attests to nothing. The local case is
+different in kind, not an exception to this: there is no separation between
+submitter and builder on your own machine, and the attestation says "this
+receipt came from a holder of this key" rather than "an independent party
+witnessed this build."
+
 ## Source
 
 - Signing: `autonomy/lib/proof-generator.py` (`_gpg_detached_sign`, and the
   `LOKI_PROOF_GPG_KEY` gate)
 - Verification: `autonomy/lib/proof-verify.py` (`_verify_gpg`)
 - Scope test: `tests/test-proof-forgery-defense.sh`
+- Attestation: `autonomy/receipt_jwt.py`; served by `autonomy/trigger-server.py`
+  (`_attest`, `_handle_jwks`); checked by `loki_proof_attestation_check` and
+  `loki_remote_attestation_status` in `autonomy/loki`
+- Attestation tests: `tests/test-receipt-jwt-attestation.sh`,
+  `tests/test-remote-attestation-verdict.sh`, `tests/test-proof-verify-jwks.sh`

package/docs/metrics.md

@@ -74,6 +74,38 @@ Returns metrics in OpenMetrics text format. No authentication required by defaul
 |--------|------|-------------|
 | `loki_events_total` | counter | Total number of events recorded in events.jsonl |
 
+### Evidence Receipt Metrics
+
+The verification surface, exposed so an operator can alert on it. Two failures
+make the receipt guarantee worthless in production and neither was observable
+before these existed: builds silently stopping producing receipts, and the
+`unknown` share climbing.
+
+| Metric | Type | Description |
+|--------|------|-------------|
+| `loki_receipts_total` | gauge | Evidence Receipts on disk for the active project |
+| `loki_receipts_by_verdict{verdict=...}` | gauge | Receipts bucketed on the recorded honesty headline: `verified`, `with_gaps`, `not_verified`, `unknown` |
+| `loki_receipts_with_provenance{kind=...}` | gauge | Receipts carrying a checkable provenance record: `attestation` (Ed25519 JWT) or `gpg` |
+
+`unknown` IS ITS OWN SERIES and must stay that way. The summary refuses to
+count a receipt as verified when it cannot prove it was -- schema v1.0 receipts
+carry no honesty block -- so folding that bucket into `verified` is dishonest
+and folding it into `not_verified` is alarming and also wrong.
+
+These read the same files as `GET /api/proofs/summary`, so the metric and the
+API cannot disagree; a test asserts it. An empty project reports `0`, not an
+error, so a fresh install does not look like a broken exporter.
+
+Example alerts:
+
+```
+# receipts stopped being produced
+increase(loki_receipts_total[6h]) == 0
+
+# the unverifiable share is growing
+loki_receipts_by_verdict{verdict="unknown"} / loki_receipts_total > 0.2
+```
+
 ## Data Sources
 
 Metrics are derived from `.loki/` flat files:

package/events/emit.sh

@@ -171,6 +171,37 @@ if [ "$_emit_max" -gt 0 ]; then
             kill -0 "$_emit_target" 2>/dev/null || exit 0
             _waited=$((_waited + 1))
         done
+        # FORENSICS BEFORE THE KILL (issue #184).
+        #
+        # The watchdog bounds the damage but has never recorded WHY the hang
+        # happened, which is why the cause is still unknown after two disproved
+        # hypotheses (the lock-retry counter, and six synthetic race probes).
+        # A SIGKILL destroys the only evidence that existed.
+        #
+        # Captures a stack sample and the process tree to a file, then kills. On
+        # the next occurrence the reader gets a stack instead of a guess.
+        #
+        # Every part is bounded and best-effort: this runs INSIDE the watchdog,
+        # so a capture that blocks would replace a bounded failure with an
+        # unbounded one -- the exact thing the watchdog exists to prevent.
+        # `sample` is macOS-only and absent on Linux; both branches are guarded
+        # and neither is allowed to fail the watchdog.
+        _emit_diag_dir="${LOKI_EMIT_DIAG_DIR:-${TMPDIR:-/tmp}}"
+        _emit_diag="$_emit_diag_dir/loki-emit-hang-$_emit_target.txt"
+        {
+            echo "emit.sh watchdog fired after ${_emit_max}s on pid $_emit_target"
+            echo "captured: $(date -u '+%Y-%m-%dT%H:%M:%SZ' 2>/dev/null)"
+            echo "--- ps ---"
+            ps -o pid=,ppid=,pgid=,stat=,etime=,command= -p "$_emit_target" 2>/dev/null
+            echo "--- children ---"
+            ps -eo pid=,ppid=,stat=,command= 2>/dev/null | awk -v p="$_emit_target" '$2==p'
+            echo "--- stack (macOS sample, 1s) ---"
+            if command -v sample >/dev/null 2>&1; then
+                sample "$_emit_target" 1 -mayDie 2>/dev/null | head -60
+            else
+                echo "(sample unavailable on this platform)"
+            fi
+        } > "$_emit_diag" 2>/dev/null || true
         kill -9 "$_emit_target" 2>/dev/null || true
     ) >/dev/null 2>&1 &
     # Disown so the watchdog is not a tracked job of the caller's shell.

package/loki-ts/dist/loki.js

@@ -1,5 +1,5 @@
 // @bun
-var p_=Object.create;var{getPrototypeOf:d_,defineProperty:eK,getOwnPropertyNames:c_}=Object;var l_=Object.prototype.hasOwnProperty;function i_(Z){return this[Z]}var a_,s_,n_=(Z,X,Q)=>{var Y=Z!=null&&typeof Z==="object";if(Y){var J=X?a_??=new WeakMap:s_??=new WeakMap,z=J.get(Z);if(z)return z}Q=Z!=null?p_(d_(Z)):{};let K=X||!Z||!Z.__esModule?eK(Q,"default",{value:Z,enumerable:!0}):Q;for(let $ of c_(Z))if(!l_.call(K,$))eK(K,$,{get:i_.bind(Z,$),enumerable:!0});if(Y)J.set(Z,K);return K};var HQ=(Z,X)=>()=>(X||Z((X={exports:{}}).exports,X),X.exports);var o_=(Z)=>Z;function r_(Z,X){this[Z]=o_.bind(null,X)}var l0=(Z,X)=>{for(var Q in X)eK(Z,Q,{get:X[Q],enumerable:!0,configurable:!0,set:r_.bind(X,Q)})};var p=(Z,X)=>()=>(Z&&(X=Z(Z=0)),X);var t0=import.meta.require;var xO={};l0(xO,{lokiDir:()=>j0,homeLokiDir:()=>R4,findRepoRootForVersion:()=>X$,REPO_ROOT:()=>i0});import{resolve as n7,dirname as Z$}from"path";import{fileURLToPath as t_}from"url";import{existsSync as UQ}from"fs";import{homedir as e_}from"os";function Zf(){let Z=kO;for(let X=0;X<6;X++){if(UQ(n7(Z,"VERSION"))&&UQ(n7(Z,"autonomy/run.sh")))return Z;let Q=Z$(Z);if(Q===Z)break;Z=Q}return n7(kO,"..","..","..")}function X$(Z){let X=Z;for(let Q=0;Q<6;Q++){if(UQ(n7(X,"VERSION"))&&UQ(n7(X,"autonomy/run.sh")))return X;let Y=Z$(X);if(Y===X)break;X=Y}return n7(Z,"..","..","..")}function j0(){return process.env.LOKI_DIR??n7(process.cwd(),".loki")}function R4(){return n7(e_(),".loki")}var kO,i0;var H8=p(()=>{kO=Z$(t_(import.meta.url));i0=Zf()});import{readFileSync as Xf}from"fs";import{resolve as Qf,dirname as Yf}from"path";import{fileURLToPath as Jf}from"url";function h3(){if(h5!==null)return h5;let Z="9.18.4";if(typeof Z==="string"&&Z.length>0)return h5=Z,h5;try{let X=Yf(Jf(import.meta.url)),Q=X$(X);h5=Xf(Qf(Q,"VERSION"),"utf-8").trim()}catch{h5="unknown"}return h5}var h5=null;var BQ=p(()=>{H8()});var _O={};l0(_O,{runOrThrow:()=>Tf,run:()=>E0,readStreamCapped:()=>NQ,commandVersion:()=>Cf,commandExists:()=>X9,ShellError:()=>Q$,MAX_STDOUT_BYTES:()=>bO});async function NQ(Z,X=bO){let Q=Z.getReader(),Y=new TextDecoder,J="",z=0;try{while(z<X){let{done:K,value:$}=await Q.read();if(K)break;if(!$)continue;if(z+=$.byteLength,z>X){let V=$.byteLength-(z-X);J+=Y.decode($.subarray(0,V),{stream:!0});break}J+=Y.decode($,{stream:!0})}J+=Y.decode()}finally{try{await Q.cancel()}catch{}Q.releaseLock()}return J}async function E0(Z,X={}){let Q=Bun.spawn({cmd:[...Z],stdout:"pipe",stderr:"pipe",env:X.env?{...process.env,...X.env}:process.env,cwd:X.cwd}),Y,J;if(X.timeoutMs&&X.timeoutMs>0)Y=setTimeout(()=>{try{Q.kill("SIGTERM")}catch{}J=setTimeout(()=>{try{Q.kill("SIGKILL")}catch{}},2000)},X.timeoutMs);try{let[z,K,$]=await Promise.all([NQ(Q.stdout),new Response(Q.stderr).text(),Q.exited]);return{stdout:z,stderr:K,exitCode:$}}finally{if(Y)clearTimeout(Y);if(J)clearTimeout(J)}}async function Tf(Z,X={}){let Q=await E0(Z,X);if(Q.exitCode!