loki-mode 9.25.2 → 9.26.3

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: Autonomous spec-driven build system with a built-in trust layer. It does not call work done until it is verified (RARV-C closure loop, 8 quality gates, completion council, verified-completion evidence gate). Triggers on "Loki Mode". Takes a spec (PRD, GitHub issue, OpenAPI doc, etc.) to deployed product with minimal human intervention. Provider-agnostic. Requires --dangerously-skip-permissions flag.
 ---
 
-# Loki Mode v9.25.2
+# Loki Mode v9.26.3
 
 **You are an autonomous agent. You make decisions. You do not ask questions. You do not stop.**
 
@@ -470,4 +470,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v9.25.2 | [Autonomi](https://www.autonomi.dev/) flagship product | ~410 lines core**
+**v9.26.3 | [Autonomi](https://www.autonomi.dev/) flagship product | ~410 lines core**

package/VERSION

@@ -1 +1 @@
-9.25.2
+9.26.3

package/autonomy/lib/config-map.sh

@@ -838,6 +838,106 @@ loki_config_generate_schema() {
 # refs, raw-secret literals (ERROR), and per-value validation failures. Returns
 # non-zero on ANY failure. Reads the file directly (format-aware) WITHOUT
 # exporting anything into the environment.
+# Walk a JSON/YAML config's OWN key set and echo any dotted key that is not a
+# member of LOKI_CONFIG_MAP, one per line. Used by validate only.
+#
+# Inert descriptive fields written by `loki init` (version/template/created) are
+# allowlisted: they carry no behavior, so erroring on them would fail a file the
+# product itself generated. Every other unmapped key is reported -- those are the
+# ones a user expects to change behavior and that are silently dropped instead.
+#
+# Container keys are not reported: in {"dashboard":{"port":1}} the key
+# "dashboard" is a parent of the mapped "dashboard.port", never a typo itself.
+# A leaf is what a user actually mistypes.
+loki_config_unknown_keys() {
+    local file="$1" fmt="$2"
+    command -v python3 >/dev/null 2>&1 || return 0
+
+    # YAML needs a parser. The rest of this file reaches for yq first, so do the
+    # same: convert to JSON via yq and let the JSON walk below handle it. That
+    # keeps detection working on a host with yq but no pyyaml (CI installs
+    # neither by default, and yq is the more common of the two here). Without
+    # either parser the walk no-ops and YAML validates as it did before -- a
+    # missing parser must not invent a verdict.
+    local scratch_json=""
+    if [ "$fmt" = "yaml" ] && ! python3 -c "import yaml" >/dev/null 2>&1; then
+        command -v yq >/dev/null 2>&1 || return 0
+        scratch_json="$(mktemp "${TMPDIR:-/tmp}/loki-cfg-uk.XXXXXX")" || return 0
+        if ! yq eval -o=json '.' "$file" > "$scratch_json" 2>/dev/null; then
+            rm -f "$scratch_json"; return 0
+        fi
+        file="$scratch_json"; fmt="json"
+    fi
+
+    local map_str="" mapping
+    for mapping in "${LOKI_CONFIG_MAP[@]}"; do map_str+="${mapping%%:*}"$'\n'; done
+
+    _LOKI_UK_FILE="$file" _LOKI_UK_FMT="$fmt" _LOKI_UK_MAP="$map_str" python3 -c '
+import json, os, sys
+
+path = os.environ["_LOKI_UK_FILE"]
+fmt = os.environ["_LOKI_UK_FMT"]
+
+known = set()
+for line in os.environ.get("_LOKI_UK_MAP", "").splitlines():
+    line = line.strip()
+    if line:
+        known.add(line)
+
+# Parents of a mapped key are containers, not typos.
+containers = set()
+for k in known:
+    parts = k.split(".")
+    for i in range(1, len(parts)):
+        containers.add(".".join(parts[:i]))
+
+# Inert metadata emitted by `loki init` -- descriptive, never behavioral.
+ALLOW = {"version", "template", "created", "name", "description"}
+
+try:
+    if fmt == "json":
+        with open(path) as f:
+            data = json.load(f)
+    else:
+        try:
+            import yaml
+        except ImportError:
+            sys.exit(0)
+        with open(path) as f:
+            data = yaml.safe_load(f)
+except Exception:
+    # A malformed file is out of scope here -- the parsers report it.
+    sys.exit(0)
+
+if not isinstance(data, dict):
+    sys.exit(0)
+
+unknown = []
+
+def walk(node, prefix):
+    for key, val in node.items():
+        dotted = prefix + key if not prefix else prefix + "." + key
+        if isinstance(val, dict) and val:
+            # Recurse into containers; report the leaves inside them.
+            walk(val, dotted)
+            continue
+        if dotted in known or dotted in containers or dotted in ALLOW:
+            continue
+        unknown.append(dotted)
+
+walk(data, "")
+for u in unknown:
+    print(u)
+' 2>/dev/null
+    # Always succeed: this helper reports keys on stdout, and a parser that
+    # cannot run must degrade to "nothing to report" rather than failing the
+    # caller. The `[ -n ... ] && rm` form would return non-zero on the common
+    # empty-scratch path and discard the captured output, so clean up with an
+    # unconditional rm on a possibly-empty path instead.
+    rm -f "${scratch_json:-/dev/null}" 2>/dev/null
+    return 0
+}
+
 loki_config_validate_file() {
     local path="$1"
     local rc=0
@@ -907,6 +1007,32 @@ loki_config_validate_file() {
         _loki_cfg_collect_pairs "$path" "$fmt"
     )"
 
