npm - loki-mode - Versions diffs - 10.1.1 → 10.2.1 - Mend

loki-mode 10.1.1 → 10.2.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (68) hide show

package/SKILL.md CHANGED Viewed

@@ -3,7 +3,7 @@ name: loki-mode
 description: Autonomous spec-driven build system with a built-in trust layer. It does not call work done until it is verified (RARV-C closure loop, 8 quality gates, completion council, verified-completion evidence gate). Triggers on "Loki Mode". Takes a spec (PRD, GitHub issue, OpenAPI doc, etc.) to deployed product with minimal human intervention. Provider-agnostic. Requires --dangerously-skip-permissions flag.
 ---
-# Loki Mode v10.1.1
+# Loki Mode v10.2.1
 **You are an autonomous agent. You make decisions. You do not ask questions. You do not stop.**
@@ -470,4 +470,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 ---
-**v10.1.1 | [Autonomi](https://www.autonomi.dev/) flagship product | ~410 lines core**
+**v10.2.1 | [Autonomi](https://www.autonomi.dev/) flagship product | ~410 lines core**

package/VERSION CHANGED Viewed

	@@ -1 +1 @@
1	- 10.1.1
1	+ 10.2.1

package/dashboard/__init__.py CHANGED Viewed

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
-__version__ = "10.1.1"
+__version__ = "10.2.1"
 # Expose the control app for easy import
 try:

package/docs/INSTALLATION.md CHANGED Viewed

@@ -2,7 +2,7 @@
 The flagship product of [Autonomi](https://www.autonomi.dev/). Loki Mode is a spec-driven autonomous builder with a built-in trust layer that takes any spec to a deployed product and verifies completion with evidence (quality gates plus a completion council), not just a "done" claim. Complete installation instructions for all platforms and use cases.
-**Version:** v10.1.1
+**Version:** v10.2.1
 ---

