Loki Mode v9.22.0

Source-bound measurement closes the outcome-routing canary loop without
invoking or switching a provider.

Added

• Deterministic outcome canary evaluation
  (tools/outcome-canary-evaluate.py): validates a canary plan against its
  exact router report, consumes bounded consented control and challenger
  observations, and returns PROMOTE, HOLD, or ROLLBACK with stable reason
  codes. The evaluator rejects tampered, mismatched, stale, sparse, and
  threshold-invalid evidence and remains offline and read-only.

Fixed

• Release-gate reliability after canary evaluation: rebuilt the shipped
  TypeScript distribution from source, bounded the stale-install PTY probe,
  aligned completion-reap checks with process-group safety, and removed an
  obsolete gate-count assertion. The exact release predecessor passed the full
  GitHub Tests matrix plus Bun Parity, Coverage, SBOM, and Pages.

Loki Mode v9.21.0

Four features from the parallel lanes plus one post-release fix to v9.20.0's
lineage guard.

Added

• loki start <dir> accepts an existing repository directory, not only a
  spec file, with an opt-in fast repository pass for the common case.
• Outcome route advisor (tools/outcome-router.py): picks a route from
  recorded outcome data rather than a fixed default.
• Reversible outcome route canary (tools/outcome-canary.py): rolls a
  route change forward on evidence and back out without one.

Fixed

• A reaped child's lineage marker is UNKNOWN, not absent. v9.20.0's Tests
  run failed on Python 3.10 only -- 3.11, 3.12 and 3.13 passed in the same
  matrix -- with 127 != 0 and "provider attempt lineage marker is
  unavailable". 127 is reported for a LAUNCH failure; the runner had in fact
  launched and completed, then been reaped before the check could read
  /proc/<pid>/environ.

  That read has three "process is gone" outcomes and only one was handled.
  ENOENT raised _LineageUnknown; ESRCH was swallowed by
  except OSError: return False; and a zero-length read raised nothing at all,
  splitting to [b""] and answering "no marker" for a process that carried
  one. Both now classify as unknown and reach the caller's existing
  poll()-based decision.

  Fail-closed is preserved and asserted twice: a populated environ without the
  marker still returns False, and EACCES/EIO stay False -- a read failure
  is not evidence of a completed child. Only "the process is gone" is
  reclassified. Linux-only: macOS has the pipe-handle fallback, which is why
  the local repro passed 5/5 while CI stayed red.

Loki Mode v9.20.0

The Evidence Receipt becomes portable. A receipt from any build -- laptop, CI,
or cluster -- can now prove WHO produced it to someone holding only proof.json
and a public key set: no API token, no gpg key import over a side channel, no
network, and no Loki install. That closes the gap that made receipts checkable
only by people who already had our infrastructure.

Two security fixes ship alongside it, and both were reachable in production.

Added

• Per-job receipt attestation. Ed25519 JWT binding job id, run id and the
  receipt's own integrity digest, with the signing keys published at
  GET /.well-known/jwks.json -- unauthenticated, deliberately, because a
  receipt only a token-holder can check is not independently verifiable.
  kid and multi-key rotation from day one: without them the first key
  rotation would make every historical receipt fail verification, and a
  receipt that stops verifying is indistinguishable from a tampered one.
• loki proof verify <id> --jwks <url|file>. The third-party path. A file
  is accepted as well as a URL so an air-gapped reviewer can verify offline.
  Four outcomes kept distinct -- VERIFIED, FAILED, ABSENT, NOT CHECKED --
  because "we could not check" must never render as "unattested".
• Local receipts are attested too, not only cluster-served ones. The
  generator signs when LOKI_RECEIPT_SIGNING_KEY_FILE is set.
• Receipt signing in Helm and docker-compose. Receiver-only in both: a
  worker runs model-directed code, so a key there would let a build sign its
  own receipt. Compose ships the mount commented out because Docker has no
  optional bind and an active bind to a missing file is a hard start failure.
• Evidence Receipts in the web app -- a panel listing every receipt with
  its verdict, plus a distribution strip. unknown is its own series and is
  never folded into verified.
• Receipt metrics on /metrics: loki_receipts_total,
  loki_receipts_by_verdict, loki_receipts_with_provenance. Twelve metric
  lines became nineteen; verification was previously invisible to monitoring.
• Worker autoscaling on queue depth (Helm, off by default). CPU is the
  wrong signal: a worker blocked on a model call is idle by CPU measure while
  the backlog grows, so a CPU-targeted HPA scales a saturated cluster DOWN.
• Outcome Contract + Proof Passport foundation (autonomy/lib/ outcome_contract.py, tools/proof-passport.py, schema, tests).