+    # Unknown-key detection for JSON/YAML.
+    #
+    # The extraction above walks LOKI_CONFIG_MAP and pulls each KNOWN path out of
+    # the file, so a key the map does not contain is never emitted and cannot
+    # reach the pair loop below -- a misspelled key validated clean while the
+    # same typo in .env format was correctly rejected. Detection therefore has to
+    # walk the FILE's own key set and diff it against the map, which is what this
+    # block does. Kept in validate only: the load/emit paths are unchanged, so a
+    # config that runs today still runs.
+    case "$fmt" in
+        (json|yaml)
+            local unknown_keys
+            unknown_keys="$(loki_config_unknown_keys "$path" "$fmt")" || unknown_keys=""
+            if [ -n "$unknown_keys" ]; then
+                local ukey
+                while IFS= read -r ukey; do
+                    [ -n "$ukey" ] || continue
+                    printf 'loki: config validate: ERROR unknown key %s (not a recognized config key -- typo?)\n' "$ukey" >&2
+                    rc=1
+                done <<UNKNOWN_KEYS
+$unknown_keys
+UNKNOWN_KEYS
+            fi
+            ;;
+    esac
+
     local env_var value expanded
     while IFS=$'\t' read -r env_var value; do
         [ -n "$env_var" ] || continue

package/autonomy/verify.sh

@@ -69,6 +69,151 @@ VERIFY_EXIT_ERROR=3
 VERIFY_SCHEMA_VERSION="1.0"
 
 # Resolve tool version from the VERSION file shipped alongside the repo.
+# ---------------------------------------------------------------------------
+# LLM review stage (v9.26.0). Phase 2 of the spec; the deterministic MVP shipped
+# without it and the evidence document said so honestly.
+#
+# WHY IT LIVES HERE AND NOT IN THE COUNCIL. This module deliberately does not
+# source completion-council.sh (see the header): those functions are welded to
+# the iteration loop's globals and diff base. Instead this calls the same
+# raw-SDK bridge the council uses under the hood -- `loki internal sdk-judge`,
+# a pure-HTTPS judge that prints JSON on exit 0 and NOTHING on any failure.
+#
+# FAIL-CLOSED, NEVER FAIL-QUIET. Every failure path records an honest status
+# (unavailable, with the reason) rather than a pass. A verifier that reports
+# "reviewed, no issues" when the reviewer never ran is worse than one that
+# never had a reviewer.
+#
+# ADVISORY IN THIS RELEASE. The verdict and exit code are computed exactly as
+# before; this only adds a section to the evidence document. `loki verify`
+# exits 0/1/2 on the same conditions it always did, so a CI job gating on exit
+# 0 sees no behavior change. Verdict influence is a separate, later flag.
+_verify_llm_review() {
+    local out_dir="$1" merge_base="$2" head_sha="$3"
+
+    if [ "${VERIFY_NO_LLM:-0}" = "1" ]; then
+        printf '%s\t%s\t%s\t%s\t%s\n' "skipped" "--no-llm requested" "" "0" ""
+        return 0
+    fi
+
+    local loki_bin
+    loki_bin="$(command -v loki 2>/dev/null || true)"
+    if [ -z "$loki_bin" ]; then
+        printf '%s\t%s\t%s\t%s\t%s\n' "unavailable" "the loki CLI is not on PATH, so the SDK judge bridge cannot be reached" "" "0" ""
+        return 0
+    fi
+
+    # Bound the diff. A judge prompt is an input cost and an unbounded diff is
+    # both expensive and useless -- past some size the model cannot reason about
+    # it anyway. The cap is explicit in the reason string when it bites, so a
+    # truncated review is never silently presented as a whole-diff review.
+    local diff_cap="${LOKI_VERIFY_LLM_DIFF_BYTES:-200000}"
+    local diff_file; diff_file="$(mktemp "${TMPDIR:-/tmp}/loki-verify-llm-diff.XXXXXX")" || {
+        printf '%s\t%s\t%s\t%s\t%s\n' "unavailable" "could not create a temp file for the diff" "" "0" ""
+        return 0
+    }
+    git diff --function-context "${merge_base}..${head_sha}" > "$diff_file" 2>/dev/null || true
+    local diff_bytes; diff_bytes=$(wc -c < "$diff_file" 2>/dev/null | tr -d ' ')
+    diff_bytes="${diff_bytes:-0}"
+    local truncated=""
+    if [ "$diff_bytes" -gt "$diff_cap" ]; then
+        head -c "$diff_cap" "$diff_file" > "${diff_file}.cut" 2>/dev/null && mv -f "${diff_file}.cut" "$diff_file"
+        truncated=" (diff truncated to ${diff_cap} bytes of ${diff_bytes})"
+    fi
+    if [ "$diff_bytes" -eq 0 ]; then
+        rm -f "$diff_file" 2>/dev/null || true
+        printf '%s\t%s\t%s\t%s\t%s\n' "skipped" "no diff to review between the merge base and HEAD" "" "0" ""
+        return 0
+    fi
+
+    local pf sf
+    pf="$(mktemp "${TMPDIR:-/tmp}/loki-verify-llm-prompt.XXXXXX")" || { rm -f "$diff_file"; return 0; }
+    sf="$(mktemp "${TMPDIR:-/tmp}/loki-verify-llm-schema.XXXXXX")" || { rm -f "$diff_file" "$pf"; return 0; }
+
+    # Context first: the diff is the bulk of the prompt and identical across any
+    # retry, so leading with it keeps the cacheable prefix stable.
+    {
+        printf 'Review this diff for correctness defects only.\n\n'
+        cat "$diff_file"
+        printf '\n\nYou are a code reviewer on a verification service. Report ONLY defects you can point at in this diff:\n'
+        printf -- '- a bug that produces a wrong result or a crash, with the input that triggers it\n'
+        printf -- '- a security hole reachable from untrusted input\n'
+        printf -- '- data loss or corruption\n\n'
+        printf 'Do NOT report style, naming, formatting, test coverage, or speculative refactors.\n'
+        printf 'If the diff has no such defect, return an empty findings array. An empty result is a\n'
+        printf 'legitimate and common answer; do not invent a finding to appear useful.\n'
+    } > "$pf"
+
+    cat > "$sf" <<'SCHEMA'
+{
+  "type": "object",
+  "properties": {
+    "summary": { "type": "string" },
+    "findings": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "properties": {
+          "severity": { "type": "string", "enum": ["critical", "high", "medium", "low"] },
+          "file": { "type": "string" },
+          "message": { "type": "string" },
+          "why_it_breaks": { "type": "string" }
+        },
+        "required": ["severity", "message", "why_it_breaks"]
+      }
+    }
+  },
+  "required": ["summary", "findings"]
+}
+SCHEMA
+
+    model="${LOKI_VERIFY_LLM_MODEL:-claude-sonnet-5}"
+    local to_s="${LOKI_VERIFY_LLM_TIMEOUT_S:-120}"
+    local wrap=""
+    if command -v timeout >/dev/null 2>&1; then wrap="timeout $(( to_s + 15 ))"
+    elif command -v gtimeout >/dev/null 2>&1; then wrap="gtimeout $(( to_s + 15 ))"; fi
+
+    local out rc=0
+    out="$($wrap "$loki_bin" internal sdk-judge \
+        --prompt-file "$pf" --schema-file "$sf" \
+        --model "$model" --effort high \
+        --timeout-ms "$(( to_s * 1000 ))" 2>/dev/null)" || rc=$?
+    rm -f "$diff_file" "$pf" "$sf" 2>/dev/null || true
+
+    if [ "$rc" -ne 0 ] || [ -z "$out" ]; then
+        printf '%s\t%s\t%s\t%s\t%s\n' "unavailable" "the SDK judge returned no result (no API key, transport failure, or timeout)${truncated}" "" "0" "$model"
+        return 0
+    fi
+
+    # Parse defensively: a malformed payload is "unavailable", never a pass.
+    local parsed
+    parsed="$(printf '%s' "$out" | python3 -c '
+import json, sys
+try:
+    d = json.load(sys.stdin)
+    fs = d.get("findings") or []
+    if not isinstance(fs, list):
+        raise ValueError("findings is not a list")
+    print("%d\t%s" % (len(fs), (d.get("summary") or "").replace("\t", " ").replace("\n", " ")[:300]))
+except Exception as exc:
+    print("ERR\t%s" % type(exc).__name__)
+' 2>/dev/null)" || parsed="ERR\tparse"
+
+    case "$parsed" in
+        ERR*)
+            printf '%s\t%s\t%s\t%s\t%s\n' "unavailable" "the SDK judge returned a payload that did not parse${truncated}" "" "0" "$model" ;;
+        *)
+            findings_n="${parsed%%\t*}"
+            summary="${parsed#*\t}"
+            printf '%s\t%s\t%s\t%s\t%s\n' "reviewed" "" "$summary" "$findings_n" "$model"
+            # Keep the raw payload beside the evidence document so a reader can
+            # check the review rather than take the summary on faith.
+            printf '%s' "$out" > "${out_dir}/llm-review.json" 2>/dev/null || true
+            ;;
+    esac
+    return 0
+}
+
 _verify_tool_version() {
     local here
     here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
@@ -1917,6 +2062,23 @@ verify_emit_evidence() {
     repo_name="$(git config --get remote.origin.url 2>/dev/null | sed -E 's#.*[:/]([^/]+/[^/]+)(\.git)?$#\1#' || echo "local")"
     [ -z "$repo_name" ] && repo_name="local"
 
+    # LLM review (advisory this release: it does not change VERIFY_VERDICT or
+    # VERIFY_EXIT, both already computed above).
+    local _llm_line _llm_status _llm_reason _llm_summary _llm_n _llm_model
+    _llm_line="$(_verify_llm_review "$out_dir" "${VERIFY_MERGE_BASE:-}" "${VERIFY_HEAD_SHA:-HEAD}" 2>/dev/null || true)"
+    _llm_status="$(printf '%s' "$_llm_line" | cut -f1)"
+    _llm_reason="$(printf '%s' "$_llm_line" | cut -f2)"
+    _llm_summary="$(printf '%s' "$_llm_line" | cut -f3)"
+    _llm_n="$(printf '%s' "$_llm_line" | cut -f4)"
+    _llm_model="$(printf '%s' "$_llm_line" | cut -f5)"
+    [ -n "$_llm_status" ] || _llm_status="unavailable"
+    [ -n "$_llm_n" ] || _llm_n=0
+
+    _V_LLM_STATUS="$_llm_status" \
+    _V_LLM_REASON="$_llm_reason" \
+    _V_LLM_SUMMARY="$_llm_summary" \
+    _V_LLM_N="$_llm_n" \
+    _V_LLM_MODEL="$_llm_model" \
     _VERIFY_OUT_DIR="$out_dir" \
     _VERIFY_FINDINGS="$_VERIFY_FINDINGS_FILE" \
     _VERIFY_GATES="$_VERIFY_GATES_FILE" \
@@ -2019,9 +2181,21 @@ doc = {
     },
     "deterministic_gates": gates,
     "llm_review": {
-        "status": "skipped",
-        "reason": "deterministic-only MVP (30-day cut); single-reviewer LLM stage and blind council are deferred to Phase 2",
+        # status is one of: reviewed | skipped | unavailable.
+        # "unavailable" is deliberately NOT "skipped": a reviewer that could not
+        # run is a different fact from one that was not asked to, and collapsing
+        # them would let a broken key read as a clean pass.
+        "status": os.environ.get("_V_LLM_STATUS", "unavailable"),
+        "reason": os.environ.get("_V_LLM_REASON", "") or None,
+        "summary": os.environ.get("_V_LLM_SUMMARY", "") or None,
+        "finding_count": int(os.environ.get("_V_LLM_N", "0") or 0),
+        "model": os.environ.get("_V_LLM_MODEL", "") or None,
+        # An LLM review is not reproducible the way a runner exit code is, and
+        # the document says so rather than implying determinism it lacks.
         "reproducible": False,
+        # Advisory in this release: recorded, but never folded into the verdict
+        # or the exit code. Promoting it is a separate, flagged change.
+        "affects_verdict": False,
     },
     "findings": findings,
     "suppressed": [],
@@ -2102,7 +2276,15 @@ lines.append("# Autonomi Verify report")
 lines.append("")
 lines.append("Verdict: **%s** (exit %d)" % (doc["verdict"], doc["exit_code"]))
 lines.append("")
-lines.append("Tool: loki verify %s  |  deterministic-only MVP (no LLM review)" % doc["produced_by"]["tool_version"])
+_llm = doc.get("llm_review") or {}
+_llm_status = _llm.get("status", "unavailable")
+if _llm_status == "reviewed":
+    _llm_note = "LLM review: %d finding(s)" % _llm.get("finding_count", 0)
+elif _llm_status == "skipped":
+    _llm_note = "LLM review: skipped"
+else:
+    _llm_note = "LLM review: unavailable"
+lines.append("Tool: loki verify %s  |  %s" % (doc["produced_by"]["tool_version"], _llm_note))
 lines.append("")
 s = doc["subject"]
 lines.append("## Subject")
@@ -2140,7 +2322,10 @@ else:
 lines.append("")
 lines.append("## LLM review")
 lines.append("")
-lines.append("Skipped: %s" % doc["llm_review"]["reason"])
+if _llm.get("reason"):
+    lines.append("LLM review not run: %s" % _llm["reason"])
+elif _llm_status == "reviewed" and _llm.get("summary"):
+    lines.append("LLM review: %s" % _llm["summary"])
 lines.append("")
 lines.append("Evidence JSON: %s" % ev_path)
 lines.append("")
@@ -2183,7 +2368,9 @@ OPTIONS:
     --block-on <list>  Comma list of severities that BLOCK.
                        Default: critical,high  (one notch looser than the
                        Loki build loop, which also blocks on medium).
-    --no-llm           Accepted for forward-compat; LLM is already off in MVP.
+    --no-llm           Skip the LLM review stage. The deterministic gates and the
+                       verdict are unchanged either way -- the review is advisory
+                       in this release and never alters the exit code.
     --json             Emit the evidence document to stdout so it can be piped
                        (`loki verify --json | jq .verdict`). The same document
                        is still written to <out>/evidence.json. The human
@@ -2793,6 +2980,9 @@ verify_main() {
             --block-on)
                 block_on="$(printf '%s' "${2:-}" | tr '[:upper:]' '[:lower:]')"; shift 2 ;;
             --no-llm)
+                # Was a no-op accepted "for forward-compat" while no LLM stage
+                # existed. Now it does what its name always implied.
+                VERIFY_NO_LLM=1
                 shift ;;
             --json)
                 # Emit the evidence document to STDOUT so a caller can pipe it.

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "9.25.2"
+__version__ = "9.26.3"
 
 # Expose the control app for easy import
 try:

package/docs/COMPETITIVE-NEXT-10.md

@@ -0,0 +1,193 @@
+# The next items vs Factory.ai and 8090
+
+Written 2026-09-09. Every item below cites a file:line, a command output, or a
+fetched URL. Items that research proposed but that turned out to be **already
+shipped** are listed at the bottom under "Not items" with the evidence, because
+a plan that re-builds working code is worse than a shorter plan.
+
+There are **seven** real items, not ten. Three of the research's candidates were
+already implemented, and two more are architecturally unavailable to Loki as
+designed. Padding to ten would mean inventing work.
+
+---
+
+## What the market actually rewards
+
+Both competitors lead with **governance, not speed**. Factory.ai ($150M Series C,
+Apr 2026) sells fleets of droids under "engineers governing how much autonomy
+each workflow receives". 8090 ($135M Series A, EY partnership) sells a "governed
+multiplayer platform under human-led oversight".
+
+Loki's wedge is the same shape and sharper: **the only agent that hands you a
+receipt you can check yourself.** The items below are ranked by how much each
+one strengthens a claim a buyer can verify without trusting us.
+
+---
+
+## 1. Surface the evidence the receipt already holds
+
+**Status: the computation exists; the presentation does not.**
+
+`autonomy/lib/proof-generator.py` already computes, per run:
+
+- the exogenous-vs-advisory gate split (`:291-307`) -- which gates are
+  agent-independent and which are model-authored, fail-closed on unknown gates
+- files changed and a stat-level diff hash (`:910-917`)
+- per-run efficiency cost, shared with the benchmark adapters so both compute it
+  identically (`:39`, `:93-94`)
+
+None of it reaches the top of the receipt. A reader has to know it is in there.
+
+This is the highest-value item because the research validated it from the
+outside: Factory users complain about false-green runs and untrustworthy model
+attribution. Those complaints describe exactly the fields Loki already has and
+does not show.
+
+**Do:** promote to the receipt header -- gate counts split exogenous/advisory,
+files changed, tokens and turns, dispatched model per iteration, per-run cost.
+No new measurement, no new dependency.
+
+**Verify:** a receipt from a real run displays all six without opening the JSON.
+
+---
+
+## 2. Make the machine contract discoverable
+
+**Status: the contract exists and is documented; it is invisible where a user
+would look.**
+
+`docs/exit-codes.md` documents a genuinely good tiered contract: with
+`LOKI_DURABLE_STATE=1`, `loki start` distinguishes "failed the quality gate"
+from "crashed" -- written for a Kubernetes Job or an ECS task. `loki verify` has
+its own documented contract (`docs/exit-codes.md:53`).
+
+But `loki start --help` mentions `LOKI_DURABLE_STATE` **zero times** (measured).
+A CI author reads `--help`, sees "0 on success, nonzero on failure", and builds
+the coarse gate. Factory's `droid exec` advertises its exit codes in its own help
+output; ours are a doc you have to already know exists.
+
+**Do:** surface the durable contract in `loki start --help` and `loki verify
+--help`, with a one-line pointer to `docs/exit-codes.md`.
+
+**Note:** the research framed this as "Loki has no headless one-shot contract".
+That framing was wrong -- the contract exists. The defect is discoverability,
+which is a much cheaper fix.
+
+---
+
+## 3. Publish a measured kill-switch latency
+
+**Status: mechanism exists, number does not.**
+
+`check_human_intervention()` (`autonomy/run.sh`) implements PAUSE/STOP/INPUT.
+There is no stated termination window anywhere in `docs/` (measured: zero
+matches for "termination window" or "kill switch").
+
+An enterprise buyer asks "how fast can I stop it?" Factory answers with a number.
+"There is a stop signal" is not an answer.
+
+**Do:** measure worst-case latency from signal to process exit across the bash
+and Bun routes, publish the number, and add a test that fails if it regresses
+past the published bound.
+
+**Care:** publish the measured worst case, not the median. A number we beat 50%
+of the time is worse than no number.
+
+---
+
+## 4. Close the config-diagnostic gap for the remaining format
+
+**Status: shipped for JSON and .env in v9.26.1-9.26.2; YAML is parser-dependent.**
+
+`loki config validate` now reports unknown keys in JSON and `.env`. YAML
+detection requires pyyaml or `yq`; with neither installed it degrades quietly
+(correct -- a missing parser must not invent a verdict) but silently provides no
+detection.
+
+**Do:** either vendor a minimal YAML key-path scanner (the file already has
+`loki_yaml_fallback_extract` for the read path, so the precedent exists), or
+state the dependency in `loki config validate --help` so the gap is visible
+rather than silent.
+
+---
+
+## 5. `loki init` writes a config nothing reads
+
+**Status: confirmed defect, low blast radius.**
+
+`loki init` writes `.loki/loki.config.json` with six behavioral-looking keys --
+`provider`, `complexity`, `quality_gates`, `parallel_mode`, `dashboard` -- and
+labels it "project configuration" (`autonomy/loki:16598`). **Nothing reads any
+of them** (measured: 0 read sites for all five; the only `template` match is a
+comment). A user who sets `"quality_gates": false` is silently ignored.
+
+Note this is a *different file* from `.loki/config.json`, which is live and is
+read for `memory.disabled` and `otel_endpoint`.
+
+**Mitigated already:** as of v9.26.1, `loki config validate` on that file
+reports each dead key by name. The gap is now diagnosable rather than silent.
+
+**Do:** the honest minimum is to stop describing it as "project configuration".
+Removing the keys outright flips `tests/test-init-command.sh:141`, which asserts
+`'provider' in d` -- so that is a deliberate contract change, not a cleanup.
+
+---
+
+## 6. Verdict influence for the LLM review stage
+
+**Status: stage ships in v9.26.0/9.26.1; verdict influence deliberately deferred.**
+
+`llm_review` now runs by default and is recorded, but `affects_verdict` is
+`false`. That was the right call for the release -- flipping it would silently
+break anyone gating CI on exit 0.
+
+**Do:** measure the reviewer on real diffs, then promote verdict influence behind
+an explicit flag (`--llm-blocks`) before considering it as a default. The
+sequencing matters more than the speed: a reviewer that returns CONCERNS where
+deterministic-only returned VERIFIED is a breaking change to a published exit
+contract.
+
+---
+
+## 7. Make the deferred-suite gap structural
+
+**Status: process defect, cost two broken releases this cycle.**
+
+v9.25.0 and v9.25.1 both failed to publish because a check that guards the
+shipped artifact was **deferred by the fast tier** -- the only tier that runs
+before every push. v9.26.0 failed the same way on repo-wide ShellCheck.
+
+CLAUDE.md already states the rule ("a check that guards the shipped artifact must
+run in the FAST tier"). The rule is not enforced.
+
+**Do:** when a change touches a file, run the deferred suites that grep that file
+before pushing. This session did it by hand (16 suites for `verify.sh`, then
+repo-wide ShellCheck) and it caught the failure locally instead of one 25-minute
+CI cycle at a time. Make it a script rather than a habit.
+
+---
+
+## Not items (research proposed these; they are already shipped)
+
+- **Signed receipts default-off is a moat gated behind an env var.** The receipt
+  already states signature status explicitly in both directions
+  (`proof-generator.py:1808-1820`): SIGNED, or UNSIGNED with the honest line that
+  the integrity hash "does NOT prove who produced them, so this receipt trusts
+  its generator." That is the shippable version. Do **not** flip
+  `LOKI_PROOF_GPG_KEY` to default-on: with no key present it would either fail
+  the run or silently emit no signature, and the second is the false-green this
+  project exists to prevent. Key distribution is a founder decision.
+- **OTEL to a customer-owned collector.** Already implemented -- `otel_endpoint`
+  is persisted and read (`autonomy/loki:26755`, `:26828-26837`).
+- **A headless exec contract with documented exit codes.** Already exists via
+  `LOKI_DURABLE_STATE=1`; see item 2, which is the real (smaller) gap.
+
+## Architecturally unavailable, and worth saying so
+
+- **Per-command risk tiers** and a **hard command blocklist** ("cannot be
+  bypassed by approval", per Factory's docs). `autonomy/run.sh:515` documents
+  that `LOKI_ALLOWED_PATHS` "does NOT restrict provider-driven agent writes
+  (run.sh never sees them)". You cannot classify a command you never observe.
+  The only honest form is a sandbox-boundary blocklist, which is a different and
+  much larger piece of work. Attempting a partial version would ship a security
+  claim we cannot keep.

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 The flagship product of [Autonomi](https://www.autonomi.dev/). Loki Mode is a spec-driven autonomous builder with a built-in trust layer that takes any spec to a deployed product and verifies completion with evidence (quality gates plus a completion council), not just a "done" claim. Complete installation instructions for all platforms and use cases.
 
-**Version:** v9.25.2
+**Version:** v9.26.3
 
 ---
 

package/loki-ts/dist/loki.js

@@ -1,5 +1,5 @@
 // @bun
-var St=Object.create;var{getPrototypeOf:yt,defineProperty:jG,getOwnPropertyNames:bt}=Object;var ft=Object.prototype.hasOwnProperty;function _t($){return this[$]}var vt,ht,gt=($,X,Q)=>{var z=$!=null&&typeof $==="object";if(z){var Z=X?vt??=new WeakMap:ht??=new WeakMap,K=Z.get($);if(K)return K}Q=$!=null?St(yt($)):{};let J=X||!$||!$.__esModule?jG(Q,"default",{value:$,enumerable:!0}):Q;for(let q of bt($))if(!ft.call(J,q))jG(J,q,{get:_t.bind($,q),enumerable:!0});if(z)Z.set($,J);return J};var zq=($,X)=>()=>(X||$((X={exports:{}}).exports,X),X.exports);var mt=($)=>$;function ut($,X){this[$]=mt.bind(null,X)}var B1=($,X)=>{for(var Q in X)jG($,Q,{get:X[Q],enumerable:!0,configurable:!0,set:ut.bind(X,Q)})};var s=($,X)=>()=>($&&(X=$($=0)),X);var w5=import.meta.require;var YR={};B1(YR,{lokiDir:()=>h0,homeLokiDir:()=>HQ,findRepoRootForVersion:()=>AG,REPO_ROOT:()=>L1});import{resolve as h2,dirname as LG}from"path";import{fileURLToPath as dt}from"url";import{existsSync as Zq}from"fs";import{homedir as pt}from"os";function ct(){let $=VR;for(let X=0;X<6;X++){if(Zq(h2($,"VERSION"))&&Zq(h2($,"autonomy/run.sh")))return $;let Q=LG($);if(Q===$)break;$=Q}return h2(VR,"..","..","..")}function AG($){let X=$;for(let Q=0;Q<6;Q++){if(Zq(h2(X,"VERSION"))&&Zq(h2(X,"autonomy/run.sh")))return X;let z=LG(X);if(z===X)break;X=z}return h2($,"..","..","..")}function h0(){return process.env.LOKI_DIR??h2(process.cwd(),".loki")}function HQ(){return h2(pt(),".loki")}var VR,L1;var k1=s(()=>{VR=LG(dt(import.meta.url));L1=ct()});import{readFileSync as lt}from"fs";import{resolve as it,dirname as at}from"path";import{fileURLToPath as ot}from"url";function j9(){if(n3!==null)return n3;let $="9.25.2";if(typeof $==="string"&&$.length>0)return n3=$,n3;try{let X=at(ot(import.meta.url)),Q=AG(X);n3=lt(it(Q,"VERSION"),"utf-8").trim()}catch{n3="unknown"}return n3}var n3=null;var Kq=s(()=>{k1()});var GR={};B1(GR,{runOrThrow:()=>Ue,run:()=>$1,readStreamCapped:()=>Jq,commandVersion:()=>We,commandExists:()=>g5,ShellError:()=>CG,MAX_STDOUT_BYTES:()=>WR});async function Jq($,X=WR){let Q=$.getReader(),z=new TextDecoder,Z="",K=0;try{while(K<X){let{done:J,value:q}=await Q.read();if(J)break;if(!q)continue;if(K+=q.byteLength,K>X){let V=q.byteLength-(K-X);Z+=z.decode(q.subarray(0,V),{stream:!0});break}Z+=z.decode(q,{stream:!0})}Z+=z.decode()}finally{try{await Q.cancel()}catch{}Q.releaseLock()}return Z}async function $1($,X={}){let Q=Bun.spawn({cmd:[...$],stdout:"pipe",stderr:"pipe",env:X.env?{...process.env,...X.env}:process.env,cwd:X.cwd}),z,Z;if(X.timeoutMs&&X.timeoutMs>0)z=setTimeout(()=>{try{Q.kill("SIGTERM")}catch{}Z=setTimeout(()=>{try{Q.kill("SIGKILL")}catch{}},2000)},X.timeoutMs);try{let[K,J,q]=await Promise.all([Jq(Q.stdout),new Response(Q.stderr).text(),Q.exited]);return{stdout:K,stderr:J,exitCode:q}}finally{if(z)clearTimeout(z);if(Z)clearTimeout(Z)}}async function Ue($,X={}){let Q=await $1($,X);if(Q.exitCode!==0)throw new CG(`command failed (${Q.exitCode}): ${$.join(" ")}`,Q.exitCode,Q.stdout,Q.stderr);return Q}async function g5($){let X=He($),Q=await $1(["sh","-c",`command -v ${X}`],{timeoutMs:5000});if(Q.exitCode===0)return Q.stdout.trim()||null;return null}function He($){if(!/^[A-Za-z0-9._/-]+$/.test($))throw Error(`refused to shell-escape suspect token: ${$}`);return $}async function We($,X="--version"){if(!await g5($))return null;let z=await $1([$,X],{timeoutMs:5000});if(z.exitCode!==0)return null;return((z.stdout||z.stderr).split(/\r?\n/)[0]?.trim()??"")||null}var WR=16777216,CG;var y8=s(()=>{CG=class CG extends Error{message;exitCode;stdout;stderr;constructor($,X,Q,z){super($);this.message=$;this.exitCode=X;this.stdout=Q;this.stderr=z;this.name="ShellError"}}});function g2($){return Ge?"":$}var Ge,p0,$5,q1,L61,A1,f1,m5,r;var t7=s(()=>{Ge=(process.env.NO_COLOR??"").length>0;p0=g2("\x1B[0;31m"),$5=g2("\x1B[0;32m"),q1=g2("\x1B[1;33m"),L61=g2("\x1B[0;34m"),A1=g2("\x1B[0;36m"),f1=g2("\x1B[1m"),m5=g2("\x1B[2m"),r=g2("\x1B[0m")});import{existsSync as De}from"fs";async function Z2(){if(GQ!==void 0)return GQ;let $="/opt/homebrew/bin/python3.12";if(De($))return GQ=$,$;let X=await g5("python3.12");if(X)return GQ=X,X;let Q=await g5("python3");return GQ=Q,Q}async function I4($,X={}){let Q=await Z2();if(!Q)return{stdout:"",stderr:"python3 not found",exitCode:127};return $1([Q,"-c",$],X)}var GQ;var m2=s(()=>{y8()});var yR={};B1(yR,{runStatus:()=>oe});import{existsSync as u5,readFileSync as A9,readdirSync as RR,statSync as IR}from"fs";import{resolve as A5,basename as ge}from"path";import{homedir as me}from"os";function wR($){let X=Math.trunc($);if(X>=1e6)return`${(Math.trunc(X/1e6*10)/10).toFixed(1)}M`;if(X>=1000)return`${(Math.trunc(X/1000*10)/10).toFixed(1)}K`;return String(X)}function PR($,X,Q){if(X===0)return null;let z=Math.trunc($*100/X),Z=Math.trunc($*Vq/X);if(Z>Vq)Z=Vq;let K=Vq-Z,J=$5;if(z>=80)J=p0;else if(z>=50)J=q1;let q="=".repeat(Math.max(0,Z))+" ".repeat(Math.max(0,K)),V=wR($),Y=wR(X);return`  ${f1}${Q}${r} ${J}[${q}]${r} ${z}% (${V} / ${Y})`}async function de(){if(await g5("jq"))return!0;return process.stdout.write(`${p0}Error: jq is required but not installed.${r}
+var St=Object.create;var{getPrototypeOf:yt,defineProperty:jG,getOwnPropertyNames:bt}=Object;var ft=Object.prototype.hasOwnProperty;function _t($){return this[$]}var vt,ht,gt=($,X,Q)=>{var z=$!=null&&typeof $==="object";if(z){var Z=X?vt??=new WeakMap:ht??=new WeakMap,K=Z.get($);if(K)return K}Q=$!=null?St(yt($)):{};let J=X||!$||!$.__esModule?jG(Q,"default",{value:$,enumerable:!0}):Q;for(let q of bt($))if(!ft.call(J,q))jG(J,q,{get:_t.bind($,q),enumerable:!0});if(z)Z.set($,J);return J};var zq=($,X)=>()=>(X||$((X={exports:{}}).exports,X),X.exports);var mt=($)=>$;function ut($,X){this[$]=mt.bind(null,X)}var B1=($,X)=>{for(var Q in X)jG($,Q,{get:X[Q],enumerable:!0,configurable:!0,set:ut.bind(X,Q)})};var s=($,X)=>()=>($&&(X=$($=0)),X);var w5=import.meta.require;var YR={};B1(YR,{lokiDir:()=>h0,homeLokiDir:()=>HQ,findRepoRootForVersion:()=>AG,REPO_ROOT:()=>L1});import{resolve as h2,dirname as LG}from"path";import{fileURLToPath as dt}from"url";import{existsSync as Zq}from"fs";import{homedir as pt}from"os";function ct(){let $=VR;for(let X=0;X<6;X++){if(Zq(h2($,"VERSION"))&&Zq(h2($,"autonomy/run.sh")))return $;let Q=LG($);if(Q===$)break;$=Q}return h2(VR,"..","..","..")}function AG($){let X=$;for(let Q=0;Q<6;Q++){if(Zq(h2(X,"VERSION"))&&Zq(h2(X,"autonomy/run.sh")))return X;let z=LG(X);if(z===X)break;X=z}return h2($,"..","..","..")}function h0(){return process.env.LOKI_DIR??h2(process.cwd(),".loki")}function HQ(){return h2(pt(),".loki")}var VR,L1;var k1=s(()=>{VR=LG(dt(import.meta.url));L1=ct()});import{readFileSync as lt}from"fs";import{resolve as it,dirname as at}from"path";import{fileURLToPath as ot}from"url";function j9(){if(n3!