loki-mode 9.22.9 → 9.22.11

package/README.md

@@ -399,6 +399,19 @@ honest verdict (VERIFIED / VERIFIED WITH GAPS / NOT VERIFIED), the key facts
 only when the receipt's own headline is VERIFIED. This is on by default whenever
 Loki opens or advises a PR; opt out with `LOKI_PROVEN_PR=0`.
 
+For a review-before-publish workflow, preparation and GitHub mutation are two
+explicit steps:
+
+```bash
+loki start owner/repo#42 --prepare-pr  # builds and writes exact title/body locally
+loki ship --publish                    # pushes that issue branch and opens the PR
+```
+
+The second command consumes `.loki/state/pr-title.txt` and
+`.loki/state/pr-body.md` byte-for-byte. Plain `loki ship`, previews, and default
+start paths remain non-publishing. A failed PR creation preserves both files and
+prints the exact remote-branch rollback command.
+
 An optional advisory status check (`loki: verified-completion`) maps the verdict
 to a GitHub check-run. It is opt-in (`LOKI_PROVEN_PR_CHECK=1`) and can never block
 a merge on its own. To make verified-completion blocking, add it as a required

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: Autonomous spec-driven build system with a built-in trust layer. It does not call work done until it is verified (RARV-C closure loop, 8 quality gates, completion council, verified-completion evidence gate). Triggers on "Loki Mode". Takes a spec (PRD, GitHub issue, OpenAPI doc, etc.) to deployed product with minimal human intervention. Provider-agnostic. Requires --dangerously-skip-permissions flag.
 ---
 
-# Loki Mode v9.22.9
+# Loki Mode v9.22.11
 
 **You are an autonomous agent. You make decisions. You do not ask questions. You do not stop.**
 
@@ -470,4 +470,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v9.22.9 | [Autonomi](https://www.autonomi.dev/) flagship product | ~410 lines core**
+**v9.22.11 | [Autonomi](https://www.autonomi.dev/) flagship product | ~410 lines core**

package/VERSION

@@ -1 +1 @@
-9.22.9
+9.22.11

package/autonomy/issue-parser.sh

@@ -265,7 +265,7 @@ _gp_criteria_lines() {
 }
 
 # write_journey_context <owner> <repo> <number> <title> <url> <acceptance>
-#                       <files> <type> <priority>
+#                       <files> <type> <priority> [journey-start-epoch]
 #
 # Writes .loki/state/issue-context.json (feature 2: the exact acceptance context)
 # and .loki/state/journey-plan.json (feature 3: the early machine-readable
@@ -277,6 +277,7 @@ _gp_criteria_lines() {
 write_journey_context() {
     local owner="$1" repo="$2" number="$3" title="$4" url="$5"
     local acceptance="$6" files="$7" issue_type="$8" priority="$9"
+    local journey_started_epoch="${10:-}"
 
     local state_dir="${LOKI_DIR:-.loki}/state"
     mkdir -p "$state_dir" 2>/dev/null || return 0
@@ -348,6 +349,34 @@ write_journey_context() {
         rm -f "$plan_tmp" 2>/dev/null || true
     fi
 
+    # The parsed, acceptance-bound plan is the first useful result: it tells the
+    # user what Loki understood and what it will attempt before provider latency
+    # begins. Measure it honestly from command entry when the caller supplied a
+    # valid epoch. This is explicitly a proposed plan, never represented as a
+    # verified patch. Later first-artifact evidence supersedes it in receipts.
+    case "$journey_started_epoch" in
+        ''|*[!0-9]*) ;;
+        *)
+            local now_epoch elapsed first_tmp
+            now_epoch="$(date +%s)"
+            elapsed=$((now_epoch >= journey_started_epoch ? now_epoch - journey_started_epoch : 0))
+            first_tmp="$state_dir/.first-useful-result.$$.json"
+            if jq -n --argjson seconds "$elapsed" \
+                --arg generated_at "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
+                '{schema_version:"1.0", kind:"proposed_solution_plan",
+                  seconds_to_first_result:$seconds,
+                  under_60_seconds:($seconds < 60),
+                  verified_patch:false, generated_at:$generated_at,
+                  artifact:".loki/state/journey-plan.json"}' \
+                > "$first_tmp" 2>/dev/null; then
+                mv -f "$first_tmp" "$state_dir/first-useful-result.json" 2>/dev/null \
+                    || rm -f "$first_tmp"
+            else
+                rm -f "$first_tmp" 2>/dev/null || true
+            fi
+            ;;
+    esac
+
     return 0
 }
 