Fixed

• SECURITY: loki dashboard start refused an exposed bind without auth.
  dashboard/auth.py returns allow when neither LOKI_ENTERPRISE_AUTH nor
  OIDC is configured, leaving all 166 scoped endpoints open. Fine on loopback;
  not on 0.0.0.0, which docker run -p 57374:57374 <img> dashboard start
  reaches. Now refused unless auth is configured, checked AFTER argument
  parsing so an explicit --host is covered. Refuses rather than auto-minting
  a token: a credential the operator never sees is worse than a refusal.
• PRIVACY: the Proof Passport leaked absolute machine paths on macOS.
  Redaction was built from .resolve() while the attester embeds the
  unresolved path; /var -> /private/var meant the redactor never matched.
  Green on Linux CI, leaking on every developer Mac.
• The receipt verifier now enforces schema_version. The generator has
  stamped it on every receipt since it shipped and nothing read it -- a future
  incompatible receipt would have been judged by the wrong rules and reported
  as a clean pass. Fails closed on absent or unknown major; every minor of
  major 1 still verifies, so no existing receipt breaks.
• The receipt panel was unreachable for every loki web user.
  /api/proofs* existed only on the dashboard server, not the one loki web
  runs, and the panel rendered only while a build was in flight.

Performance

• Auto-documentation no longer spends five minutes on a one-file project.
  Measured on a graded build: 2.8 min of iteration work, 13.4 min wall clock,
  5.0 of which was the doc suite timing out at 300s over one 20-line module.
  The budget now scales to source-file count (<=3 files -> 90s). Median wall
  clock on the same task moved 12.8 -> 8.6 min.

Measurement

• Per-gate durations are preserved in the benchmark metrics. The engine had
  emitted them for eleven gates all along and the harness discarded them. First
  attribution: agent 392s, code_review 211s, doc_generation 90s, and all eight
  other gates 2s COMBINED -- the gates are not the overhead.
• Factory's droid measured in the competitor surface audit; the head-to-head
  corpus now refuses a zero-result row without a positive control.

Loki Mode v9.19.1

Ships v9.19.0's payload, whose release was blocked by two CI failures of my own
making: a ShellCheck warning in a new test, and a suite whose failing assertion
moved between adjacent cases run to run.

Fixed

• The DA review cases now carry their own budget. Shard 2/4 failed three
  consecutive CI runs while the suite passed 43/43 locally, and the failing
  assertion MOVED between adjacent devils-advocate cases. A failure that
  relocates between neighbours is a shared environmental cause, not a defect in
  any one assertion. All four DA cases took the shared default budget, and that
  path dispatches a reviewer AND a speculative devils-advocate -- two sequential
  model calls under one budget. Now scaled explicitly: tight locally, generous on
  a contended runner. Verified 43/43 in both configurations.

• A failure message that named a cause it had not measured. "council dissent
  discarded a speculative DA blocker" asserted a fail-open across six shared
  conditions. Each clause now reports separately with the assertion text
  captured. The first attempt at this fix re-ran the assertions in the else
  branch, which passes on its own correct copy and reported an empty cause --
  the gating run is now captured once and branched on.