==0)throw new Q$(`command failed (${Q.exitCode}): ${Z.join(" ")}`,Q.exitCode,Q.stdout,Q.stderr);return Q}async function X9(Z){let X=wf(Z),Q=await E0(["sh","-c",`command -v ${X}`],{timeoutMs:5000});if(Q.exitCode===0)return Q.stdout.trim()||null;return null}function wf(Z){if(!/^[A-Za-z0-9._/-]+$/.test(Z))throw Error(`refused to shell-escape suspect token: ${Z}`);return Z}async function Cf(Z,X="--version"){if(!await X9(Z))return null;let Y=await E0([Z,X],{timeoutMs:5000});if(Y.exitCode!==0)return null;return((Y.stdout||Y.stderr).split(/\r?\n/)[0]?.trim()??"")||null}var bO=16777216,Q$;var x9=p(()=>{Q$=class Q$ extends Error{message;exitCode;stdout;stderr;constructor(Z,X,Q,Y){super(Z);this.message=Z;this.exitCode=X;this.stdout=Q;this.stderr=Y;this.name="ShellError"}}});function o7(Z){return Ff?"":Z}var Ff,A0,F8,_0,$W0,a0,V8,Q9,h;var S6=p(()=>{Ff=(process.env.NO_COLOR??"").length>0;A0=o7("\x1B[0;31m"),F8=o7("\x1B[0;32m"),_0=o7("\x1B[1;33m"),$W0=o7("\x1B[0;34m"),a0=o7("\x1B[0;36m"),V8=o7("\x1B[1m"),Q9=o7("\x1B[2m"),h=o7("\x1B[0m")});import{existsSync as ff}from"fs";async function E7(){if(x4!==void 0)return x4;let Z="/opt/homebrew/bin/python3.12";if(ff(Z))return x4=Z,Z;let X=await X9("python3.12");if(X)return x4=X,X;let Q=await X9("python3");return x4=Q,Q}async function Y7(Z,X={}){let Q=await E7();if(!Q)return{stdout:"",stderr:"python3 not found",exitCode:127};return E0([Q,"-c",Z],X)}var x4;var r7=p(()=>{x9()});var XA={};l0(XA,{runStatus:()=>Vh});import{existsSync as Y9,readFileSync as g3,readdirSync as aO,statSync as sO}from"fs";import{resolve as h8,basename as ef}from"path";import{homedir as Zh}from"os";function nO(Z){let X=Math.trunc(Z);if(X>=1e6)return`${(Math.trunc(X/1e6*10)/10).toFixed(1)}M`;if(X>=1000)return`${(Math.trunc(X/1000*10)/10).toFixed(1)}K`;return String(X)}function oO(Z,X,Q){if(X===0)return null;let Y=Math.trunc(Z*100/X),J=Math.trunc(Z*AQ/X);if(J>AQ)J=AQ;let z=AQ-J,K=F8;if(Y>=80)K=A0;else if(Y>=50)K=_0;let $="=".repeat(Math.max(0,J))+" ".repeat(Math.max(0,z)),V=nO(Z),W=nO(X);return`  ${V8}${Q}${h} ${K}[${$}]${h} ${Y}% (${V} / ${W})`}async function Qh(){if(await X9("jq"))return!0;return process.stdout.write(`${A0}Error: jq is required but not installed.${h}
+var p_=Object.create;var{getPrototypeOf:d_,defineProperty:eK,getOwnPropertyNames:c_}=Object;var l_=Object.prototype.hasOwnProperty;function i_(Z){return this[Z]}var a_,s_,n_=(Z,X,Q)=>{var Y=Z!=null&&typeof Z==="object";if(Y){var J=X?a_??=new WeakMap:s_??=new WeakMap,z=J.get(Z);if(z)return z}Q=Z!=null?p_(d_(Z)):{};let K=X||!Z||!Z.__esModule?eK(Q,"default",{value:Z,enumerable:!0}):Q;for(let $ of c_(Z))if(!l_.call(K,$))eK(K,$,{get:i_.bind(Z,$),enumerable:!0});if(Y)J.set(Z,K);return K};var HQ=(Z,X)=>()=>(X||Z((X={exports:{}}).exports,X),X.exports);var o_=(Z)=>Z;function r_(Z,X){this[Z]=o_.bind(null,X)}var l0=(Z,X)=>{for(var Q in X)eK(Z,Q,{get:X[Q],enumerable:!0,configurable:!0,set:r_.bind(X,Q)})};var p=(Z,X)=>()=>(Z&&(X=Z(Z=0)),X);var t0=import.meta.require;var xO={};l0(xO,{lokiDir:()=>j0,homeLokiDir:()=>R4,findRepoRootForVersion:()=>X$,REPO_ROOT:()=>i0});import{resolve as n7,dirname as Z$}from"path";import{fileURLToPath as t_}from"url";import{existsSync as UQ}from"fs";import{homedir as e_}from"os";function Zf(){let Z=kO;for(let X=0;X<6;X++){if(UQ(n7(Z,"VERSION"))&&UQ(n7(Z,"autonomy/run.sh")))return Z;let Q=Z$(Z);if(Q===Z)break;Z=Q}return n7(kO,"..","..","..")