package/autonomy/lib/proof-generator.py

@@ -1031,13 +1031,24 @@ def _collect_journey(loki_dir):
         },
     }
 
-    # Time to first useful result. Reuses the number run.sh already writes; we
-    # do not add a second writer and we never synthesize the value.
+    # Time to first useful result. Prefer the first verified code artifact when
+    # one exists. Before that, issue mode can truthfully report its acceptance-
+    # bound proposed plan, explicitly labelled as NOT a verified patch.
     fa = _read_json(os.path.join(state, "first-artifact.json"), default=None)
     if isinstance(fa, dict):
         v = fa.get("seconds_to_first_artifact")
         if isinstance(v, (int, float)) and v >= 0:
             out["time_to_first_result_sec"] = int(v)
+            out["first_result_kind"] = "code_change"
+            out["first_result_verified_patch"] = True
+    else:
+        fr = _read_json(os.path.join(state, "first-useful-result.json"), default=None)
+        if isinstance(fr, dict):
+            v = fr.get("seconds_to_first_result")
+            if isinstance(v, (int, float)) and v >= 0:
+                out["time_to_first_result_sec"] = int(v)
+                out["first_result_kind"] = str(fr.get("kind") or "")
+                out["first_result_verified_patch"] = bool(fr.get("verified_patch") is True)
 
     # Human interventions. Fills the socket trust_trajectory.py:145 already
     # reads and documents as "no per-run counter persisted today". Absent file

package/autonomy/lib/proof-pr.sh

@@ -220,7 +220,12 @@ def main():
 
         ttfr = journey.get("time_to_first_result_sec")
         if isinstance(ttfr, int):
-            _line("| Time to first result | " + str(ttfr) + "s |")
+            first_kind = str(journey.get("first_result_kind") or "").strip()
+            if first_kind == "proposed_solution_plan":
+                _line("| First useful result | proposed plan in " + str(ttfr)
+                      + "s (not a verified patch) |")
+            else:
+                _line("| Time to first result | " + str(ttfr) + "s |")
 
         ivs = journey.get("interventions")
         if isinstance(ivs, int):

package/autonomy/loki

@@ -4617,6 +4617,89 @@ cmd_next() {
 }
 
 # loki ship -- the build is done, now get it out (review + PR advice in one flow).
+# Publish an already-prepared PR. This is deliberately a separate, explicit
+# mutation boundary from the default print-only `loki ship` flow. Preparation
+# writes the exact reviewed title/body under .loki/state; publishing consumes
+# those bytes without rebuilding, re-rendering, or inventing evidence.
+publish_prepared_pr() {
+    local state_dir="${LOKI_DIR:-.loki}/state"
+    local title_file="$state_dir/pr-title.txt"
+    local body_file="$state_dir/pr-body.md"
+    local pr_state="$state_dir/pr.json"
+
+    if [ ! -s "$title_file" ] || [ ! -s "$body_file" ]; then
+        echo "Error: no prepared PR found. Run 'loki start <issue> --prepare-pr' first." >&2
+        return 2
+    fi
+    if ! command -v git >/dev/null 2>&1 || ! git rev-parse --git-dir >/dev/null 2>&1; then
+        echo "Error: publishing a prepared PR requires a git repository." >&2
+        return 2
+    fi
+    if ! command -v gh >/dev/null 2>&1; then
+        echo "Error: publishing a prepared PR requires the GitHub CLI (gh)." >&2
+        return 2
+    fi
+
+    local branch base title existing_url pr_url tmp_state
+    branch="$(git rev-parse --abbrev-ref HEAD 2>/dev/null || true)"
+    case "$branch" in
+        ""|HEAD|main|master)
+            echo "Error: refusing to publish prepared work from '$branch'; check out its issue branch." >&2
+            return 2 ;;
+    esac
+    if ! git remote get-url origin >/dev/null 2>&1; then
+        echo "Error: publishing a prepared PR requires an 'origin' remote." >&2
+        return 2
+    fi
+    title="$(cat "$title_file")"
+    if [ -z "$title" ]; then
+        echo "Error: prepared PR title must be one non-empty line." >&2
+        return 2
+    fi
+    case "$title" in
+        *$'\n'*)
+            echo "Error: prepared PR title must be one non-empty line." >&2
+            return 2 ;;
+    esac
+
+    # Idempotence: an interrupted/retried publish reuses the open PR and never
+    # creates a duplicate. This read-only query occurs only after --publish.
+    existing_url="$(gh pr list --head "$branch" --state open --json url --jq '.[0].url // empty' 2>/dev/null || true)"
+    if [ -n "$existing_url" ]; then
+        pr_url="$existing_url"
+    else
+        # Do not attempt PR creation after a failed push. The prepared body
+        # remains local and byte-identical, so the operator can fix auth/network
+        # and retry. A successful push followed by create failure is reversible
+        # with the exact command printed below.
+        if ! git push --set-upstream origin "$branch"; then
+            echo "Error: branch push failed; prepared PR files were preserved." >&2
+            return 1
+        fi
+        if ! pr_url="$(gh pr create --head "$branch" --title "$title" --body-file "$body_file")"; then
+            echo "Error: PR creation failed; prepared PR files were preserved." >&2
+            echo "Rollback remote branch: git push origin --delete $branch" >&2
+            return 1
+        fi
+        pr_url="$(printf '%s\n' "$pr_url" | grep -Eo 'https://[^[:space:]]+' | head -1)"
+        if [ -z "$pr_url" ]; then
+            echo "Error: gh reported success without a PR URL; prepared files were preserved." >&2
+            echo "Inspect: gh pr list --head $branch" >&2
+            return 1
+        fi
+    fi
+
+    mkdir -p "$state_dir" || return 1
+    tmp_state="$pr_state.tmp.$$"
+    if command -v jq >/dev/null 2>&1; then
+        jq -n --arg url "$pr_url" --arg branch "$branch" --arg title "$title" \
+            '{state:"created", url:$url, branch:$branch, title:$title,
+              body_path:".loki/state/pr-body.md"}' > "$tmp_state" \
+            && mv "$tmp_state" "$pr_state" || { rm -f "$tmp_state"; return 1; }
+    fi
+    echo "PR ready: $pr_url"
+}
+
 # Composes existing surfaces only: optionally opens the running app (--preview),
 # runs the SAME diff quality gates as cmd_review, and on a clean-enough result
 # prints the exact branch-aware PR command via the shared print_pr_advice (the
@@ -4626,6 +4709,7 @@ cmd_next() {
 # and points at the findings instead of advising a PR.
 cmd_ship() {
     local do_preview=false
+    local publish=false
     local review_args=()
     # Tracks whether the caller passed an explicit scope flag (--staged, --since,
     # ...). Passthrough flags like --yes/--severity do NOT set this, so they do
@@ -4637,6 +4721,7 @@ cmd_ship() {
                 echo -e "${BOLD}Loki Mode -- finish the build: review, then PR advice (print-only)${NC}"
                 echo ""
                 echo "Usage: loki ship [--preview] [--yes] [review options]"
+                echo "       loki ship --publish"
                 echo ""
                 echo "Runs the natural finish line in one command:"
                 echo "  1. (with --preview) opens the app Loki built and started locally"
@@ -4645,13 +4730,15 @@ cmd_ship() {
                 echo "  3. on a clean-enough result, PRINTS the exact branch-aware"
                 echo "     git push + pull-request command for YOU to run"
                 echo ""
-                echo "It is advisory only for shipping: it NEVER runs 'git push', NEVER"
-                echo "creates a PR, and NEVER deploys. You run the printed command."
+                echo "The default flow is advisory only: it NEVER runs 'git push' or"
+                echo "creates a PR. --publish is the explicit mutation boundary: it"
+                echo "publishes the exact title/body previously written by --prepare-pr."
                 echo "If review finds HIGH or CRITICAL findings it stops and points you"
                 echo "at the findings instead of advising a PR (exit code 1)."
                 echo ""
                 echo "Options:"
                 echo "  --preview    Open the running local app first (loki preview)"
+                echo "  --publish    Push the current issue branch and publish its prepared PR"
                 echo "  --yes, -y    Pass through to review (skip its confirmation prompt)"
                 echo "  --help, -h   Show this help and exit"
                 echo ""
@@ -4660,6 +4747,7 @@ cmd_ship() {
                 return 0
                 ;;
             --preview) do_preview=true ;;
+            --publish) publish=true ;;
             # Only a known set of NON-scope passthrough flags are exempt from
             # "explicit scope". Everything else the caller passes -- an explicit
             # scope flag (--staged/--since/...), a positional <file-or-dir>, or any
@@ -4689,6 +4777,15 @@ cmd_ship() {
         shift
     done
 