Added

• A measured page-weight budget for the dashboard bundle. It is a single
  788 KB file every user downloads before seeing anything, and nothing guarded
  its size. The budget is derived from three recorded measurements, and the
  positive control is load-bearing: a bare size check passes perfectly on a
  missing or truncated bundle.

Closes the spec-to-production loop. Two gaps, both of which broke the promise of
an end-to-end autonomous lifecycle.

Added

• A deploy is now authorized by a verified receipt, or refused. loki deploy
  was print-only: Loki built, verified, produced an Evidence Receipt, then handed
  the user a string to paste. --execute now runs the detected command, but only
  when the receipt's verdict is VERIFIED, its facts still hash to their digest, it
  anchors to the tree being deployed, and the tree is clean. UNSIGNED, UNCHECKED
  and TAMPERED all refuse, because integrity is not provenance. Fail-closed
  throughout: a check that cannot be evaluated is a refusal, and the refusal names
  which check could not run. Destructive operations are refused even with a valid
  receipt; git push and PR creation stay out of scope; Loki never reads cloud
  credentials. Every executed deploy writes its own receipt naming the command,
  exit code, anchor and authorizing run_id.

  Known limitation, stated rather than hidden: an unanchored receipt cannot
  authorize a deploy, and 8 of 9 receipts measured in this repo carry no
  baseline. --execute will refuse those by name. A per-invocation override
  covering "unknown" but never "known wrong" is the fix and is not in this
  release.

• The build pipeline is visible while it runs. dashboard/api_phases.py was
  262 lines of working phase-timeline parsing that nothing imported and nothing
  consumed. Now wired to an endpoint and a panel. An unmeasured duration renders
  as unmeasured rather than 0; not-started, running and failed are three distinct
  renderings, because collapsing not-started into running shows a stalled build as
  healthy; sampled or stale data is labelled as such.

Re-release of v9.18.3, whose release was blocked by a FALSE test failure of my
own making: a helm test guarded on helm and python3 but not on PyYAML, which
is not stdlib. Without it every manifest parse raised, the redirect swallowed
the traceback, and four assertions compared against empty strings -- reporting
"the scaling knob is not wired" about a chart that renders correctly. It now
skips with a named reason, and fails loudly if helm template cannot render at
all rather than blaming the knob for a chart-wide failure.

No product change from 9.18.3. The two false-green fixes below are the payload.

Fixed

• A failed remote build exited 0. loki start --remote was shipped in
  9.18.2 with the job status taken from the LAUNCH result, so a build that
  started and then failed reported success. Anyone gating CI on it got a green
  pipeline on a red build -- the exact defect class this product exists to
  prevent. Terminal statuses are now explicit: only passed means the build
  succeeded, failed means it ran and failed, and unknown (detached past the
  wait window, exit code never observed) fails CLOSED because an unobserved
  outcome is not a pass. queued and running are deliberately not terminal so
  a client can tell "not done yet" from "done and failed".

• A webhook credential could overwrite a job's terminal status. The same
  defect had a second door: job_id was honoured from any payload, and a GitHub
  webhook payload carries none of its own, so a holder of the webhook HMAC could
  supply one and flip passed back to fired. That is a webhook credential
  reaching a /jobs capability, which the separate-credential design exists to
  prevent. job_id is now honoured only for a remotely-submitted job.

Both were found by auditing delivered work rather than by a failing test, and
the second was more serious than the first: the first was a wrong default, the
second was a privilege boundary.

Third attempt to publish the session-killer fix. 9.18.0's release was blocked
when its Tests run was cancelled by later pushes; 9.18.1's gate failed because
the pushed commit contained an intermediate state where a test referenced a
method that did not exist yet. Both were my sequencing errors, not defects in
the fix. No code change from 9.18.1 beyond the receipt-verdict hardening below.

