This release includes 4 breaking changes for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Topics
+13 more
Affected surfaces
Summary
AI summaryVerification gates are now fully implemented and block as documented, with four new functional gates added and two phantom gates removed.
Full changelog
Verification-credibility sweep (the trust layer is now honest and real)
This release makes Loki's verification layer match its claims. An internal audit
found gates that were advertised but hollow, unwired, or described inaccurately.
The fix: make every gate real or stop claiming it. The deterministic gate set is
now an honest 8.
- Mock-integrity and test-mutation detectors are now wired as blocking gates.
tests/detect-mock-problems.shandtests/detect-test-mutations.shexisted but
were never invoked by the build loop. They now run every iteration: HIGH-severity
findings block; Medium/Low are advisory and injected into the next iteration.
Opt out withLOKI_GATE_MOCK=0/LOKI_GATE_MUTATION=0. Both detectors honor
LOKI_SCAN_DIRso they scan the target project, not the Loki install. - Anti-sycophancy now acts, not just logs. On a unanimous code-review PASS, a
Devil's-Advocate reviewer is dispatched; a Critical/High finding blocks
completion. Previously this path only wrote an audit note. Opt out with
LOKI_GATE_DEVILS_ADVOCATE=0. - Test-coverage gate honesty. The gate ran tests for pass/fail but never
measured a coverage percentage, while docs claimed ">80% coverage". Docs and
log labels now state pass/fail accurately; themin_coverageJSON field is
retained as a target. Real coverage measurement is a planned follow-up. - Phantom gates removed. "Input Guardrails" and "Output Guardrails" were
listed among the gates but had no implementation. Removed. The canonical count
is now 8: static analysis, test suite (pass/fail), blind 3-reviewer code review
with severity blocking, anti-sycophancy Devil's Advocate, mock integrity, test
mutation, documentation coverage, and Magic Modules debate. Backward-compat is a
conditional healing-mode auditor, not one of the 8. - Severity-blocking documented accurately. Code-review blocks on Critical/High
only; Medium/Low are advisory. Docs and the dashboard-served gate list now match
the code (previously several surfaces said Medium blocks). - Bun-route parity for the new gates and the Devil's-Advocate toggle in
loki-ts/src/runner/quality_gates.ts. - Regression guards added (
tests/test-p0-verification-sweep.sh,
tests/test-p0-gate-behavior.sh, wired into local-ci) so gate-count and
severity-blocking claims cannot silently drift again.
Reviewed by a 3-of-3 unanimous completion council. No runtime behavior changes
beyond the gates now actually blocking on the conditions documented.
Breaking Changes
- Removed 'Input Guardrails' and 'Output Guardrails' gates – they were undocumented placeholders.
- Mock‑integrity detector (`tests/detect-mock-problems.sh`) now runs as a blocking gate by default; opt out with `LOKI_GATE_MOCK=0`.
- Test‑mutation detector (`tests/detect-test-mutations.sh`) now runs as a blocking gate by default; opt out with `LOKI_GATE_MUTATION=0`.
- Anti‑sycophancy (Devil's Advocate) reviewer is dispatched and blocks on Critical/High findings; opt out with `LOKI_GATE_DEVILS_ADVOCATE=0`.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Loki Mode
Multi-agent autonomous SDLC framework. Spec to deployed app. PRD, GitHub issue, OpenAPI/JSON/YAML, or one-line brief. 5 AI providers, 11 quality gates.
Related context
Related tools
Beta — feedback welcome: [email protected]