package/docs/v10/BOARD.md CHANGED Viewed

@@ -344,58 +344,73 @@ set is declared to avoid overlap with those and with each other.
 | E-57 | Line reclaim: engine10 back to 4,700 or fewer by deleting dead exports and duplicated helpers, no behavior change | loki-ts/src/engine10/ (deletions only, no new files) | LOW | cd loki-ts && bun test tests/engine10/ && bunx tsc --noEmit; budget.test count at or below 4700 | released@2026-09-28T02:38Z | Source: train E10 hit 5,019 and needed a header trim; E-36, E-45 and E-52..E-56 need room. Merge after the gate-path slices to avoid conflicts. Dispatched after train E13. Merged 3ab2a8fa (train E14, rebased on main): engine10 404 pass 0 fail (402 pass 0 fail with claude removed from PATH), tsc exit 0, test-harness 86/0, test-local-ci-gitleaks 6/0, test-engine10-dist 18/0. Released v9.81.0 (npm view loki-mode time: 2026-09-28T02:38:54Z). |
 | EV-10 | Harness reaps arm descendants that escape the timeout process group: after the cap, KILL recorded PIDs under the run clone (.loki/**/*.pid) and processes whose cwd is inside that run-owned clone; guard in docs/v10/GUARDS.md | eval/loki10/harness.py (kill_orphans only), eval/loki10/test-harness.sh (one leg), docs/v10/GUARDS.md (one entry) | HIGH | bash eval/loki10/test-harness.sh; a fixture arm that setsid-spawns a sleeper leaves no live process after the cap | released@2026-09-28T02:38Z | Source: incident 00:08Z, pulse ORPHAN_WORKTREE caught 4 legacy /tmp/loki-run-*.sh loops (ppid 1, 30 min, 15-min cap) plus 2 sleep 300 children from run dir loki-run.u6ikBxCT; stopped by PID (kill -TERM 58249 58251 58633 58634 57049 56916, ps -p afterwards empty). Never match by name. Opus CONCERN: Linux /proc/<pid> mtime is not process start, so the age filter passes everything. Rework dispatched. Merged 3ab2a8fa (train E14, rebased on main): engine10 404 pass 0 fail (402 pass 0 fail with claude removed from PATH), tsc exit 0, test-harness 86/0, test-local-ci-gitleaks 6/0, test-engine10-dist 18/0. Released v9.81.0 (npm view loki-mode time: 2026-09-28T02:38:54Z). |
 | E-60 | Secret-scan guard before push: scripts/local-ci.sh fast tier runs gitleaks v8.30.0 with .gitleaksignore over origin/main..HEAD when the binary is present (SKIP line, not green, when absent); fixtures must build secret-shaped strings at runtime; entry in docs/v10/GUARDS.md | scripts/local-ci.sh (one step), tests/test-local-ci-gitleaks.sh, docs/v10/GUARDS.md | MEDIUM | bash tests/test-local-ci-gitleaks.sh: a commit adding a planted AKIA fixture fails the step; the same fixture built by concatenation passes | released@2026-09-28T02:38Z | Source: incident 00:45Z. Security Audit gitleaks failed on 9dc0b1d3 and 085306ae (3 findings: deep.test.ts aws-access-token, test-engine10-push-gitlab.sh gitlab-pat, rule_of_two.test.ts generic-api-key, all synthetic), so v9.79.0 and v9.80.0 never reached npm (npm view loki-mode version = 9.78.0). Baselined in 5190756f; local full-history scan shows only local-branch copies. Dispatched. Merged 3ab2a8fa (train E14, rebased on main): engine10 404 pass 0 fail (402 pass 0 fail with claude removed from PATH), tsc exit 0, test-harness 86/0, test-local-ci-gitleaks 6/0, test-engine10-dist 18/0. Released v9.81.0 (npm view loki-mode time: 2026-09-28T02:38:54Z). |
-| E-61 | A session that exits with an error fails its stage (implement reported done after exit "error" in 1s with 0 tokens) and its stderr tail is kept under the run dir for diagnosis | loki-ts/src/engine10/session.ts (stderr capture only), loki-ts/src/engine10/stages/implement.ts, loki-ts/src/engine10/stages/plan.ts, tests | HIGH | cd loki-ts && bun test tests/engine10/; a stub provider exiting 1 yields stage.failed with the stderr tail path | review@2026-09-28T14:20Z | Source: incident 01:38Z (EV-8 0/5 twice). Opus reviewer. Overlaps E-68 (exit classification) and E-69; builder of E-68 covers the stage-failure part. Wave E19, after E-68 landed (ea288330). D33: states its net core line delta; core must stay under 5,000 (92 lines of headroom shared by E-67, E-66, E-61, M-14, merge order E-67, E-66, E-61); offset any excess by deleting dead core code. Built b5f9f7fe (branch slice-E-61) at 04:30Z; its Opus review died on the 04:48Z access outage. Needs review only; D33 core delta must be checked. Wave E21 (wf_39ab3f7d-8f3). Opus review. |
-| E-62 | Eval harness v10 arm defaults to this repo's bin/loki (never the global loki, which was v9.78.0) and the manifest records its path and the agent SDK version; local-ci and the harness refuse when loki-ts/node_modules differs from bun.lock | eval/loki10/harness.py (loki_bin default, manifest), scripts/local-ci.sh (one check), eval/loki10/test-harness.sh (one leg) | HIGH | bash eval/loki10/test-harness.sh; a leg asserts the v10 arm binary is the repo bin/loki | building@2026-09-28T14:20Z | Source: incident 01:38Z. Wave E19, after EV-13 landed (ea288330). Built 3e8f6dc8 (branch slice-E-62). Opus REJECT (reproduced): the new lockfile check in scripts/local-ci.sh is not in _FAST_KEEP, so the fast tier (the only gate) skips it. Next: rework. Wave E21 (wf_39ab3f7d-8f3). r2. |
+| E-61 | A session that exits with an error fails its stage (implement reported done after exit "error" in 1s with 0 tokens) and its stderr tail is kept under the run dir for diagnosis | loki-ts/src/engine10/session.ts (stderr capture only), loki-ts/src/engine10/stages/implement.ts, loki-ts/src/engine10/stages/plan.ts, tests | HIGH | cd loki-ts && bun test tests/engine10/; a stub provider exiting 1 yields stage.failed with the stderr tail path | merged@2026-09-28T14:50Z | Source: incident 01:38Z (EV-8 0/5 twice). Opus reviewer. Overlaps E-68 (exit classification) and E-69; builder of E-68 covers the stage-failure part. Wave E19, after E-68 landed (ea288330). D33: states its net core line delta; core must stay under 5,000 (92 lines of headroom shared by E-67, E-66, E-61, M-14, merge order E-67, E-66, E-61); offset any excess by deleting dead core code. Built b5f9f7fe (branch slice-E-61) at 04:30Z; its Opus review died on the 04:48Z access outage. Needs review only; D33 core delta must be checked. Wave E21 (wf_39ab3f7d-8f3). Opus review. Opus APPROVE of b5f9f7fe; merged into train E22 (9042e964): `bun test tests/engine10/` 547 pass 0 fail, tsc 0, `bash tests/test-v10-pulse.sh` 107 passed, `bash eval/loki10/test-harness.sh` 108 passed. |
+| E-62 | Eval harness v10 arm defaults to this repo's bin/loki (never the global loki, which was v9.78.0) and the manifest records its path and the agent SDK version; local-ci and the harness refuse when loki-ts/node_modules differs from bun.lock | eval/loki10/harness.py (loki_bin default, manifest), scripts/local-ci.sh (one check), eval/loki10/test-harness.sh (one leg) | HIGH | bash eval/loki10/test-harness.sh; a leg asserts the v10 arm binary is the repo bin/loki | merged@2026-09-28T15:35Z | Source: incident 01:38Z. Wave E19, after EV-13 landed (ea288330). Built 3e8f6dc8 (branch slice-E-62). Opus REJECT (reproduced): the new lockfile check in scripts/local-ci.sh is not in _FAST_KEEP, so the fast tier (the only gate) skips it. Next: rework. Wave E21 (wf_39ab3f7d-8f3). r2. r2 3e4f489c Opus APPROVE; conflicts in eval/loki10/test-harness.sh with EV-11a. Next: one engineer rebases EV-11b first, then E-62, onto main. r3 30047e4e Opus APPROVE (includes EV-11b-r2); merged locally; `bash eval/loki10/test-harness.sh` 114 passed 0 failed, validate all ok. |
 | E-63 | Pulse STALE_PROGRESS violation when the newest PROGRESS.md entry is over 35 minutes old | scripts/v10-pulse.sh, tests/test-v10-pulse.sh | MEDIUM | bash tests/test-v10-pulse.sh | approved@2026-09-28T02:50Z | Source: Loki 01:49Z (PROGRESS.md was 100 minutes stale). Built 67c6b8ac, TL APPROVE; train E17 test-v10-pulse 95/0. |
 | E-64 | Lean small path and model cascade (D31): small tasks get one sonnet implement session with the cached repo map, impacted tests, PR; no plan or Wall unless no relevant tests; opus only on a test failure, reason logged; cost per call type | loki-ts/src/engine10 (implement, fix, plan, wall, sizing, session) | HIGH | cd loki-ts && bun test tests/engine10/; then EV-8 5-task measurement | merged@2026-09-28T04:15Z | Source: D30, D31. Opus REJECT (47f0d33a): a non-escalated fix round still runs on the top model while the event says no escalation; does not merge onto main. Rework dispatched. Rework APPROVE (branch worktree-wf_4601e7b3-4d8-1: 70bae9be, db2c104f, 01ff7737): non-escalated fix rounds run on the cheap model and the event records the real model. Not merged; must be re-measured (full small arm) before it becomes the default. Merged c9c15f38 (trainE18), session.ts conflict with E-68 resolved to the 30s heartbeat; `bun test tests/engine10/` 444 pass. Still behind the gate: re-measure before default. |
 | E-65 | Session token diet: find and cut what makes one v10 session cost more than raw claude -p on the same task and model | loki-ts/src/engine10, engine10-only flag in loki-ts/src/runner if needed | HIGH | before/after token table on one task, then the EV-8 5 tasks | merged@2026-09-28T02:38Z | Source: EV-8 variant C (a sonnet session $0.155 to $0.32 vs raw opus $0.216 per whole task). Built 92e3c06c: engine sessions 6 tools, no legacy append, no MCP, settingSources project; prefix 20.4k -> 7.1k tokens; 5 tasks on claude-sonnet-5 v10 4/5 $0.1523 per completed vs raw 4/5 $0.2113. Opus CONCERN: M5 (tools spread removed) and M6 (noAppend ignored) survive 1345 tests; rework sent (query()-level assertion, rebase). Opus APPROVE on rework c9a90cce (M5, M6, M7, M8 all red; runner plus engine10 1347 pass 0 fail, also without claude on PATH). Merged 8b76fd9a with dist rebuilt. EV-8 D (opus, lean, no plan or Wall) 4/5 $0.1571 per completed p50 28s; E (sonnet, lean) 4/5 $0.1519 p50 27.5s; raw opus on the same 5 tasks 5/5 $0.2161 p50 41s (~/loki-ci-logs/ev8r-{D,E}/results.jsonl). |