Fixed

• Remote receipt verdicts: a signature gpg cannot evaluate (public key absent)
  is reported as UNCHECKED, never TAMPERED (which would accuse a user of a
  forgery that did not happen) and never VERIFIED (which would claim provenance
  that was never established).
• docs/VERIFICATION-COST.md corrected: loki proof verify does not simply
  "exit 1 on tamper" -- an untampered receipt whose tree has drifted also exits
  1. Read hash_ok for integrity. A three-command reproduction is included.

Re-release of v9.18.0, whose release job was blocked when its Tests run was
cancelled by subsequent pushes to main (required-ci correctly refuses to treat
cancelled as a pass). No code change from 9.18.0 beyond the additions below.

Added

• A remote build's Evidence Receipt is verifiable without trusting the machine
  that produced it. GET /jobs/<id>/proof serves the receipt and its detached
  signature; loki start --remote re-hashes and verifies before reporting
  success, with four distinct verdicts: VERIFIED, UNSIGNED (integrity only, not
  provenance), UNCHECKED (signed but the key is absent, so it cannot be
  evaluated), and TAMPERED. UNCHECKED is deliberately not folded into either
  neighbour: calling it TAMPERED accuses a user of a forgery that did not
  happen, and calling it UNSIGNED is false about a receipt that is signed.

Fixed

• loki start could kill the user's other terminal sessions. This is the
  headline fix and it affects anyone running builds from a terminal that also
  holds an editor or agent session. reap_own_process_group() TERM/KILLs every
  PID sharing a recorded process group; .loki/loki.pgid was removed only on
  the normal exit path, so a Ctrl+C'd or crashed run left it behind. Measured on
  a real machine: five orphan files, the oldest 1435 hours (60 days). PIDs
  recycle (macOS wraps near 99999; max observed there was 99762), so a stale
  pgid eventually matches a LIVE unrelated shell group, the "is this my own
  group?" check passes, and every sibling in that terminal is killed.

  The file is now stamped pgid/boot/started; the reader requires the boot id
  to match this boot AND the stamp not to predate the reading process, which a
  recycled pgid cannot forge. Removal moved onto the EXIT trap, guarded on
  BASHPID rather than $$ (which does not change in a subshell). Fails closed:
  an unprovable stamp reaps nothing, because an orphaned agent is strictly less
  harmful than killing someone's editor.

• A green doctor recommended a command that exits 2. With the bundled SDK
  and no provider CLI, doctor PASSed and its final line said
  Next: loki quickstart -- which exits 2. A warning existed 520 lines above
  the recommendation and never reached it.

Added

• Deployment path. POST /jobs on the trigger server: an authenticated
  non-GitHub submit with a credential separate from the webhook HMAC,
  constant-time comparison, fail-closed 503 when unconfigured, and validation of
  untrusted spec input. Plus helm/loki-mode (receiver + worker + Redis) with
  one tenant per worker, a worker grace period that exceeds the drain budget,
  and a value-gated NetworkPolicy that carves the cloud metadata endpoint out of
  any operator-supplied CIDR.
• loki telemetry analytics on|off|status. The first-run funnel was gated on
  ANALYTICS_ENABLED, a key with no writer anywhere in the repo, so drop-off was
  structurally unmeasurable. Still default-off and opt-in.

Loki Mode v9.18.4

Re-release of v9.18.3, whose release was blocked by a FALSE test failure of my
own making: a helm test guarded on helm and python3 but not on PyYAML, which
is not stdlib. Without it every manifest parse raised, the redirect swallowed
the traceback, and four assertions compared against empty strings -- reporting
"the scaling knob is not wired" about a chart that renders correctly. It now
skips with a named reason, and fails loudly if helm template cannot render at
all rather than blaming the knob for a chart-wide failure.

No product change from 9.18.3. The two false-green fixes below are the payload.

