feat: ship issue-to-PR harness and execution cockpit

autonomy/issue-parser.sh

@@ -247,6 +247,110 @@ extract_type_from_labels() {
 #===============================================================================
 
 # Parse a GitHub issue and output structured data
+#===============================================================================
+# Golden path: issue context + early plan
+#===============================================================================
+
+# Split the extracted acceptance-criteria blob into one normalized item per
+# line. Keeps ONLY genuine list items (checkbox / bullet / numbered) so a
+# section heading or a stray prose line never becomes a fake "criterion".
+# Prints nothing when there is nothing to print -- an empty criteria list is a
+# truthful answer, and inventing one would poison every downstream coverage
+# claim.
+_gp_criteria_lines() {
+    printf '%s\n' "${1:-}" \
+        | sed -E 's/^[[:space:]]*[-*][[:space:]]*\[[ xX]\][[:space:]]*//; s/^[[:space:]]*[-*][[:space:]]+//; s/^[[:space:]]*[0-9]+[.)][[:space:]]+//' \
+        | grep -vE '^[[:space:]]*$' \
+        | grep -vE '^[[:space:]]*-{3,}[[:space:]]*$'
+}
+
+# write_journey_context <owner> <repo> <number> <title> <url> <acceptance>
+#                       <files> <type> <priority>
+#
+# Writes .loki/state/issue-context.json (feature 2: the exact acceptance context)
+# and .loki/state/journey-plan.json (feature 3: the early machine-readable
+# status/plan). Both are written from `gh` output BEFORE the first provider
+# call, so the early artifact is deterministic rather than latency-dependent.
+#
+# Never fails the caller: every write is best-effort and the function always
+# returns 0. Honors LOKI_DIR so a test can point it at a scratch directory.
+write_journey_context() {
+    local owner="$1" repo="$2" number="$3" title="$4" url="$5"
+    local acceptance="$6" files="$7" issue_type="$8" priority="$9"
+
+    local state_dir="${LOKI_DIR:-.loki}/state"
+    mkdir -p "$state_dir" 2>/dev/null || return 0
+
+    local criteria
+    criteria=$(_gp_criteria_lines "$acceptance")
+
+    # jq builds both documents so quoting/escaping is handled once, correctly.
+    command -v jq >/dev/null 2>&1 || return 0
+
+    local ctx_tmp="$state_dir/.issue-context.$$.json"
+    if jq -n \
+        --arg owner "$owner" --arg repo "$repo" --arg number "$number" \
+        --arg title "$title" --arg url "$url" --arg criteria "$criteria" \
+        --arg files "$files" --arg type "$issue_type" --arg priority "$priority" \
+        --arg captured_at "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
+        '{
+            schema_version: "1.0",
+            captured_at: $captured_at,
+            issue: {
+                owner: $owner, repo: $repo,
+                number: (try ($number | tonumber) catch null),
+                ref: ($owner + "/" + $repo + "#" + $number),
+                url: $url, title: $title,
+                type: $type, priority: $priority
+            },
+            acceptance_criteria: (
+                if ($criteria | length) == 0 then []
+                else ($criteria | split("\n") | map(select(length > 0)))
+                end
+            ),
+            file_references: (
+                if ($files | length) == 0 then []
+                else ($files | split("\n") | map(select(length > 0)))
+                end
+            )
+        }' > "$ctx_tmp" 2>/dev/null; then
+        mv -f "$ctx_tmp" "$state_dir/issue-context.json" 2>/dev/null || rm -f "$ctx_tmp"
+    else
+        rm -f "$ctx_tmp" 2>/dev/null || true
+    fi
+
+    # The early plan is a PLAN, not a result: it states what was understood and
+    # what will be attempted. It deliberately carries no outcome fields -- a
+    # status file that guessed at outcomes before any work happened would be the
+    # exact fake-green this repo's trust core forbids.
+    local plan_tmp="$state_dir/.journey-plan.$$.json"
+    if jq -n \
+        --arg ref "$owner/$repo#$number" --arg title "$title" --arg url "$url" \
+        --arg criteria "$criteria" \
+        --arg generated_at "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
+        '{
+            schema_version: "1.0",
+            command: "loki start",
+            mode: "issue",
+            stage: "planned",
+            generated_at: $generated_at,
+            issue: { ref: $ref, title: $title, url: $url },
+            acceptance_criteria: (
+                if ($criteria | length) == 0 then []
+                else ($criteria | split("\n") | map(select(length > 0)))
+                end
+            ),
+            provider_invoked: false,
+            next: "implement, verify, then review-ready result with evidence receipt"
+        }' > "$plan_tmp" 2>/dev/null; then
+        mv -f "$plan_tmp" "$state_dir/journey-plan.json" 2>/dev/null || rm -f "$plan_tmp"
+    else
+        rm -f "$plan_tmp" 2>/dev/null || true
+    fi
+
+    return 0
+}
+
 parse_github_issue() {
     local issue_ref="$1"
     local output_format="${2:-yaml}"  # yaml or json
@@ -303,6 +407,14 @@ parse_github_issue() {
     priority=$(extract_priority_from_labels "$labels_json")
     issue_type=$(extract_type_from_labels "$labels_json")
 
