This release adds 2 notable features for engineering teams evaluating rollout.
✓ No known CVEs patched in this version
Topics
+13 more
Affected surfaces
Summary
AI summaryAudit manifest linking/verification and compliance snapshot commands are now reachable on demand and invariant findings are surfaced into prompts.
Full changelog
Reachable audit helpers + invariant-findings prompt surfacing
- Audit/compliance CLI commands (
autonomy/loki): the manifest tamper-evidence
helpers (v7.55 linkManifest/verifyManifestLink) and the compliance snapshot
scheduler (v7.54 maybeGenerateSnapshot) shipped as tested-but-not-invoked.
They are now reachable on demand:loki audit link-manifest [dir]hashes the
run manifest into the audit chain,loki audit verify-manifest [dir]checks it
(detects tamper), andloki compliance snapshot [dir] [--force]generates a
compliance snapshot (respecting the default-disabled interval unless --force).
All are explicit on-demand commands (never gate or slow a run); honest no-op
when the manifest is absent. - Invariant-findings surfaced into the prompt (
loki-ts/src/runner/build_prompt.ts):
the invariant gate wrote.loki/quality/invariant-findings.txtbut nothing read
it into the next-iteration prompt (the actionable per-finding text was not
surfaced). build_prompt.ts now reads and injects it, mirroring the semantic-
findings consumer. Closes the writer-with-no-reader on the prompt side.
Gates: local-ci 83/83, bun tests + parity green, 2-reviewer council APPROVE (both
verified the CLI commands work empirically and the prompt injection reaches the
rendered prompt).
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Loki Mode
Multi-agent autonomous SDLC framework. Spec to deployed app. PRD, GitHub issue, OpenAPI/JSON/YAML, or one-line brief. 5 AI providers, 11 quality gates.
Related context
Related tools
Beta — feedback welcome: [email protected]