Fixed

• A failed remote build exited 0. loki start --remote was shipped in
  9.18.2 with the job status taken from the LAUNCH result, so a build that
  started and then failed reported success. Anyone gating CI on it got a green
  pipeline on a red build -- the exact defect class this product exists to
  prevent. Terminal statuses are now explicit: only passed means the build
  succeeded, failed means it ran and failed, and unknown (detached past the
  wait window, exit code never observed) fails CLOSED because an unobserved
  outcome is not a pass. queued and running are deliberately not terminal so
  a client can tell "not done yet" from "done and failed".

• A webhook credential could overwrite a job's terminal status. The same
  defect had a second door: job_id was honoured from any payload, and a GitHub
  webhook payload carries none of its own, so a holder of the webhook HMAC could
  supply one and flip passed back to fired. That is a webhook credential
  reaching a /jobs capability, which the separate-credential design exists to
  prevent. job_id is now honoured only for a remotely-submitted job.

Both were found by auditing delivered work rather than by a failing test, and
the second was more serious than the first: the first was a wrong default, the
second was a privilege boundary.

Third attempt to publish the session-killer fix. 9.18.0's release was blocked
when its Tests run was cancelled by later pushes; 9.18.1's gate failed because
the pushed commit contained an intermediate state where a test referenced a
method that did not exist yet. Both were my sequencing errors, not defects in
the fix. No code change from 9.18.1 beyond the receipt-verdict hardening below.

Fixed

• Remote receipt verdicts: a signature gpg cannot evaluate (public key absent)
  is reported as UNCHECKED, never TAMPERED (which would accuse a user of a
  forgery that did not happen) and never VERIFIED (which would claim provenance
  that was never established).
• docs/VERIFICATION-COST.md corrected: loki proof verify does not simply
  "exit 1 on tamper" -- an untampered receipt whose tree has drifted also exits
  1. Read hash_ok for integrity. A three-command reproduction is included.

Re-release of v9.18.0, whose release job was blocked when its Tests run was
cancelled by subsequent pushes to main (required-ci correctly refuses to treat
cancelled as a pass). No code change from 9.18.0 beyond the additions below.

Added

• A remote build's Evidence Receipt is verifiable without trusting the machine
  that produced it. GET /jobs/<id>/proof serves the receipt and its detached
  signature; loki start --remote re-hashes and verifies before reporting
  success, with four distinct verdicts: VERIFIED, UNSIGNED (integrity only, not
  provenance), UNCHECKED (signed but the key is absent, so it cannot be
  evaluated), and TAMPERED. UNCHECKED is deliberately not folded into either
  neighbour: calling it TAMPERED accuses a user of a forgery that did not
  happen, and calling it UNSIGNED is false about a receipt that is signed.

Fixed

• loki start could kill the user's other terminal sessions. This is the
  headline fix and it affects anyone running builds from a terminal that also
  holds an editor or agent session. reap_own_process_group() TERM/KILLs every
  PID sharing a recorded process group; .loki/loki.pgid was removed only on
  the normal exit path, so a Ctrl+C'd or crashed run left it behind. Measured on
  a real machine: five orphan files, the oldest 1435 hours (60 days). PIDs
  recycle (macOS wraps near 99999; max observed there was 99762), so a stale
  pgid eventually matches a LIVE unrelated shell group, the "is this my own
  group?" check passes, and every sibling in that terminal is killed.

  The file is now stamped pgid/boot/started; the reader requires the boot id
  to match this boot AND the stamp not to predate the reading process, which a
  recycled pgid cannot forge. Removal moved onto the EXIT trap, guarded on
  BASHPID rather than $$ (which does not change in a subshell). Fails closed:
  an unprovable stamp reaps nothing, because an orphaned agent is strictly less
  harmful than killing someone's editor.

• A green doctor recommended a command that exits 2. With the bundled SDK
  and no provider CLI, doctor PASSed and its final line said
  Next: loki quickstart -- which exits 2. A warning existed 520 lines above
  the recommendation and never reached it.

