loki-mode 10.10.5 → 10.11.0

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: An autonomous software factory that knows what it is supposed to deliver, and proves it did. Use when the user says Loki Mode or asks to build, fix or verify software autonomously.
 ---
 
-# Loki Mode v10.10.5
+# Loki Mode v10.11.0
 
 **Current entry points (Loki 10 engine):** `loki "<task>"`, `loki owner/repo#N` and `loki quick "<task>"` run the Loki 10 engine and end with a signed receipt (`loki verify`). `loki backlog owner/repo --all` runs many issues in parallel. Guide: `docs/v10/GUIDE.md`. The skill instructions below, and `loki start`, describe the legacy engine, which still ships and is being removed (`loki start owner/repo#N` still routes to it; prefer `loki owner/repo#N`).
 
@@ -483,4 +483,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v10.10.5 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**
+**v10.11.0 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**

package/VERSION

@@ -1 +1 @@
-10.10.5
+10.11.0

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "10.10.5"
+__version__ = "10.11.0"
 
 # Expose the control app for easy import
 try:

package/docs/CLI-REFERENCE.md

@@ -1,6 +1,6 @@
 # CLI reference
 
-Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v10.10.5. Do not edit by hand.
+Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v10.11.0. Do not edit by hand.
 Hidden and legacy-only commands are omitted; see `docs/v10/CLI-MODERN.md` for the full inventory.
 
 | Command | Description |

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 The flagship product of [Autonomi](https://www.autonomi.dev/). Loki Mode is a spec-driven autonomous builder with a built-in trust layer that takes any spec to a deployed product and verifies completion with evidence (quality gates plus a completion council), not just a "done" claim. Complete installation instructions for all platforms and use cases.
 
-**Version:** v10.10.5
+**Version:** v10.11.0
 
 **Engine note:** `loki "<task>"`, `loki owner/repo#N` and `loki quick` run the Loki 10 engine. `loki start` still routes to the legacy engine, which is being removed (planned work resumes 2026-10-07); prefer `loki owner/repo#N`. See [docs/v10/GUIDE.md](v10/GUIDE.md).
 