==null)return n3;let $="9.26.3";if(typeof $==="string"&&$.length>0)return n3=$,n3;try{let X=at(ot(import.meta.url)),Q=AG(X);n3=lt(it(Q,"VERSION"),"utf-8").trim()}catch{n3="unknown"}return n3}var n3=null;var Kq=s(()=>{k1()});var GR={};B1(GR,{runOrThrow:()=>Ue,run:()=>$1,readStreamCapped:()=>Jq,commandVersion:()=>We,commandExists:()=>g5,ShellError:()=>CG,MAX_STDOUT_BYTES:()=>WR});async function Jq($,X=WR){let Q=$.getReader(),z=new TextDecoder,Z="",K=0;try{while(K<X){let{done:J,value:q}=await Q.read();if(J)break;if(!q)continue;if(K+=q.byteLength,K>X){let V=q.byteLength-(K-X);Z+=z.decode(q.subarray(0,V),{stream:!0});break}Z+=z.decode(q,{stream:!0})}Z+=z.decode()}finally{try{await Q.cancel()}catch{}Q.releaseLock()}return Z}async function $1($,X={}){let Q=Bun.spawn({cmd:[...$],stdout:"pipe",stderr:"pipe",env:X.env?{...process.env,...X.env}:process.env,cwd:X.cwd}),z,Z;if(X.timeoutMs&&X.timeoutMs>0)z=setTimeout(()=>{try{Q.kill("SIGTERM")}catch{}Z=setTimeout(()=>{try{Q.kill("SIGKILL")}catch{}},2000)},X.timeoutMs);try{let[K,J,q]=await Promise.all([Jq(Q.stdout),new Response(Q.stderr).text(),Q.exited]);return{stdout:K,stderr:J,exitCode:q}}finally{if(z)clearTimeout(z);if(Z)clearTimeout(Z)}}async function Ue($,X={}){let Q=await $1($,X);if(Q.exitCode!==0)throw new CG(`command failed (${Q.exitCode}): ${$.join(" ")}`,Q.exitCode,Q.stdout,Q.stderr);return Q}async function g5($){let X=He($),Q=await $1(["sh","-c",`command -v ${X}`],{timeoutMs:5000});if(Q.exitCode===0)return Q.stdout.trim()||null;return null}function He($){if(!/^[A-Za-z0-9._/-]+$/.test($))throw Error(`refused to shell-escape suspect token: ${$}`);return $}async function We($,X="--version"){if(!await g5($))return null;let z=await $1([$,X],{timeoutMs:5000});if(z.exitCode!==0)return null;return((z.stdout||z.stderr).split(/\r?\n/)[0]?.trim()??"")||null}var WR=16777216,CG;var y8=s(()=>{CG=class CG extends Error{message;exitCode;stdout;stderr;constructor($,X,Q,z){super($);this.message=$;this.exitCode=X;this.stdout=Q;this.stderr=z;this.name="ShellError"}}});function g2($){return Ge?"":$}var Ge,p0,$5,q1,L61,A1,f1,m5,r;var t7=s(()=>{Ge=(process.env.NO_COLOR??"").length>0;p0=g2("\x1B[0;31m"),$5=g2("\x1B[0;32m"),q1=g2("\x1B[1;33m"),L61=g2("\x1B[0;34m"),A1=g2("\x1B[0;36m"),f1=g2("\x1B[1m"),m5=g2("\x1B[2m"),r=g2("\x1B[0m")});import{existsSync as De}from"fs";async function Z2(){if(GQ!==void 0)return GQ;let $="/opt/homebrew/bin/python3.12";if(De($))return GQ=$,$;let X=await g5("python3.12");if(X)return GQ=X,X;let Q=await g5("python3");return GQ=Q,Q}async function I4($,X={}){let Q=await Z2();if(!Q)return{stdout:"",stderr:"python3 not found",exitCode:127};return $1([Q,"-c",$],X)}var GQ;var m2=s(()=>{y8()});var yR={};B1(yR,{runStatus:()=>oe});import{existsSync as u5,readFileSync as A9,readdirSync as RR,statSync as IR}from"fs";import{resolve as A5,basename as ge}from"path";import{homedir as me}from"os";function wR($){let X=Math.trunc($);if(X>=1e6)return`${(Math.trunc(X/1e6*10)/10).toFixed(1)}M`;if(X>=1000)return`${(Math.trunc(X/1000*10)/10).toFixed(1)}K`;return String(X)}function PR($,X,Q){if(X===0)return null;let z=Math.trunc($*100/X),Z=Math.trunc($*Vq/X);if(Z>Vq)Z=Vq;let K=Vq-Z,J=$5;if(z>=80)J=p0;else if(z>=50)J=q1;let q="=".repeat(Math.max(0,Z))+" ".repeat(Math.max(0,K)),V=wR($),Y=wR(X);return`  ${f1}${Q}${r} ${J}[${q}]${r} ${z}% (${V} / ${Y})`}async function de(){if(await g5("jq"))return!0;return process.stdout.write(`${p0}Error: jq is required but not installed.${r}
 `),process.stdout.write(`Install with:
 `),process.stdout.write(`  brew install jq    (macOS)
 `),process.stdout.write(`  apt install jq     (Debian/Ubuntu)
@@ -1334,4 +1334,4 @@ Set LOKI_LEGACY_BASH=1 to force the bash CLI for every command.
 `),2}case"start":{let{runStart:z}=await Promise.resolve().then(() => (Et(),Pt));return z(Q)}default:return process.stderr.write(`Unknown command: ${X}
 `),process.stderr.write(xt),2}}DR();process.on("SIGINT",()=>process.exit(130));process.on("SIGTERM",()=>process.exit(143));var X61=await $61(Bun.argv.slice(2));process.exit(X61);
 