-| EV-11 | Medium eval tier: 15 multi-file tasks with hidden tests, tier field and --tier selection | eval/loki10/tasks/, eval/loki10/harness.py, run.sh | HIGH | python3 eval/loki10/harness.py validate; no-op baseline grades 15 not completed, 0 invalid | building@2026-09-28T14:20Z | Source: D30. Opus CONCERN: 3 of 15 medium tasks verified (ea04f1e0). Rework dispatched to finish the 15. Rework (branch worktree-wf_4601e7b3-4d8-2, head 5718225a): 4 of 15 medium tasks verified (pub-attrs-1313, pub-click-2869, pub-faker-1817, pub-jinja-1413). Opus CONCERN: 11 tasks still missing; leads in eval/loki10/tasks/INDEX.md. Wave E18 rework: 11 missing medium tasks, branch slice-EV-11-medium-15. Opus REJECT: pub-werkzeug-3121 hidden test not verbatim as claimed; pub-werkzeug-3105 grades a feature deletion as completed. Rework wave E19. Rework r2 f7cf7b58 (branch slice-EV-11-r2). Opus REJECT (reproduced): pub-faker-1817 grades a feature deletion (uniqueness tracking removed) as completed. Next: per-task deletion-mutant audit. Wave E21 (wf_39ab3f7d-8f3). Split EV-11a/EV-11b by task, per-task deletion-mutant audit. |
-| EV-12 | Large eval tier: 10 feature or legacy tasks with hidden tests, including augmentiq-style issues | eval/loki10/tasks/ | HIGH | validate plus no-op baseline over 10 | building@2026-09-28T14:20Z | Source: D30. Opus REJECT (fbd32234): 3 legacy tasks point at fixtures absent before merge (prepare_failed); spec items missing. Rework dispatched. Rework (branch worktree-wf_4601e7b3-4d8-3, head 0b9a2d91: 10 large tasks, repo-relative fixture sources). Opus REJECT: the repo-relative sources, .. rejection and fixture fixes are reproduced, but the large tasks are still smaller than the medium ones (task-size finding open). Next: rework with genuinely feature-sized tasks. Wave E18 rework: feature-sized large tasks, branch slice-EV-12-large-tasks. Opus REJECT: only lg-rbac reworked (1 of 10 feature-sized); fixture files outside the set. Rework wave E19 (fixtures now in set). Rework r2 237daa65 (branch slice-EV-12-r2). Opus REJECT: large tasks still not all feature-sized (engineer report agrees). Next: split across engineers, a few tasks each. Wave E21 (wf_39ab3f7d-8f3). Split EV-12a/b/c by task. |
+| EV-11 | Medium eval tier: 15 multi-file tasks with hidden tests, tier field and --tier selection | eval/loki10/tasks/, eval/loki10/harness.py, run.sh | HIGH | python3 eval/loki10/harness.py validate; no-op baseline grades 15 not completed, 0 invalid | merged@2026-09-28T15:35Z | Source: D30. Opus CONCERN: 3 of 15 medium tasks verified (ea04f1e0). Rework dispatched to finish the 15. Rework (branch worktree-wf_4601e7b3-4d8-2, head 5718225a): 4 of 15 medium tasks verified (pub-attrs-1313, pub-click-2869, pub-faker-1817, pub-jinja-1413). Opus CONCERN: 11 tasks still missing; leads in eval/loki10/tasks/INDEX.md. Wave E18 rework: 11 missing medium tasks, branch slice-EV-11-medium-15. Opus REJECT: pub-werkzeug-3121 hidden test not verbatim as claimed; pub-werkzeug-3105 grades a feature deletion as completed. Rework wave E19. Rework r2 f7cf7b58 (branch slice-EV-11-r2). Opus REJECT (reproduced): pub-faker-1817 grades a feature deletion (uniqueness tracking removed) as completed. Next: per-task deletion-mutant audit. Wave E21 (wf_39ab3f7d-8f3). Split EV-11a/EV-11b by task, per-task deletion-mutant audit. EV-11a (02e68591, Opus APPROVE) merged into train E22 (9042e964): `bun test tests/engine10/` 547 pass 0 fail, tsc 0, `bash tests/test-v10-pulse.sh` 107 passed, `bash eval/loki10/test-harness.sh` 108 passed. EV-11b (39ee810b, Opus APPROVE) conflicts with EV-11a in harness.py and test-harness.sh (each resolved the EV-11-r2 merge separately); rebase onto main next. EV-11b r2 0d601f64 Opus APPROVE, merged with E-62-r3; gitleaks v8.30.0 dir scan of eval/loki10/tasks finds only the known pub-werkzeug-3271 pin. |
+| EV-12 | Large eval tier: 10 feature or legacy tasks with hidden tests, including augmentiq-style issues | eval/loki10/tasks/ | HIGH | validate plus no-op baseline over 10 | building@2026-09-28T14:55Z | Source: D30. Opus REJECT (fbd32234): 3 legacy tasks point at fixtures absent before merge (prepare_failed); spec items missing. Rework dispatched. Rework (branch worktree-wf_4601e7b3-4d8-3, head 0b9a2d91: 10 large tasks, repo-relative fixture sources). Opus REJECT: the repo-relative sources, .. rejection and fixture fixes are reproduced, but the large tasks are still smaller than the medium ones (task-size finding open). Next: rework with genuinely feature-sized tasks. Wave E18 rework: feature-sized large tasks, branch slice-EV-12-large-tasks. Opus REJECT: only lg-rbac reworked (1 of 10 feature-sized); fixture files outside the set. Rework wave E19 (fixtures now in set). Rework r2 237daa65 (branch slice-EV-12-r2). Opus REJECT: large tasks still not all feature-sized (engineer report agrees). Next: split across engineers, a few tasks each. Wave E21 (wf_39ab3f7d-8f3). Split EV-12a/b/c by task. Round 4: EV-12a CONCERN (size bar met by deleted docstrings, about 93-106 added lines), EV-12b REJECT (bundles built by an uncommitted script; no legacy code left), EV-12c REJECT (storage.validate counted but untested). Sent to the CTO for a tier ruling before any further rework. D34 (CTO): synthetic lg-* tasks closed, not merged; replaced by EV-12S (size gate) and EV-12A/B/C (real upstream PRs, 5 needed), then EV-12D (INDEX). Legacy moves to M-27. |
 | M-00 | MODERNIZE.md design (CTO and Architect) and the Part 2 slice table M-01.. | docs/v10/MODERNIZE.md | HIGH | doc under 400 lines with a 20 to 30 slice plan | merged@2026-09-28T02:50Z | Source: D30 Part 2. ETA 02:45Z. Built 17e97855 (399 lines, 30 slices); merges in train E17 (b2ad73ce). |
 | M-01 | Modernize event types, log wrapper and state paths | loki-ts/src/engine10/modernize/types.ts, loki-ts/src/engine10/modernize/log.ts, loki-ts/tests/engine10/modernize/log.test.ts | MEDIUM | cd loki-ts && bun test tests/engine10/modernize/log.test.ts | merged@2026-09-28T04:25Z | Source: MODERNIZE.md (D30). Depends on none. Built on branch worktree-wf_4601e7b3-4d8-4 (777f6cdd M-01, 212a7404 M-02, 6b00c05c M-05, 3d8edb5d M-06). TL CONCERN: cluster.ts tarjanSCC recursion overflows the stack on dependency chains of about 20-50k nodes (the M-28/M-29 scale); needs an iterative SCC. Wave E18 (wf_5063e58d-7a5) carries it with the M-05 iterative SCC rework, branch slice-M-05-iterative-scc. Merged f4d98c0b with M-05. |
 | M-02 | Inventory core: files, languages, build, entry points, tests | loki-ts/src/engine10/modernize/inventory.ts, loki-ts/tests/engine10/modernize/inventory.test.ts, loki-ts/tests/engine10/modernize/fixtures/inv/ | MEDIUM | cd loki-ts && bun test tests/engine10/modernize/inventory.test.ts | merged@2026-09-28T04:25Z | Source: MODERNIZE.md (D30). Depends on M-01. Built on branch worktree-wf_4601e7b3-4d8-4 (777f6cdd M-01, 212a7404 M-02, 6b00c05c M-05, 3d8edb5d M-06). TL CONCERN: cluster.ts tarjanSCC recursion overflows the stack on dependency chains of about 20-50k nodes (the M-28/M-29 scale); needs an iterative SCC. Wave E18 with M-05, branch slice-M-05-iterative-scc. Merged f4d98c0b with M-05. |
 | M-03 | Python import graph via tokenize (lexes py2 source) | loki-ts/src/engine10/modernize/lang/python.ts, autonomy/lib/modernize/py_imports.py, loki-ts/tests/engine10/modernize/python_graph.test.ts | MEDIUM | cd loki-ts && bun test tests/engine10/modernize/python_graph.test.ts | merged@2026-09-28T14:10Z | Source: MODERNIZE.md (D30). Depends on M-02. Wave E18, based on the M-02 branch, branch slice-M-03-python-graph. TL REJECT: bare relative from-imports (from . import X) mis-parsed in py_imports.py. Rework wave E19. Rework 8b5e1340 TL APPROVE (sonnet); merged c90d7924; `bun test tests/engine10/` 481 pass 0 fail. |
-| M-04 | Java graph via jdeps, import-scan fallback recorded | loki-ts/src/engine10/modernize/lang/java.ts, loki-ts/tests/engine10/modernize/java_graph.test.ts, loki-ts/tests/engine10/modernize/fixtures/java8/ | MEDIUM | cd loki-ts && bun test tests/engine10/modernize/java_graph.test.ts | building@2026-09-28T14:20Z | Source: MODERNIZE.md (D30). Depends on M-02. Wave E18, based on the M-02 branch, branch slice-M-04-java-graph. TL REJECT: wildcard and static imports silently dropped in the import-scan fallback. Rework wave E19. Rework r2 7713ad9b (branch slice-M-04-r2). TL REJECT (reproduced): an unresolved wildcard whose package has no local files is dropped silently (java.ts importScanGraph). Next: rework. Wave E21 (wf_39ab3f7d-8f3). r3. |
+| M-04 | Java graph via jdeps, import-scan fallback recorded | loki-ts/src/engine10/modernize/lang/java.ts, loki-ts/tests/engine10/modernize/java_graph.test.ts, loki-ts/tests/engine10/modernize/fixtures/java8/ | MEDIUM | cd loki-ts && bun test tests/engine10/modernize/java_graph.test.ts | merged@2026-09-28T14:50Z | Source: MODERNIZE.md (D30). Depends on M-02. Wave E18, based on the M-02 branch, branch slice-M-04-java-graph. TL REJECT: wildcard and static imports silently dropped in the import-scan fallback. Rework wave E19. Rework r2 7713ad9b (branch slice-M-04-r2). TL REJECT (reproduced): an unresolved wildcard whose package has no local files is dropped silently (java.ts importScanGraph). Next: rework. Wave E21 (wf_39ab3f7d-8f3). r3. Rework r3 771ff0a0 TL APPROVE; merged into train E22 (9042e964): `bun test tests/engine10/` 547 pass 0 fail, tsc 0, `bash tests/test-v10-pulse.sh` 107 passed, `bash eval/loki10/test-harness.sh` 108 passed. |
 | M-05 | SCC clustering, 1,500-line unit cap, topological waves | loki-ts/src/engine10/modernize/cluster.ts, loki-ts/tests/engine10/modernize/cluster.test.ts | MEDIUM | cd loki-ts && bun test tests/engine10/modernize/cluster.test.ts | merged@2026-09-28T04:25Z | Source: MODERNIZE.md (D30). Depends on M-02. Built on branch worktree-wf_4601e7b3-4d8-4 (777f6cdd M-01, 212a7404 M-02, 6b00c05c M-05, 3d8edb5d M-06). TL CONCERN: cluster.ts tarjanSCC recursion overflows the stack on dependency chains of about 20-50k nodes (the M-28/M-29 scale); needs an iterative SCC. Wave E18 rework: iterative Tarjan, branch slice-M-05-iterative-scc. TL APPROVE (sonnet): iterative Tarjan 372ebe11, red on recursive (RangeError), 2000/2000 fuzz identical; merged f4d98c0b, `bun test tests/engine10/modernize/` 28 pass 0 fail. |
 | M-06 | Up-front estimate (cost, time, risk), --budget math, --dry-run print | loki-ts/src/engine10/modernize/estimate.ts, loki-ts/tests/engine10/modernize/estimate.test.ts | LOW | cd loki-ts && bun test tests/engine10/modernize/estimate.test.ts | merged@2026-09-28T04:25Z | Source: MODERNIZE.md (D30). Depends on M-05. Built on branch worktree-wf_4601e7b3-4d8-4 (777f6cdd M-01, 212a7404 M-02, 6b00c05c M-05, 3d8edb5d M-06). TL CONCERN: cluster.ts tarjanSCC recursion overflows the stack on dependency chains of about 20-50k nodes (the M-28/M-29 scale); needs an iterative SCC. Wave E18 with M-05, branch slice-M-05-iterative-scc. Merged f4d98c0b with M-05. |
-| M-07 | modernize CLI and flag parsing; TABLE route in engine10 cli | loki-ts/src/engine10/modernize/cli.ts, loki-ts/src/engine10/cli.ts (TABLE and USAGE line only), loki-ts/tests/engine10/modernize/cli.test.ts | MEDIUM | cd loki-ts && bun test tests/engine10/modernize/cli.test.ts | building@2026-09-28T14:20Z | Source: MODERNIZE.md (D30). Depends on M-06, E-31 merged or parked. Wave E21 (wf_39ab3f7d-8f3). |
+| M-07 | modernize CLI and flag parsing; TABLE route in engine10 cli | loki-ts/src/engine10/modernize/cli.ts, loki-ts/src/engine10/cli.ts (TABLE and USAGE line only), loki-ts/tests/engine10/modernize/cli.test.ts | MEDIUM | cd loki-ts && bun test tests/engine10/modernize/cli.test.ts | ready@2026-09-28T15:35Z | Source: MODERNIZE.md (D30). Depends on M-06, E-31 merged or parked. Wave E21 (wf_39ab3f7d-8f3). TL APPROVE of 13848b53, but merged after E-66/E-61/M-24 core reads exactly 5,000 (cap is under 5,000). Next: net core delta at most -1 (offset in cli.ts or dead core code), then merge. r2 TL REJECT (reproduced): modernize/cli.ts TABLE-routed but not in registry.ts (registry.test.ts red when merged); report claimed 40/0 but 39/1; --help lost its modernize line. Next: register it, keep the USAGE line, offset core elsewhere. |
 | M-08 | bin/loki modernize arm to engine10 regardless of default | bin/loki (modernize arm only), tests/test-modernize-dispatch.sh | MEDIUM | bash tests/test-modernize-dispatch.sh | ready@2026-09-28T02:45Z | Source: MODERNIZE.md (D30). Depends on M-07. |
 | M-09 | py2/3 capture tracer with type-tagged JSON and branch coverage | autonomy/lib/modernize/py_capture.py, tests/test-modernize-py-capture.sh, tests/fixtures/modernize/py2/ | HIGH | bash tests/test-modernize-py-capture.sh | merged@2026-09-28T14:10Z | Source: MODERNIZE.md (D30). Depends on M-01. Built a4fbf034 (branch worktree-wf_4601e7b3-4d8-5). Opus REJECT (reproduced): unsupported types (sets, Decimal, datetime, bytearray, custom classes) record as equal with no not_proven entry, so the oracle could certify unproven equivalence. Next: rework. Wave E18 rework: unsupported types yield not_proven, branch slice-M-09-not-proven-types. Opus REJECT of 3594eee5: subclasses of supported types (namedtuple, IntEnum, OrderedDict) tag as the base type with no not_proven. Rework wave E19. Rework 085bc2e0 Opus APPROVE; merged b8d40a34; `bash tests/test-modernize-py-capture.sh` Passed 50 Failed 0 Skipped 1 (no python2). |
-| M-10 | Coverage-guided input search (read-only session, plateau stop) | loki-ts/src/engine10/modernize/oracle/search.ts, loki-ts/tests/engine10/modernize/search.test.ts | HIGH | cd loki-ts && bun test tests/engine10/modernize/search.test.ts | ready@2026-09-28T02:45Z | Source: MODERNIZE.md (D30). Depends on M-09. |
-| M-11 | Java capture: JUnit under JDK 8 with JaCoCo plus Randoop | autonomy/lib/modernize/java_capture.sh, loki-ts/src/engine10/modernize/oracle/java.ts, loki-ts/tests/engine10/modernize/java_capture.test.ts | HIGH | cd loki-ts && bun test tests/engine10/modernize/java_capture.test.ts | ready@2026-09-28T02:45Z | Source: MODERNIZE.md (D30). Depends on M-04. |
-| M-12 | Oracle seal, held-out split, 80% floor, up-front NOT PROVEN | loki-ts/src/engine10/modernize/oracle/seal.ts, loki-ts/tests/engine10/modernize/oracle_seal.test.ts | HIGH | cd loki-ts && bun test tests/engine10/modernize/oracle_seal.test.ts | ready@2026-09-28T02:45Z | Source: MODERNIZE.md (D30). Depends on M-09. |
+| M-10 | Coverage-guided input search (read-only session, plateau stop) | loki-ts/src/engine10/modernize/oracle/search.ts, loki-ts/tests/engine10/modernize/search.test.ts | HIGH | cd loki-ts && bun test tests/engine10/modernize/search.test.ts | ready@2026-09-28T15:35Z | Source: MODERNIZE.md (D30). Depends on M-09. Opus REJECT (reproduced): a failed seed capture is reported as a plateau. Next: rework. |
+| M-11 | Java capture: JUnit under JDK 8 with JaCoCo plus Randoop | autonomy/lib/modernize/java_capture.sh, loki-ts/src/engine10/modernize/oracle/java.ts, loki-ts/tests/engine10/modernize/java_capture.test.ts | HIGH | cd loki-ts && bun test tests/engine10/modernize/java_capture.test.ts | ready@2026-09-28T15:35Z | Source: MODERNIZE.md (D30). Depends on M-04. Opus REJECT (reproduced): multi-line java -version breaks status.json (json_escape skips newlines). Next: rework. |
+| M-12 | Oracle seal, held-out split, 80% floor, up-front NOT PROVEN | loki-ts/src/engine10/modernize/oracle/seal.ts, loki-ts/tests/engine10/modernize/oracle_seal.test.ts | HIGH | cd loki-ts && bun test tests/engine10/modernize/oracle_seal.test.ts | ready@2026-09-28T15:35Z | Source: MODERNIZE.md (D30). Depends on M-09. Opus REJECT (reproduced): delete-and-reseal defeats tamper evidence (hashes stored beside the data). Next: rework. |
 | M-13 | Equivalence checker with sealed normalizers and contract output | loki-ts/src/engine10/modernize/equiv.ts, loki-ts/tests/engine10/modernize/equiv.test.ts, loki-ts/tests/engine10/modernize/fixtures/equiv/ | HIGH | cd loki-ts && bun test tests/engine10/modernize/equiv.test.ts | ready@2026-09-28T02:45Z | Source: MODERNIZE.md (D30). Depends on M-12. |
 | M-14 | Wall pre-sealed mode: oracle plus conformance, green base is an error | loki-ts/src/engine10/stages/wall.ts (pre-sealed branch only), loki-ts/tests/engine10/modernize/wall_presealed.test.ts | HIGH | cd loki-ts && bun test tests/engine10/modernize/wall_presealed.test.ts | ready@2026-09-28T02:45Z | Source: MODERNIZE.md (D30). Depends on M-12, E-54. D33: states its net core line delta; core must stay under 5,000 (92 lines of headroom shared by E-67, E-66, E-61, M-14, merge order E-67, E-66, E-61); offset any excess by deleting dead core code. |
 | M-15 | Unit runner: card to v10 run with oracle Wall and equiv check | loki-ts/src/engine10/modernize/unit.ts, loki-ts/tests/engine10/modernize/unit.test.ts | HIGH | cd loki-ts && bun test tests/engine10/modernize/unit.test.ts | ready@2026-09-28T02:45Z | Source: MODERNIZE.md (D30). Depends on M-13, M-14. |
-| M-16 | Deterministic codemods first (futurize, OpenRewrite) or skipped | loki-ts/src/engine10/modernize/codemod.ts, loki-ts/tests/engine10/modernize/codemod.test.ts | MEDIUM | cd loki-ts && bun test tests/engine10/modernize/codemod.test.ts | review@2026-09-28T14:20Z | Source: MODERNIZE.md (D30). Depends on M-02. Built 0a8bbe6c (branch slice-M-16-codemods); TL review died on the 04:48Z access outage. Wave E21 (wf_39ab3f7d-8f3). TL review. |
+| M-16 | Deterministic codemods first (futurize, OpenRewrite) or skipped | loki-ts/src/engine10/modernize/codemod.ts, loki-ts/tests/engine10/modernize/codemod.test.ts | MEDIUM | cd loki-ts && bun test tests/engine10/modernize/codemod.test.ts | merged@2026-09-28T14:50Z | Source: MODERNIZE.md (D30). Depends on M-02. Built 0a8bbe6c (branch slice-M-16-codemods); TL review died on the 04:48Z access outage. Wave E21 (wf_39ab3f7d-8f3). TL review. TL APPROVE of 0a8bbe6c; merged into train E22 (9042e964): `bun test tests/engine10/` 547 pass 0 fail, tsc 0, `bash tests/test-v10-pulse.sh` 107 passed, `bash eval/loki10/test-harness.sh` 108 passed. |
 | M-17 | Scheduler: N workers, worktrees, cascade, best-of-2, budget stop | loki-ts/src/engine10/modernize/scheduler.ts, loki-ts/tests/engine10/modernize/scheduler.test.ts | HIGH | cd loki-ts && bun test tests/engine10/modernize/scheduler.test.ts | ready@2026-09-28T02:45Z | Source: MODERNIZE.md (D30). Depends on M-15. |
 | M-18 | Re-slice non-equivalent units to depth 2, then NOT PROVEN | loki-ts/src/engine10/modernize/reslice.ts, loki-ts/tests/engine10/modernize/reslice.test.ts | MEDIUM | cd loki-ts && bun test tests/engine10/modernize/reslice.test.ts | ready@2026-09-28T02:45Z | Source: MODERNIZE.md (D30). Depends on M-05, M-13. |
-| M-19 | Strangler targets and routes.json (py2/dual/py3, per-module release) | loki-ts/src/engine10/modernize/routes.ts, loki-ts/src/engine10/modernize/targets/python3.ts, loki-ts/src/engine10/modernize/targets/java21.ts, loki-ts/tests/engine10/modernize/routes.test.ts | MEDIUM | cd loki-ts && bun test tests/engine10/modernize/routes.test.ts | review@2026-09-28T14:20Z | Source: MODERNIZE.md (D30). Depends on M-05. Built 3299d359 (branch slice-M-19-routes); TL review died on the 04:48Z access outage. Wave E21 (wf_39ab3f7d-8f3). TL review. |
+| M-19 | Strangler targets and routes.json (py2/dual/py3, per-module release) | loki-ts/src/engine10/modernize/routes.ts, loki-ts/src/engine10/modernize/targets/python3.ts, loki-ts/src/engine10/modernize/targets/java21.ts, loki-ts/tests/engine10/modernize/routes.test.ts | MEDIUM | cd loki-ts && bun test tests/engine10/modernize/routes.test.ts | merged@2026-09-28T14:50Z | Source: MODERNIZE.md (D30). Depends on M-05. Built 3299d359 (branch slice-M-19-routes); TL review died on the 04:48Z access outage. Wave E21 (wf_39ab3f7d-8f3). TL review. TL APPROVE of 3299d359; merged into train E22 (9042e964): `bun test tests/engine10/` 547 pass 0 fail, tsc 0, `bash tests/test-v10-pulse.sh` 107 passed, `bash eval/loki10/test-harness.sh` 108 passed. |
 | M-20 | Wave verify: full build, integration and original suite | loki-ts/src/engine10/modernize/wave.ts, loki-ts/tests/engine10/modernize/wave.test.ts | MEDIUM | cd loki-ts && bun test tests/engine10/modernize/wave.test.ts | ready@2026-09-28T02:45Z | Source: MODERNIZE.md (D30). Depends on M-17, M-19. |
 | M-21 | Wave ship: one PR per wave with unit receipts, draft unless all proven | loki-ts/src/engine10/modernize/ship.ts, loki-ts/tests/engine10/modernize/ship.test.ts | HIGH | cd loki-ts && bun test tests/engine10/modernize/ship.test.ts | ready@2026-09-28T02:45Z | Source: MODERNIZE.md (D30). Depends on M-20. |