package/docs/v10/BOARD.md

@@ -877,7 +877,9 @@ Source: ~/git/autonomi-dev/research/2026-09-30-adoption/SWARM-PROMPT-ADOPTION.md
 | FC-01b | Monorepo visual-evidence skip reason: with backend/ and frontend/ package.json and no root manifest, say "no dev, preview or start script in backend/ or frontend/", not "no package.json" | visual evidence path in loki-ts/src plus test | LOW | monorepo fixture prints the per-package reason | ready@2026-10-03T21:31Z | FC-01 sibling (Engine Law L5). |
 | FC-19b | Spec-conflict resume near the stage limit: skip the resume when under about 60s of the implement window remains, or keep the first conflict when the resume is aborted, so the run ends BLOCKED with its question instead of a limit failure | loki-ts/src/util/conflict_resume.ts plus machine.ts plus test | MEDIUM | a fake first session that uses the window then conflicts ends BLOCKED with its question | ready@2026-10-03T21:56Z | review-fc19 non-blocking follow-up, from reading machine.ts runStage. |
 | CP-START | FC-20 (LATER list): root-cause the CP home Start "HTTP 404" (route mismatch, stale CP process serving a newer UI, or the loopback guard) and fix it at the shared layer (UI and server version match; a stale CP restarts or refuses a newer UI); never show a bare HTTP status, show a sentence with the next step; repo chip lists registered repos by name plus Browse; choosing a smaller model shows one muted line ("haiku: fastest, may be less accurate") and never blocks. The composer itself is redefined by CP-ASK (founder 22:03Z): greenfield-from-composer is dropped | packages/control-plane server and ui plus tests | MEDIUM | a forced 404 renders a sentence, a version-skewed UI gets the restart sentence | ready@2026-10-03T22:05Z | Founder bug via steering 22:01Z, rescoped by founder 22:03Z. Do not displace FC-15 or FC-16. |
-| CP-ASK | Founder 22:03Z: "we are not a vibe coding tool". The CP home box becomes Ask Loki: search, learn, compare runs, and ask anything about Loki Mode, past runs, receipts, repos and issues. Default provider claude (or any configured provider and model the user picks); the model gets all of that data (read-only tools or MCP over runs, receipts, events, METRICS, repos, gh issues and PRs); answers are async jobs the user can leave and come back to, listed in the CP. Read-only: Ask never edits a repo or starts a build | Architect slices first (10-40 slices, feature flag); packages/control-plane routes and ui, a read-only data layer, provider invocation | HIGH | the founder asks "compare my last two runs on FireLater" and gets a cited answer async in the CP; Ask cannot write to any repo | ready@2026-10-03T22:05Z | Founder direct directive 22:03Z. Architect plan first. |
-| FC-21 | FC-21: (a) a limit in implement still runs verify on the existing work plus the fix rounds the budget allows, never seal directly; (b) the run cap scales with task size (sizing and Project Model), with a generous subscription default set in loki.yaml; (c) implement is told its remaining time; (d) the CLI summary, CP and PR body read receipt.verdict (one outcome) | loki-ts/src/engine10 run orchestration, the budget and sizing modules, the CLI summary, plus tests | MEDIUM | a fake implement limit is followed by verify; CLI outcome equals receipt.verdict for 4 verdicts; a large task gets a larger cap; core cap under 5000 | merged@2026-10-03T22:55Z | FireLater#17 gate on 10.10.3 PARTIAL (steering 22:08Z). P0 tier with FC-16/FC-15. Built 21fec9deb; opus review-fc21 APPROVE on merge e80abc63a (suites 1719/0, budget 27/0, tsc rc=0 with real node_modules); merged 881f1275f. Advisories A1-A4 filed as FC-21b. Ships in one train with FC-15 and FC-16. |
-| FC-21b | FC-21 follow-ups, next train (steering 23:00Z): (1) an implement limit forces PARTIAL only while checks are red or unrun; if the fix rounds make the impacted checks green with n>0 the run earns VERIFIED (L3: what ran is the evidence, not how long implement took); (2) size the run cap from the Project Model and plan (packages and files touched) or a plan-session estimate, never from task-text character count (L0); (3) the CLI outcome must equal receipt.verdict, so a cap stop after a limit cannot print BUDGET_STOP over a PARTIAL or FAILED receipt (L7, was advisory A4); (A1) machine.ts:145 mustJump keys on reason limit only, require r.killed too; (A2) a spec-conflict resume gets the full original budget in the time note and limitS, and the note lands after FINISH_LINE; (A3) yamlRunCapS matches run_cap_s at any depth under budgets, CRLF yaml falls back silently, ls-files count off by one | loki-ts/src/engine10/machine.ts, stages/implement.ts, stages/seal.ts, output.ts, src/util/run_cap.ts, project_model sizing, plus tests | HIGH | a limit then fix-green with n>0 seals VERIFIED, a limit with a red or unrun check seals PARTIAL; the cap for a short task touching many packages exceeds the cap for one file; CLI outcome equals receipt.verdict on a cap stop after a limit; a thrown limit without a kill never reaches VERIFIED; nested per_stage run_cap_s is ignored; a resumed implement gets the remaining time | ready@2026-10-03T23:01Z | From review-fc21 22:53Z plus steering 23:00Z. HIGH because it changes the verdict rule (opus reviewer). Architect plan first for the sizing source. e10ext is 1 line under its 1500 cap. Queue after the FireLater#17 gate on 10.10.4. |
-| FC-16b | FC-16 follow-ups: package_suite.ts:33 detects go by first token only (make test, GOFLAGS=x go test fall to the generic path); go -json parsing; load_owner killTree process-group kill; unittest atexit forged trailer | loki-ts/src/engine10 package_suite, load_owner, test classify, plus tests | MEDIUM | make test wrapping go test classifies with runner go; a forged unittest trailer from atexit is not a pass | ready@2026-10-03T23:01Z | From review-fc16-fc02-integ rounds 4-6. package_suite results never feed seal proof today. Also owed: an end-to-end test running a go Wall file through RealBaseTestRunner (the seal.test.ts case does not guard wall.ts). |
+| CP-ASK | Founder 22:03Z: "we are not a vibe coding tool". The CP home box becomes Ask Loki: search, learn, compare runs, and ask anything about Loki Mode, past runs, receipts, repos and issues. Default provider claude (or any configured provider and model the user picks); the model gets all of that data (read-only tools or MCP over runs, receipts, events, METRICS, repos, gh issues and PRs); answers are async jobs the user can leave and come back to, listed in the CP. Read-only: Ask never edits a repo or starts a build | Architect slices first (10-40 slices, feature flag); packages/control-plane routes and ui, a read-only data layer, provider invocation | HIGH | the founder asks "compare my last two runs on FireLater" and gets a cited answer async in the CP; Ask cannot write to any repo | building@2026-10-04T00:06Z | Plan docs/v10/CP-ASK-PLAN.md (15 slices behind LOKI_CP_ASK=1, waves {1,4,6,8} {2,5,7} {3,9} 10 11 {12,13} 14 15); founder questions decided as FOUNDER-QUEUE row 20. Slice 1 (MCP read-only mode) seated. Founder direct directive 22:03Z. Architect plan first. | 00:33Z: slices 1 (9f454444a, plus fix-forward F1/F2 7bcffc70f, opus APPROVE), 4 (2a0ad3fc1) and 8 (d1b38e508) merged; flag off; next wave 2/5/6/7. 
+| FC-21 | FC-21: (a) a limit in implement still runs verify on the existing work plus the fix rounds the budget allows, never seal directly; (b) the run cap scales with task size (sizing and Project Model), with a generous subscription default set in loki.yaml; (c) implement is told its remaining time; (d) the CLI summary, CP and PR body read receipt.verdict (one outcome) | loki-ts/src/engine10 run orchestration, the budget and sizing modules, the CLI summary, plus tests | MEDIUM | a fake implement limit is followed by verify; CLI outcome equals receipt.verdict for 4 verdicts; a large task gets a larger cap; core cap under 5000 | released@2026-10-03T23:33Z | Released in v10.10.5. FireLater#17 gate on 10.10.3 PARTIAL (steering 22:08Z). P0 tier with FC-16/FC-15. Built 21fec9deb; opus review-fc21 APPROVE on merge e80abc63a (suites 1719/0, budget 27/0, tsc rc=0 with real node_modules); merged 881f1275f. Advisories A1-A4 filed as FC-21b. Ships in one train with FC-15 and FC-16. |
+| FC-21b | FC-21 follow-ups, next train (steering 23:00Z): (1) an implement limit forces PARTIAL only while checks are red or unrun; if the fix rounds make the impacted checks green with n>0 the run earns VERIFIED (L3: what ran is the evidence, not how long implement took); (2) size the run cap from the Project Model and plan (packages and files touched) or a plan-session estimate, never from task-text character count (L0); (3) the CLI outcome must equal receipt.verdict, so a cap stop after a limit cannot print BUDGET_STOP over a PARTIAL or FAILED receipt (L7, was advisory A4); (A1) machine.ts:145 mustJump keys on reason limit only, require r.killed too; (A2) a spec-conflict resume gets the full original budget in the time note and limitS, and the note lands after FINISH_LINE; (A3) yamlRunCapS matches run_cap_s at any depth under budgets, CRLF yaml falls back silently, ls-files count off by one | loki-ts/src/engine10/machine.ts, stages/implement.ts, stages/seal.ts, output.ts, src/util/run_cap.ts, project_model sizing, plus tests | HIGH | a limit then fix-green with n>0 seals VERIFIED, a limit with a red or unrun check seals PARTIAL; the cap for a short task touching many packages exceeds the cap for one file; CLI outcome equals receipt.verdict on a cap stop after a limit; a thrown limit without a kill never reaches VERIFIED; nested per_stage run_cap_s is ignored; a resumed implement gets the remaining time | building@2026-10-03T23:59Z | Plan docs/v10/FC21B-FC22-PLAN.md (slices S1 graph+yaml_key, S5 cap sizing, S4 verdict+L7+A1+A2; S4 last). From review-fc21 22:53Z plus steering 23:00Z. HIGH because it changes the verdict rule (opus reviewer). Architect plan first for the sizing source. e10ext is 1 line under its 1500 cap. Queue after the FireLater#17 gate on 10.10.4. |
+| FC-16b | FC-16 follow-ups: package_suite.ts:33 detects go by first token only (make test, GOFLAGS=x go test fall to the generic path); go -json parsing; load_owner killTree process-group kill; unittest atexit forged trailer | loki-ts/src/engine10 package_suite, load_owner, test classify, plus tests | MEDIUM | make test wrapping go test classifies with runner go; a forged unittest trailer from atexit is not a pass | building@2026-10-03T23:59Z | Engineer fix-fc16b in worktree. From review-fc16-fc02-integ rounds 4-6. package_suite results never feed seal proof today. Also owed: an end-to-end test running a go Wall file through RealBaseTestRunner (the seal.test.ts case does not guard wall.ts). | 00:33Z: review-fc16b BLOCKED 1b3f594cb (forged go events, unittest multi-Ran); fix 626b46c74 in opus re-review. 
+| FC-22 | FC-22: (a) impacted-test selection is scoped by the Project Model, touched packages plus their real dependents (manifest or import edges), never every package; (b) a selected package with no installed deps gets the Project Model's own install command run once before verify, recorded as a check with its cwd, opt-out by config | loki-ts/src/e10ext/select.ts, project_model resolve and gather, engine10 verify pre-step, plus tests | HIGH | a backend-only change in the monorepo-fc01 fixture selects no frontend test; a selected package without node_modules gets one recorded install check; no guessed command; e10ext under 1500 | building@2026-10-03T23:59Z | Plan docs/v10/FC21B-FC22-PLAN.md (S1 then S2 selection and S3 install). FireLater#17 gate on 10.10.5 (run e10-20261003T233414Z-30ca) PARTIAL only from 4 over-selected frontend tests (steering 23:47Z). HIGH because selection feeds verify proof. Architect plan first; e10ext is 1 line under its cap. Next train with FC-21b and FC-23. | 00:33Z: S1 merged 88e9e43fb (review-s1 APPROVE). S2 e9e04fe1d in opus review-s2; S3 cb6486550 in opus review-s3. 
+| FC-23 | FC-23: the Wall writes tests matching the package's module system and test conventions from the Project Model; a lint or type error inside a Wall file is harness-owned, the Wall file is regenerated once or discarded with a NOT PROVEN note, and no fix round is spent on it | loki-ts/src/engine10/stages/wall.ts, the fix-round target filter, project_model conventions, plus tests | MEDIUM | a CommonJS package gets a Wall test with no import.meta; a forced type error in a Wall file yields regenerate-or-discard and zero fix rounds | building@2026-10-03T23:59Z | merged@2026-10-04T00:23Z | Merged c0a1c43c2 (38c782386, review-fc23 sonnet APPROVE; nits: duplicate NOT PROVEN line for a discarded file, merged comment in verify.ts). 

package/docs/v10/CP-ASK-PLAN.md

@@ -0,0 +1,85 @@
+# CP-ASK slice plan (Architect, 2026-10-04T00:05Z)
+
+Founder 22:03Z: the CP home box stops being "what should Loki build" and becomes Ask Loki.
+- What it does: search, learn and compare across runs, receipts, repos and issues.
+- How it runs: asynchronously, on the user's provider (default claude).
+
+Everything ships behind LOKI_CP_ASK=1 (default off). Ask is a read-only async job: the provider calls tools from the existing MCP server, and threads are stored in control.db. It never starts a build.
+
+## Findings (file:line; CP = packages/control-plane)
+- **The box today:** CP/ui/src/pages/home/Hero.tsx:45-68, mounted at home/index.tsx:8.
+  - Submit (:26-40) calls POST /v1/start, which reaches spawn.ts:52 planStart, then spawnStart (:73), which runs `loki start --brief`.
+  - Compose (ui/src/pages/compose/index.tsx:75) is a second start path, so builds keep a home.
+- **CP data that already exists:**
+  - control.db holds events, runs, audit, local_repos and actions (src/db/schema.ts:3-89).
+  - HTTP reads: /v1/runs (app.ts:55), /v1/runs/:s/:r (:63), events and the artifact allowlist (artifacts.ts:53, :68), plus stats, cost, fleet, metrics, memory, audit, checkpoints and providers.
+  - There is no /v1/compare route (CONTROL-PLANE.md:41 lists one).
+- **mcp/server.py (3028 lines) mixes read and write tools.**
+  - Read tools: memory_retrieve, state_get, metrics_efficiency, v10_status, project_status, agent_metrics, quality_report, code_search, mem_search, timeline, get, hotspots, co_changes, doc_coverage, findings, learnings, graph_query.
+  - Write or spawn tools: store_pattern, task_queue_add, task_queue_update, capture_session_summary, consolidate_memory, complete_task, v10_run, start_project, checkpoint_restore, loki_start, verify_fast, v10_verify.
+  - It is stdio and works relative to its cwd's .loki.
+- **Repos:** ~/.loki/dashboard/projects.json (spawn.ts:34) plus local_repos.
+- **GitHub:** nothing in the CP; gh is on the host.
+- **Read-only primitives per provider:**
+  - claude: --mcp-config (loki-ts/src/providers/mcp_config.ts) and --allowedTools/--disallowedTools, with deny taking precedence (claude_flags.ts:472-512).
+  - codex: `exec --sandbox read-only`.
+  - opencode: MCP (opencode.sh:72).
+  - cline and aider: no MCP on our path.
+- **Reusable CP helpers:** the SSE helper stream.ts:20-44 and child env scrubbing spawn.ts:14 childEnv.
+
+## Decisions
+- **Data access is tools only (ADOPT, no prompt stuffing).**
+  - mcp/server.py gets `--read-only`, which registers only the read allowlist.
+  - A new mcp/cp_tools.py calls the CP's own HTTP read API: runs_search, run_get, run_events, run_artifact, runs_compare, stats, cost and repos_list (names only).
+  - gh_issues and gh_prs use fixed argv (`gh issue list|view`, `gh pr list|view`), with the repo validated against a known origin_repo.
+  - The CP token reaches only the MCP child env, never the model.
+- **Async job.**
+  - POST /v1/ask writes ask_threads and ask_messages rows, then spawns a detached ask worker (argv, no shell, childEnv).
+  - The worker parses the provider's stream-json into ask_events and records cost.
+  - A message ends as done, failed, timeout (600s), over_budget or interrupted.
+  - The UI streams over SSE; the user can leave and come back, and follow-ups replay prior turns.
+- **Security boundary, three layers:**
+  1. Tools: claude gets --strict-mcp-config with allowedTools Read,Grep,Glob,mcp__loki__* and disallowedTools Write,Edit,NotebookEdit,Bash,WebFetch,WebSearch; codex gets --sandbox read-only.
+  2. cwd is an empty 0700 per-job scratch dir, never a repo, removed at the end.
+  3. The MCP surface is read-only and gh runs with fixed argv.
+  - The ask module never imports planStart or spawnStart (guard test).
+  - All run, event and issue text is untrusted data.
+  - POST requires loopback or a bearer token, accepts JSON only and questions up to 4000 chars, and allows at most 2 concurrent jobs.
+  - cline and aider are refused with "Ask needs a provider with MCP; use claude, codex or opencode".
+
+## Founder questions (decided by the CoS under the standing mandate; FOUNDER-QUEUE row 20, reversible)
+- (a) With the flag on, the home box is Ask only, with a visible "Start a build" link to Compose. This follows the founder's words directly.
+- (b) Defaults are $1.00 per ask (LOKI_ASK_MAX_USD) and a 600s timeout, both configurable. Ask spend is tracked and shown on the Cost page apart from run budgets.
+- (c) Scope:
+  - CP-level data (runs, receipts and events across every repo, since they are already in control.db) is always available.
+  - Per-repo memory and code tools use one repo per ask (the repo chip, default the CP repo).
+  - All-repos memory fan-out is a later slice.
+
+## Slices (no shared files)
+| # | Slice | Tier | Needs | Files | Wall checks |
+|---|---|---|---|---|---|
+| 1 | MCP read-only mode | HIGH | none | mcp/server.py, mcp/tests/test_read_only.py, tests/test-mcp-tool-surface-guard-rejects.sh | The tool list equals the read allowlist exactly; each write tool is absent (re-adding store_pattern goes red); default mode is unchanged. |
+| 2 | CP data tools | HIGH | 1 | mcp/cp_tools.py, mcp/tests/test_cp_tools.py, mcp/tests/fixtures/cp_api/*.json | runs_compare of two fixture runs returns both ids, verdicts and costs; an artifact outside the allowlist is refused; no CP URL or token is returned. |
+| 3 | gh read tools | HIGH | 2 | mcp/gh_tools.py, mcp/tests/test_gh_tools.py | Only list/view argv is spawned; an unknown repo is refused; gh api is unreachable. |
+| 4 | DB schema | MEDIUM | none | CP/src/db/schema.ts, CP/drizzle/0005_ask.sql, CP/drizzle/meta/*, CP/test/db/ask_schema.test.ts | Migrating a 0004 db keeps runs rows byte-equal. |
+| 5 | Ask store | MEDIUM | 4 | CP/src/ask/store.ts, CP/test/server/ask_store.test.ts | Append order is kept; markInterrupted flips only dead-pid running rows. |
+| 6 | Policy and job dir | HIGH | none | CP/src/ask/policy.ts, CP/test/server/ask_policy.test.ts | The deny list covers the loki-ts REVIEW denylist; mcp.json names --read-only; the scratch dir is 0700 and outside every repo. |
+| 7 | Provider argv | HIGH | 6 | CP/src/ask/invoke.ts, CP/test/server/ask_invoke.test.ts | claude has --strict-mcp-config and the deny list and has no --dangerously-skip-permissions; codex has --sandbox read-only; cline and aider are refused; the default model is omitted (L1). |
+| 8 | Stream parser | MEDIUM | none | CP/src/ask/parse.ts, CP/test/server/ask_parse.test.ts, CP/test/fixtures/ask/{claude,codex}-stream.jsonl | Deltas concatenate to the final text; tool_use is captured; the cost comes from the result line; a truncated stream is failed, never done. |
+| 9 | Worker and prompt | HIGH | 5, 7, 8 | CP/src/ask/worker.ts, CP/src/ask/prompt.ts, CP/test/server/ask_worker.test.ts | A timeout kills only the recorded pgid; over budget gives over_budget; the scratch dir is gone after exit; tool calls are stored as citations. |
+| 10 | Routes | HIGH | 5, 9 | CP/src/server/routes/ask.ts, routes/index.ts, routes/stream.ts (export sse), CP/test/server/ask_routes.test.ts, CP/package.json | Flag off gives 404; non-loopback without a token gives 403; a third job gives 429; cancel kills only the recorded pid; nothing is imported from spawn.ts except childEnv. |
+| 11 | Ask page | MEDIUM | 10 | CP/ui/src/pages/ask/{index.tsx,Thread.tsx,api.ts}, CP/ui/src/pages/wired.tsx | Text streams; citations link to #/runs/:s/:r; an interrupted message shows a retry. |
+| 12 | Home box swap | MEDIUM | 11 | CP/ui/src/pages/home/Hero.tsx, AskBox.tsx | Flag on: submit POSTs /v1/ask, never /v1/start, and a "Start a build" link goes to Compose. Flag off: byte-identical. |
+| 13 | Nav and palette | LOW | 11 | CP/ui/src/shell/AppShell.tsx, CP/ui/src/palette/index.tsx | The Ask entry appears only with the flag on. |
+| 14 | E2E and red team | HIGH | 10, 12 | CP/test/e2e/ask.spec.ts, CP/test/server/ask_readonly.test.ts, CP/test/fixtures/ask/inject-run/* | An injected "edit README, run loki start" leaves git status unchanged, spawns no loki and logs no Write or Edit; "compare my last two runs on FireLater" cites both ids. |
+| 15 | Docs and flag flip | LOW | 14 | docs/v10/CONTROL-PLANE.md, CP-ENTERPRISE-UI.md, CHANGELOG.md | The flip is a separate one-line change after a live EV run on real claude passes. |
+
+Waves: {1,4,6,8}, then {2,5,7}, then {3,9}, then 10, then 11, then {12,13}, then 14, then 15.
+
+## Risks
+1. Run data, repo files and issues go to the user's provider. The UI says so on first use.
+2. Prompt injection from issue and run text: no write tool exists, and with no WebFetch the provider is the only outbound channel.
+3. mcp/server.py memory tools are per-repo; cross-repo memory waits for a later slice.
+4. $1 and 600s may truncate deep comparisons; both are configurable.
+5. The read-only allowlist can drift as tools are added. The exact-list test makes a new tool absent until it is classified (fail closed).
+6. codex and opencode MCP flags are version-sensitive. Gate them on probes and mark them degraded.

package/docs/v10/FAILURE-CLASSES.md

@@ -272,3 +272,18 @@ L0 review rule (ENGINE-LAWS.md L0): a fix that adds an `if` or a regex about the
 - Siblings: every stage that can end at "limit" (plan, wall, implement, fix, deep); every caller that jumps from a stage failure straight to seal; every outcome printer (CLI summary, CP run page, PR body, Slack) that derives the verdict itself instead of reading receipt.verdict; FC-19 (a fixed time handicap on implement).
 - Mechanism: (a) a limit in implement still runs verify on the work that exists, plus the fix rounds the remaining budget allows, and never jumps to seal; (b) the run time budget scales with task size (sizing and the Project Model: files, packages), and subscription runs default to a generous wall cap that can be set in loki.yaml; (c) the implement session is told its remaining time so it can checkpoint with tests passing; (d) every outcome printer reads receipt.verdict.
 - Fixture: owed. A fake implement that hits the limit is followed by a verify stage event; the CLI summary equals receipt.verdict for VERIFIED, PARTIAL, FAILED and BLOCKED; a large sized task gets a larger cap than a small one.
+- Status: shipped in v10.10.5 (implement limit runs verify, cap scales, time note, PARTIAL outcome). Fixtures: loki-ts/tests/engine10/fc21_limit.test.ts and fc21_cap.test.ts. Follow-ups in BOARD FC-21b (earned VERIFIED after a limit, Project Model cap sizing, L7 outcome on a cap stop). Gate on 10.10.5: implement finished in 6m36s under cap 2700s and verify ran.
+
+## FC-22 Impacted-test selection crosses package boundaries, and a selected package with no installed deps can never be proven
+- User saw: FireLater#17 on 10.10.5 (run e10-20261003T233414Z-30ca) ended PARTIAL although the backend-only change was correct (backend suite 5914 pass, 0 fail; tsc 0 errors). Verify had selected 4 frontend tests (page.test.tsx, Header, Sidebar, auth store) that do not import the backend; the clone had no frontend deps, so they could not load ("Cannot find module 'vitest/config'") and were NOT PROVEN.
+- Law: L0 and L4 (selection follows the repo's real structure, never a name or text guess), L1 (raw Claude Code would have run the backend suite and stopped), L5 (the NOT PROVEN reason was honest; FC-02 classified it correctly).
+- Siblings: every selector that maps changed files to tests (e10ext/select.ts, the Wall test map, deep full suite, package_suite per-package runs); every stage that runs a package's command without checking its deps are installed.
+- Mechanism: (a) impacted selection is scoped by the Project Model: the touched packages plus the packages that really depend on them (manifest or import edges), never every package in the repo. (b) when a selected package has no installed deps, run the Project Model's own install command for that package once, before verify, recorded as a check with its cwd; opt-out by config; never a guessed command.
+- Fixture: owed. The monorepo-fc01 fixture with a backend-only change selects no frontend test; a selected package without node_modules gets one recorded install check before its test runs.
+
+## FC-23 The Wall writes a test that fails the package's own type check, and a fix round is spent on Loki's read-only file
+- User saw: the same run's Wall wrote a test that failed the package tsc (TS1470: import.meta is not allowed in CommonJS output). Fix round 1 was spent on it; the model correctly refused to edit Loki's read-only Wall file, so the round bought nothing and the check stayed red.
+- Law: L5 (a harness-authored failure is harness-owned, never charged to the user's work), L1 (no wasted model time), cost.
+- Siblings: every harness-authored file that later runs under the user's tooling (Wall tests, presealed Wall in modernize, generated fixtures); every place a fix round can target a file the model is forbidden to edit.
+- Mechanism: the Wall reads the package's module system and test conventions from the Project Model (type, module, test runner, import style) and writes to match; a lint or type error located inside a Wall file is harness-owned: the Wall file is regenerated once or discarded with a NOT PROVEN note, and no fix round is ever spent on it.
+- Fixture: loki-ts/tests/engine10/fc23_wall_conventions.test.ts (a CommonJS package: the Wall brief carries the convention and an import.meta Wall file is discarded with a NOT PROVEN note; a Wall-only tsc error yields not_run, owner harness, zero grouped failures; control: a user-code type error still fails and gets a fix round). Readers: loki-ts/src/project_model/conventions.ts, loki-ts/src/util/wall_owned.ts.

package/docs/v10/FC21B-FC22-PLAN.md

@@ -0,0 +1,107 @@
+# FC-21b and FC-22 slice plan (Architect, 2026-10-03T23:58Z)
+
+The order is S1, then S2, S3 and S5 in parallel, then S4 last. No two slices touch the same file. Every slice must pass the full `bun test` plus `bunx tsc --noEmit` before APPROVE.
+
+## Findings (file:line, loki-ts/src)
+- Impacted-test selection lives in engine10/testmap.ts:201 impactedRefs, not in e10ext/select.ts (which is attempt ranking).
+  - It matches basename stems across the whole repo (sourceRefs :186-193), so a backend validation.ts pulls in frontend validation.test.ts.
+  - Callers: verify.ts:250 and :260, implement.ts:25, sizing.ts:43, plan.ts:58.
+- The Project Model has no package graph (schema.ts:21 ModelPackage) and no install command (COMMAND_KINDS, schema.ts:8).
+- seal.ts:140: an implement exit of killed is always PARTIAL. machine.ts:128 overwrites outputs.implement on a kill, and restoreReadOnly (implement.ts:43) never runs on a kill. A killed session can therefore leave an edited Wall file behind, and verify runs it. This blocks shipping VERIFIED-after-limit.
+- The cap is fixed before the worker spawns (supervisor.ts:330), and the backstop comes from it (:181).
+  - plan.ts:91 relevant_files is keyword overlap, so it is not a size signal.
+  - run_cap.ts:28 matches run_cap_s at any depth under budgets; CRLF fails silently at :27; :35 has an off-by-one line count. budget_cap.ts:20 yamlPerRun has the same bugs.
+- output.ts:70 outcomeOf returns BUDGET_STOP over a sealed PARTIAL or FAILED receipt, which is an L7 violation.
+- A1: machine.ts:145.
+- A2: conflict_resume.ts:14 spreads the first session's options, and machine.ts:66 raises limitS back to the full budget, then appends the note after FINISH_LINE.
+- Measured line counts: core 4705, e10ext 1481, features 2971. New modules go in project_model/ and util/ (uncapped). e10ext changes must be net <= 0.
+
+## Decisions
+- FC-22a: ModelPackage gets `dependsOn?: string[]` (package roots), declared and cited by the discovery model (L0, no import parsing).
+  - Absent means edges are unknown: keep today's cross-package selection (fail safe).
+  - [] is an explicit "no dependents".
+- FC-22b: ModelPackage gets `install?: ModelCommand|null`. Install is triggered by evidence only: a selected check in that package came back as a harness-owned load error (FC-02).
+  - It runs once per package per run, between verify and the fix loop, with timeout min(300s, cap left).
+  - It is recorded as check `install:<root>`, and verify is rerun once (not a fix round).
+  - No install command means NOT PROVEN naming the package; never guess.
+  - Opt-out: LOKI_E10_INSTALL=0 or loki.yaml `verify.install_deps: false`.
+- FC-21b(1): add before the fail->FAILED line in verdictOf:
+  `if (exit === "killed") return typeof o.implement?.limit_s === "number" && targetProof && proof && !verifyNotProven && checks.length > 0 && checks.every((c) => c.result === "pass") ? "VERIFIED" : "PARTIAL";`
+  - targetProof means a verify `target_checks` entry (Wall or a task-named relevant test) passed with n>0.
+  - The receipt gets an optional `implement_limit: {limit_s, elapsed_s}`, omitted when unset so other receipts stay byte-stable.
+- FC-21b(2): the plan session writes <runDir>/plan-scope.json {"files":[...]}.
+  - P = packages owning those files plus their dependentsOf; F = the file count.
+  - cap = clamp(900 + 450*(P-1) + 20*max(0, F-3), 900, ceiling). The ceiling is 3600 on subscription and 2400 with a dollar cap.
+  - The worker resizes once after plan||wall. An explicit env or yaml cap is fixed.
+  - Task-text length and the repo file count are removed from the formula.
+- FC-21b(3): the receipt is the one source of truth. Outcome = receipt.verdict, and the exit code is EXIT[verdict].
+  - A cap stop is shown on the Reason line and as `stop:"cap"` in --json.
+  - BUDGET_STOP remains only when no receipt was sealed.
+
+## Questions the Architect raised (decided by the CoS under the standing mandate; recorded in FOUNDER-QUEUE.md for veto)
+- (a) After a limit, VERIFIED requires a Wall or task-named test to pass with n>0. ACCEPTED: Seal accuracy outranks delivered accuracy.
+- (b) Install defaults ON (L1 parity with raw Claude Code, which would install deps), with the opt-out above. ACCEPTED, on two conditions: install runs only on evidence of a load error, and the tree guard is L2-classified.
+- (c) Exit code 3 is dropped when a receipt is sealed. ACCEPTED (L7). It ships as a CHANGELOG "Changed" entry that names the exit-code change.
+
+## Slices
+S1 (MEDIUM, no deps): Project Model graph and install schema.
+- Files: project_model/schema.ts, api.ts, discover.ts, gather.ts (computeKey salt "model-rev:2"), new project_model/graph.ts, new util/yaml_key.ts, tests/project_model/graph.test.ts, tests/util/yaml_key.test.ts, fixtures/project-model/firelater-17/response.json.
+- Wall checks:
+  - dependsOn naming an unknown root is rejected;
+  - an absent dependsOn validates;
+  - dependentsOf is transitive and ignores cycles;
+  - a rev-1 cached model is rediscovered;
+  - yamlKey ignores nested per_stage run_cap_s;
+  - yamlKey reads CRLF.
+- If FC-23 merged module-system fields into schema.ts, rebase on them.
+
+S2 (HIGH, needs S1): package-scoped selection (FC-22a).
+- Files: engine10/testmap.ts, new project_model/scope.ts, tests/engine10/fc22_select.test.ts, fixtures/monorepo-fc22/**.
+- Wall checks:
+  - a backend-only change selects no frontend test;
+  - with frontend dependsOn backend, the frontend test is kept;
+  - an absent dependsOn keeps today's selection;
+  - single-package output is byte-identical;
+  - an unowned test is kept;
+  - implement impactedTests and hasRelevantTests are scoped the same way;
+  - scoped-out tests are emitted as a verify event.
+
+S3 (HIGH, needs S1): install pre-step library (FC-22b).
+- Files: new project_model/install.ts (prepareDeps, once-per-run memo, git status snapshot before and after), the L2 destructive-path classification entry, tests/engine10/fc22_install.test.ts, fixtures/install-fc22/**.
+- Wall checks:
+  - one install check per load-failed package, with its cwd;
+  - no command means no run and a NOT PROVEN naming the package;
+  - both opt-outs skip the install;
+  - it runs once across fix rounds;
+  - a failed install is not_run with owner harness, never fail;
+  - an install that writes a lockfile is restored and listed.
+
+S5 (HIGH, needs S1): cap sizing and A3 (FC-21b(2)).
+- Files: util/run_cap.ts, e10ext/budget_cap.ts (net <= 0 lines), stages/plan.ts (plan-scope.json), supervisor.ts (backstop at the ceiling, started.cap_ceiling_s), tests/engine10/fc21_cap.test.ts.
+- Wall checks:
+  - a 4-package, 4-file scope gets a larger cap than a 1-file scope;
+  - a 1-file scope gets 900;
+  - a long task text with a 1-file scope gets 900;
+  - explicit env and yaml caps are fixed and win;
+  - a nested run_cap_s is ignored;
+  - CRLF yaml is read;
+  - the clamp holds;
+  - the e10ext cap passes.
+
+S4 (HIGH, needs S3 and S5 merged): earned VERIFIED, A1, A2, L7 and wiring (FC-21b(1)(3)).
+- Files: stages/seal.ts, stages/verify.ts, stages/implement.ts (export restoreReadOnly), machine.ts, types.ts, output.ts, worker.ts, tests/engine10/fc21_limit.test.ts, new tests/engine10/fc21b_verdict.test.ts.
+- Wall checks:
+  - limit plus green fix rounds with n>0 and a Wall pass is VERIFIED, with implement_limit set;
+  - limit plus a red check, an unrun check, or no target check is PARTIAL;
+  - a limit throw with killed false never seals VERIFIED (A1);
+  - a killed session's Wall edit is restored before verify;
+  - a resumed implement gets limitS <= budget - elapsed, and both briefs end with FINISH_LINE (A2);
+  - CLI outcome equals receipt.verdict and the exit code is EXIT[verdict] for a cap stop;
+  - core stays under 5000.
+
+## Risks
+1. With the backstop at the ceiling, a hung small task can live up to 3600s. Follow-up: re-arm the backstop on cap.sized.
+2. The salt forces one rediscovery per repo. If discovery fails, selection runs unscoped and the cap is sized by file count only.
+3. A wrong "no edge" from the model under-selects tests. Mitigation: dependsOn must cite a manifest, and scoped-out tests are audited.
+4. Install runs repo scripts and spends the cap. Mitigation: it is evidence-triggered, guarded, and opt-out.
+5. Scripts keyed on exit code 3 change behavior. Mitigation: a CHANGELOG Changed entry.

package/docs/v10/FOUNDER-QUEUE.md

@@ -23,3 +23,5 @@ this file; each item says what the loop does meanwhile.
 | 16 | 2026-10-01 | A Slack incoming-webhook URL for testing D51 item 4 (notify.sh on the v10 path: PR opened, BLOCKED, backlog finished). Provide it as an env var (for example `LOKI_SLACK_WEBHOOK_URL`) in the Release Manager session, never in a file or chat. | Needs a credential only the founder holds. | Until then notify.sh is tested against a local mock webhook; the real end-to-end check runs once the env var is set. | open |
 | 17 | 2026-10-01 | Ship bun with the npm package so `npm install -g loki-mode` runs the Loki 10 default without a separate bun install (P0-nobun, architect option B): add `"bun": "1.4.2"` as an optionalDependency. Cost: each install grows from 26.6MB to about 90-110MB (platform binary 62MB darwin-arm64, 80MB linux-x64, 86MB win-x64); `--omit=optional` and unsupported platforms keep the legacy engine with a plain message. The alternative (rewrite engine10 to run under node) is about 14 files and 300-450 lines, breaks the engine10 line budget and needs a third Bun Parity runtime. | Install size and dependency policy. | Builds only the resolver and the plain cannot-run message (both useful either way); npm users without bun keep getting legacy, and promote stays paused until the two-leg gate (E-167) lands. DECIDED B 07:35Z by peer relay (autonomi-dev-dc, citing the founder's 03:30Z delegation): the Loki 10 default is the product; a bigger install costs less than an inert default for most npm users; same pattern as esbuild and biome. Conditions: per-platform optional packages only; measured delta reported and held if above about 60MB per platform (architect figures 62-86MB exceed it; 07:35Z follow-up relay: decided (i) accept about 62-86MB, or (iii) bun's baseline build if smaller and Bun Parity passes; not (ii), since a first-run consent step breaks the one-command bar; record measured deltas in the CHANGELOG; document --omit=optional as the slim legacy path); --version probe plus plain start line when bun cannot run; Docker and Homebrew use the same resolver; E-167 two-leg gate stays. Founder may reverse. |
 | 18 | 2026-10-03 | Screenshot veto for the 10.8.0 Control Plane rebuild (D83): the ground colour #F1F2F6 from the legacy dashboard, and keeping the legacy mascot in the sidebar brand. Also: light-theme status text uses AA-safe companion ink tokens (darker than the legacy hex) because the legacy success, warning, info and muted text fail WCAG AA on #F1F2F6. | Brand and visual design. | Builds with the legacy ground and mascot plus the AA ink tokens (D83 point 6); screenshots go in PROGRESS when CPE-02 lands. | open |
+| 19 | 2026-10-03 | FC-21b and FC-22 (docs/v10/FC21B-FC22-PLAN.md): (a) after an implement time limit, VERIFIED also requires a Wall or task-named test to pass with n>0; (b) dependency install runs by default, only when a selected check fails with a harness-owned load error, opt-out LOKI_E10_INSTALL=0 or loki.yaml verify.install_deps false; (c) exit code 3 (BUDGET_STOP) is dropped whenever a receipt is sealed, outcome and exit follow receipt.verdict. | Behavior and exit-code changes users see. | Decided by the CoS under the standing mandate: (a) yes, (b) yes as stated, (c) yes with a CHANGELOG Changed entry. Founder may reverse. | open |
+| 20 | 2026-10-04 | CP-ASK (docs/v10/CP-ASK-PLAN.md): (a) with LOKI_CP_ASK on, the home box is Ask only, with a "Start a build" link to Compose; (b) defaults $1.00 per ask and 600s, configurable, Ask spend shown on the Cost page apart from run budgets; (c) CP-level runs, receipts and events across all repos always available, per-repo memory and code tools scoped to one repo chip per ask. | Product shape and spend defaults. | Decided by the CoS under the standing mandate as stated. Founder may reverse. | open |