+    if [ "$publish" = true ]; then
+        if [ "$do_preview" = true ] || [ "${#review_args[@]}" -gt 0 ]; then
+            echo "Error: --publish cannot be combined with preview/review options." >&2
+            return 2
+        fi
+        publish_prepared_pr
+        return $?
+    fi
+
     # 1. Optional preview of the running local app. Only when an app-runner state
     #    file exists, so we never imply an app is running when it is not.
     if [ "$do_preview" = true ]; then
@@ -9694,6 +9791,12 @@ cmd_issue_view() {
 #===============================================================================
 
 cmd_run() {
+    # Wall-clock anchor for the issue journey. Captured before argument parsing,
+    # auth, or issue fetch so the first-result measurement includes the wait the
+    # user actually experiences. Exported only through the explicit writer call
+    # below; it does not alter runner/provider behavior.
+    local _issue_journey_started_epoch
+    _issue_journey_started_epoch="$(date +%s)"
     # v6.84.0: `loki run` is now a deprecated alias for `loki start <issue-ref>`.
     # When invoked directly (not via the unified start dispatcher), emit a
     # deprecation notice and a telemetry event so we can track adoption of the
@@ -10060,7 +10163,8 @@ cmd_run() {
             _gp_acc=$(extract_acceptance_criteria "$_gp_body" 2>/dev/null || true)
         fi
         write_journey_context "$_gp_owner" "$_gp_repo" "${number:-}" "$title" \
-            "$url" "$_gp_acc" "" "${issue_provider:-github}" "" 2>/dev/null || true
+            "$url" "$_gp_acc" "" "${issue_provider:-github}" "" \
+            "$_issue_journey_started_epoch" 2>/dev/null || true
     fi
 
     # Per-session locking (v6.4.0): export session ID so run.sh uses

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "9.22.9"
+__version__ = "9.22.11"
 
 # Expose the control app for easy import
 try: