loki-mode 9.28.1 → 9.30.0

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: Autonomous spec-driven build system with a built-in trust layer. It does not call work done until it is verified (RARV-C closure loop, 8 quality gates, completion council, verified-completion evidence gate). Triggers on "Loki Mode". Takes a spec (PRD, GitHub issue, OpenAPI doc, etc.) to deployed product with minimal human intervention. Provider-agnostic. Requires --dangerously-skip-permissions flag.
 ---
 
-# Loki Mode v9.28.1
+# Loki Mode v9.30.0
 
 **You are an autonomous agent. You make decisions. You do not ask questions. You do not stop.**
 
@@ -470,4 +470,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v9.28.1 | [Autonomi](https://www.autonomi.dev/) flagship product | ~410 lines core**
+**v9.30.0 | [Autonomi](https://www.autonomi.dev/) flagship product | ~410 lines core**

package/VERSION

@@ -1 +1 @@
-9.28.1
+9.30.0

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "9.28.1"
+__version__ = "9.30.0"
 
 # Expose the control app for easy import
 try:

package/dashboard/audit.py

@@ -194,8 +194,16 @@ def _ensure_audit_dir() -> None:
 def _compute_chain_hash(entry_json: str, prev_hash: str) -> str:
     """Compute a SHA-256 chain hash linking this entry to the previous one.
 
-    Each hash depends on the previous entry's hash, creating a tamper-evident
-    chain. If any entry is modified, all subsequent hashes will be invalid.
+    Each hash depends on the previous entry's hash, so modifying an entry
+    invalidates every hash after it. That detects corruption and truncation.
+
+    It is NOT tamper-proof. This hash is unkeyed and the genesis is a constant
+    ("0" * 64), so every input is available to anyone who can write the file:
+    an attacker can recompute a fully consistent chain over invented history.
+    Reproduced in docs/AUDIT-CHAIN-THREAT-MODEL.md. Closing it requires
+    something the writer cannot reproduce (an external witness, or a signature
+    over the tip with an off-machine key). Do not describe the output of this
+    function as tamper-proof.
     """
     return hashlib.sha256((prev_hash + entry_json).encode("utf-8")).hexdigest()
 

