loki-mode 9.22.0 → 9.22.2

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: Autonomous spec-driven build system with a built-in trust layer. It does not call work done until it is verified (RARV-C closure loop, 8 quality gates, completion council, verified-completion evidence gate). Triggers on "Loki Mode". Takes a spec (PRD, GitHub issue, OpenAPI doc, etc.) to deployed product with minimal human intervention. Provider-agnostic. Requires --dangerously-skip-permissions flag.
 ---
 
-# Loki Mode v9.22.0
+# Loki Mode v9.22.2
 
 **You are an autonomous agent. You make decisions. You do not ask questions. You do not stop.**
 
@@ -470,4 +470,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v9.22.0 | [Autonomi](https://www.autonomi.dev/) flagship product | ~410 lines core**
+**v9.22.2 | [Autonomi](https://www.autonomi.dev/) flagship product | ~410 lines core**

package/VERSION

@@ -1 +1 @@
-9.22.0
+9.22.2

package/autonomy/loki

@@ -32219,6 +32219,55 @@ if _result.get('error'):
 # this is a thin dispatcher, mirroring how cmd_proof delegates to the proof
 # generator. Generation is incremental (skips when the codebase is unchanged).
 # =============================================================================
+# loki outcomes canary: installed access to the complete local canary workflow.
+#
+# Keep this as a thin dispatcher. Each Python tool retains its own explicit
+# opt-in gate, input validation, privacy contract, writes (where applicable),
+# and exit codes. Resolving from the installed Loki root makes the workflow
+# usable from any current directory without copying repository-relative paths.
+cmd_canary() {
+    local subcommand="${1:-}"
+    local tool_name=""
+    local tools_dir="${_LOKI_SCRIPT_DIR}/../tools"
+
+    case "$subcommand" in
+        plan)     tool_name="outcome-canary.py" ;;
+        record)   tool_name="outcome-canary-observe.py" ;;
+        evaluate) tool_name="outcome-canary-evaluate.py" ;;
+        receipt)  tool_name="outcome-canary-receipt.py" ;;
+        verify)   tool_name="outcome-canary-receipt-verify.py" ;;
+        --help|-h|help|"")
+            echo -e "${BOLD}loki outcomes canary${NC} - run the local outcome-routing canary workflow"
+            echo ""
+            echo "Usage: loki outcomes canary <command> [options]"
+            echo ""
+            echo "Commands:"
+            echo "  plan       Plan a deterministic reversible canary assignment"
+            echo "  record     Record one explicitly consented local observation"
+            echo "  evaluate   Produce an aggregate PROMOTE, HOLD, or ROLLBACK verdict"
+            echo "  receipt    Create one portable immutable decision receipt"
+            echo "  verify     Independently verify a receipt against current evidence"
+            echo ""
+            echo "Every mutating or decision-producing step remains explicitly opt-in."
+            echo "Run 'loki outcomes canary <command> --help' for its exact arguments."
+            return 0
+            ;;
+        *)
+            echo "loki outcomes canary: unknown command: $subcommand" >&2
+            echo "Run 'loki outcomes canary --help' for usage." >&2
+            return 64
+            ;;
+    esac
+
+    shift
+    local tool="${tools_dir}/${tool_name}"
+    if [ ! -f "$tool" ]; then
+        echo "loki outcomes canary: installed tool is unavailable: $tool_name" >&2
+        return 2
+    fi
+    python3 "$tool" "$@"
+}
+
 # loki outcomes: what happened to the work AFTER the receipt was written.
 #
 # Every competing agent reports VOLUME. Factory AI's analytics expose files
@@ -32233,6 +32282,11 @@ if _result.get('error'):
 # feature. See autonomy/lib/outcome_ledger.py for the anchor gate and the
 # measured evidence behind it.
 cmd_outcomes() {
+    if [ "${1:-}" = "canary" ]; then
+        shift
+        cmd_canary "$@"
+        return $?
+    fi
     local lib="${_LOKI_SCRIPT_DIR}/lib/outcome_ledger.py"
     if [ ! -f "$lib" ]; then
         echo "outcome ledger is not installed at $lib" >&2
@@ -32243,6 +32297,7 @@ cmd_outcomes() {
             echo -e "${BOLD}loki outcomes${NC} - did the work turn out to be RIGHT, not just that it happened"
             echo ""
             echo "Usage: loki outcomes [--json] [--run-id <id>]"
+            echo "       loki outcomes canary <command> [options]"
             echo ""
             echo "Follows each Evidence Receipt past the moment it was written and"
             echo "reports, from local git only: was it reverted, did its lines survive,"
@@ -32251,6 +32306,9 @@ cmd_outcomes() {
             echo "A receipt is measured ONLY when sha algebra proves base..head is that"
             echo "change. Everything else reads UNKNOWN with a named reason -- never 0,"
             echo "never a pass. Read-only: it never writes to the repo it analyses."
+            echo ""
+            echo "'loki outcomes canary' runs the local plan, record, evaluate, receipt,"
+            echo "and verify workflow; each step retains its explicit opt-in gate."
             return 0
             ;;
     esac

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "9.22.0"
+__version__ = "9.22.2"
 
 # Expose the control app for easy import
 try:

package/docs/OUTCOME-CANARY-EVALUATION.md

@@ -4,13 +4,88 @@
 observations into one deterministic aggregate verdict. It never invokes a provider,
 changes an assignment, or promotes a route.
 
+Installed Loki distributions expose the complete workflow through one command:
+
+```bash
+loki outcomes canary plan --help
+loki outcomes canary record --help
+loki outcomes canary evaluate --help
+loki outcomes canary receipt --help
+loki outcomes canary verify --help
+```
+
+`loki outcomes canary` resolves the bundled tools from the installation, so these commands
+work outside the Loki source checkout. It passes arguments and exit codes through
+unchanged; the explicit opt-in gates documented below still apply.
+
 ```bash
-python3 tools/outcome-canary-evaluate.py report.json observations.json \
+loki outcomes canary evaluate report.json observations.json \
   --enable-evaluation --control-route safe --canary-percent 10 --json
 ```
 
 Evaluation is opt-in. Without `--enable-evaluation`, the command refuses.
 
+## Retain a decision receipt
+
+After a complete evaluation, create one immutable portable proof by independently
+rerunning the same decision:
+
+```bash
+loki outcomes canary receipt report.json observations.json receipt.json \
+  --enable-receipt --control-route safe --canary-percent 10 --min-samples 5
+```
+
+The command creates a new canonical `loki-outcome-canary-decision-receipt/v1`
+file. It binds the exact report, source, and observation digests; the full
+evaluation policy; privacy-safe aggregate arm results; the acceptance delta; and
+the `PROMOTE`, `HOLD`, or `ROLLBACK` verdict. It never includes subject keys or
+local input/output pathnames, invokes a provider, or changes a route.
+
+Receipt creation is explicit and create-only. An existing file or symlink is
+never replaced, and a target created by another process wins without being
+changed. Refused or sparse evaluation, malformed or oversized inputs, unsafe
+path indirection, source drift, evidence drift, and publication failure leave no
+receipt claim. The output is written with mode `0600`, fsynced, and published
+atomically in its destination directory.
+
+Verify a handed-off receipt against the exact current evidence before acting on
+its verdict:
+
+```bash
+loki outcomes canary verify report.json observations.json receipt.json \
+  --enable-verification --json
+```
+
+The read-only verifier takes the policy from the canonical receipt, independently
+reruns the deterministic evaluation, rechecks the report, source, and observation
+bytes, and requires the complete rederived receipt to match exactly. It returns
+`VERIFIED` only for the same bound evidence, aggregates, policy, and verdict.
+Missing, symlinked, oversized, malformed, non-canonical, sparse, refused,
+substituted, or drifted inputs fail closed without writes, telemetry, provider
+calls, or route changes.
+
+## Record an observation
+
+Use the installed recorder instead of hand-editing the observation contract:
+
+```bash
+loki outcomes canary record report.json observations.json \
+  --enable-recording --subject '<locally chosen opaque key>' \
+  --accepted --risk 0.10 --control-route safe --canary-percent 10
+```
+
+Choose exactly one of `--accepted` or `--rejected`. The risk value is a finite
+number from zero through one. The recorder independently reproduces the subject's
+deterministic assignment and route, then creates or appends one canonical item
+through an atomic local replacement. Existing report and source bindings must
+match, and every prior item is rebound before the append is accepted.
+
+Recording is explicit and local: the command never invokes a provider, changes a
+route, or emits the subject or input pathname. Duplicate subjects, symlinks,
+malformed or oversized evidence, binding drift, assignment drift, and unsafe
+values are refused without changing the observation file. A sidecar `.lock` file
+serializes cooperating writers.
+
 ## Observation contract
 
 The input is one `loki-outcome-canary-observations/v1` JSON object:
@@ -37,10 +112,12 @@ Each item has exactly those five fields. Subjects must be unique and non-empty;
 The file is capped at 5 MiB and 100,000 observations. Duplicate JSON keys are
 rejected.
 
-The evaluator hashes the exact report and observation bytes, rechecks the report's
-underlying source digest, and reruns the released deterministic canary assignment
-for every subject. A recorded arm or route that does not match that assignment
-refuses the entire evaluation. Output contains no subject keys.
+The evaluator accepts only named regular report and observation files. Symlinks,
+directories, devices, and other path indirection are refused. It hashes the exact
+report and observation bytes, rechecks the report's underlying source digest, and
+reruns the released deterministic canary assignment for every subject. A recorded
+arm or route that does not match that assignment refuses the entire evaluation.
+Output contains no subject keys or input pathnames.
 
 ## Verdict policy
 
@@ -60,6 +137,7 @@ unbound evidence returns `REFUSED` rather than a partial verdict.
 ## Output and exit codes
 
 `--json` emits the aggregate arms, policy, exact evidence digests, verdict, and
-refusal reasons. The default output is a short human-readable summary. Exit 0 means
+refusal reasons. It is portable across machines because it omits local input paths.
+The default output is a short human-readable summary. Exit 0 means
 a verdict was produced (including `ROLLBACK`), 3 means evaluation was refused, 64
 is an invocation error, and 66 is a missing input file.