Added

• Deployment path. POST /jobs on the trigger server: an authenticated
  non-GitHub submit with a credential separate from the webhook HMAC,
  constant-time comparison, fail-closed 503 when unconfigured, and validation of
  untrusted spec input. Plus helm/loki-mode (receiver + worker + Redis) with
  one tenant per worker, a worker grace period that exceeds the drain budget,
  and a value-gated NetworkPolicy that carves the cloud metadata endpoint out of
  any operator-supplied CIDR.
• loki telemetry analytics on|off|status. The first-run funnel was gated on
  ANALYTICS_ENABLED, a key with no writer anywhere in the repo, so drop-off was
  structurally unmeasurable. Still default-off and opt-in.

Loki Mode v9.18.2

Third attempt to publish the session-killer fix. 9.18.0's release was blocked
when its Tests run was cancelled by later pushes; 9.18.1's gate failed because
the pushed commit contained an intermediate state where a test referenced a
method that did not exist yet. Both were my sequencing errors, not defects in
the fix. No code change from 9.18.1 beyond the receipt-verdict hardening below.

Fixed

• Remote receipt verdicts: a signature gpg cannot evaluate (public key absent)
  is reported as UNCHECKED, never TAMPERED (which would accuse a user of a
  forgery that did not happen) and never VERIFIED (which would claim provenance
  that was never established).
• docs/VERIFICATION-COST.md corrected: loki proof verify does not simply
  "exit 1 on tamper" -- an untampered receipt whose tree has drifted also exits
  1. Read hash_ok for integrity. A three-command reproduction is included.

Re-release of v9.18.0, whose release job was blocked when its Tests run was
cancelled by subsequent pushes to main (required-ci correctly refuses to treat
cancelled as a pass). No code change from 9.18.0 beyond the additions below.

Added

• A remote build's Evidence Receipt is verifiable without trusting the machine
  that produced it. GET /jobs/<id>/proof serves the receipt and its detached
  signature; loki start --remote re-hashes and verifies before reporting
  success, with four distinct verdicts: VERIFIED, UNSIGNED (integrity only, not
  provenance), UNCHECKED (signed but the key is absent, so it cannot be
  evaluated), and TAMPERED. UNCHECKED is deliberately not folded into either
  neighbour: calling it TAMPERED accuses a user of a forgery that did not
  happen, and calling it UNSIGNED is false about a receipt that is signed.

Fixed

• loki start could kill the user's other terminal sessions. This is the
  headline fix and it affects anyone running builds from a terminal that also
  holds an editor or agent session. reap_own_process_group() TERM/KILLs every
  PID sharing a recorded process group; .loki/loki.pgid was removed only on
  the normal exit path, so a Ctrl+C'd or crashed run left it behind. Measured on
  a real machine: five orphan files, the oldest 1435 hours (60 days). PIDs
  recycle (macOS wraps near 99999; max observed there was 99762), so a stale
  pgid eventually matches a LIVE unrelated shell group, the "is this my own
  group?" check passes, and every sibling in that terminal is killed.

  The file is now stamped pgid/boot/started; the reader requires the boot id
  to match this boot AND the stamp not to predate the reading process, which a
  recycled pgid cannot forge. Removal moved onto the EXIT trap, guarded on
  BASHPID rather than $$ (which does not change in a subshell). Fails closed:
  an unprovable stamp reaps nothing, because an orphaned agent is strictly less
  harmful than killing someone's editor.

• A green doctor recommended a command that exits 2. With the bundled SDK
  and no provider CLI, doctor PASSed and its final line said
  Next: loki quickstart -- which exits 2. A warning existed 520 lines above
  the recommendation and never reached it.