+    # Golden path (feature 2): persist the EXACT criteria we just extracted, plus
+    # the early machine-readable plan (feature 3), before any provider call. Both
+    # are derived from `gh` output only, so the early artifact does not depend on
+    # provider latency at all. Best-effort: a failure here must never break issue
+    # parsing, which is why it is guarded and ignores its own exit status.
+    write_journey_context "$owner" "$repo" "$number" "$title" "$url" \
+        "$acceptance_criteria" "$file_references" "$issue_type" "$priority" || true
+
     # Output based on format
     if [ "$output_format" = "json" ]; then
         output_json "$owner" "$repo" "$number" "$title" "$body" "$problem_statement" \

autonomy/lib/proof-generator.py

@@ -990,6 +990,78 @@ def _collect_iterations(loki_dir):
     return {"count": count, "succeeded": n_completed, "failed": n_failed}
 
 
+def _collect_journey(loki_dir):
+    """Issue-to-PR journey facts (golden path features 4 and 10).
+
+    Descriptive record half ONLY. Like `functional` and `healthcheck`, this is
+    NOT read by _compute_headline / _compute_degraded: nothing here can turn a
+    receipt green or make a blocked run look finished.
+
+    Every field is absent-not-zero. A measurement that did not happen renders
+    nothing rather than a fabricated 0, matching run.sh:4258 ("a wrong timing
+    table is worse than silence"). Returns {} when this run was not an
+    issue-mode run, so a PRD/brief run's proof bytes are unchanged.
+    """
+    state = os.path.join(loki_dir, "state")
+    ctx = _read_json(os.path.join(state, "issue-context.json"), default=None)
+    if not isinstance(ctx, dict):
+        return {}
+
+    issue = ctx.get("issue") if isinstance(ctx.get("issue"), dict) else {}
+    stated = ctx.get("acceptance_criteria")
+    stated = [str(c) for c in stated] if isinstance(stated, list) else []
+
+    out = {
+        "issue": {
+            "ref": str(issue.get("ref") or ""),
+            "url": str(issue.get("url") or ""),
+            "title": str(issue.get("title") or ""),
+        },
+        # Coverage is a CORRESPONDENCE, not a verdict. There is no deterministic
+        # checker for free-text criteria, so we report what the issue stated and
+        # decline to claim any of it was satisfied. `addressed` is deliberately
+        # null rather than 0: 0 would read as "none met", which we do not know.
+        "acceptance": {
+            "stated": stated,
+            "stated_count": len(stated),
+            "addressed_count": None,
+            "basis": "criteria imported verbatim from the issue; no "
+                     "deterministic checker exists for free-text criteria, so "
+                     "this receipt reports what was ASKED, never what was met",
+        },
+    }
+
+    # Time to first useful result. Reuses the number run.sh already writes; we
+    # do not add a second writer and we never synthesize the value.
+    fa = _read_json(os.path.join(state, "first-artifact.json"), default=None)
+    if isinstance(fa, dict):
+        v = fa.get("seconds_to_first_artifact")
+        if isinstance(v, (int, float)) and v >= 0:
+            out["time_to_first_result_sec"] = int(v)
+
+    # Human interventions. Fills the socket trust_trajectory.py:145 already
+    # reads and documents as "no per-run counter persisted today". Absent file
+    # means unmeasured, NOT zero -- claiming a confident 0 would overstate
+    # autonomy, which is the one direction this number must never err in.
+    iv = _read_json(os.path.join(state, "interventions.json"), default=None)
+    if isinstance(iv, dict):
+        n = iv.get("count")
+        if isinstance(n, int) and n >= 0:
+            out["interventions"] = n
+
+    # PR state/URL, written by the consent-gated PR step. "prepared" means a PR
+    # body exists locally and GitHub was NOT mutated.
+    pr = _read_json(os.path.join(state, "pr.json"), default=None)
+    if isinstance(pr, dict) and pr.get("state"):
+        out["pull_request"] = {
+            "state": str(pr.get("state")),
+            "url": str(pr.get("url") or ""),
+            "branch": str(pr.get("branch") or ""),
+        }
+
+    return out
+
+
 def _collect_spec(loki_dir, target_dir):
     """Return spec dict {source, brief}. brief truncated to 600 chars."""
     prd_path = os.environ.get("PRD_PATH", "").strip()
@@ -1158,6 +1230,7 @@ def _build_proof(args, loki_dir, target_dir, repo_root):
     healthcheck = _collect_healthcheck(loki_dir)  # Evidence Receipt record-half
     evidence_gate = _collect_evidence_gate(loki_dir)
     functionality = _collect_functionality(loki_dir)  # func axes as HONEST facts
+    journey = _collect_journey(loki_dir)  # issue-to-PR record half; {} when N/A
 
     deployed_url = os.environ.get("LOKI_DEPLOYED_URL") or None
 
@@ -1238,6 +1311,12 @@ def _build_proof(args, loki_dir, target_dir, repo_root):
         },
     }
 