-//# debugId=D041EDC92463BFEDF7B5C026608DA371
+//# debugId=9A71B209805E0B772494C9C8FABE742E

package/mcp/__init__.py

@@ -75,4 +75,4 @@ try:
 except ImportError:
     __all__ = ['mcp']
 
-__version__ = '9.25.2'
+__version__ = '9.26.3'

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "loki-mode",
   "mcpName": "io.github.asklokesh/loki-mode",
-  "version": "9.25.2",
+  "version": "9.26.3",
   "description": "Loki Mode by Autonomi. Autonomous spec-to-product system: takes a PRD, GitHub issue, OpenAPI/JSON/YAML, or one-line brief to a deployed app via the RARV-C closure loop with 8 quality gates. Provider-agnostic (Claude Code, OpenAI Codex, Cline, Aider, opencode).",
   "keywords": [
     "agent",

package/plugins/loki-mode/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "loki-mode",
   "displayName": "Loki Mode",
-  "version": "9.25.2",
+  "version": "9.26.3",
   "description": "Autonomous spec-to-product build system with a built-in trust layer (RARV-C closure loop, 8 quality gates, completion council). Ships Loki's spec-hardening, drift-detection, and deterministic PR verification commands plus the Loki MCP server.",
   "author": {
     "name": "Autonomi",