loki-mode 9.34.1 → 9.36.0

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: Autonomous spec-driven build system with a built-in trust layer. It does not call work done until it is verified (RARV-C closure loop, 8 quality gates, completion council, verified-completion evidence gate). Triggers on "Loki Mode". Takes a spec (PRD, GitHub issue, OpenAPI doc, etc.) to deployed product with minimal human intervention. Provider-agnostic. Requires --dangerously-skip-permissions flag.
 ---
 
-# Loki Mode v9.34.1
+# Loki Mode v9.36.0
 
 **You are an autonomous agent. You make decisions. You do not ask questions. You do not stop.**
 
@@ -470,4 +470,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v9.34.1 | [Autonomi](https://www.autonomi.dev/) flagship product | ~410 lines core**
+**v9.36.0 | [Autonomi](https://www.autonomi.dev/) flagship product | ~410 lines core**

package/VERSION

@@ -1 +1 @@
-9.34.1
+9.36.0

package/autonomy/run.sh

@@ -2484,6 +2484,39 @@ print(json.dumps(event))
 }
 
 # Emit structured event with key-value pairs
+# Record that the operator's explicitly-pinned model was NOT the model dispatched.
+#
+# WHY THIS EXISTS: a tier resolution that quietly returns something other than the
+# pin is indistinguishable, in the receipt, from a run that got what it asked for.
+# The substitution itself is often legitimate; the SILENCE is the defect. This
+# emits both an event (machine-readable) and an audit line (the tamper-evident
+# chain), so the swap and its stated reason can be audited and, if wrong,
+# refuted by whoever has the evidence to refute it.
+#
+# Never changes the dispatched model and never fails the caller: an observability
+# record that can break a run would be worse than the silence it replaces.
+emit_model_substituted() {
+    local pinned="$1" dispatched="$2" reason="$3" site="$4"
+
+    # Nothing to report when the pin was honored.
+    [ "$pinned" = "$dispatched" ] && return 0
+
+    emit_event_json "model_substituted" \
+        "pinned=$pinned" \
+        "dispatched=$dispatched" \
+        "reason=$reason" \
+        "site=$site" 2>/dev/null || true
+
+    if type audit_agent_action >/dev/null 2>&1; then
+        audit_agent_action "model_substituted" \
+            "Pinned model '$pinned' dispatched as '$dispatched' ($reason)" \
+            "site=$site" 2>/dev/null || true
+    fi
+
+    log_warn "Model pin '$pinned' dispatched as '$dispatched' ($reason)" 2>/dev/null || true
+    return 0
+}
+
 emit_event_json() {
     local event_type="$1"
     shift
@@ -22668,6 +22701,14 @@ except Exception as exc:
         # effort/model strings and have no fable equivalent (v7.39.1).
         if [ "${PROVIDER_NAME:-claude}" = "claude" ] && [ "$tier_param" = "fable" ]; then
             tier_param="opus"
+            # The operator asked for one model and is getting another. A
+            # substitution may well be CORRECT (a model genuinely unavailable on
+            # this transport), but a SILENT one never is: without this record the
+            # receipt shows an opus run and nothing says the pin was fable, so
+            # nobody can audit the swap or refute the reason behind it.
+            # Behaviour is unchanged -- this only makes the existing collapse
+            # visible and attributable.
+            emit_model_substituted "fable" "opus" "fable_unavailable_at_api" "run.sh:dispatch_backstop"
         fi
         echo "=== RARV Phase: $rarv_phase, Tier: $CURRENT_TIER ($tier_param) ===" | tee -a "$log_file" "$agent_log"
         log_info "RARV Phase: $rarv_phase -> Tier: $CURRENT_TIER ($tier_param)"
@@ -24473,12 +24514,31 @@ EOF
                 _loki_check_claim_grounding || true
             fi
             local _loki_completion_ready=1
+            # TIME THE COUNCIL. Measured on a one-function build: the agent did
+            # the work in 71s and the council window was 142s -- the largest
+            # single cost in the run -- yet it was the one major step with no
+            # stage_complete record, so its cost could only be INFERRED from
+            # artifact mtimes. Inferring duration from mtimes is invalid (an
+            # mtime says when a file was written, not how long a step took), and
+            # doing so produced a wrong attribution that had to be retracted.
+            # Emitting the real number makes the profile measured rather than
+            # guessed. Purely additive: emit_stage_complete never changes a
+            # verdict, an exit code, or control flow.
+            local _council_t0
+            _council_t0=$(date +%s 2>/dev/null || echo "")
             if loki_is_supervised_simple_web; then
                 _loki_supervised_completion_gates_pass "${gate_failures:-}" && _loki_completion_ready=0
             elif type council_should_stop &>/dev/null \
                  && LOKI_COMPLETION_CLAIMED="$_loki_completion_claimed" council_should_stop; then
                 _loki_completion_ready=0
             fi
+            # Status reports what the council DECIDED, not whether it errored:
+            # "pass" = it approved a stop, "not_run" = it ran and declined to
+            # stop (the build continues). Both are normal outcomes; neither is a
+            # failure, so neither is reported as one.
+            emit_stage_complete "completion_council" \
+                "$([ "$_loki_completion_ready" -eq 0 ] 2>/dev/null && echo pass || echo not_run)" \
+                "$_council_t0" 2>/dev/null || true
             if [ "$_loki_completion_ready" -eq 0 ]; then
                 # bash-F1: council_should_stop returns 0 from a genuine approval
                 # AND from two force-stop safety valves (stagnation flood /

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "9.34.1"
+__version__ = "9.36.0"
 
 # Expose the control app for easy import
 try:

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 The flagship product of [Autonomi](https://www.autonomi.dev/). Loki Mode is a spec-driven autonomous builder with a built-in trust layer that takes any spec to a deployed product and verifies completion with evidence (quality gates plus a completion council), not just a "done" claim. Complete installation instructions for all platforms and use cases.
 
-**Version:** v9.34.1
+**Version:** v9.36.0
 
 ---