 | M-22 | Unit-level resume after coordinator crash | loki-ts/src/engine10/modernize/resume.ts, loki-ts/tests/engine10/modernize/resume.test.ts | MEDIUM | cd loki-ts && bun test tests/engine10/modernize/resume.test.ts | ready@2026-09-28T02:45Z | Source: MODERNIZE.md (D30). Depends on M-17, E-39. |
 | M-23 | Remote units via POST /jobs kind unit, Helm worker.engine v10, local re-verify | autonomy/trigger-server.py (unit job kind only), deploy/helm/autonomi/templates/job-worker.yaml, deploy/helm/autonomi/values.yaml, loki-ts/src/engine10/modernize/remote.ts, loki-ts/tests/engine10/modernize/remote.test.ts, tests/test-trigger-server-unit-jobs.py | HIGH | python3 tests/test-trigger-server-unit-jobs.py && (cd loki-ts && bun test tests/engine10/modernize/remote.test.ts) | ready@2026-09-28T02:45Z | Source: MODERNIZE.md (D30). Depends on M-17. |
-| M-24 | Dashboard /modernize view | loki-ts/src/engine10/dashboard/modernize.ts, loki-ts/src/engine10/dashboard/server.ts (one route), loki-ts/tests/engine10/modernize/dashboard.test.ts | LOW | cd loki-ts && bun test tests/engine10/modernize/dashboard.test.ts | review@2026-09-28T14:20Z | Source: MODERNIZE.md (D30). Depends on M-01. Built fe3dd87a (branch slice-M-24-dashboard); TL review died on the 04:48Z access outage. Wave E21 (wf_39ab3f7d-8f3). TL review. |
+| M-24 | Dashboard /modernize view | loki-ts/src/engine10/dashboard/modernize.ts, loki-ts/src/engine10/dashboard/server.ts (one route), loki-ts/tests/engine10/modernize/dashboard.test.ts | LOW | cd loki-ts && bun test tests/engine10/modernize/dashboard.test.ts | merged@2026-09-28T14:50Z | Source: MODERNIZE.md (D30). Depends on M-01. Built fe3dd87a (branch slice-M-24-dashboard); TL review died on the 04:48Z access outage. Wave E21 (wf_39ab3f7d-8f3). TL review. TL APPROVE of fe3dd87a; merged into train E22 (9042e964): `bun test tests/engine10/` 547 pass 0 fail, tsc 0, `bash tests/test-v10-pulse.sh` 107 passed, `bash eval/loki10/test-harness.sh` 108 passed. |
 | M-25 | Final report and verdict (COMPLETE only if all proven), sealed | loki-ts/src/engine10/modernize/report.ts, loki-ts/tests/engine10/modernize/report.test.ts | HIGH | cd loki-ts && bun test tests/engine10/modernize/report.test.ts | ready@2026-09-28T02:45Z | Source: MODERNIZE.md (D30). Depends on M-13, M-21. |
 | M-26 | End-to-end: py2 fixture repo modernized with stub provider | loki-ts/tests/engine10/modernize/e2e.test.ts, loki-ts/tests/engine10/modernize/fixtures/e2e_py2/ | MEDIUM | cd loki-ts && bun test tests/engine10/modernize/e2e.test.ts | ready@2026-09-28T02:45Z | Source: MODERNIZE.md (D30). Depends on M-08, M-22, M-25. |
-| M-27 | Legacy-Bench pilot harness; confirm public set; calibrate cap | eval/modernize/pilot.py, eval/modernize/test-pilot.sh | HIGH | bash eval/modernize/test-pilot.sh | ready@2026-09-28T02:45Z | Source: MODERNIZE.md (D30). Depends on M-26. |
+| M-27 | Legacy-Bench pilot harness; confirm public set; calibrate cap | eval/modernize/pilot.py, eval/modernize/test-pilot.sh | HIGH | bash eval/modernize/test-pilot.sh | ready@2026-09-28T02:45Z | Source: MODERNIZE.md (D30). Depends on M-26. D34: absorbs the D30 large-tier legacy coverage. |
 | M-28 | 200K scale run (Mercurial 4.x, measured first, fallback Calibre) | eval/modernize/scale.py, eval/modernize/SCALE.md | HIGH | python3 eval/modernize/scale.py --target hg --dry-run-first | ready@2026-09-28T02:45Z | Source: MODERNIZE.md (D30). Depends on M-27. |
 | M-29 | 1M scale run (Hadoop 2.x Java 8 to 21, measured first) | eval/modernize/scale_1m.py, eval/modernize/SCALE-1M.md | HIGH | python3 eval/modernize/scale_1m.py --dry-run-first | ready@2026-09-28T02:45Z | Source: MODERNIZE.md (D30). Depends on M-28, M-11. |
 | M-30 | User docs for loki modernize, no dashes, commands match USAGE | docs/v10/GUIDE-MODERNIZE.md, tests/test-modernize-docs.sh | LOW | bash tests/test-modernize-docs.sh | ready@2026-09-28T02:45Z | Source: MODERNIZE.md (D30). Depends on M-07. |
-| E-66 | "Already implemented" outcome: evidence search in code, tests, docs, CHANGELOG; no change needed verdict, receipt, issue comment, no PR | loki-ts/src/engine10 (intake or plan, implement marker path, seal, pr) | HIGH | fixture with the feature ends no change needed, no implement session; fixture without proceeds | building@2026-09-28T14:20Z | Source: D32 (augmentiq #52). Opus REJECT (reproduced): no test that ALREADY_SATISFIED opens no PR; evidence search matched 652 hits for an unrelated task on this repo; confirmation need not cite files. Rework dispatched. Rework 1c7e1b09 (branch worktree-wf_b707f4ab-24f-1): all 3 blockers fixed (no-PR test F5, 0 hits for both review sentences on this repo, citation must name an existing code or test hit; evidence in receipt). Opus CONCERN: the real-repo test uses listRepoFiles capped at 2000 of 4784 files, so removing STOP_WORDS still passes; the existsSync branch of the citation check is untested. Next: small fix (full file list in that test, one existsSync test). Wave E18 small fix (uncapped file list, existsSync test), branch slice-E-66-test-fixes. Opus APPROVE of 0a64ea98 (uncapped list, existsSync test). Merge onto main conflicts in seal.ts, supervisor.ts, types.ts, rule_of_two.test.ts after E-68/E-69; rebase dispatched (wave E19). D33: states its net core line delta; core must stay under 5,000 (92 lines of headroom shared by E-67, E-66, E-61, M-14, merge order E-67, E-66, E-61); offset any excess by deleting dead core code. Rework 135ba06b Opus APPROVE, but merged it takes core to 5,189 (D33 cap 5,000; `bun test tests/engine10/budget.test.ts`). Not merged. Next: offset about 190 core lines in the same slice (dead or duplicated core code), then merge. Wave E21 (wf_39ab3f7d-8f3). r3: D33 offset. |
+| E-66 | "Already implemented" outcome: evidence search in code, tests, docs, CHANGELOG; no change needed verdict, receipt, issue comment, no PR | loki-ts/src/engine10 (intake or plan, implement marker path, seal, pr) | HIGH | fixture with the feature ends no change needed, no implement session; fixture without proceeds | merged@2026-09-28T14:50Z | Source: D32 (augmentiq #52). Opus REJECT (reproduced): no test that ALREADY_SATISFIED opens no PR; evidence search matched 652 hits for an unrelated task on this repo; confirmation need not cite files. Rework dispatched. Rework 1c7e1b09 (branch worktree-wf_b707f4ab-24f-1): all 3 blockers fixed (no-PR test F5, 0 hits for both review sentences on this repo, citation must name an existing code or test hit; evidence in receipt). Opus CONCERN: the real-repo test uses listRepoFiles capped at 2000 of 4784 files, so removing STOP_WORDS still passes; the existsSync branch of the citation check is untested. Next: small fix (full file list in that test, one existsSync test). Wave E18 small fix (uncapped file list, existsSync test), branch slice-E-66-test-fixes. Opus APPROVE of 0a64ea98 (uncapped list, existsSync test). Merge onto main conflicts in seal.ts, supervisor.ts, types.ts, rule_of_two.test.ts after E-68/E-69; rebase dispatched (wave E19). D33: states its net core line delta; core must stay under 5,000 (92 lines of headroom shared by E-67, E-66, E-61, M-14, merge order E-67, E-66, E-61); offset any excess by deleting dead core code. Rework 135ba06b Opus APPROVE, but merged it takes core to 5,189 (D33 cap 5,000; `bun test tests/engine10/budget.test.ts`). Not merged. Next: offset about 190 core lines in the same slice (dead or duplicated core code), then merge. Wave E21 (wf_39ab3f7d-8f3). r3: D33 offset. Rework r3 605f33b0 Opus APPROVE (core under 5,000 after offset); merged into train E22 (9042e964): `bun test tests/engine10/` 547 pass 0 fail, tsc 0, `bash tests/test-v10-pulse.sh` 107 passed, `bash eval/loki10/test-harness.sh` 108 passed. |
 | EV-13 | Eval expected_outcome no_change_needed; aiq-52 set to it | eval/loki10/harness.py, eval/loki10/tasks/aiq-52-searchbar, test-harness.sh | HIGH | bash eval/loki10/test-harness.sh | merged@2026-09-28T04:15Z | Source: D32. Opus CONCERN: a correct v10 no-change run on aiq-52 is graded as a source change. Rework dispatched. Rework APPROVE (branch worktree-wf_b707f4ab-24f-5: 19224201, e0264724): v10 Wall side effect excluded from the diff check. Not merged yet. Merged c9c15f38 (trainE18); `bash eval/loki10/test-harness.sh` 103 passed 0 failed. |
-| E-67 | No pause state: unfinishable runs end as a draft PR or an issue comment with the reason within the cap; stdin never read | loki-ts/src/engine10 (machine, supervisor, worker, escalate, session) | HIGH | a stub provider that asks for input ends within the cap with a draft-PR or comment argv | ready@2026-09-28T04:35Z | Source: D32. Opus REJECT (reproduced): a hung worker ended FAILED with no draft PR and no comment, after the cap. Rework dispatched. Rework ba679f4e (branch worktree-wf_b707f4ab-24f-2). Opus REJECT: at the default cap the supervisor backstop fires before the worker cap can seal; concern: the diff check misses untracked files and uncommitted work never reaches a PR. Next: rework. Held, no builder since 03:20Z (row was stale, not running). Dispatch after E-61 (session.ts) and the E-66 rebase (supervisor.ts) merge, from rework ba679f4e plus the Opus findings above. D33: states its net core line delta; core must stay under 5,000 (92 lines of headroom shared by E-67, E-66, E-61, M-14, merge order E-67, E-66, E-61); offset any excess by deleting dead core code. |
+| E-67 | No pause state: unfinishable runs end as a draft PR or an issue comment with the reason within the cap; stdin never read | loki-ts/src/engine10 (machine, supervisor, worker, escalate, session) | HIGH | a stub provider that asks for input ends within the cap with a draft-PR or comment argv | ready@2026-09-28T15:35Z | Source: D32. Opus REJECT (reproduced): a hung worker ended FAILED with no draft PR and no comment, after the cap. Rework dispatched. Rework ba679f4e (branch worktree-wf_b707f4ab-24f-2). Opus REJECT: at the default cap the supervisor backstop fires before the worker cap can seal; concern: the diff check misses untracked files and uncommitted work never reaches a PR. Next: rework. Held, no builder since 03:20Z (row was stale, not running). Dispatch after E-61 (session.ts) and the E-66 rebase (supervisor.ts) merge, from rework ba679f4e plus the Opus findings above. D33: states its net core line delta; core must stay under 5,000 (92 lines of headroom shared by E-67, E-66, E-61, M-14, merge order E-67, E-66, E-61); offset any excess by deleting dead core code. D33 update 14:50Z: E-66 and E-61 merged first, core is 4,998 (1 line of headroom); E-67 must be net core negative. r3 Opus REJECT (reproduced): backstopMs = max(0, capS-30)*1000 is 0 when capS <= 30, so the worker is killed at spawn. Next: rework. |