package/docs/v10/METRICS.md

@@ -594,3 +594,4 @@ Cost per completed task for sonnet arms measured before this date used the old 3
 | 10.7.1 | false ALREADY_SATISFIED, then FAILED | $2.69 | FC-15 class |
 | 10.9.1 | BLOCKED | $0.75 | brief handicap, FC-19 class |
 | 10.10.3 | PARTIAL | $2.27 | 12m; full migration (83 files); backend 5855/5858 green; implement stopped at a 900s run cap and verify was skipped (FC-21); run e10-20261003T220847Z-78fa, main be0799f, reported by steering 22:08Z |
+| 10.10.5 | PARTIAL (CLI and receipt match) | $1.73 | run e10-20261003T233414Z-30ca, defaults, cap_s 2700, 12m05s, 2.42M tokens; implement 6m36s finished with no limit; verify, fix, verify ran; 77 files +4325/-2006; independent check: backend 5914 pass 0 fail 29 skip, tsc 0 errors; PARTIAL only from FC-22 (4 frontend tests over-selected, deps absent, honestly NOT PROVEN) and FC-23 (a Wall file failed the package tsc, TS1470); integration request-approval-race NOT PROVEN (needs DB). Zero false claims. |

package/docs/v10/PROGRESS.md

@@ -2222,3 +2222,18 @@ The swarm is stopped: .loki/V10-STOP exists, the loop has no wake-ups, and the c
 - FireLater#17 gate on 10.10.3 (steering): PARTIAL $2.27, full migration, 5855/5858 green; implement hit the 900s cap and verify was skipped. FC-21 filed (8d17b8c59); sonnet fix-fc21 seated 22:24Z under D87.
 - FC-16 narrowed (Go exit 0 always not_run) at 1f3c97831: 1504/0, red-then-green 4/6 against c35bc2d62; opus re-review in flight.
 - Next: FC-16 APPROVE + FC-21 green, then one train FC-15+FC-16+FC-21, then the gate rerun.
+
+## 2026-10-03T23:34Z (CoS)
+- v10.10.5 live: npm latest=10.10.5, next=10.10.5; release run 37161077606 success. Ships FC-15, FC-16 + FC-02 (6 review rounds, final 6bc7f8674), FC-21 (21fec9deb, opus APPROVE).
+- v10.10.4 (4fa4e8015) never published: release gate 37160286619 failed spawn env guard (run_cap.ts git ls-files, load_owner.ts pgrep had no env). Fixed d64739204; full bun test 3580/0, tsc rc=0; fix-forward a3b303478.
+- Lesson: slice and review gates ran 4 suite dirs; loki-ts/src changes now need the full bun test before APPROVE.
+- Main CI fix 65ce2060b (CP-04 Dockerfile, DEP-01 DEPS rows): Tests 37159323291 success.
+- Follow-ups ready: FC-21b (HIGH, next train: earned VERIFIED after a limit, Project Model cap sizing, L7 outcome on cap stop), FC-16b.
+- Steering running the FireLater#17 gate on 10.10.5 defaults. Seats: 0 active (week 82 percent at 22:43Z, D87 stop at 95).
+
+## 2026-10-04T00:12Z (CoS)
+- Plans pushed: FC21B-FC22-PLAN.md (5 slices: S1, then S2/S3/S5, then S4) at f1ab77d1e; CP-ASK-PLAN.md (15 slices behind LOKI_CP_ASK) at 04c8915a9. FOUNDER-QUEUE rows 19-20 hold the CoS decisions for veto.
+- CP-ASK slice 1 (MCP read-only, a2bb8b4ad): opus review BLOCK. Allowlisted tools still write events/signals (B1), graph_query spawns graphify (B2), code_search can reindex (B3), memory tools create an empty store (B4). Fix round sent, with an audit-hook zero-write Wall check. Priority stays below FC-22/FC-23 (steering 00:02Z).
+- FC-23 (Wall module system): first full bun test failed 3 (two L0 guards, one brief test); fixed by key-based reading. Commit and gate evidence requested.
+- Building: FC-16b, S1 (Project Model graph). Main CI on 04c8915a9 pending; npm latest=10.10.5.
+- Usage: week 83 percent, session 28 percent at 00:02Z. Stop new seats at 90 percent (D87).