package/loki-ts/dist/loki.js

@@ -1,5 +1,5 @@
 // @bun
-var p_=Object.create;var{getPrototypeOf:d_,defineProperty:eK,getOwnPropertyNames:c_}=Object;var l_=Object.prototype.hasOwnProperty;function i_(Z){return this[Z]}var a_,s_,n_=(Z,X,Q)=>{var Y=Z!=null&&typeof Z==="object";if(Y){var J=X?a_??=new WeakMap:s_??=new WeakMap,z=J.get(Z);if(z)return z}Q=Z!=null?p_(d_(Z)):{};let K=X||!Z||!Z.__esModule?eK(Q,"default",{value:Z,enumerable:!0}):Q;for(let $ of c_(Z))if(!l_.call(K,$))eK(K,$,{get:i_.bind(Z,$),enumerable:!0});if(Y)J.set(Z,K);return K};var HQ=(Z,X)=>()=>(X||Z((X={exports:{}}).exports,X),X.exports);var o_=(Z)=>Z;function r_(Z,X){this[Z]=o_.bind(null,X)}var l0=(Z,X)=>{for(var Q in X)eK(Z,Q,{get:X[Q],enumerable:!0,configurable:!0,set:r_.bind(X,Q)})};var p=(Z,X)=>()=>(Z&&(X=Z(Z=0)),X);var t0=import.meta.require;var xO={};l0(xO,{lokiDir:()=>j0,homeLokiDir:()=>R4,findRepoRootForVersion:()=>X$,REPO_ROOT:()=>i0});import{resolve as n7,dirname as Z$}from"path";import{fileURLToPath as t_}from"url";import{existsSync as UQ}from"fs";import{homedir as e_}from"os";function Zf(){let Z=kO;for(let X=0;X<6;X++){if(UQ(n7(Z,"VERSION"))&&UQ(n7(Z,"autonomy/run.sh")))return Z;let Q=Z$(Z);if(Q===Z)break;Z=Q}return n7(kO,"..","..","..")}function X$(Z){let X=Z;for(let Q=0;Q<6;Q++){if(UQ(n7(X,"VERSION"))&&UQ(n7(X,"autonomy/run.sh")))return X;let Y=Z$(X);if(Y===X)break;X=Y}return n7(Z,"..","..","..")}function j0(){return process.env.LOKI_DIR??n7(process.cwd(),".loki")}function R4(){return n7(e_(),".loki")}var kO,i0;var H8=p(()=>{kO=Z$(t_(import.meta.url));i0=Zf()});import{readFileSync as Xf}from"fs";import{resolve as Qf,dirname as Yf}from"path";import{fileURLToPath as Jf}from"url";function h3(){if(h5!==null)return h5;let Z="9.22.0";if(typeof Z==="string"&&Z.length>0)return h5=Z,h5;try{let X=Yf(Jf(import.meta.url)),Q=X$(X);h5=Xf(Qf(Q,"VERSION"),"utf-8").trim()}catch{h5="unknown"}return h5}var h5=null;var BQ=p(()=>{H8()});var _O={};l0(_O,{runOrThrow:()=>Tf,run:()=>E0,readStreamCapped:()=>NQ,commandVersion:()=>Cf,commandExists:()=>X9,ShellError:()=>Q$,MAX_STDOUT_BYTES:()=>bO});async function NQ(Z,X=bO){let Q=Z.getReader(),Y=new TextDecoder,J="",z=0;try{while(z<X){let{done:K,value:$}=await Q.read();if(K)break;if(!$)continue;if(z+=$.byteLength,z>X){let V=$.byteLength-(z-X);J+=Y.decode($.subarray(0,V),{stream:!0});break}J+=Y.decode($,{stream:!0})}J+=Y.decode()}finally{try{await Q.cancel()}catch{}Q.releaseLock()}return J}async function E0(Z,X={}){let Q=Bun.spawn({cmd:[...Z],stdout:"pipe",stderr:"pipe",env:X.env?{...process.env,...X.env}:process.env,cwd:X.cwd}),Y,J;if(X.timeoutMs&&X.timeoutMs>0)Y=setTimeout(()=>{try{Q.kill("SIGTERM")}catch{}J=setTimeout(()=>{try{Q.kill("SIGKILL")}catch{}},2000)},X.timeoutMs);try{let[z,K,$]=await Promise.all([NQ(Q.stdout),new Response(Q.stderr).text(),Q.exited]);return{stdout:z,stderr:K,exitCode:$}}finally{if(Y)clearTimeout(Y);if(J)clearTimeout(J)}}async function Tf(Z,X={}){let Q=await E0(Z,X);if(Q.exitCode!==0)throw new Q$(`command failed (${Q.exitCode}): ${Z.join(" ")}`,Q.exitCode,Q.stdout,Q.stderr);return Q}async function X9(Z){let X=wf(Z),Q=await E0(["sh","-c",`command -v ${X}`],{timeoutMs:5000});if(Q.exitCode===0)return Q.stdout.trim()||null;return null}function wf(Z){if(!/^[A-Za-z0-9._/-]+$/.test(Z))throw Error(`refused to shell-escape suspect token: ${Z}`);return Z}async function Cf(Z,X="--version"){if(!await X9(Z))return null;let Y=await E0([Z,X],{timeoutMs:5000});if(Y.exitCode!==0)return null;return((Y.stdout||Y.stderr).split(/\r?\n/)[0]?.trim()??"")||null}var bO=16777216,Q$;var x9=p(()=>{Q$=class Q$ extends Error{message;exitCode;stdout;stderr;constructor(Z,X,Q,Y){super(Z);this.message=Z;this.exitCode=X;this.stdout=Q;this.stderr=Y;this.name="ShellError"}}});function o7(Z){return Ff?"":Z}var Ff,A0,F8,_0,$W0,a0,V8,Q9,h;var S6=p(()=>{Ff=(process.env.NO_COLOR??"").length>0;A0=o7("\x1B[0;31m"),F8=o7("\x1B[0;32m"),_0=o7("\x1B[1;33m"),$W0=o7("\x1B[0;34m"),a0=o7("\x1B[0;36m"),V8=o7("\x1B[1m"),Q9=o7("\x1B[2m"),h=o7("\x1B[0m")});import{existsSync as ff}from"fs";async function E7(){if(x4!==void 0)return x4;let Z="/opt/homebrew/bin/python3.12";if(ff(Z))return x4=Z,Z;let X=await X9("python3.12");if(X)return x4=X,X;let Q=await X9("python3");return x4=Q,Q}async function Y7(Z,X={}){let Q=await E7();if(!Q)return{stdout:"",stderr:"python3 not found",exitCode:127};return E0([Q,"-c",Z],X)}var x4;var r7=p(()=>{x9()});var XA={};l0(XA,{runStatus:()=>Vh});import{existsSync as Y9,readFileSync as g3,readdirSync as aO,statSync as sO}from"fs";import{resolve as h8,basename as ef}from"path";import{homedir as Zh}from"os";function nO(Z){let X=Math.trunc(Z);if(X>=1e6)return`${(Math.trunc(X/1e6*10)/10).toFixed(1)}M`;if(X>=1000)return`${(Math.trunc(X/1000*10)/10).toFixed(1)}K`;return String(X)}function oO(Z,X,Q){if(X===0)return null;let Y=Math.trunc(Z*100/X),J=Math.trunc(Z*AQ/X);if(J>AQ)J=AQ;let z=AQ-J,K=F8;if(Y>=80)K=A0;else if(Y>=50)K=_0;let $="=".repeat(Math.max(0,J))+" ".repeat(Math.max(0,z)),V=nO(Z),W=nO(X);return`  ${V8}${Q}${h} ${K}[${$}]${h} ${Y}% (${V} / ${W})`}async function Qh(){if(await X9("jq"))return!0;return process.stdout.write(`${A0}Error: jq is required but not installed.${h}
