loki-mode 10.11.0 → 10.11.2

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: An autonomous software factory that knows what it is supposed to deliver, and proves it did. Use when the user says Loki Mode or asks to build, fix or verify software autonomously.
 ---
 
-# Loki Mode v10.11.0
+# Loki Mode v10.11.2
 
 **Current entry points (Loki 10 engine):** `loki "<task>"`, `loki owner/repo#N` and `loki quick "<task>"` run the Loki 10 engine and end with a signed receipt (`loki verify`). `loki backlog owner/repo --all` runs many issues in parallel. Guide: `docs/v10/GUIDE.md`. The skill instructions below, and `loki start`, describe the legacy engine, which still ships and is being removed (`loki start owner/repo#N` still routes to it; prefer `loki owner/repo#N`).
 
@@ -483,4 +483,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v10.11.0 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**
+**v10.11.2 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**

package/VERSION

@@ -1 +1 @@
-10.11.0
+10.11.2

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "10.11.0"
+__version__ = "10.11.2"
 
 # Expose the control app for easy import
 try:

package/docs/CLI-REFERENCE.md

@@ -1,6 +1,6 @@
 # CLI reference
 
-Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v10.11.0. Do not edit by hand.
+Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v10.11.2. Do not edit by hand.
 Hidden and legacy-only commands are omitted; see `docs/v10/CLI-MODERN.md` for the full inventory.
 
 | Command | Description |

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 The flagship product of [Autonomi](https://www.autonomi.dev/). Loki Mode is a spec-driven autonomous builder with a built-in trust layer that takes any spec to a deployed product and verifies completion with evidence (quality gates plus a completion council), not just a "done" claim. Complete installation instructions for all platforms and use cases.
 
-**Version:** v10.11.0
+**Version:** v10.11.2
 
 **Engine note:** `loki "<task>"`, `loki owner/repo#N` and `loki quick` run the Loki 10 engine. `loki start` still routes to the legacy engine, which is being removed (planned work resumes 2026-10-07); prefer `loki owner/repo#N`. See [docs/v10/GUIDE.md](v10/GUIDE.md).
 