 | E-68 | Per-call deadline at the stage limit, progress every 30s, every exit code classified (125, 143 included), never "cause not classified" | loki-ts/src/engine10/session.ts, failures.ts | HIGH | per-code tests plus a grep test | merged@2026-09-28T04:15Z | Source: D32. Opus REJECT (reproduced): a real limit kill reports "exit 143 (SIGTERM)" because the session child traps SIGTERM; the stub test missed it. Rework dispatched. Rework APPROVE (branch worktree-wf_b707f4ab-24f-3: 4dd05bf9, 922bd923): a limit kill is classified from the engine, not the child exit code. Not merged yet. Merged c9c15f38 (trainE18); engine10 `bun test tests/engine10/` 444 pass 0 fail. |
 | E-69 | Cost shows "not measured" (or partial), never $0 when unmeasured | output.ts, pr_body.ts, seal.ts, status.ts, dashboard/page.ts, cost.ts | MEDIUM | output and receipt tests for measured, partial, unmeasured | merged@2026-09-28T04:15Z | Source: D32 (EV-8 printed $0.00 with 0 tokens). TL CONCERN: genuine-zero test never exercises it; partialCost bypasses the tamper guard; dashboard lacks the partial detail. Rework dispatched. Rework APPROVE (branch worktree-wf_b707f4ab-24f-4: b9825c4c, f42a2aee, 5c66dc55). Not merged yet. Merged c9c15f38 (trainE18); engine10 `bun test tests/engine10/` 444 pass 0 fail. |
 | E-70 | Dashboard shows its and the CLI's version, warns on mismatch; loki dashboard replaces an older Loki dashboard on its port, leaves a non-Loki listener alone | loki-ts/src/engine10/dashboard/ | MEDIUM | version, mismatch, replace and refuse tests | approved@2026-09-28T02:40Z | Source: D32. Built 1397a1f8, TL APPROVE. Merges in the next train. |
 | E-71 | Pulse UNEVIDENCED_CLAIM treats M-NN rows like S/E/EV rows (only status and notes cells can claim), so an M row's spec cell never flags | scripts/v10-pulse.sh (the row-id regex in check_unevidenced_claims only), tests/test-v10-pulse.sh | LOW | bash tests/test-v10-pulse.sh; a case with an M row whose Wall cell says "green" is not flagged, and its notes cell still is | merged@2026-09-28T04:35Z | Source: pulse flagged M-14 (8f4dc965) for its title "green base is an error", a spec, not a claim. TL APPROVE (sonnet): red without the fix (95 passed 1 failed), `bash tests/test-v10-pulse.sh` 96 passed 0 failed on main. |
 | E-72 | release.sh --bump-only leaves a dist bundle unchanged when only its debugId differs (no churn in cockpit.js on a version bump) | scripts/release.sh (dist step only), tests/test-release-bump-only.sh | LOW | bash tests/test-release-bump-only.sh | merged@2026-09-28T04:35Z | Source: v10.0.1 bump rewrote cockpit.js and .map with only a new debugId; the Release Manager reverted them by hand. TL APPROVE (sonnet): red on pre-fix release.sh (3 passed 3 failed), `bash tests/test-release-bump-only.sh` 6 passed 0 failed on main; registered in run-all-tests. |
 | E-73 | Guard (D26): no test writes a hardcoded "far-future" latest version that the current VERSION can overtake; derive it from VERSION instead | tests/test-no-stale-future-version.sh, docs/v10/GUARDS.md (one entry) | LOW | bash tests/test-no-stale-future-version.sh; red on a fixture test that writes latest 9.99.0 against VERSION 10.0.1 | merged@2026-09-28T04:35Z | Source: incident 898fa081, v10.0.0 blocked from npm by latest=9.99.0 in tests/test-start-update-hint.sh (fixed 306b6b0c). TL APPROVE (sonnet); `bash tests/test-no-stale-future-version.sh` RESULT: PASS on main; registered in run-all-tests. |
-| E-74 | release.sh run_bump_only actually calls the debugId restore helper (end-to-end test of the call site, not only the helper) | tests/test-release-bump-only.sh (one leg) | LOW | bash tests/test-release-bump-only.sh; deleting the call site in run_bump_only turns the new leg red | building@2026-09-28T14:20Z | Source: E-72 TL non-blocking note on 1b06bc61: removing the call site does not turn the E-72 test red. Wave E21 (wf_39ab3f7d-8f3). |
-| E-75 | Pulse main-CI check never reads UNKNOWN for a completed Tests run: fall back to `gh run list --commit <sha> --workflow Tests` when the cached check fails, and report RED with the run id | scripts/v10-pulse.sh (main CI check only), tests/test-v10-pulse.sh | MEDIUM | bash tests/test-v10-pulse.sh; a stubbed gh whose check call fails but whose run list says failure yields CI_RED, not UNKNOWN | building@2026-09-28T14:20Z | Source: main red at 5404b0c6, e26bf52b, 983dda58 (Tests run 36377688703) while the pulse printed Main CI UNKNOWN each turn. Wave E21 (wf_39ab3f7d-8f3). |
+| E-74 | release.sh run_bump_only actually calls the debugId restore helper (end-to-end test of the call site, not only the helper) | tests/test-release-bump-only.sh (one leg) | LOW | bash tests/test-release-bump-only.sh; deleting the call site in run_bump_only turns the new leg red | merged@2026-09-28T14:50Z | Source: E-72 TL non-blocking note on 1b06bc61: removing the call site does not turn the E-72 test red. Wave E21 (wf_39ab3f7d-8f3). TL APPROVE; merged into train E22 (9042e964): `bun test tests/engine10/` 547 pass 0 fail, tsc 0, `bash tests/test-v10-pulse.sh` 107 passed, `bash eval/loki10/test-harness.sh` 108 passed. |
+| E-75 | Pulse main-CI check never reads UNKNOWN for a completed Tests run: fall back to `gh run list --commit <sha> --workflow Tests` when the cached check fails, and report RED with the run id | scripts/v10-pulse.sh (main CI check only), tests/test-v10-pulse.sh | MEDIUM | bash tests/test-v10-pulse.sh; a stubbed gh whose check call fails but whose run list says failure yields CI_RED, not UNKNOWN | merged@2026-09-28T14:50Z | Source: main red at 5404b0c6, e26bf52b, 983dda58 (Tests run 36377688703) while the pulse printed Main CI UNKNOWN each turn. Wave E21 (wf_39ab3f7d-8f3). TL APPROVE of 8e989837; merged into train E22 (9042e964): `bun test tests/engine10/` 547 pass 0 fail, tsc 0, `bash tests/test-v10-pulse.sh` 107 passed, `bash eval/loki10/test-harness.sh` 108 passed. |
 | E-76 | Split the engine10 budget test per D33: core under 5,000, modernize/ under 4,000, core never imports modernize | loki-ts/tests/engine10/budget.test.ts | LOW | cd loki-ts && bun test tests/engine10/budget.test.ts; core limit 4900 turns test 1 red | merged@2026-09-28T04:42Z | Source: D33 (CTO). Main red since 5404b0c6 on the combined 5,288 count. TL APPROVE (sonnet) on 797705bc: `bun test tests/engine10/budget.test.ts` 3 pass exit 0, core 4907, modernize 381, core limit 4900 goes red; merged 84fbf9b4, full `bun test tests/engine10/` 474 pass 0 fail. |
-| E-77 | Pulse SESSION_STALLED violation: no assistant turn for more than 20 minutes while the /loop is active (armed wakeup or live workflow), reading the newest session transcript mtime | scripts/v10-pulse.sh (one new check), tests/test-v10-pulse.sh | MEDIUM | bash tests/test-v10-pulse.sh; a fixture transcript 25 minutes old with an active-loop marker yields SESSION_STALLED, 10 minutes old does not, no marker does not | building@2026-09-28T14:20Z | Source: founder 14:00Z; session stalled 04:48Z to about 14:00Z on "organization has disabled Claude subscription access", pulse raised nothing. Wave E21 (wf_39ab3f7d-8f3). |
-| EV-14 | v10 against raw on the medium and large tiers (same model, same tasks, both arms), gate table per tier for the default-flip decision (E-31) | eval/loki10 results, docs/v10/METRICS.md (one section) | HIGH | eval/loki10/run.sh per tier for arms raw and v10; every task has a row in both arms, none arm_unavailable; METRICS.md table cites the result files | ready@2026-09-28T14:20Z | Source: founder priority 14:00Z (flip v10 to default once it beats raw on the measured tiers). Depends on EV-11 and EV-12 merged; paid run, one tier at a time. |
+| E-77 | Pulse SESSION_STALLED violation: no assistant turn for more than 20 minutes while the /loop is active (armed wakeup or live workflow), reading the newest session transcript mtime | scripts/v10-pulse.sh (one new check), tests/test-v10-pulse.sh | MEDIUM | bash tests/test-v10-pulse.sh; a fixture transcript 25 minutes old with an active-loop marker yields SESSION_STALLED, 10 minutes old does not, no marker does not | merged@2026-09-28T14:50Z | Source: founder 14:00Z; session stalled 04:48Z to about 14:00Z on "organization has disabled Claude subscription access", pulse raised nothing. Wave E21 (wf_39ab3f7d-8f3). TL APPROVE of 409adb68; merged into train E22 (9042e964): `bun test tests/engine10/` 547 pass 0 fail, tsc 0, `bash tests/test-v10-pulse.sh` 107 passed, `bash eval/loki10/test-harness.sh` 108 passed. Marker .loki/state/loop-active. |
+| EV-14 | v10 against raw on the medium and large tiers (same model, same tasks, both arms), gate table per tier for the default-flip decision (E-31) | eval/loki10 results, docs/v10/METRICS.md (one section) | HIGH | eval/loki10/run.sh per tier for arms raw and v10; every task has a row in both arms, none arm_unavailable; METRICS.md table cites the result files | ready@2026-09-28T14:20Z | Source: founder priority 14:00Z (flip v10 to default once it beats raw on the measured tiers). Depends on EV-11 and EV-12 merged; paid run, one tier at a time. D34: may run on 5 real large tasks, 2 runs per arm; flip only if v10 is at or better than raw on completions, cost per completed and p50. |
+| E-78 | v10-guard also blocks moving main without a checkout: `git branch -f main`, `git update-ref refs/heads/main` and `git checkout -B main` | scripts/v10-guard.sh (RULE2 only), tests/test-v10-guard.sh | MEDIUM | bash tests/test-v10-guard.sh; each spelling is refused while on another branch, `git branch -f other` still allowed | merged@2026-09-28T15:35Z | Source: 14:12Z the Chief of Staff realigned local main with `git branch -f main origin/main` after RULE2 refused `git reset --hard`; the guard did not see it (harmless there: only an unpushed local merge was dropped, work kept on slice-E-66-r2). First build CONCERN (sonnet TL): update-ref check matches refs/heads/main anywhere in the args, blocking `git update-ref refs/heads/other refs/heads/main`. Next: match the target ref position only. r2 b6e5b389 TL APPROVE; `bash tests/test-v10-guard.sh` ALL TESTS PASSED. |