+var p_=Object.create;var{getPrototypeOf:d_,defineProperty:eK,getOwnPropertyNames:c_}=Object;var l_=Object.prototype.hasOwnProperty;function i_(Z){return this[Z]}var a_,s_,n_=(Z,X,Q)=>{var Y=Z!=null&&typeof Z==="object";if(Y){var J=X?a_??=new WeakMap:s_??=new WeakMap,z=J.get(Z);if(z)return z}Q=Z!=null?p_(d_(Z)):{};let K=X||!Z||!Z.__esModule?eK(Q,"default",{value:Z,enumerable:!0}):Q;for(let $ of c_(Z))if(!l_.call(K,$))eK(K,$,{get:i_.bind(Z,$),enumerable:!0});if(Y)J.set(Z,K);return K};var HQ=(Z,X)=>()=>(X||Z((X={exports:{}}).exports,X),X.exports);var o_=(Z)=>Z;function r_(Z,X){this[Z]=o_.bind(null,X)}var l0=(Z,X)=>{for(var Q in X)eK(Z,Q,{get:X[Q],enumerable:!0,configurable:!0,set:r_.bind(X,Q)})};var p=(Z,X)=>()=>(Z&&(X=Z(Z=0)),X);var t0=import.meta.require;var xO={};l0(xO,{lokiDir:()=>j0,homeLokiDir:()=>R4,findRepoRootForVersion:()=>X$,REPO_ROOT:()=>i0});import{resolve as n7,dirname as Z$}from"path";import{fileURLToPath as t_}from"url";import{existsSync as UQ}from"fs";import{homedir as e_}from"os";function Zf(){let Z=kO;for(let X=0;X<6;X++){if(UQ(n7(Z,"VERSION"))&&UQ(n7(Z,"autonomy/run.sh")))return Z;let Q=Z$(Z);if(Q===Z)break;Z=Q}return n7(kO,"..","..","..")}function X$(Z){let X=Z;for(let Q=0;Q<6;Q++){if(UQ(n7(X,"VERSION"))&&UQ(n7(X,"autonomy/run.sh")))return X;let Y=Z$(X);if(Y===X)break;X=Y}return n7(Z,"..","..","..")}function j0(){return process.env.LOKI_DIR??n7(process.cwd(),".loki")}function R4(){return n7(e_(),".loki")}var kO,i0;var H8=p(()=>{kO=Z$(t_(import.meta.url));i0=Zf()});import{readFileSync as Xf}from"fs";import{resolve as Qf,dirname as Yf}from"path";import{fileURLToPath as Jf}from"url";function h3(){if(h5!==null)return h5;let Z="9.22.2";if(typeof Z==="string"&&Z.length>0)return h5=Z,h5;try{let X=Yf(Jf(import.meta.url)),Q=X$(X);h5=Xf(Qf(Q,"VERSION"),"utf-8").trim()}catch{h5="unknown"}return h5}var h5=null;var BQ=p(()=>{H8()});var _O={};l0(_O,{runOrThrow:()=>Tf,run:()=>E0,readStreamCapped:()=>NQ,commandVersion:()=>Cf,commandExists:()=>X9,ShellError:()=>Q$,MAX_STDOUT_BYTES:()=>bO});async function NQ(Z,X=bO){let Q=Z.getReader(),Y=new TextDecoder,J="",z=0;try{while(z<X){let{done:K,value:$}=await Q.read();if(K)break;if(!$)continue;if(z+=$.byteLength,z>X){let V=$.byteLength-(z-X);J+=Y.decode($.subarray(0,V),{stream:!0});break}J+=Y.decode($,{stream:!0})}J+=Y.decode()}finally{try{await Q.cancel()}catch{}Q.releaseLock()}return J}async function E0(Z,X={}){let Q=Bun.spawn({cmd:[...Z],stdout:"pipe",stderr:"pipe",env:X.env?{...process.env,...X.env}:process.env,cwd:X.cwd}),Y,J;if(X.timeoutMs&&X.timeoutMs>0)Y=setTimeout(()=>{try{Q.kill("SIGTERM")}catch{}J=setTimeout(()=>{try{Q.kill("SIGKILL")}catch{}},2000)},X.timeoutMs);try{let[z,K,$]=await Promise.all([NQ(Q.stdout),new Response(Q.stderr).text(),Q.exited]);return{stdout:z,stderr:K,exitCode:$}}finally{if(Y)clearTimeout(Y);if(J)clearTimeout(J)}}async function Tf(Z,X={}){let Q=await E0(Z,X);if(Q.exitCode!==0)throw new Q$(`command failed (${Q.exitCode}): ${Z.join(" ")}`,Q.exitCode,Q.stdout,Q.stderr);return Q}async function X9(Z){let X=wf(Z),Q=await E0(["sh","-c",`command -v ${X}`],{timeoutMs:5000});if(Q.exitCode===0)return Q.stdout.trim()||null;return null}function wf(Z){if(!/^[A-Za-z0-9._/-]+$/.test(Z))throw Error(`refused to shell-escape suspect token: ${Z}`);return Z}async function Cf(Z,X="--version"){if(!await X9(Z))return null;let Y=await E0([Z,X],{timeoutMs:5000});if(Y.exitCode!==0)return null;return((Y.stdout||Y.stderr).split(/\r?\n/)[0]?.trim()??"")||null}var bO=16777216,Q$;var x9=p(()=>{Q$=class Q$ extends Error{message;exitCode;stdout;stderr;constructor(Z,X,Q,Y){super(Z);this.message=Z;this.exitCode=X;this.stdout=Q;this.stderr=Y;this.name="ShellError"}}});function o7(Z){return Ff?"":Z}var Ff,A0,F8,_0,$W0,a0,V8,Q9,h;var S6=p(()=>{Ff=(process.env.NO_COLOR??"").length>0;A0=o7("\x1B[0;31m"),F8=o7("\x1B[0;32m"),_0=o7("\x1B[1;33m"),$W0=o7("\x1B[0;34m"),a0=o7("\x1B[0;36m"),V8=o7("\x1B[1m"),Q9=o7("\x1B[2m"),h=o7("\x1B[0m")});import{existsSync as ff}from"fs";async function E7(){if(x4!==void 0)return x4;let Z="/opt/homebrew/bin/python3.12";if(ff(Z))return x4=Z,Z;let X=await X9("python3.12");if(X)return x4=X,X;let Q=await X9("python3");return x4=Q,Q}async function Y7(Z,X={}){let Q=await E7();if(!Q)return{stdout:"",stderr:"python3 not found",exitCode:127};return E0([Q,"-c",Z],X)}var x4;var r7=p(()=>{x9()});var XA={};l0(XA,{runStatus:()=>Vh});import{existsSync as Y9,readFileSync as g3,readdirSync as aO,statSync as sO}from"fs";import{resolve as h8,basename as ef}from"path";import{homedir as Zh}from"os";function nO(Z){let X=Math.trunc(Z);if(X>=1e6)return`${(Math.trunc(X/1e6*10)/10).toFixed(1)}M`;if(X>=1000)return`${(Math.trunc(X/1000*10)/10).toFixed(1)}K`;return String(X)}function oO(Z,X,Q){if(X===0)return null;let Y=Math.trunc(Z*100/X),J=Math.trunc(Z*AQ/X);if(J>AQ)J=AQ;let z=AQ-J,K=F8;if(Y>=80)K=A0;else if(Y>=50)K=_0;let $="=".repeat(Math.max(0,J))+" ".repeat(Math.max(0,z)),V=nO(Z),W=nO(X);return`  ${V8}${Q}${h} ${K}[${$}]${h} ${Y}% (${V} / ${W})`}async function Qh(){if(await X9("jq"))return!0;return process.stdout.write(`${A0}Error: jq is required but not installed.${h}
 `),process.stdout.write(`Install with:
 `),process.stdout.write(`  brew install jq    (macOS)
 `),process.stdout.write(`  apt install jq     (Debian/Ubuntu)
@@ -1236,4 +1236,4 @@ Set LOKI_LEGACY_BASH=1 to force the bash CLI for every command.
 `),2}case"start":{let{runStart:Y}=await Promise.resolve().then(() => (g_(),v_));return Y(Q)}default:return process.stderr.write(`Unknown command: ${X}
 `),process.stderr.write(m_),2}}lO();process.on("SIGINT",()=>process.exit(130));process.on("SIGTERM",()=>process.exit(143));var dV0=await pV0(Bun.argv.slice(2));process.exit(dV0);
 
-//# debugId=DE8569120D6E31F464756E2164756E21
+//# debugId=1B1E1BA0D9D91D1E64756E2164756E21

package/mcp/__init__.py

@@ -75,4 +75,4 @@ try:
 except ImportError:
     __all__ = ['mcp']
 
-__version__ = '9.22.0'
+__version__ = '9.22.2'

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "loki-mode",
   "mcpName": "io.github.asklokesh/loki-mode",
-  "version": "9.22.0",
+  "version": "9.22.2",
   "description": "Loki Mode by Autonomi. Autonomous spec-to-product system: takes a PRD, GitHub issue, OpenAPI/JSON/YAML, or one-line brief to a deployed app via the RARV-C closure loop with 8 quality gates. Provider-agnostic (Claude Code, OpenAI Codex, Cline, Aider).",
   "keywords": [
     "agent",

package/plugins/loki-mode/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "loki-mode",
   "displayName": "Loki Mode",
-  "version": "9.22.0",
+  "version": "9.22.2",
   "description": "Autonomous spec-to-product build system with a built-in trust layer (RARV-C closure loop, 8 quality gates, completion council). Ships Loki's spec-hardening, drift-detection, and deterministic PR verification commands plus the Loki MCP server.",
   "author": {
     "name": "Autonomi",

package/tools/outcome-canary-evaluate.py

@@ -7,6 +7,7 @@ import json
 import math
 import os
 import pathlib
+import stat
 import sys
 