+    # Issue-to-PR journey facts, attached ONLY on an issue-mode run so a PRD or
+    # brief run's proof bytes stay exactly as they were. Record half: descriptive
+    # only, never read by _compute_headline / _compute_degraded.
+    if journey:
+        facts["journey"] = journey
+
     # ASSESSMENTS: LLM opinions. Explicitly labeled as judgment, NOT proof. A
     # green council verdict is an opinion that can be wrong or gamed; it never
     # contributes to the deterministic headline.
@@ -1351,6 +1430,15 @@ def _build_proof(args, loki_dir, target_dir, repo_root):
         "assessments": assessments,
         "honesty": honesty,
     }
+
+    # Top-level mirror for the intervention axis. trust_trajectory.py:145 already
+    # reads proof["interventions"] and documents that no writer exists yet; this
+    # is that writer. Mirrored (not moved) for the same back-compat reason the
+    # other flat keys are mirrored. Only ever set when actually measured, so the
+    # axis stays honestly "unavailable" rather than showing a fabricated zero.
+    if isinstance(journey, dict) and isinstance(journey.get("interventions"), int):
+        proof["interventions"] = journey["interventions"]
+
     return proof, run_id
 
 

autonomy/lib/proof-pr.sh

@@ -206,6 +206,58 @@ def main():
         _line("| Gates disabled | " + ", ".join(sorted(_off)) + " |")
     _line("| Base sha | `" + (base_sha or "(none)") + "` |")
     _line("| Head sha | `" + (head_sha or "(none)") + "` |")
+
+    # Issue-to-PR journey rows. Emitted ONLY on an issue-mode run, and each row
+    # ONLY when that fact was actually measured -- an unmeasured number renders
+    # no row rather than a zero, the same rule the rest of this receipt follows.
+    journey = facts.get("journey") if isinstance(facts.get("journey"), dict) else {}
+    if journey:
+        jissue = journey.get("issue") if isinstance(journey.get("issue"), dict) else {}
+        jref = str(jissue.get("ref") or "").strip()
+        jurl = str(jissue.get("url") or "").strip()
+        if jref:
+            _line("| Issue | " + (("[" + jref + "](" + jurl + ")") if jurl else jref) + " |")
+
+        ttfr = journey.get("time_to_first_result_sec")
+        if isinstance(ttfr, int):
+            _line("| Time to first result | " + str(ttfr) + "s |")
+
+        ivs = journey.get("interventions")
+        if isinstance(ivs, int):
+            _line("| Human interventions | " + str(ivs) + " |")
+
+        acc = journey.get("acceptance") if isinstance(journey.get("acceptance"), dict) else {}
+        n_stated = acc.get("stated_count")
+        if isinstance(n_stated, int):
+            # Reported as ASKED, never as met. addressed_count is null by design
+            # (no deterministic checker for free-text criteria), so this row must
+            # never be phrased as coverage or a pass -- that would be the exact
+            # fake-green the headline rules forbid.
+            _line("| Acceptance criteria | " + str(n_stated)
+                  + " stated in the issue (not machine-verified) |")
+
+        pr = journey.get("pull_request") if isinstance(journey.get("pull_request"), dict) else {}
+        pr_state = str(pr.get("state") or "").strip()
+        if pr_state:
+            pr_url = str(pr.get("url") or "").strip()
+            _line("| Pull request | " + pr_state + ((" -- " + pr_url) if pr_url else "") + " |")
+
+        # Rollback: derived from the base sha this run started at, so the reader
+        # gets a runnable command rather than a promise. Only emitted when the
+        # base is actually known.
+        if base_sha:
+            _line("| Rollback | `git reset --hard " + base_sha + "` |")
+
+        # Uncertainty: the honest count of checks that did NOT conclusively pass,
+        # read from the SAME honesty.degraded[] the headline is computed from, so
+        # it can never disagree with the verdict above it.
+        _degraded = honesty.get("degraded")
+        _degraded = _degraded if isinstance(_degraded, list) else []
+        if effective_headline == "VERIFIED" and not _degraded:
+            _line("| Uncertainty | none recorded; every check that ran concluded |")
+        elif _degraded:
+            _line("| Uncertainty | " + str(len(_degraded))
+                  + " check(s) not conclusive -- see the list below |")
     _line()
 
     # Gaps: when headline != VERIFIED, list honesty.degraded[] verbatim. By