}function X$(Z){let X=Z;for(let Q=0;Q<6;Q++){if(UQ(n7(X,"VERSION"))&&UQ(n7(X,"autonomy/run.sh")))return X;let Y=Z$(X);if(Y===X)break;X=Y}return n7(Z,"..","..","..")}function j0(){return process.env.LOKI_DIR??n7(process.cwd(),".loki")}function R4(){return n7(e_(),".loki")}var kO,i0;var H8=p(()=>{kO=Z$(t_(import.meta.url));i0=Zf()});import{readFileSync as Xf}from"fs";import{resolve as Qf,dirname as Yf}from"path";import{fileURLToPath as Jf}from"url";function h3(){if(h5!==null)return h5;let Z="9.20.0";if(typeof Z==="string"&&Z.length>0)return h5=Z,h5;try{let X=Yf(Jf(import.meta.url)),Q=X$(X);h5=Xf(Qf(Q,"VERSION"),"utf-8").trim()}catch{h5="unknown"}return h5}var h5=null;var BQ=p(()=>{H8()});var _O={};l0(_O,{runOrThrow:()=>Tf,run:()=>E0,readStreamCapped:()=>NQ,commandVersion:()=>Cf,commandExists:()=>X9,ShellError:()=>Q$,MAX_STDOUT_BYTES:()=>bO});async function NQ(Z,X=bO){let Q=Z.getReader(),Y=new TextDecoder,J="",z=0;try{while(z<X){let{done:K,value:$}=await Q.read();if(K)break;if(!$)continue;if(z+=$.byteLength,z>X){let V=$.byteLength-(z-X);J+=Y.decode($.subarray(0,V),{stream:!0});break}J+=Y.decode($,{stream:!0})}J+=Y.decode()}finally{try{await Q.cancel()}catch{}Q.releaseLock()}return J}async function E0(Z,X={}){let Q=Bun.spawn({cmd:[...Z],stdout:"pipe",stderr:"pipe",env:X.env?{...process.env,...X.env}:process.env,cwd:X.cwd}),Y,J;if(X.timeoutMs&&X.timeoutMs>0)Y=setTimeout(()=>{try{Q.kill("SIGTERM")}catch{}J=setTimeout(()=>{try{Q.kill("SIGKILL")}catch{}},2000)},X.timeoutMs);try{let[z,K,$]=await Promise.all([NQ(Q.stdout),new Response(Q.stderr).text(),Q.exited]);return{stdout:z,stderr:K,exitCode:$}}finally{if(Y)clearTimeout(Y);if(J)clearTimeout(J)}}async function Tf(Z,X={}){let Q=await E0(Z,X);if(Q.exitCode!==0)throw new Q$(`command failed (${Q.exitCode}): ${Z.join(" ")}`,Q.exitCode,Q.stdout,Q.stderr);return Q}async function X9(Z){let X=wf(Z),Q=await E0(["sh","-c",`command -v ${X}`],{timeoutMs:5000});if(Q.exitCode===0)return Q.stdout.trim()||null;return null}function wf(Z){if(!/^[A-Za-z0-9._/-]+$/.test(Z))throw Error(`refused to shell-escape suspect token: ${Z}`);return Z}async function Cf(Z,X="--version"){if(!await X9(Z))return null;let Y=await E0([Z,X],{timeoutMs:5000});if(Y.exitCode!==0)return null;return((Y.stdout||Y.stderr).split(/\r?\n/)[0]?.trim()??"")||null}var bO=16777216,Q$;var x9=p(()=>{Q$=class Q$ extends Error{message;exitCode;stdout;stderr;constructor(Z,X,Q,Y){super(Z);this.message=Z;this.exitCode=X;this.stdout=Q;this.stderr=Y;this.name="ShellError"}}});function o7(Z){return Ff?"":Z}var Ff,A0,F8,_0,$W0,a0,V8,Q9,h;var S6=p(()=>{Ff=(process.env.NO_COLOR??"").length>0;A0=o7("\x1B[0;31m"),F8=o7("\x1B[0;32m"),_0=o7("\x1B[1;33m"),$W0=o7("\x1B[0;34m"),a0=o7("\x1B[0;36m"),V8=o7("\x1B[1m"),Q9=o7("\x1B[2m"),h=o7("\x1B[0m")});import{existsSync as ff}from"fs";async function E7(){if(x4!