 OK, REFUSED, USAGE, NO_INPUT = 0, 3, 64, 66
@@ -53,7 +54,17 @@ def _sha256(data):
     return hashlib.sha256(data).hexdigest()
 
 
+def _require_named_regular_file(path, label):
+    try:
+        mode = os.lstat(path).st_mode
+    except OSError as exc:
+        raise ValueError(f"{label} cannot be inspected: {exc}") from exc
+    if not stat.S_ISREG(mode):
+        raise ValueError(f"{label} must be a named regular file")
+
+
 def _read_json(path):
+    _require_named_regular_file(path, "input")
     with open(path, "rb") as handle:
         data = handle.read(MAX_BYTES + 1)
     if len(data) > MAX_BYTES:
@@ -105,10 +116,8 @@ def evaluate(report_path, observations_path, control_route, canary_percent=10.0,
 
     out = {
         "evaluation": DOMAIN,
-        "report": os.path.abspath(report_path),
         "report_sha256": None,
         "source_sha256": None,
-        "observations": os.path.abspath(observations_path),
         "observations_sha256": None,
         "control_route": control_route,
         "canary_route": None,
@@ -141,6 +150,7 @@ def evaluate(report_path, observations_path, control_route, canary_percent=10.0,
         return out
 
     try:
+        _require_named_regular_file(report_path, "report")
         planner = _load_planner()
         report, report_sha256, report_reasons = planner.load_report(report_path)
     except Exception as exc:
@@ -228,7 +238,7 @@ def main(argv=None):
     parser.add_argument("--json", action="store_true")
     args = parser.parse_args(argv)
     for path in (args.report, args.observations):
-        if not os.path.isfile(path):
+        if not os.path.lexists(path):
             print(f"outcome-canary-evaluate: no such file: {path}", file=sys.stderr)
             return NO_INPUT
     result = evaluate(

package/tools/outcome-canary-observe.py

@@ -0,0 +1,261 @@
+#!/usr/bin/env python3
+"""Atomically record one consented, source-bound canary observation."""
+import argparse
+import fcntl
+import hashlib
+import importlib.util
+import json
+import math
+import os
+import pathlib
+import stat
+import sys
+import tempfile
+
+OK, REFUSED, USAGE, NO_INPUT = 0, 3, 64, 66
+DOMAIN = "loki-outcome-canary-observation-record/v1"
+OBSERVATIONS = "loki-outcome-canary-observations/v1"
+MAX_BYTES = 5 * 1024 * 1024
+MAX_ITEMS = 100_000
+
+
+class Parser(argparse.ArgumentParser):
+    def error(self, message):
+        self.print_usage(sys.stderr)
+        self.exit(USAGE, f"{self.prog}: error: {message}\n")
+
+
+def _load_tool(filename, module_name):
+    path = pathlib.Path(__file__).with_name(filename)
+    spec = importlib.util.spec_from_file_location(module_name, path)
+    if spec is None or spec.loader is None:
+        raise RuntimeError("installed tool dependency is unavailable")
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module
+
+
+def _named_regular(path, allow_missing=False):
+    try:
+        mode = os.lstat(path).st_mode
+    except FileNotFoundError:
+        if allow_missing:
+            return False
+        raise
+    if not stat.S_ISREG(mode):
+        raise ValueError("not_named_regular_file")
+    return True
+
+
+def _sha256(data):
+    return hashlib.sha256(data).hexdigest()
+
+
+def _valid_risk(value):
+    return (
+        not isinstance(value, bool)
+        and isinstance(value, (int, float))
+        and math.isfinite(value)
+        and 0 <= value <= 1
+    )
+
+
+def _validate_existing(body, report_sha256, source_sha256, planner, report_path,
+                       control_route, canary_percent, max_risk):
+    if not isinstance(body, dict) or set(body) != {
+        "observations", "report_sha256", "source_sha256", "items"
+    }:
+        raise ValueError("noncanonical_observations")
+    if body["observations"] != OBSERVATIONS:
+        raise ValueError("unsupported_observations_version")
+    if body["report_sha256"] != report_sha256 or body["source_sha256"] != source_sha256:
+        raise ValueError("binding_mismatch")
+    items = body["items"]
+    if not isinstance(items, list) or len(items) >= MAX_ITEMS:
+        raise ValueError("item_limit")
+    seen = set()
+    for item in items:
+        if not isinstance(item, dict) or set(item) != {
+            "subject", "assignment", "route", "accepted", "risk"
+        }:
+            raise ValueError("noncanonical_item")
+        subject = item["subject"]
+        if not isinstance(subject, str) or not subject.strip() or subject in seen:
+            raise ValueError("invalid_or_duplicate_subject")
+        seen.add(subject)
+        if not isinstance(item["accepted"], bool) or not _valid_risk(item["risk"]):
+            raise ValueError("invalid_measured_value")
+        plan = planner.plan(
+            report_path, subject, control_route, canary_percent, max_risk, True
+        )
+        if plan.get("refusal_reasons"):
+            raise ValueError("existing_item_cannot_be_rebound")
+        if item["assignment"] != plan.get("assignment") or item["route"] != plan.get("route"):
+            raise ValueError("existing_assignment_mismatch")
+    return items, seen
+
+
+def _atomic_write(path, payload):
+    directory = os.path.dirname(os.path.abspath(path)) or "."
+    if not os.path.isdir(directory):
+        raise ValueError("parent_not_directory")
+    existing = _named_regular(path, allow_missing=True)
+    mode = stat.S_IMODE(os.lstat(path).st_mode) if existing else 0o600
+    temporary = None
+    try:
+        fd, temporary = tempfile.mkstemp(prefix=f".{os.path.basename(path)}.", dir=directory)
+        os.fchmod(fd, mode)
+        with os.fdopen(fd, "wb") as handle:
+            handle.write(payload)
+            handle.flush()
+            os.fsync(handle.fileno())
+        os.replace(temporary, path)
+        temporary = None
+        directory_fd = os.open(directory, os.O_RDONLY)
+        try:
+            os.fsync(directory_fd)
+        finally:
+            os.close(directory_fd)
+    finally:
+        if temporary is not None:
+            try:
+                os.unlink(temporary)
+            except FileNotFoundError:
+                pass
+
+
+def record(report_path, observations_path, subject, accepted, risk, control_route,
+           canary_percent=10.0, max_risk=.25, enable_recording=False):
+    result = {
+        "record": DOMAIN,
+        "status": "REFUSED",
+        "assignment": None,
+        "route": None,
+        "observation_count": None,
+        "observations_sha256": None,
+        "refusal_reason": None,
+    }
+    if not enable_recording:
+        result["refusal_reason"] = "recording_not_enabled"
+        return result
+    if not isinstance(subject, str) or not subject.strip():
+        result["refusal_reason"] = "invalid_subject"
+        return result
+    if not isinstance(accepted, bool) or not _valid_risk(risk):
+        result["refusal_reason"] = "invalid_measured_value"
+        return result
+    try:
+        _named_regular(report_path)
+        if os.lstat(report_path).st_size > MAX_BYTES:
+            raise ValueError("report_too_large")
+        planner = _load_tool("outcome-canary.py", "outcome_canary_observe_planner")
+        evaluator = _load_tool("outcome-canary-evaluate.py", "outcome_canary_observe_evaluator")
+        plan = planner.plan(
+            report_path, subject, control_route, canary_percent, max_risk, True
+        )
+        if plan.get("source_missing"):
+            result["refusal_reason"] = "source_missing"
+            return result
+        if plan.get("refusal_reasons"):
+            result["refusal_reason"] = "plan_refused"
+            return result
+        report_sha256 = plan["report_sha256"]
+        source_sha256 = plan["source_sha256"]
+
+        lock_path = os.path.abspath(observations_path) + ".lock"
+        flags = os.O_RDWR | os.O_CREAT
+        if hasattr(os, "O_NOFOLLOW"):
+            flags |= os.O_NOFOLLOW
+        lock_fd = os.open(lock_path, flags, 0o600)
+        try:
+            if not stat.S_ISREG(os.fstat(lock_fd).st_mode):
+                raise ValueError("invalid_lock")
+            fcntl.flock(lock_fd, fcntl.LOCK_EX)
+            if _named_regular(observations_path, allow_missing=True):
+                body, _ = evaluator._read_json(observations_path)
+                items, seen = _validate_existing(
+                    body, report_sha256, source_sha256, planner, report_path,
+                    control_route, canary_percent, max_risk,
+                )
+            else:
+                body = {
+                    "observations": OBSERVATIONS,
+                    "report_sha256": report_sha256,
+                    "source_sha256": source_sha256,
+                    "items": [],
+                }
+                items, seen = body["items"], set()
+            if len(items) >= MAX_ITEMS:
+                raise ValueError("item_limit")
+            if subject in seen:
+                raise ValueError("duplicate_subject")
+            items.append({
+                "subject": subject,
+                "assignment": plan["assignment"],
+                "route": plan["route"],
+                "accepted": accepted,
+                "risk": float(risk),
+            })
+            payload = (json.dumps(body, sort_keys=True, separators=(",", ":")) + "\n").encode()
+            if len(payload) > MAX_BYTES:
+                raise ValueError("observations_too_large")
+            _atomic_write(observations_path, payload)
+        finally:
+            os.close(lock_fd)
+        result.update({
+            "status": "RECORDED",
+            "assignment": plan["assignment"],
+            "route": plan["route"],
+            "observation_count": len(items),
+            "observations_sha256": _sha256(payload),
+        })
+    except FileNotFoundError:
+        result["refusal_reason"] = "input_missing"
+    except (OSError, ValueError, json.JSONDecodeError, UnicodeDecodeError) as exc:
+        reason = str(exc)
+        allowed = {
+            "not_named_regular_file", "noncanonical_observations",
+            "unsupported_observations_version", "binding_mismatch", "item_limit",
+            "noncanonical_item", "invalid_or_duplicate_subject", "invalid_measured_value",
+            "existing_item_cannot_be_rebound", "existing_assignment_mismatch",
+            "parent_not_directory", "report_too_large", "source_missing", "invalid_lock",
+            "duplicate_subject", "observations_too_large",
+        }
+        result["refusal_reason"] = reason if reason in allowed else "unsafe_or_malformed_input"
+    return result
+
+
+def main(argv=None):
+    parser = Parser(prog="outcome-canary-observe")
+    parser.add_argument("report")
+    parser.add_argument("observations")
+    parser.add_argument("--enable-recording", action="store_true")
+    parser.add_argument("--subject", required=True)
+    accepted = parser.add_mutually_exclusive_group(required=True)
+    accepted.add_argument("--accepted", action="store_true")
+    accepted.add_argument("--rejected", action="store_true")
+    parser.add_argument("--risk", type=float, required=True)
+    parser.add_argument("--control-route", required=True)
+    parser.add_argument("--canary-percent", type=float, default=10.0)
+    parser.add_argument("--max-risk", type=float, default=.25)
+    parser.add_argument("--json", action="store_true")
+    args = parser.parse_args(argv)
+    if not os.path.lexists(args.report):
+        print("outcome-canary-observe: input missing", file=sys.stderr)
+        return NO_INPUT
+    result = record(
+        args.report, args.observations, args.subject, args.accepted, args.risk,
+        args.control_route, args.canary_percent, args.max_risk, args.enable_recording,
+    )
+    if args.json:
+        print(json.dumps(result, sort_keys=True))
+    elif result["status"] == "RECORDED":
+        print(f"Canary observation: RECORDED ({result['assignment']} -> {result['route']})")
+        print(f"  observations={result['observation_count']} sha256={result['observations_sha256']}")
+    else:
+        print(f"Canary observation: REFUSED ({result['refusal_reason']})")
+    return OK if result["status"] == "RECORDED" else REFUSED
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/tools/outcome-canary-receipt-verify.py