Added

• Deployment path. POST /jobs on the trigger server: an authenticated
  non-GitHub submit with a credential separate from the webhook HMAC,
  constant-time comparison, fail-closed 503 when unconfigured, and validation of
  untrusted spec input. Plus helm/loki-mode (receiver + worker + Redis) with
  one tenant per worker, a worker grace period that exceeds the drain budget,
  and a value-gated NetworkPolicy that carves the cloud metadata endpoint out of
  any operator-supplied CIDR.
• loki telemetry analytics on|off|status. The first-run funnel was gated on
  ANALYTICS_ENABLED, a key with no writer anywhere in the repo, so drop-off was
  structurally unmeasurable. Still default-off and opt-in.

Loki Mode v9.17.2

Ships the tree v9.17.0 and v9.17.1 were both meant to. 9.17.0 on npm carries
gitHead 00b9f4e (an older commit, published by a concurrent release run) so it
lacks the fixes its changelog describes; 9.17.1 was blocked by required-ci while
shell shard 2/4 was red. That shard now passes. No code change beyond the test
fixes below.

Fixed

• Review-assurance timing assertions now scale on a contended CI runner and
  report which clause failed. Measured: idle 43/43, CPU-saturated fails at a
  different assertion each run, load removed 43/43 -- one environmental
  sensitivity, not the four defects it was patched as. Two assertions compared
  a scaled budget against the literal it replaced.

Loki Mode v9.17.0

Sixteen commits of trust-layer repair. The theme: six of these were FALSE
SIGNALS, not missing features. The machinery was built and telling users
things that were not true.

Fixed

• The receipt could never be verified. facts.git.base_sha was empty on
  every receipt, so resolve_anchor() returned unanchored/base_sha_empty and
  the dashboard honestly reported "9 receipts, 0 verified". The baseline was on
  disk at .loki/state/start-sha the whole time and both other consumers read
  it; the receipt writer was the only one that did not. First anchored receipt
  in this repo's history.
• A crashed queue worker silently lost the user's build. The redis backend
  was at-most-once: pop, crash, item gone, no record anywhere. Proven against a
  real redis 8.6.3 before the fix. Now LMOVE (RPOPLPUSH pre-6.2) with the ack
  only after a zero-exit build. LOKI_QUEUE_ACK=0 restores the old path.
• Quality showed eight gates as "Last checked: Never" on a repo holding
  nine receipts, because /api/council/gate served static defaults. Now reads
  the newest receipt. Only gates the receipt names are filled in; the rest stay
  pending with no timestamp.
• Harness failures were reported as Critical defects in the user's code.
  All 16 findings read "Critical" and all 16 were the REVIEWER failing to
  answer. Split severity from confidence: these now carry [unverified] and
  say plainly that the review harness failed, not the code. Still blocks.
• loki steer told users to set a value the runner rejected. The CLI
  printed export LOKI_PROMPT_INJECTION=1; the runner tested != "true" only,
  so a note followed exactly was moved to a REJECTED log unread.
• 34 dashboard tokens were consumed but never defined, silently falling
  back to light-mode literals, so status colours were wrong in dark mode.

Added

• loki gates -- what blocks here, what only advises, how many times each has
  fired, and the exact variable that promotes an advisory gate. An unmeasured
  gate reports "not measured", never 0.
• loki readiness --fix -- writes the missing files whose content can be
  derived honestly, and REFUSES to fabricate a test command, lockfile or CI
  config. Guessing one makes the score green while the capability is absent.
• queue-consumer.sh --reap -- requeues in-flight items past
  LOKI_QUEUE_VISIBILITY_SEC (default 7200). A fresh claim is never reaped; an
  item with no claim is treated as infinitely old.
• Stable acceptance-criterion IDs (AC-AUTH-001) on both intake paths, so a
  receipt can cite a criterion instead of listing prose.
• The verdict on the Slack card: gate results, changed files, receipt id. An
  unanchored receipt reports "Verified: no", not a diff count.
• Product chrome runs sans; Fraunces went 11 occurrences to 1 in the shipped
  bundle and is no longer downloaded. Status carries a glyph plus aria-label,
  not colour alone.