package/docs/AUDIT-CHAIN-THREAT-MODEL.md

@@ -0,0 +1,134 @@
+# What the audit hash chain does and does not prove
+
+Loki's wedge is a receipt the buyer verifies without trusting us. That claim is
+only worth making if we are precise about what the current chain actually
+proves. This document states the limit, with a reproduction, because a
+tamper-evidence claim that does not hold is worse than no claim: a buyer may
+rely on it.
+
+## Measured: the chain is re-forgeable
+
+`src/audit/log.js` computes each entry hash as an unkeyed SHA-256 over public
+fields, with a constant genesis:
+
+- genesis is the literal string `GENESIS` (`src/audit/log.js:16`)
+- `_computeHash` (`:127-134`) hashes `{seq,timestamp,who,what,where,why,metadata,previousHash}`
+- every input to that hash is present in the file the attacker is editing
+
+Nothing in the recipe is secret, so anyone who can write the log can recompute a
+complete, internally consistent chain over invented history. Reproduced on
+v9.28.1:
+
+```
+honest verify   : {"valid":true,"entries":2,"brokenAt":null,"error":null}
+forged verify   : {"valid":true,"entries":2,"brokenAt":null,"error":null}
+forged contents : NEVER HAPPENED | ALSO FORGED
+```
+
+The history was replaced wholesale and `verifyChain()` reported `valid: true`.
+
+### The same holds for the dashboard chain
+
+`dashboard/audit.py` is a separate implementation with the same property:
+genesis is the constant `"0" * 64` (`:58`, `:115`), and `_compute_chain_hash`
+(`:194-200`) is an unkeyed `sha256(prev_hash + entry_json)`. Its own docstring
+at `:197` calls the result tamper-evident. Forged with the writer's exact recipe
+(`json.dumps(entry, sort_keys=True, default=str)`, field `_integrity_hash`,
+`:369-371`), `verify_log_integrity` reports:
+
+```
+forged verdict: {'valid': True, 'entries_checked': 2, 'first_tampered_line': None, ...}
+contents      : NEVER HAPPENED | ALSO FORGED
+```
+
+One methodological note, because it nearly produced a false all-clear here: a
+first forgery attempt using a guessed field name returned `valid: False` with
+`entries_checked: 0`. That was the verifier rejecting the probe's SCHEMA, not
+detecting tampering. A failed exploit can mean the probe was wrong rather than
+the target is sound, and `entries_checked: 0` is the tell. Any future test of
+this property must assert that entries were actually checked.
+
+## What this means
+
+The chain detects **accidental corruption and truncation**: a partial write, a
+dropped line, a byte flip. Those are real failure modes and catching them has
+value.
+
+It does **not** detect a deliberate rewrite by anyone with write access to the
+log, which is the threat an audit trail exists to address. Under the standard
+audit-log threat model the writer is the adversary, and an unkeyed chain the
+writer can recompute offers that adversary no obstacle.
+
+Note the failure direction. A broken chain is strong evidence of a problem. An
+intact chain is NOT evidence of integrity, because it is exactly what both an
+honest run and a competent forgery produce. Absence of evidence is not evidence
+of absence.
+
+## What would actually close it
+
+Tamper-evidence requires something the log's writer cannot reproduce. In
+increasing order of strength:
+
+1. **A keyed MAC** with a key the agent cannot read. Moves the problem to key
+   custody; on a developer laptop where the agent runs as the user, there is
+   often nowhere to put such a key that the agent cannot reach.
+2. **An external witness**: periodically pin the chain tip somewhere append-only
+   that the agent cannot rewrite. `writeWitness` already exists at
+   `src/audit/crosslink.js:234` and has zero production callers.
+3. **A signature over the tip** with a key held off the machine.
+
+Only 2 and 3 survive an adversary who controls the machine, which is the case
+that matters for a receipt a third party is meant to trust.
+
+## What is closed as of v9.30.0
+
+`writeWitness` is now wired and, more importantly, **reconciled**. The gap was
+not only that nothing called it: `verifyUnified` called `verifyWitnessFile`,
+which checks the witness file's own monotonicity and never compares a witnessed
+tip to the live chain. Measured before the fix, with a witness file present and
+valid:
+
+```
+witnessed tip : 337d47ce70...      live tip now : d376cdd97d...
+verifyUnified : {"valid":true, "witness":{"present":true,"valid":true}}
+```
+
+A witness nobody reconciles is not a control. `reconcileWitnessedPrefix`
+(`src/audit/crosslink.js`) now compares each witnessed tip against the chain
+entry at that position, and `verifyUnified` folds the result into its verdict.
+The same forgery now returns `valid:false` with the entry named.
+
+The comparison is prefix-based rather than tip-equality on purpose: a chain
+legitimately grows after a witness, so requiring the tips to match would fire on
+normal operation, and a guard that fires on normal operation gets turned off.
+Both directions are mutation-tested.
+
+The subscriber writes a witness at session end and every
+`LOKI_AUDIT_WITNESS_INTERVAL_SEC` (default 300; `LOKI_AUDIT_WITNESS=0` opts out).
+Periodic witnessing matters because a witness taken only at shutdown is lost to
+SIGKILL, which is when the trail matters most.
+
+**What is still open, precisely.** A local witness file is itself rewritable by
+the same adversary. What the reconciliation buys is that forging now requires
+rewriting the chain AND every witness consistently, rather than the chain alone.
+That is a higher bar, not a closed door. The closed door is
+`LOKI_AUDIT_WITNESS_COMMAND`, which ships the witness line off the machine to a
+WORM mount or timestamping authority: an out-of-band copy is the only form that
+survives an adversary who controls this host. It is off by default because it
+needs infrastructure we cannot assume.
+
+Two honest limits that remain:
+
+- The subscriber is gated on `LOKI_AUDIT_ENABLED` (default false), so a default
+  install still writes no agent chain and no witness.
+- Nothing yet witnesses on the Bun route.
+
+## Current honest claim
+
+Until a witness or off-machine signature is wired, the supportable claim is:
+
+> The audit log is hash-chained, which detects corruption and truncation. It is
+> not tamper-proof against an adversary with write access to the log.
+
+Do not describe the current chain as tamper-proof, tamper-resistant, or as
+evidence a third party can rely on for integrity against a motivated writer.

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 The flagship product of [Autonomi](https://www.autonomi.dev/). Loki Mode is a spec-driven autonomous builder with a built-in trust layer that takes any spec to a deployed product and verifies completion with evidence (quality gates plus a completion council), not just a "done" claim. Complete installation instructions for all platforms and use cases.
 
-**Version:** v9.28.1
+**Version:** v9.30.0
 
 ---
 

package/loki-ts/dist/loki.js

@@ -1,5 +1,5 @@
 // @bun
-var St=Object.create;var{getPrototypeOf:yt,defineProperty:jG,getOwnPropertyNames:bt}=Object;var ft=Object.prototype.hasOwnProperty;function _t($){return this[$]}var vt,ht,gt=($,X,Q)=>{var z=$!=null&&typeof $==="object";if(z){var Z=X?vt??=new WeakMap:ht??=new WeakMap,K=Z.get($);if(K)return K}Q=$!=null?St(yt($)):{};let J=X||!$||!$.__esModule?jG(Q,"default",{value:$,enumerable:!0}):Q;for(let q of bt($))if(!ft.call(J,q))jG(J,q,{get:_t.bind($,q),enumerable:!0});if(z)Z.set($,J);return J};var zq=($,X)=>()=>(X||$((X={exports:{}}).exports,X),X.exports);var mt=($)=>$;function ut($,X){this[$]=mt.bind(null,X)}var B1=($,X)=>{for(var Q in X)jG($,Q,{get:X[Q],enumerable:!0,configurable:!0,set:ut.bind(X,Q)})};var s=($,X)=>()=>($&&(X=$($=0)),X);var w5=import.meta.require;var YR={};B1(YR,{lokiDir:()=>h0,homeLokiDir:()=>HQ,findRepoRootForVersion:()=>AG,REPO_ROOT:()=>L1});import{resolve as h2,dirname as LG}from"path";import{fileURLToPath as dt}from"url";import{existsSync as Zq}from"fs";import{homedir as pt}from"os";function ct(){let $=VR;for(let X=0;X<6;X++){if(Zq(h2($,"VERSION"))&&Zq(h2($,"autonomy/run.sh")))return $;let Q=LG($);if(Q===$)break;$=Q}return h2(VR,"..","..","..")}function AG($){let X=$;for(let Q=0;Q<6;Q++){if(Zq(h2(X,"VERSION"))&&Zq(h2(X,"autonomy/run.sh")))return X;let z=LG(X);if(z===X)break;X=z}return h2($,"..","..","..")}function h0(){return process.env.LOKI_DIR??h2(process.cwd(),".loki")}function HQ(){return h2(pt(),".loki")}var VR,L1;var k1=s(()=>{VR=LG(dt(import.meta.url));L1=ct()});import{readFileSync as lt}from"fs";import{resolve as it,dirname as at}from"path";import{fileURLToPath as ot}from"url";function j9(){if(n3!==null)return n3;let $="9.28.1";if(typeof $==="string"&&$.length>0)return n3=$,n3;try{let X=at(ot(import.meta.url)),Q=AG(X);n3=lt(it(Q,"VERSION"),"utf-8").trim()}catch{n3="unknown"}return n3}var n3=null;var Kq=s(()=>{k1()});var GR={};B1(GR,{runOrThrow:()=>Ue,run:()=>$1,readStreamCapped:()=>Jq,commandVersion:()=>We,commandExists:()=>g5,ShellError:()=>CG,MAX_STDOUT_BYTES:()=>WR});async function Jq($,X=WR){let Q=$.getReader(),z=new TextDecoder,Z="",K=0;try{while(K<X){let{done:J,value:q}=await Q.read();if(J)break;if(!q)continue;if(K+=q.byteLength,K>X){let V=q.byteLength-(K-X);Z+=z.decode(q.subarray(0,V),{stream:!0});break}Z+=z.decode(q,{stream:!0})}Z+=z.decode()}finally{try{await Q.cancel()}catch{}Q.releaseLock()}return Z}async function $1($,X={}){let Q=Bun.spawn({cmd:[...$],stdout:"pipe",stderr:"pipe",env:X.env?{...process.env,...X.env}:process.env,cwd:X.cwd}),z,Z;if(X.timeoutMs&&X.timeoutMs>0)z=setTimeout(()=>{try{Q.kill("SIGTERM")}catch{}Z=setTimeout(()=>{try{Q.kill("SIGKILL")}catch{}},2000)},X.timeoutMs);try{let[K,J,q]=await Promise.all([Jq(Q.stdout),new Response(Q.stderr).text(),Q.exited]);return{stdout:K,stderr:J,exitCode:q}}finally{if(z)clearTimeout(z);if(Z)clearTimeout(Z)}}async function Ue($,X={}){let Q=await $1($,X);if(Q.exitCode!==0)throw new CG(`command failed (${Q.exitCode}): ${$.join(" ")}`,Q.exitCode,Q.stdout,Q.stderr);return Q}async function g5($){let X=He($),Q=await $1(["sh","-c",`command -v ${X}`],{timeoutMs:5000});if(Q.exitCode===0)return Q.stdout.trim()||null;return null}function He($){if(!/^[A-Za-z0-9._/-]+$/.test($))throw Error(`refused to shell-escape suspect token: ${$}`);return $}async function We($,X="--version"){if(!await g5($))return null;let z=await $1([$,X],{timeoutMs:5000});if(z.exitCode!==0)return null;return((z.stdout||z.stderr).split(/\r?\n/)[0]?.trim()??"")||null}var WR=16777216,CG;var y8=s(()=>{CG=class CG extends Error{message;exitCode;stdout;stderr;constructor($,X,Q,z){super($);this.message=$;this.exitCode=X;this.stdout=Q;this.stderr=z;this.name="ShellError"}}});function g2($){return Ge?"":$}var Ge,p0,$5,q1,L61,A1,f1,m5,r;var t7=s(()=>{Ge=(process.env.NO_COLOR??"").length>0;p0=g2("\x1B[0;31m"),$5=g2("\x1B[0;32m"),q1=g2("\x1B[1;33m"),L61=g2("\x1B[0;34m"),A1=g2("\x1B[0;36m"),f1=g2("\x1B[1m"),m5=g2("\x1B[2m"),r=g2("\x1B[0m")});import{existsSync as De}from"fs";async function Z2(){if(GQ!==void 0)return GQ;let $="/opt/homebrew/bin/python3.12";if(De($))return GQ=$,$;let X=await g5("python3.12");if(X)return GQ=X,X;let Q=await g5("python3");return GQ=Q,Q}async function I4($,X={}){let Q=await Z2();if(!Q)return{stdout:"",stderr:"python3 not found",exitCode:127};return $1([Q,"-c",$],X)}var GQ;var m2=s(()=>{y8()});var yR={};B1(yR,{runStatus:()=>oe});import{existsSync as u5,readFileSync as A9,readdirSync as RR,statSync as IR}from"fs";import{resolve as A5,basename as ge}from"path";import{homedir as me}from"os";function wR($){let X=Math.trunc($);if(X>=1e6)return`${(Math.trunc(X/1e6*10)/10).toFixed(1)}M`;if(X>=1000)return`${(Math.trunc(X/1000*10)/10).toFixed(1)}K`;return String(X)}function PR($,X,Q){if(X===0)return null;let z=Math.trunc($*100/X),Z=Math.trunc($*Vq/X);if(Z>Vq)Z=Vq;let K=Vq-Z,J=$5;if(z>=80)J=p0;else if(z>=50)J=q1;let q="=".repeat(Math.max(0,Z))+" ".repeat(Math.max(0,K)),V=wR($),Y=wR(X);return`  ${f1}${Q}${r} ${J}[${q}]${r} ${z}% (${V} / ${Y})`}async function de(){if(await g5("jq"))return!0;return process.stdout.write(`${p0}Error: jq is required but not installed.${r}
+var St=Object.create;var{getPrototypeOf:yt,defineProperty:jG,getOwnPropertyNames:bt}=Object;var ft=Object.prototype.hasOwnProperty;function _t($){return this[$]}var vt,ht,gt=($,X,Q)=>{var z=$!=null&&typeof $==="object";if(z){var Z=X?vt??=new WeakMap:ht??=new WeakMap,K=Z.get($);if(K)return K}Q=$!=null?St(yt($)):{};let J=X||!$||!$.__esModule?jG(Q,"default",{value:$,enumerable:!0}):Q;for(let q of bt($))if(!ft.call(J,q))jG(J,q,{get:_t.bind($,q),enumerable:!0});if(z)Z.set($,J);return J};var zq=($,X)=>()=>(X||$((X={exports:{}}).exports,X),X.exports);var mt=($)=>$;function ut($,X){this[$]=mt.bind(null,X)}var B1=($,X)=>{for(var Q in X)jG($,Q,{get:X[Q],enumerable:!0,configurable:!0,set:ut.bind(X,Q)})};var s=($,X)=>()=>($&&(X=$($=0)),X);var w5=import.meta.require;var YR={};B1(YR,{lokiDir:()=>h0,homeLokiDir:()=>HQ,findRepoRootForVersion:()=>AG,REPO_ROOT:()=>L1});import{resolve as h2,dirname as LG}from"path";import{fileURLToPath as dt}from"url";import{existsSync as Zq}from"fs";import{homedir as pt}from"os";function ct(){let $=VR;for(let X=0;X<6;X++){if(Zq(h2($,"VERSION"))&&Zq(h2($,"autonomy/run.sh")))return $;let Q=LG($);if(Q===$)break;$=Q}return h2(VR,"..","..","..")}function AG($){let X=$;for(let Q=0;Q<6;Q++){if(Zq(h2(X,"VERSION"))&&Zq(h2(X,"autonomy/run.sh")))return X;let z=LG(X);if(z===X)break;X=z}return h2($,"..","..","..")}function h0(){return process.env.LOKI_DIR??h2(process.cwd(),".loki")}function HQ(){return h2(pt(),".loki")}var VR,L1;var k1=s(()=>{VR=LG(dt(import.meta.url));L1=ct()});import{readFileSync as lt}from"fs";import{resolve as it,dirname as at}from"path";import{fileURLToPath as ot}from"url";function j9(){if(n3!==null)return n3;let $="9.30.0";if(typeof $==="string"&&$.length>0)return n3=$,n3;try{let X=at(ot(import.meta.url)),Q=AG(X);n3=lt(it(Q,"VERSION"),"utf-8").trim()}catch{n3="unknown"}return n3}var n3=null;var Kq=s(()=>{k1()});var GR={};B1(GR,{runOrThrow:()=>Ue,run:()=>$1,readStreamCapped:()=>Jq,commandVersion:()=>We,commandExists:()=>g5,ShellError:()=>CG,MAX_STDOUT_BYTES:()=>WR});async function Jq($,X=WR){let Q=$.getReader(),z=new TextDecoder,Z="",K=0;try{while(K<X){let{done:J,value:q}=await Q.read();if(J)break;if(!q)continue;if(K+=q.byteLength,K>X){let V=q.byteLength-(K-X);Z+=z.decode(q.subarray(0,V),{stream:!0});break}Z+=z.decode(q,{stream:!0})}Z+=z.decode()}finally{try{await Q.cancel()}catch{}Q.releaseLock()}return Z}async function $1($,X={}){let Q=Bun.spawn({cmd:[...$],stdout:"pipe",stderr:"pipe",env:X.env?{...process.env,...X.env}:process.env,cwd:X.cwd}),z,Z;if(X.timeoutMs&&X.timeoutMs>0)z=setTimeout(()=>{try{Q.kill("SIGTERM")}catch{}Z=setTimeout(()=>{try{Q.kill("SIGKILL")}catch{}},2000)},X.timeoutMs);try{let[K,J,q]=await Promise.all([Jq(Q.stdout),new Response(Q.stderr).text(),Q.exited]);return{stdout:K,stderr:J,exitCode:q}}finally{if(z)clearTimeout(z);if(Z)clearTimeout(Z)}}async function Ue($,X={}){let Q=await $1($,X);if(Q.exitCode!==0)throw new CG(`command failed (${Q.exitCode}): ${$.join(" ")}`,Q.exitCode,Q.stdout,Q.stderr);return Q}async function g5($){let X=He($),Q=await $1(["sh","-c",`command -v ${X}`],{timeoutMs:5000});if(Q.exitCode===0)return Q.stdout.trim()||null;return null}function He($){if(!/^[A-Za-z0-9._/-]+$/.test($))throw Error(`refused to shell-escape suspect token: ${$}`);return $}async function We($,X="--version"){if(!await g5($))return null;let z=await $1([$,X],{timeoutMs:5000});if(z.exitCode!==0)return null;return((z.stdout||z.stderr).split(/\r?\n/)[0]?.trim()??"")||null}var WR=16777216,CG;var y8=s(()=>{CG=class CG extends Error{message;exitCode;stdout;stderr;constructor($,X,Q,z){super($);this.message=$;this.exitCode=X;this.stdout=Q;this.stderr=z;this.name="ShellError"}}});function g2($){return Ge?"":$}var Ge,p0,$5,q1,L61,A1,f1,m5,r;var t7=s(()=>{Ge=(process.env.NO_COLOR??"").length>0;p0=g2("\x1B[0;31m"),$5=g2("\x1B[0;32m"),q1=g2("\x1B[1;33m"),L61=g2("\x1B[0;34m"),A1=g2("\x1B[0;36m"),f1=g2("\x1B[1m"),m5=g2("\x1B[2m"),r=g2("\x1B[0m")});import{existsSync as De}from"fs";async function Z2(){if(GQ!==void 0)return GQ;let $="/opt/homebrew/bin/python3.12";if(De($))return GQ=$,$;let X=await g5("python3.12");if(X)return GQ=X,X;let Q=await g5("python3");return GQ=Q,Q}async function I4($,X={}){let Q=await Z2();if(!Q)return{stdout:"",stderr:"python3 not found",exitCode:127};return $1([Q,"-c",$],X)}var GQ;var m2=s(()=>{y8()});var yR={};B1(yR,{runStatus:()=>oe});import{existsSync as u5,readFileSync as A9,readdirSync as RR,statSync as IR}from"fs";import{resolve as A5,basename as ge}from"path";import{homedir as me}from"os";function wR($){let X=Math.trunc($);if(X>=1e6)return`${(Math.trunc(X/1e6*10)/10).toFixed(1)}M`;if(X>=1000)return`${(Math.trunc(X/1000*10)/10).toFixed(1)}K`;return String(X)}function PR($,X,Q){if(X===0)return null;let z=Math.trunc($*100/X),Z=Math.trunc($*Vq/X);if(Z>Vq)Z=Vq;let K=Vq-Z,J=$5;if(z>=80)J=p0;else if(z>=50)J=q1;let q="=".repeat(Math.max(0,Z))+" ".repeat(Math.max(0,K)),V=wR($),Y=wR(X);return`  ${f1}${Q}${r} ${J}[${q}]${r} ${z}% (${V} / ${Y})`}async function de(){if(await g5("jq"))return!0;return process.stdout.write(`${p0}Error: jq is required but not installed.${r}
 `),process.stdout.write(`Install with:
 `),process.stdout.write(`  brew install jq    (macOS)
 `),process.stdout.write(`  apt install jq     (Debian/Ubuntu)
@@ -1334,4 +1334,4 @@ Set LOKI_LEGACY_BASH=1 to force the bash CLI for every command.
 `),2}case"start":{let{runStart:z}=await Promise.resolve().then(() => (Et(),Pt));return z(Q)}default:return process.stderr.write(`Unknown command: ${X}
 `),process.stderr.write(xt),2}}DR();process.on("SIGINT",()=>process.exit(130));process.on("SIGTERM",()=>process.exit(143));var X61=await $61(Bun.argv.slice(2));process.exit(X61);
 
-//# debugId=933CC84685D51DDC6BA1C1C5D1DD614C
+//# debugId=AA95222A4C31D0041FE66BEAFA8F2DD1

package/mcp/__init__.py

@@ -75,4 +75,4 @@ try:
 except ImportError:
     __all__ = ['mcp']
 
-__version__ = '9.28.1'
+__version__ = '9.30.0'

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "loki-mode",
   "mcpName": "io.github.asklokesh/loki-mode",
-  "version": "9.28.1",
+  "version": "9.30.0",
   "description": "Loki Mode by Autonomi. Autonomous spec-to-product system: takes a PRD, GitHub issue, OpenAPI/JSON/YAML, or one-line brief to a deployed app via the RARV-C closure loop with 8 quality gates. Provider-agnostic (Claude Code, OpenAI Codex, Cline, Aider, opencode).",
   "keywords": [
     "agent",

package/plugins/loki-mode/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "loki-mode",
   "displayName": "Loki Mode",
-  "version": "9.28.1",
+  "version": "9.30.0",
   "description": "Autonomous spec-to-product build system with a built-in trust layer (RARV-C closure loop, 8 quality gates, completion council). Ships Loki's spec-hardening, drift-detection, and deterministic PR verification commands plus the Loki MCP server.",
   "author": {
     "name": "Autonomi",

package/src/audit/crosslink.js

@@ -385,11 +385,17 @@ function verifyUnified(opts) {
     opts.witnessFile ||
     path.join((opts.projectDir || process.cwd()), '.loki', 'audit', WITNESS_FILE));
 
+  // Reconcile witnessed tips against the live chain. verifyWitnessFile above
+  // only checks the witness file's own monotonicity, so without this a
+  // re-forged chain passed with a witness sitting right next to it recording
+  // the honest tip. Reproduced before the fix; see the helper's comment.
+  var witnessedPrefix = reconcileWitnessedPrefix(opts);
+
   var dashboardOk = dash.available ? !!dash.valid : !requireDashboard;
   var crosslinkOk = requireCrosslink ? anchors.length > 0 : true;
 
   var valid = !!agentResult.valid && dashboardOk && anchorReconcile.valid &&
-    witness.valid && crosslinkOk;
+    witness.valid && witnessedPrefix.valid && crosslinkOk;
 
   return {
     valid: valid,
@@ -397,6 +403,7 @@ function verifyUnified(opts) {
     dashboard: dash,
     anchors: anchorReconcile,
     witness: witness,
+    witnessedPrefix: witnessedPrefix,
     requireDashboard: requireDashboard,
     requireCrosslink: requireCrosslink,
   };
@@ -523,6 +530,117 @@ function linkManifest(opts) {
  * @returns {object} { present, highWater } -- highWater:0 and
  *   present:false when no witness file / no usable counts exist.
  */
+/**
+ * Reconcile every witnessed agent tip against the CURRENT chain.
+ *
+ * Why this exists, measured: the agent chain hash is unkeyed over public
+ * fields from a constant genesis (log.js:16,127-134), so anyone who can write
+ * the log can recompute a fully consistent chain over invented history --
+ * verifyChain() returns valid:true for it. A witness pins what the tip really
+ * was at a point in time, which is the one thing the forger cannot retroactively
+ * change once it has left the machine. See docs/AUDIT-CHAIN-THREAT-MODEL.md.
+ *
+ * Before this, writeWitness recorded that tip and NOTHING ever compared it to
+ * the live chain: verifyWitnessFile only checks the witness file's own
+ * monotonicity. A witness nobody reconciles is not a control.
+ *
+ * The comparison must be PREFIX-based, not tip-equality: the chain legitimately
+ * grows after a witness is taken, so a differing live tip is normal. What is
+ * NOT normal is entry N of the current chain hashing differently than when a
+ * witness saw N entries. That is a rewrite of already-witnessed history.
+ *
+ * Honest states, never collapsed:
+ *   checked   - at least one witness was reconciled against the chain
+ *   no_records- no witness file, or none carrying a usable tip. NOT a pass.
+ *   unreadable- the chain or witness file could not be read. NOT a pass.
+ *
+ * @returns {{state:string, valid:boolean, witnessesChecked:number,
+ *            rewrittenAt:(number|null), reason:(string|undefined)}}
+ */
+function reconcileWitnessedPrefix(opts) {
+  opts = opts || {};
+  var witnessFile = opts.witnessFile ||
+    path.join((opts.projectDir || process.cwd()), '.loki', 'audit', WITNESS_FILE);
+
+  if (!fs.existsSync(witnessFile)) {
+    return { state: 'no_records', valid: true, witnessesChecked: 0,
+      rewrittenAt: null,
+      reason: 'no witness file; witnessed-prefix reconciliation did not run' };
+  }
+
+  var records = [];
+  try {
+    var content = fs.readFileSync(witnessFile, 'utf8').trim();
+    if (!content) {
+      return { state: 'no_records', valid: true, witnessesChecked: 0,
+        rewrittenAt: null, reason: 'witness file is empty' };
+    }
+    var lines = content.split('\n');
+    for (var i = 0; i < lines.length; i++) {
+      var rec;
+      try { rec = JSON.parse(lines[i]); } catch (_) { continue; }
+      if (rec && typeof rec.agentEntries === 'number' &&
+          typeof rec.agentTipHash === 'string' && rec.agentTipHash) {
+        records.push(rec);
+      }
+    }
+  } catch (e) {
+    return { state: 'unreadable', valid: false, witnessesChecked: 0,
+      rewrittenAt: null,
+      reason: 'witness file unreadable: ' + String((e && e.message) || e) };
+  }
+
+  if (records.length === 0) {
+    return { state: 'no_records', valid: true, witnessesChecked: 0,
+      rewrittenAt: null,
+      reason: 'witness file carries no usable agent tip' };
+  }
+
+  var entries;
+  try {
+    var log = new AuditLog(opts);
+    entries = log.readEntries();
+    log.destroy();
+  } catch (e) {
+    return { state: 'unreadable', valid: false, witnessesChecked: 0,
+      rewrittenAt: null,
+      reason: 'agent chain unreadable: ' + String((e && e.message) || e) };
+  }
+
+  var checked = 0;
+  for (var j = 0; j < records.length; j++) {
+    var r = records[j];
+    var n = r.agentEntries;
+    if (n <= 0) continue;
+    // Fewer entries than were witnessed is truncation of witnessed history.
+    if (entries.length < n) {
+      return { state: 'checked', valid: false, witnessesChecked: checked,
+        rewrittenAt: entries.length,
+        reason: 'audit chain has ' + entries.length + ' entries but a witness ' +
+          'recorded ' + n + '; witnessed history was truncated' };
+    }
+    // Entry n-1 is the tip AS WITNESSED. Its stored hash must still match.
+    var atWitness = entries[n - 1];
+    var liveHash = atWitness && atWitness.hash;
+    if (liveHash !== r.agentTipHash) {
+      return { state: 'checked', valid: false, witnessesChecked: checked,
+        rewrittenAt: n,
+        reason: 'entry ' + n + ' hashes ' + String(liveHash).slice(0, 16) +
+          '... but a witness recorded ' + String(r.agentTipHash).slice(0, 16) +
+          '...; witnessed history was rewritten' };
+    }
+    checked++;
+  }
+
+  if (checked === 0) {
+    return { state: 'no_records', valid: true, witnessesChecked: 0,
+      rewrittenAt: null,
+      reason: 'no witness recorded a positive entry count' };
+  }
+  return { state: 'checked', valid: true, witnessesChecked: checked,
+    rewrittenAt: null };
+}
+
 function witnessAgentHighWater(opts) {
   opts = opts || {};
   var witnessFile = opts.witnessFile ||
@@ -674,6 +792,7 @@ module.exports = {
   linkManifest: linkManifest,
   verifyManifestLink: verifyManifestLink,
   witnessAgentHighWater: witnessAgentHighWater,
+  reconcileWitnessedPrefix: reconcileWitnessedPrefix,
   hashManifest: hashManifest,
   defaultManifestPath: defaultManifestPath,
   CROSSLINK_ACTION: CROSSLINK_ACTION,

package/src/audit/subscriber.js

@@ -4,6 +4,7 @@
 var fs = require('fs');
 var path = require('path');
 var AuditLog = require('./log').AuditLog;
+var crosslink = require('./crosslink');
 
 var lokiDir = process.env.LOKI_DIR || '.loki';
 var pendingDir = path.join(process.cwd(), lokiDir, 'events', 'pending');
@@ -58,6 +59,46 @@ function processEventFile(filepath) {
     }
 }
 