@@ -0,0 +1,183 @@
+#!/usr/bin/env python3
+"""Independently verify a canary decision receipt against its exact evidence."""
+import argparse
+import hashlib
+import importlib.util
+import json
+import os
+import pathlib
+import sys
+
+OK, REFUSED, USAGE, NO_INPUT = 0, 3, 64, 66
+DOMAIN = "loki-outcome-canary-decision-receipt/v1"
+VERDICTS = {"PROMOTE", "HOLD", "ROLLBACK"}
+
+
+class Parser(argparse.ArgumentParser):
+    def error(self, message):
+        self.print_usage(sys.stderr)
+        self.exit(USAGE, f"{self.prog}: error: {message}\n")
+
+
+def _load_tool(filename, module_name):
+    path = pathlib.Path(__file__).with_name(filename)
+    spec = importlib.util.spec_from_file_location(module_name, path)
+    if spec is None or spec.loader is None:
+        raise RuntimeError("installed tool dependency is unavailable")
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module
+
+
+def _sha256(payload):
+    return hashlib.sha256(payload).hexdigest()
+
+
+def _expected_receipt(decision):
+    return {
+        "receipt": DOMAIN,
+        "evaluation": decision["evaluation"],
+        "report_sha256": decision["report_sha256"],
+        "source_sha256": decision["source_sha256"],
+        "observations_sha256": decision["observations_sha256"],
+        "policy": {
+            "control_route": decision["control_route"],
+            "canary_route": decision["canary_route"],
+            "canary_percent": decision["canary_percent"],
+            "max_risk": decision["max_risk"],
+            "min_samples": decision["min_samples"],
+            "min_lift_bps": decision["min_lift_bps"],
+        },
+        "control": decision["control"],
+        "canary": decision["canary"],
+        "accepted_delta_bps": decision["accepted_delta_bps"],
+        "verdict": decision["verdict"],
+    }
+
+
+def verify_receipt(report_path, observations_path, receipt_path,
+                   enable_verification=False):
+    """Recompute the decision and compare its canonical receipt byte-for-byte."""
+    result = {
+        "receipt": DOMAIN,
+        "status": "REFUSED",
+        "verdict": None,
+        "receipt_sha256": None,
+        "refusal_reason": None,
+    }
+    if not enable_verification:
+        result["refusal_reason"] = "verification_not_enabled"
+        return result
+    try:
+        creator = _load_tool(
+            "outcome-canary-receipt.py", "outcome_canary_receipt_verifier_creator"
+        )
+        evaluator = creator._load_tool(
+            "outcome-canary-evaluate.py", "outcome_canary_receipt_verifier_evaluator"
+        )
+        receipt_bytes = creator._read_named_regular(receipt_path)
+        result["receipt_sha256"] = _sha256(receipt_bytes)
+        body = json.loads(
+            receipt_bytes.decode("utf-8"), object_pairs_hook=evaluator._object
+        )
+        required = {
+            "receipt", "evaluation", "report_sha256", "source_sha256",
+            "observations_sha256", "policy", "control", "canary",
+            "accepted_delta_bps", "verdict",
+        }
+        if not isinstance(body, dict) or set(body) != required or body.get("receipt") != DOMAIN:
+            raise ValueError("receipt_schema_invalid")
+        canonical = (
+            json.dumps(body, sort_keys=True, separators=(",", ":")) + "\n"
+        ).encode()
+        if receipt_bytes != canonical:
+            raise ValueError("receipt_noncanonical")
+        policy = body.get("policy")
+        policy_fields = {
+            "control_route", "canary_route", "canary_percent", "max_risk",
+            "min_samples", "min_lift_bps",
+        }
+        if not isinstance(policy, dict) or set(policy) != policy_fields:
+            raise ValueError("receipt_policy_invalid")
+
+        decision = evaluator.evaluate(
+            report_path,
+            observations_path,
+            policy["control_route"],
+            policy["canary_percent"],
+            policy["max_risk"],
+            policy["min_samples"],
+            policy["min_lift_bps"],
+            True,
+        )
+        if decision.get("refusal_reasons") or decision.get("verdict") not in VERDICTS:
+            result["refusal_reason"] = "evaluation_refused"
+            return result
+
+        # Bind the recomputation to stable exact bytes, including the report's source.
+        report_bytes = creator._read_named_regular(report_path)
+        observations_bytes = creator._read_named_regular(observations_path)
+        if _sha256(report_bytes) != decision["report_sha256"] or (
+            _sha256(observations_bytes) != decision["observations_sha256"]
+        ):
+            result["refusal_reason"] = "evidence_drift"
+            return result
+        report = json.loads(
+            report_bytes.decode("utf-8"), object_pairs_hook=evaluator._object
+        )
+        source = report.get("source") if isinstance(report, dict) else None
+        if not isinstance(source, str) or not source.strip():
+            result["refusal_reason"] = "source_unsafe_or_drifted"
+            return result
+        if _sha256(creator._read_named_regular(source)) != decision["source_sha256"]:
+            result["refusal_reason"] = "source_unsafe_or_drifted"
+            return result
+        if body != _expected_receipt(decision):
+            result["refusal_reason"] = "receipt_mismatch"
+            return result
+        if creator._read_named_regular(receipt_path) != receipt_bytes:
+            result["refusal_reason"] = "evidence_drift"
+            return result
+        result.update(status="VERIFIED", verdict=decision["verdict"])
+    except FileNotFoundError:
+        result["refusal_reason"] = "input_missing"
+    except (OSError, ValueError, json.JSONDecodeError, UnicodeDecodeError) as exc:
+        reason = str(exc)
+        allowed = {
+            "evidence_drift", "input_too_large", "not_named_regular_file",
+            "receipt_schema_invalid", "receipt_noncanonical", "receipt_policy_invalid",
+            "source_unsafe_or_drifted",
+        }
+        result["refusal_reason"] = (
+            reason if reason in allowed else "unsafe_or_malformed_input"
+        )
+    return result
+
+
+def main(argv=None):
+    parser = Parser(prog="outcome-canary-receipt-verify")
+    parser.add_argument("report")
+    parser.add_argument("observations")
+    parser.add_argument("receipt")
+    parser.add_argument("--enable-verification", action="store_true")
+    parser.add_argument("--json", action="store_true")
+    args = parser.parse_args(argv)
+    for path in (args.report, args.observations, args.receipt):
+        if not os.path.lexists(path):
+            print("outcome-canary-receipt-verify: input missing", file=sys.stderr)
+            return NO_INPUT
+    result = verify_receipt(
+        args.report, args.observations, args.receipt, args.enable_verification
+    )
+    if args.json:
+        print(json.dumps(result, sort_keys=True))
+    elif result["status"] == "VERIFIED":
+        print(f"Canary decision receipt: VERIFIED ({result['verdict']})")
+        print(f"  sha256={result['receipt_sha256']}")
+    else:
+        print(f"Canary decision receipt: REFUSED ({result['refusal_reason']})")
+    return OK if result["status"] == "VERIFIED" else REFUSED
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/tools/outcome-canary-receipt.py