==void 0)return x4;let Z="/opt/homebrew/bin/python3.12";if(ff(Z))return x4=Z,Z;let X=await X9("python3.12");if(X)return x4=X,X;let Q=await X9("python3");return x4=Q,Q}async function Y7(Z,X={}){let Q=await E7();if(!Q)return{stdout:"",stderr:"python3 not found",exitCode:127};return E0([Q,"-c",Z],X)}var x4;var r7=p(()=>{x9()});var XA={};l0(XA,{runStatus:()=>Vh});import{existsSync as Y9,readFileSync as g3,readdirSync as aO,statSync as sO}from"fs";import{resolve as h8,basename as ef}from"path";import{homedir as Zh}from"os";function nO(Z){let X=Math.trunc(Z);if(X>=1e6)return`${(Math.trunc(X/1e6*10)/10).toFixed(1)}M`;if(X>=1000)return`${(Math.trunc(X/1000*10)/10).toFixed(1)}K`;return String(X)}function oO(Z,X,Q){if(X===0)return null;let Y=Math.trunc(Z*100/X),J=Math.trunc(Z*AQ/X);if(J>AQ)J=AQ;let z=AQ-J,K=F8;if(Y>=80)K=A0;else if(Y>=50)K=_0;let $="=".repeat(Math.max(0,J))+" ".repeat(Math.max(0,z)),V=nO(Z),W=nO(X);return`  ${V8}${Q}${h} ${K}[${$}]${h} ${Y}% (${V} / ${W})`}async function Qh(){if(await X9("jq"))return!0;return process.stdout.write(`${A0}Error: jq is required but not installed.${h}
 `),process.stdout.write(`Install with:
 `),process.stdout.write(`  brew install jq    (macOS)
 `),process.stdout.write(`  apt install jq     (Debian/Ubuntu)
@@ -1236,4 +1236,4 @@ Set LOKI_LEGACY_BASH=1 to force the bash CLI for every command.
 `),2}case"start":{let{runStart:Y}=await Promise.resolve().then(() => (g_(),v_));return Y(Q)}default:return process.stderr.write(`Unknown command: ${X}
 `),process.stderr.write(m_),2}}lO();process.on("SIGINT",()=>process.exit(130));process.on("SIGTERM",()=>process.exit(143));var dV0=await pV0(Bun.argv.slice(2));process.exit(dV0);
 
-//# debugId=FEE1C42CA5DB4B5764756E2164756E21
+//# debugId=AF141439B5D0532864756E2164756E21

package/mcp/__init__.py

@@ -75,4 +75,4 @@ try:
 except ImportError:
     __all__ = ['mcp']
 
-__version__ = '9.18.4'
+__version__ = '9.20.0'

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "loki-mode",
   "mcpName": "io.github.asklokesh/loki-mode",
-  "version": "9.18.4",
+  "version": "9.20.0",
   "description": "Loki Mode by Autonomi. Autonomous spec-to-product system: takes a PRD, GitHub issue, OpenAPI/JSON/YAML, or one-line brief to a deployed app via the RARV-C closure loop with 8 quality gates. Provider-agnostic (Claude Code, OpenAI Codex, Cline, Aider).",
   "keywords": [
     "agent",

package/plugins/loki-mode/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "loki-mode",
   "displayName": "Loki Mode",
-  "version": "9.18.4",
+  "version": "9.20.0",
   "description": "Autonomous spec-to-product build system with a built-in trust layer (RARV-C closure loop, 8 quality gates, completion council). Ships Loki's spec-hardening, drift-detection, and deterministic PR verification commands plus the Loki MCP server.",
   "author": {
     "name": "Autonomi",