+/**
+ * Pin the current chain tip to the append-only witness file.
+ *
+ * Why the agent chain needs this: its hash is unkeyed over public fields from a
+ * constant genesis (log.js:16,127-134), so verifyChain() cannot tell an honest
+ * chain from one recomputed over invented history. A witness records what the
+ * tip actually was, and verifyUnified reconciles later chains against it
+ * (crosslink.reconcileWitnessedPrefix). Without a witness there is nothing to
+ * reconcile against, so this is what gives that check something to work with.
+ * See docs/AUDIT-CHAIN-THREAT-MODEL.md.
+ *
+ * Best-effort by design: a witness that cannot be written must never take down
+ * the run or block the audit flush. A missing witness is reported honestly by
+ * verifyUnified as state "no_records", never as a pass.
+ *
+ * LOKI_AUDIT_WITNESS=0 opts out.
+ * LOKI_AUDIT_WITNESS_COMMAND, if set, is invoked with the witness line so an
+ * external party (a WORM mount, a timestamping authority) holds an out-of-band
+ * copy. That out-of-band copy is the only form that survives an adversary who
+ * controls this machine: a local witness file is itself rewritable.
+ */
+function writeWitnessSafely(reason) {
+    if (process.env.LOKI_AUDIT_WITNESS === '0') return null;
+    try {
+        var opts = { projectDir: process.cwd() };
+        var cmd = process.env.LOKI_AUDIT_WITNESS_COMMAND;
+        if (cmd) opts.witnessCommand = cmd;
+        var res = crosslink.writeWitness(opts);
+        console.log('[audit-subscriber] witness written (' + reason + '), agentEntries=' +
+                    (res && res.record && res.record.agentEntries));
+        return res;
+    } catch (e) {
+        // Reported, never swallowed: an operator who expected a witness must be
+        // able to see that none was taken.
+        console.error('[audit-subscriber] witness NOT written (' + reason + '): ' +
+                      String((e && e.message) || e));
+        return null;
+    }
+}
+
 function scanPendingEvents() {
     if (!fs.existsSync(pendingDir)) return;
     try {
@@ -79,9 +120,28 @@ if (require.main === module) {
     var pollInterval = setInterval(scanPendingEvents, 500);
     scanPendingEvents();
 
+    // A witness taken only at shutdown is lost precisely when it matters most
+    // (SIGKILL, power loss, a crashed run). Pin one periodically so the
+    // witnessed prefix covers work already done. Default 300s; 0 disables.
+    var witnessEvery = parseInt(process.env.LOKI_AUDIT_WITNESS_INTERVAL_SEC || '300', 10);
+    var witnessInterval = null;
+    if (process.env.LOKI_AUDIT_WITNESS !== '0' &&
+        Number.isFinite(witnessEvery) && witnessEvery > 0) {
+        witnessInterval = setInterval(function () {
+            writeWitnessSafely('periodic');
+        }, witnessEvery * 1000);
+        // Do not hold the event loop open for the sake of witnessing.
+        if (witnessInterval.unref) witnessInterval.unref();
+    }
+
     function shutdown() {
         clearInterval(pollInterval);
+        if (witnessInterval) clearInterval(witnessInterval);
         audit.flush();
+        // AFTER the flush: writeWitness reads the tip off disk, so witnessing
+        // before flushing would pin a tip that omits every buffered entry and
+        // then read as truncation on the next verify.
+        writeWitnessSafely('session end');
         process.exit(0);
     }
     process.on('SIGTERM', shutdown);
@@ -93,6 +153,7 @@ if (require.main === module) {
         scanPendingEvents: scanPendingEvents,
         EVENT_TO_AUDIT: EVENT_TO_AUDIT,
         _setAudit: function(a) { audit = a; },
+        writeWitnessSafely: writeWitnessSafely,
         _setPendingDir: function(d) { pendingDir = d; },
         _getLastProcessedFile: function() { return lastProcessedFile; },
         _resetState: function() { lastProcessedFile = ''; },