@@ -0,0 +1,235 @@
+#!/usr/bin/env python3
+"""Create one portable, source-bound canary decision receipt."""
+import argparse
+import hashlib
+import importlib.util
+import json
+import os
+import pathlib
+import stat
+import sys
+import tempfile
+
+OK, REFUSED, USAGE, NO_INPUT = 0, 3, 64, 66
+DOMAIN = "loki-outcome-canary-decision-receipt/v1"
+MAX_BYTES = 5 * 1024 * 1024
+
+
+class Parser(argparse.ArgumentParser):
+    def error(self, message):
+        self.print_usage(sys.stderr)
+        self.exit(USAGE, f"{self.prog}: error: {message}\n")
+
+
+def _load_tool(filename, module_name):
+    path = pathlib.Path(__file__).with_name(filename)
+    spec = importlib.util.spec_from_file_location(module_name, path)
+    if spec is None or spec.loader is None:
+        raise RuntimeError("installed tool dependency is unavailable")
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module
+
+
+def _sha256(data):
+    return hashlib.sha256(data).hexdigest()
+
+
+def _read_named_regular(path):
+    flags = os.O_RDONLY
+    if hasattr(os, "O_NOFOLLOW"):
+        flags |= os.O_NOFOLLOW
+    descriptor = os.open(path, flags)
+    try:
+        before = os.fstat(descriptor)
+        if not stat.S_ISREG(before.st_mode):
+            raise ValueError("not_named_regular_file")
+        chunks = []
+        size = 0
+        while True:
+            chunk = os.read(descriptor, min(65536, MAX_BYTES + 1 - size))
+            if not chunk:
+                break
+            chunks.append(chunk)
+            size += len(chunk)
+            if size > MAX_BYTES:
+                raise ValueError("input_too_large")
+        after = os.fstat(descriptor)
+        if (before.st_dev, before.st_ino, before.st_size, before.st_mtime_ns) != (
+            after.st_dev, after.st_ino, after.st_size, after.st_mtime_ns
+        ):
+            raise ValueError("evidence_drift")
+        return b"".join(chunks)
+    finally:
+        os.close(descriptor)
+
+
+def _target_is_absent(path):
+    try:
+        os.lstat(path)
+    except FileNotFoundError:
+        return
+    raise ValueError("target_exists")
+
+
+def _publish_create_only(path, payload):
+    directory = os.path.dirname(os.path.abspath(path)) or "."
+    if not os.path.isdir(directory):
+        raise ValueError("parent_not_directory")
+    _target_is_absent(path)
+    temporary = None
+    try:
+        descriptor, temporary = tempfile.mkstemp(
+            prefix=f".{os.path.basename(path)}.", dir=directory
+        )
+        os.fchmod(descriptor, 0o600)
+        with os.fdopen(descriptor, "wb") as handle:
+            handle.write(payload)
+            handle.flush()
+            os.fsync(handle.fileno())
+        # Hard-link publication is atomic and refuses a target created concurrently.
+        os.link(temporary, path)
+        os.unlink(temporary)
+        temporary = None
+        directory_fd = os.open(directory, os.O_RDONLY)
+        try:
+            os.fsync(directory_fd)
+        finally:
+            os.close(directory_fd)
+    finally:
+        if temporary is not None:
+            try:
+                os.unlink(temporary)
+            except FileNotFoundError:
+                pass
+
+
+def create_receipt(report_path, observations_path, receipt_path, control_route,
+                   canary_percent=10.0, max_risk=.25, min_samples=5,
+                   min_lift_bps=1, enable_receipt=False):
+    """Reverify a decision and publish one immutable portable receipt."""
+    result = {
+        "receipt": DOMAIN,
+        "status": "REFUSED",
+        "verdict": None,
+        "receipt_sha256": None,
+        "refusal_reason": None,
+    }
+    if not enable_receipt:
+        result["refusal_reason"] = "receipt_not_enabled"
+        return result
+    try:
+        _target_is_absent(receipt_path)
+        evaluator = _load_tool(
+            "outcome-canary-evaluate.py", "outcome_canary_receipt_evaluator"
+        )
+        decision = evaluator.evaluate(
+            report_path, observations_path, control_route, canary_percent,
+            max_risk, min_samples, min_lift_bps, True,
+        )
+        if decision.get("refusal_reasons") or decision.get("verdict") not in {
+            "PROMOTE", "HOLD", "ROLLBACK"
+        }:
+            result["refusal_reason"] = "evaluation_refused"
+            return result
+
+        report_bytes = _read_named_regular(report_path)
+        observations_bytes = _read_named_regular(observations_path)
+        if _sha256(report_bytes) != decision["report_sha256"] or (
+            _sha256(observations_bytes) != decision["observations_sha256"]
+        ):
+            result["refusal_reason"] = "evidence_drift"
+            return result
+        report = json.loads(report_bytes.decode("utf-8"), object_pairs_hook=evaluator._object)
+        source = report.get("source") if isinstance(report, dict) else None
+        if not isinstance(source, str) or not source.strip():
+            result["refusal_reason"] = "source_unsafe_or_drifted"
+            return result
+        source_bytes = _read_named_regular(source)
+        if _sha256(source_bytes) != decision["source_sha256"]:
+            result["refusal_reason"] = "source_unsafe_or_drifted"
+            return result
+
+        receipt = {
+            "receipt": DOMAIN,
+            "evaluation": decision["evaluation"],
+            "report_sha256": decision["report_sha256"],
+            "source_sha256": decision["source_sha256"],
+            "observations_sha256": decision["observations_sha256"],
+            "policy": {
+                "control_route": decision["control_route"],
+                "canary_route": decision["canary_route"],
+                "canary_percent": decision["canary_percent"],
+                "max_risk": decision["max_risk"],
+                "min_samples": decision["min_samples"],
+                "min_lift_bps": decision["min_lift_bps"],
+            },
+            "control": decision["control"],
+            "canary": decision["canary"],
+            "accepted_delta_bps": decision["accepted_delta_bps"],
+            "verdict": decision["verdict"],
+        }
+        payload = (json.dumps(receipt, sort_keys=True, separators=(",", ":")) + "\n").encode()
+        if len(payload) > MAX_BYTES:
+            raise ValueError("receipt_too_large")
+        # Recheck all evidence immediately before irreversible create-only publication.
+        if _sha256(_read_named_regular(report_path)) != decision["report_sha256"] or (
+            _sha256(_read_named_regular(observations_path)) != decision["observations_sha256"]
+        ) or _sha256(_read_named_regular(source)) != decision["source_sha256"]:
+            result["refusal_reason"] = "evidence_drift"
+            return result
+        _publish_create_only(receipt_path, payload)
+        result.update({
+            "status": "RECORDED",
+            "verdict": decision["verdict"],
+            "receipt_sha256": _sha256(payload),
+        })
+    except FileNotFoundError:
+        result["refusal_reason"] = "input_missing"
+    except (OSError, ValueError, json.JSONDecodeError, UnicodeDecodeError) as exc:
+        reason = str(exc)
+        allowed = {
+            "target_exists", "parent_not_directory", "evidence_drift",
+            "not_named_regular_file", "input_too_large", "receipt_too_large",
+            "source_unsafe_or_drifted",
+        }
+        if isinstance(exc, FileExistsError):
+            reason = "target_exists"
+        result["refusal_reason"] = reason if reason in allowed else "unsafe_or_malformed_input"
+    return result
+
+
+def main(argv=None):
+    parser = Parser(prog="outcome-canary-receipt")
+    parser.add_argument("report")
+    parser.add_argument("observations")
+    parser.add_argument("receipt")
+    parser.add_argument("--enable-receipt", action="store_true")
+    parser.add_argument("--control-route", required=True)
+    parser.add_argument("--canary-percent", type=float, default=10.0)
+    parser.add_argument("--max-risk", type=float, default=.25)
+    parser.add_argument("--min-samples", type=int, default=5)
+    parser.add_argument("--min-lift-bps", type=int, default=1)
+    parser.add_argument("--json", action="store_true")
+    args = parser.parse_args(argv)
+    for path in (args.report, args.observations):
+        if not os.path.lexists(path):
+            print("outcome-canary-receipt: input missing", file=sys.stderr)
+            return NO_INPUT
+    result = create_receipt(
+        args.report, args.observations, args.receipt, args.control_route,
+        args.canary_percent, args.max_risk, args.min_samples,
+        args.min_lift_bps, args.enable_receipt,
+    )
+    if args.json:
+        print(json.dumps(result, sort_keys=True))
+    elif result["status"] == "RECORDED":
+        print(f"Canary decision receipt: RECORDED ({result['verdict']})")
+        print(f"  sha256={result['receipt_sha256']}")
+    else:
+        print(f"Canary decision receipt: REFUSED ({result['refusal_reason']})")
+    return OK if result["status"] == "RECORDED" else REFUSED
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())