+| E-79 | Pulse LOW_READY counts M-NN rows whose Depends-on slices are all merged or released as ready, and names the ones blocked by dependencies | scripts/v10-pulse.sh (ready count only), tests/test-v10-pulse.sh | LOW | bash tests/test-v10-pulse.sh; an M row ready with deps merged counts, one with an unmerged dep does not | ready@2026-09-28T15:35Z | Source: pulse reported 3 to 4 ready while M-08, M-30 and other M rows were ready (14:12Z). E-79..E-81 branch REJECT (reproduced): widening ID_RE makes M rows visible, so IDLE_BUILDERS names dependency-blocked M rows as dispatch targets. Next: IDLE_BUILDERS reuses LOW_READY dependency filter. |
+| E-80 | Pulse PROGRESS.md age never negative: parse the entry timestamp as UTC and clamp future timestamps to a FUTURE_TIMESTAMP note | scripts/v10-pulse.sh (PROGRESS age only), tests/test-v10-pulse.sh | LOW | bash tests/test-v10-pulse.sh; an entry stamped 10 minutes ahead reads a note, not "-10 min ago" | ready@2026-09-28T14:30Z | Source: pulse printed "PROGRESS.md last entry: -6 min ago" at 04:39Z. |
+| E-81 | Pulse flags a git worktree registered inside the repo root outside .claude/worktrees (a reviewer created m16-review/ at the root) | scripts/v10-pulse.sh (one check), tests/test-v10-pulse.sh | LOW | bash tests/test-v10-pulse.sh; a fixture worktree at <repo>/x yields STRAY_WORKTREE, one under .claude/worktrees does not | ready@2026-09-28T14:30Z | Source: 04:45Z m16-review/ at the repo root blocked the release bump clean-tree check. |
+| E-82 | budget.test.ts computes the file lists inside a named test so a read error surfaces as a failed test, not a describe-time throw | loki-ts/tests/engine10/budget.test.ts | LOW | cd loki-ts && bun test tests/engine10/budget.test.ts | merged@2026-09-28T14:50Z | Source: E-76 TL non-blocking note (797705bc). TL APPROVE; merged 9042e964, budget test 3 pass. |
+| EV-12S | Size gate: eval/loki10/measure-size.py (files = touched non-test .py, lines = added non-blank; medium at least 2 files; large at least 4 files, at least 150 lines, above medium max), refdiffs for the medium tasks, run in test-harness.sh | eval/loki10/measure-size.py, eval/loki10/refdiff/pub-*.diff, eval/loki10/test-harness.sh (new section only) | LOW | rc=0 on the medium tasks (attrs-1313 reads 4 files, 74 lines); rc=1 on a 3-file 149-line large fixture, a missing refdiff, and --online with an unreachable source | building@2026-09-28T14:55Z | Source: D34. |
+| EV-12A | Large tasks from real upstream PRs, pool pallets/* (werkzeug incl. #3005/#3006, flask, jinja, click): at least 2 | eval/loki10/tasks/lg-<repo>-<issue>/, eval/loki10/refdiff/lg-<repo>-<issue>.diff (own tasks only) | MEDIUM | per task: measure-size --online rc=0; RED at ref, GREEN at merge_sha via run.sh; no-op not completed; full revert and leave-one-file-out mutants fail; validate rc=0 | building@2026-09-28T14:55Z | Source: D34. |
+| EV-12B | Large tasks from real upstream PRs, pool attrs, more-itertools, packaging, jsonschema, humanize, faker, arrow: at least 2 | same pattern, own tasks only | MEDIUM | as EV-12A | building@2026-09-28T14:55Z | Source: D34. |
+| EV-12C | Large tasks from real upstream PRs, pool httpx, rich, marshmallow, requests: at least 2 | same pattern, own tasks only | MEDIUM | as EV-12A | building@2026-09-28T14:55Z | Source: D34. |
+| EV-12D | INDEX.md large rows and counts; synthetic lg-* noted rejected (D34), legacy moved to M-27 | eval/loki10/tasks/INDEX.md | LOW | measure-size rc=0 over all tiers; large count at least 5 on main; validate rc=0 | ready@2026-09-28T14:55Z | Source: D34. Depends on EV-12S, EV-12A, EV-12B, EV-12C. |
+| E-83 | P0 fix-forward: main Tests red on 9d483688 (run 36438012977): modernize codemod spawn without env (spawn env guard) and the prStage bundle marker deleted by the E-66 line offset (dist test) | loki-ts/src/engine10/modernize/codemod.ts, loki-ts/src/engine10/stages/pr.ts | HIGH | `bun test tests/runner/spawn_env_guard.test.ts`; `bash tests/test-engine10-dist.sh` | merged@2026-09-28T14:58Z | TL APPROVE (sonnet) on 10391f4a, both reverts reproduce red; merged c5ace6e1: full `cd loki-ts && bun test` 2239 pass 0 fail, dist test 18 passed 0 failed, core 4,999. |
+| E-84 | Pulse TRAIN_LATE reads the last train push from the reflog of refs/remotes/origin/main (moves on every push and on fetches of others' pushes), then push-*.log, then UNKNOWN | scripts/v10-pulse.sh (last_train_push_epoch only), tests/test-v10-pulse.sh | MEDIUM | bash tests/test-v10-pulse.sh; fixture: temp repo plus bare remote, a real `git push` makes the check read under 1 min with no push-*.log present; no reflog and no logs reads UNKNOWN | merged@2026-09-28T15:30Z | Source: founder 15:09Z; TRAIN_LATE read 681.9 min while trains were pushed at 14:42Z and later, because plain `git push` writes no push-*.log. TL APPROVE (sonnet) on eeace3f6: `bash tests/test-v10-pulse.sh` 109 passed 0 failed; against the old pulse 106 passed 3 failed; live pulse after merge reads "Minutes since last train push: 12.1". |
+| E-85 | Security Audit: a narrowly scoped gitleaks allow rule for 40-hex commit pins in eval task.json (repo.ref, merge_sha) so pinned upstream SHAs stop tripping sourcegraph-access-token; CTO approval required (posture: no blanket suppressions) | .gitleaks.toml (or the workflow config), .github/workflows/security-audit.yml | HIGH | a fixture task.json with a 40-hex ref passes; the same string in any other file or key still fails | ready@2026-09-28T15:20Z | Source: v10.2.0 Release 36440534050 blocked by a pinned werkzeug SHA; EV-11b and EV-12A/B/C add more pins. |
+| DEP-01 | Dependency inventory (D35): docs/v10/DEPS.md lists every manifest (all package.json incl. @anthropic-ai/sdk and claude-agent-sdk; every requirements*.txt and pyproject.toml; every uses: in .github/workflows and .github/actions; Node, Python, Bun matrices; Docker bases, Helm images, Terraform providers, Homebrew formula) with current and latest stable, patch/minor/MAJOR, and runtime EOL; no upgrades | docs/v10/DEPS.md, scripts/dep-inventory.py | LOW | python3 scripts/dep-inventory.py regenerates DEPS.md byte-identically on a second run (network results cached); every manifest found by `git ls-files` appears | building@2026-09-28T15:25Z | Source: founder directive 15:20Z (D35). DEP workstream: max 3 builders, never ahead of E/EV/M. |
+| E-87 | Release dispatch path: required-ci also accepts a completed workflow_dispatch Security Audit run at the exact SHA (Tests and Bun Parity stay push-only), so a tree whose VERSION is already bumped can publish after an audit fix | .github/workflows/release.yml (required-ci only), a test that runs the extracted step against a fixture run list | HIGH | fixture: dispatched audit success at the SHA counts; a dispatched audit at another SHA does not; Tests via dispatch still does not | ready@2026-09-28T15:45Z | Source: v10.2.0 Release 36443541666 waited on an audit it could never count. CTO approval required (release gate). |
 | E-58 | Issue-ref runs: supervisor creates runDir before the fetch child writes issue.json; makes E-47 green | loki-ts/src/engine10/supervisor.ts (one line before fetchIssueToFile), E-47 test files from 544348a7 | MEDIUM | cd loki-ts && bun test tests/engine10/issue_ref_e2e.test.ts (3 pass) | released@2026-09-28T02:38Z | Source: E-47 finding (TL reproduced). Merged 646a6cd7 (train E13): engine10 388 pass 0 fail, tsc exit 0, test-engine10-dist 18/0, test-engine10-docs 26 passed, test-harness 82/0. APPROVE (6384fff9); issue_ref_e2e 3 pass. Released v9.81.0 (npm view loki-mode time: 2026-09-28T02:38:54Z). |
 | E-59 | Receipt model and summary tokens match the provider: cost.ts takes model from the result-cost file; events.ts fold sums cache read and creation tokens; makes E-50 green | loki-ts/src/engine10/cost.ts, loki-ts/src/engine10/events.ts, E-50 test files from 716618d4 | HIGH | cd loki-ts && bun test tests/engine10/model_report.test.ts tests/engine10/output.test.ts | released@2026-09-28T02:38Z | Source: E-50 finding. Reconcile with E-44 (output.ts already folds cache tokens at render). Opus reviewer (cost numbers feed the gate). Opus CONCERN: writeResultCost writes no model, so real records still use the caller model; summary tokens at supervisor.ts still exclude cache. Rework dispatched. Merged 3ab2a8fa (train E14, rebased on main): engine10 404 pass 0 fail (402 pass 0 fail with claude removed from PATH), tsc exit 0, test-harness 86/0, test-local-ci-gitleaks 6/0, test-engine10-dist 18/0. Released v9.81.0 (npm view loki-mode time: 2026-09-28T02:38:54Z). |
 | EV-8 | v10 cost check on 5 tasks before the full arm (CEO 23:31Z): v10 arm, same model, after E-42 and E-45 merge | eval/loki10 results (gitignored) plus docs/v10/METRICS.md block | HIGH | eval/loki10/run.sh --arm v10 --tasks <5 ids> reports completed, time to PR and provider cost per task | released@2026-09-28T02:38Z | Target cost per completed task at or below $0.2363 (raw claude -p full arm). Depends on E-42, E-45, E-38 (--tasks). Incident 01:38Z: first run 0/5 on both variants measured the wrong code. The harness default arm binary is the global loki (loki --version: v9.78.0), and the main checkout node_modules still had agent SDK 0.3.267 (package.json pins 0.3.283), whose bundled Claude Code 2.1.267 rejects claude-opus-5-5, so every session exited "error" in about 1s with 0 tokens. Fixed in 7c3dea3d: bun install (node_modules 0.3.283), repro with the harness arm_env and arm_auth now completes on claude-opus-5-5 ($0.11, 13s); dist rebuilt. Rerun started with LOKI_EVAL_LOKI_BIN=<repo>/bin/loki. Guards E-61, E-62. Rerun measured (not a code slice): A 4/5 $0.5954, B 5/5 $0.3976, C (all sonnet, no plan, no Wall) 4/5 $0.294, raw 5/5 $0.2161 (~/loki-ci-logs/ev8r-{A,B,C}/results.jsonl). Gate not met on cost; D31 and E-64, E-65 follow. Released v9.81.0 (npm view loki-mode time: 2026-09-28T02:38:54Z). |