Documented

• docs/VERIFICATION-COST.md now carries the measured harness comparison,
  INCLUDING the task where the harness bought nothing and cost 2.9x more, and
  a live false-green exclusion where a trial the grader PASSED was thrown out
  because the run timed out. It also states plainly that no 2-10x number
  against Factory/Devin/8090/Replit exists here, because none of them has a
  runnable local arm.

Loki Mode v9.16.0

Completes the 10-item competitive roadmap.

Added

• Agent readiness -- a measurement where the competitor ships an opinion.
  Factory AI's Agent Readiness Model records modelUsed and reasoningEffort
  per report, so its score is a model's opinion and two runs can disagree about
  the same commit. Ours is filesystem facts: three runs of the same repo produce
  byte-identical output, with no key, no spend and no network. It asks the
  narrower question our product depends on, can an agent verify itself here,
  and does not duplicate the deterministic maturity rubric
  loki modernize heal --assess already ships.

• SCIM 2.0 provisioning. Measured before building: OIDC is real here (76
  references in dashboard/auth.py) and SAML and SCIM were both zero. The gap was
  never authentication, it was PROVISIONING -- with OIDC alone a terminated
  employee stops being able to log in while an already-issued token keeps
  working. IdP groups map onto the scope hierarchy auth.py already enforces, so
  there is one authorization model rather than two that drift. An unknown group
  maps to the lowest scope, and a corrupt store denies rather than reading as
  "nobody provisioned"; both are mutation-checked. Deprovisioning is soft by
  default because an audit log that cannot say who acted is not an audit log.

• loki verdict -- the five measured signals, where a reviewer sees them.
  A moat nobody sees is not a moat. One block, five lines, each a measured fact
  or an explicit UNKNOWN, rendered into the Evidence Receipt already attached to
  PRs. No composite score: averaging a revert count, a hash comparison and a
  model id yields a number nobody can explain, which is what competitors already
  ship. UNKNOWN lines are printed, never hidden.

• docs/VERIFICATION-COST.md -- what our verification costs, and what it does
  not prove. The FULL gate takes 23 to 26 minutes and we do not offer a mode
  that makes it free. The page states that the unsigned receipt path is
  forgeable, that only four of eight gates are agent-independent, that
  verification cannot prove the spec was right, and that 0 of 9 of our own
  receipts are anchored so loki outcomes reports UNKNOWN for all of them. A
  14-assertion test keeps it true rather than merely present.

Loki Mode v9.12.6

Added

• Loop-harness measurement without invented outcomes. The new read-only
  report derives routing and verification evidence from existing receipts and
  emits an explicit absent-data state when no measurement exists.

Fixed

• The dashboard survives deletion of its launch directory. A long-running
  dashboard whose original temporary working directory has been removed no
  longer turns unrelated endpoints into HTTP 500 responses. Runtime path
  resolution now degrades safely, optional collaboration persistence disables
  itself when its base cannot be resolved, and PRD path confinement still
  fails closed.
• loki verify works on stock macOS Bash 3.2. A quoted-heredoc comment no
  longer breaks parsing, and the Bash 3.2 gate now checks shipped entrypoints
  rather than test scripts alone.
• CP-1 and disclosure gates are portable on macOS. Help-recursion limits
  are relative to the measured per-user process baseline; Bash/Bun parity and
  telemetry fixtures handle legitimate empty arrays under Bash 3.2; model
  override, contradiction, assurance-tail, and absent-state fixtures now fail
  on product regressions rather than harness assumptions.
• The local release gate self-heals a recurring bare parent checkout. The
  repair is bounded to the known parent checkout and retains fail-closed test
  and export behavior.
• Onboarding no longer loses its output to SIGPIPE when repository file
  enumeration exceeds the preview limit.