package/docs/v10/DECISIONS.md CHANGED Viewed

@@ -265,3 +265,20 @@ One entry per decision: context, choice, why, how to reverse. Newest last.
 - modernize/ gets its own cap of 4,000 lines in the same test: 25 planned modules (MODERNIZE.md section 13) at about 150 lines each plus 15% slack. M-24's view moves to mod/dashboard.ts. M-14 stays under 20 lines in wall.ts and calls into mod/oracle/.
 - Core never imports modernize/ (the cli.ts TABLE string is exempt), so the split cannot hide core code.
 - Hitting either cap means re-slice or delete, never raise. Ruled by the CTO (opus) on the Chief of Staff's request; implemented by E-76.
+## D34. 2026-09-28: large tier is real upstream PRs, one size gate, legacy moves to M-27
+- EV-12 failed 4 reviews: synthetic lg-* tasks met the size bar mainly by deleting starter docstrings (added lines 93-106), came from an uncommitted generator, had 0 legacy tasks, and their size script exited 0 on a miss. They are closed, not merged (branches slice-EV-12a/b/c kept).
+- Size is one command for every tier (eval/loki10/measure-size.py, run in test-harness.sh, exits 1 on any miss): files = touched non-test .py source files; lines = added non-blank lines; deletions never count. Medium: at least 2 files. Large: at least 4 files, at least 150 added lines, and above the largest medium task (74 today; the old "137" counted CI, config and deletions).
+- Large tasks use the medium pub-* pipeline: upstream repo, ref = merge^1, verbatim upstream hidden tests, RED/GREEN through run.sh, deletion mutants recorded.
+- Amends D30: legacy coverage leaves the large tier and lives in the modernize eval (M-27). The large tier is 10 feature tasks.
+- EV-14 may decide the default flip on 5 real large tasks, 2 runs per arm: v10 completions, cost per completed task and p50 time all at or better than raw. No large-tier speed claim until 10 tasks; at 10, EV-14 re-runs, and a loss on any axis reverts the default.
+- Ruled by the CTO (opus) on the Chief of Staff's request.
+## D35. 2026-09-28: DEP workstream (dependency modernization), founder directive
+- Goal: every dependency, runtime, GitHub Action, image, chart, Terraform provider and the Homebrew formula on its latest stable version, nothing broken.
+- Priority: E, EV and M slices always first. DEP uses at most 3 builders, only when the ready queue has spare capacity, never holds a train and never blocks a release.
+- Order: DEP-01 inventory (docs/v10/DEPS.md, deterministic, no upgrades), then small slices: patch and minor grouped per ecosystem (LOW, lockfiles regenerated and committed); every MAJOR its own slice (MEDIUM, release notes and migration guide read first, breaking changes fixed in the slice, notable changes recorded); Actions on the latest major pinned by full commit SHA with the version in a comment; EOL runtimes dropped and current stable Node, Python, Bun added, keeping one previous supported version where users still run it; Agent SDK and Anthropic SDK upgrades re-run the v10 small-tier eval on 5 tasks (completion, cost, time no worse); Docker, Helm, Terraform on latest stable with digests pinned.
+- Safety: every new or changed package passes the hallucinated-dependency guard and npm/pip audit with no new high or critical findings; full Tier B plus the moat suite green per slice, ratchet never regresses; anything unfixable within budget is parked in DEPS.md with the exact error, never force-merged; upgrades ride normal trains and are listed in each train's CHANGELOG.
+- Keep current: a weekly scheduled check (or pulse DEPS_STALE) reports anything more than one minor behind or past EOL and cuts a DEP slice.

package/docs/v10/PROGRESS.md CHANGED Viewed

@@ -1,5 +1,31 @@
 # Progress
+## 2026-09-28T15:45Z: 10.2.0 cannot publish by dispatch; re-release as 10.2.1; drift audit (turn 456)
+- Security Audit dispatched on 8e7d21f2 (run 36442754156) completed success, but Release dispatched on main (run 36443541666) sat in required-ci: release.yml counts only event=="push" runs, and Security Audit runs on push only when VERSION changes, so a dispatched audit is never counted. Cancelled before its 40-minute deadline. Re-release follows the 10.0.1 precedent: push the train, Tests and Bun Parity green, bump to 10.2.1 so the VERSION push runs Security Audit and Release. E-87 cut for the dispatch path.
+- Gitleaks root cause: the pub-werkzeug-3271 prompt (upstream issue text) contains a sourcegraph.com URL, which arms the sourcegraph-access-token rule, which then matches the 40-hex repo.ref. Local `gitleaks git` (8.30.0 and 8.30.1) does not reproduce it; `gitleaks dir eval/loki10/tasks` with v8.30.0 does (1 finding). E-86 (pre-push check) uses dir mode with the pinned v8.30.0.
+- DEP-01 built (2cceecd2, in review): docs/v10/DEPS.md from scripts/dep-inventory.py, 98 manifests. MAJOR bumps pending: npm 24, Python 10, GitHub Actions 74 uses, Docker 8, Terraform 4. EOL: Node 20 in test.yml (EOL 2026-04-30), nginx:1.27-alpine. Homebrew formula at 10.1.1.
+- Drift audit: since 14:00Z, 3 releases (v10.1.1 shipped; v10.2.0 blocked twice: red Tests on 9d483688, then Security Audit), main red once (9d483688, fixed forward E-83), release volume 23 per 24h against a 30 target. Deviations: train checks ran only tests/engine10 (now the full loki-ts suite plus the dist test); a release dispatch path that cannot pass.
+## 2026-09-28T15:20Z: v10.2.0 publish blocked by Security Audit (gitleaks false positive)
+- Release run 36440534050 failed at required-ci: Security Audit 36440534022 failed with 1 new gitleaks finding (report artifact gitleaks-report): rule sourcegraph-access-token at eval/loki10/tasks/pub-werkzeug-3271/task.json:8, commit 82e39c29 (EV-11a). The value is repo.ref, a 40-hex pallets/werkzeug commit (`gh api repos/pallets/werkzeug/commits/<ref>` resolves, dated 2026-09-13). Not a credential.
+- Fix: that exact commit-qualified fingerprint added to .gitleaksignore with a justification (no path or rule suppression). Nothing was tagged or published for 10.2.0; the Release workflow is re-dispatched on main once Tests, Bun Parity and Security Audit are green on the fix commit.
+- Recurrence risk: every pub-*/lg-* task pins a 40-hex SHA; E-85 asks the CTO for a narrowly scoped rule. TRAIN_LATE read 681 min because the pulse only reads ~/loki-ci-logs/push-*.log, which plain `git push` never writes; E-84 fixes it.
+## 2026-09-28T14:58Z: main red on train E22, E-83 fix-forward (c5ace6e1; Tests green on 378a2e13)
+- Tests red on 9d483688 (run 36438012977): spawn env guard (M-16 codemod.ts spawn with no env) and tests/test-engine10-dist.sh "bundle contains prStage" (E-66's offset deleted the alias the dist test greps for). Both passed review because reviewers and the Chief of Staff ran only `bun test tests/engine10/`.
+- Fixed in E-83 (c5ace6e1). Rule from now: every train touching loki-ts/src runs the full `cd loki-ts && bun test` and `bash tests/test-engine10-dist.sh` before push, and slice cards say so.
+- D34 (CTO) recorded: large tier from real upstream PRs, one size gate, legacy to M-27; EV-12S and EV-12A/B/C building (wf_6aea81c7-823).
+## 2026-09-28T14:50Z: train E22 and drift audit (turn 444)
+- Wave E21 (28 agents, ESTIMATE 3,652,703 subagent tokens) plus E21b: 13 of 16 slices approved. Train E22 (9042e964) merges E-66, E-61, M-24, M-16, M-19, M-04, E-74, E-75, E-77, EV-11a, E-82: `bun test tests/engine10/` 547 pass 0 fail, tsc 0, pulse 107 passed, eval harness 108 passed, shard drift 6 passed. Core engine 4,998 of 5,000 (D33).
+- Held: M-07 (core would read 5,000), EV-11b and E-62 (both conflict with EV-11a in the eval harness; serialized next), E-78 (TL CONCERN).
+- EV-12 blocked for a CTO tier ruling after 4 review rounds (size bar met by deleted docstrings; uncommitted generator; untested counted code; no legacy tasks left).
+- Drift audit: the 6-hour window is mostly the 04:48Z-14:00Z access stall (no work possible). Since 14:00Z: v10.1.1 released, 2 trains, main green on each push checked (Tests on 3fb56a4b, 5f295fba). Deviation: the wave script passed "-B" as the reviewers' branch name (all reviews still cited the right SHAs); fixed in the next script.
+## 2026-09-28T14:30Z: v10.1.1 shipped
+- Release run 36434253412 success; `npm view loki-mode dist-tags.latest` 10.1.1, gitHead 580540f9 = release commit. Tests and Bun Parity green on 3fb56a4b before the bump; version-only bump produced no dist churn (E-72 working).
+- Wave E21 (wf_39ab3f7d-8f3) in flight: 12 builders, 4 reviews. Ready queue refilled with E-78..E-82.
 ## 2026-09-28T14:10Z: resumed after a 9-hour stall -- read first on resume
 - Shipped before the stall: v10.0.1 (npm gitHead 76ec1c24) and v10.1.0 (Release run for b60ca0ef all jobs success; `npm view loki-mode@10.1.0 gitHead` b60ca0ef; dist-tag latest 10.1.0).
 - Stall: every model call from 04:48Z failed with "Your organization has disabled Claude subscription access for Claude Code" (workflow failures in wf_bd919989-941 and wf_1efd6e89-1f3); nothing ran until about 14:00Z. The pulse raised no violation for it; E-77 adds SESSION_STALLED.