package/docs/v10/BOARD.md

@@ -880,6 +880,6 @@ Source: ~/git/autonomi-dev/research/2026-09-30-adoption/SWARM-PROMPT-ADOPTION.md
 | CP-ASK | Founder 22:03Z: "we are not a vibe coding tool". The CP home box becomes Ask Loki: search, learn, compare runs, and ask anything about Loki Mode, past runs, receipts, repos and issues. Default provider claude (or any configured provider and model the user picks); the model gets all of that data (read-only tools or MCP over runs, receipts, events, METRICS, repos, gh issues and PRs); answers are async jobs the user can leave and come back to, listed in the CP. Read-only: Ask never edits a repo or starts a build | Architect slices first (10-40 slices, feature flag); packages/control-plane routes and ui, a read-only data layer, provider invocation | HIGH | the founder asks "compare my last two runs on FireLater" and gets a cited answer async in the CP; Ask cannot write to any repo | building@2026-10-04T00:06Z | Plan docs/v10/CP-ASK-PLAN.md (15 slices behind LOKI_CP_ASK=1, waves {1,4,6,8} {2,5,7} {3,9} 10 11 {12,13} 14 15); founder questions decided as FOUNDER-QUEUE row 20. Slice 1 (MCP read-only mode) seated. Founder direct directive 22:03Z. Architect plan first. | 00:33Z: slices 1 (9f454444a, plus fix-forward F1/F2 7bcffc70f, opus APPROVE), 4 (2a0ad3fc1) and 8 (d1b38e508) merged; flag off; next wave 2/5/6/7. 
 | FC-21 | FC-21: (a) a limit in implement still runs verify on the existing work plus the fix rounds the budget allows, never seal directly; (b) the run cap scales with task size (sizing and Project Model), with a generous subscription default set in loki.yaml; (c) implement is told its remaining time; (d) the CLI summary, CP and PR body read receipt.verdict (one outcome) | loki-ts/src/engine10 run orchestration, the budget and sizing modules, the CLI summary, plus tests | MEDIUM | a fake implement limit is followed by verify; CLI outcome equals receipt.verdict for 4 verdicts; a large task gets a larger cap; core cap under 5000 | released@2026-10-03T23:33Z | Released in v10.10.5. FireLater#17 gate on 10.10.3 PARTIAL (steering 22:08Z). P0 tier with FC-16/FC-15. Built 21fec9deb; opus review-fc21 APPROVE on merge e80abc63a (suites 1719/0, budget 27/0, tsc rc=0 with real node_modules); merged 881f1275f. Advisories A1-A4 filed as FC-21b. Ships in one train with FC-15 and FC-16. |
 | FC-21b | FC-21 follow-ups, next train (steering 23:00Z): (1) an implement limit forces PARTIAL only while checks are red or unrun; if the fix rounds make the impacted checks green with n>0 the run earns VERIFIED (L3: what ran is the evidence, not how long implement took); (2) size the run cap from the Project Model and plan (packages and files touched) or a plan-session estimate, never from task-text character count (L0); (3) the CLI outcome must equal receipt.verdict, so a cap stop after a limit cannot print BUDGET_STOP over a PARTIAL or FAILED receipt (L7, was advisory A4); (A1) machine.ts:145 mustJump keys on reason limit only, require r.killed too; (A2) a spec-conflict resume gets the full original budget in the time note and limitS, and the note lands after FINISH_LINE; (A3) yamlRunCapS matches run_cap_s at any depth under budgets, CRLF yaml falls back silently, ls-files count off by one | loki-ts/src/engine10/machine.ts, stages/implement.ts, stages/seal.ts, output.ts, src/util/run_cap.ts, project_model sizing, plus tests | HIGH | a limit then fix-green with n>0 seals VERIFIED, a limit with a red or unrun check seals PARTIAL; the cap for a short task touching many packages exceeds the cap for one file; CLI outcome equals receipt.verdict on a cap stop after a limit; a thrown limit without a kill never reaches VERIFIED; nested per_stage run_cap_s is ignored; a resumed implement gets the remaining time | building@2026-10-03T23:59Z | Plan docs/v10/FC21B-FC22-PLAN.md (slices S1 graph+yaml_key, S5 cap sizing, S4 verdict+L7+A1+A2; S4 last). From review-fc21 22:53Z plus steering 23:00Z. HIGH because it changes the verdict rule (opus reviewer). Architect plan first for the sizing source. e10ext is 1 line under its 1500 cap. Queue after the FireLater#17 gate on 10.10.4. |
-| FC-16b | FC-16 follow-ups: package_suite.ts:33 detects go by first token only (make test, GOFLAGS=x go test fall to the generic path); go -json parsing; load_owner killTree process-group kill; unittest atexit forged trailer | loki-ts/src/engine10 package_suite, load_owner, test classify, plus tests | MEDIUM | make test wrapping go test classifies with runner go; a forged unittest trailer from atexit is not a pass | building@2026-10-03T23:59Z | Engineer fix-fc16b in worktree. From review-fc16-fc02-integ rounds 4-6. package_suite results never feed seal proof today. Also owed: an end-to-end test running a go Wall file through RealBaseTestRunner (the seal.test.ts case does not guard wall.ts). | 00:33Z: review-fc16b BLOCKED 1b3f594cb (forged go events, unittest multi-Ran); fix 626b46c74 in opus re-review. 
-| FC-22 | FC-22: (a) impacted-test selection is scoped by the Project Model, touched packages plus their real dependents (manifest or import edges), never every package; (b) a selected package with no installed deps gets the Project Model's own install command run once before verify, recorded as a check with its cwd, opt-out by config | loki-ts/src/e10ext/select.ts, project_model resolve and gather, engine10 verify pre-step, plus tests | HIGH | a backend-only change in the monorepo-fc01 fixture selects no frontend test; a selected package without node_modules gets one recorded install check; no guessed command; e10ext under 1500 | building@2026-10-03T23:59Z | Plan docs/v10/FC21B-FC22-PLAN.md (S1 then S2 selection and S3 install). FireLater#17 gate on 10.10.5 (run e10-20261003T233414Z-30ca) PARTIAL only from 4 over-selected frontend tests (steering 23:47Z). HIGH because selection feeds verify proof. Architect plan first; e10ext is 1 line under its cap. Next train with FC-21b and FC-23. | 00:33Z: S1 merged 88e9e43fb (review-s1 APPROVE). S2 e9e04fe1d in opus review-s2; S3 cb6486550 in opus review-s3. 
-| FC-23 | FC-23: the Wall writes tests matching the package's module system and test conventions from the Project Model; a lint or type error inside a Wall file is harness-owned, the Wall file is regenerated once or discarded with a NOT PROVEN note, and no fix round is spent on it | loki-ts/src/engine10/stages/wall.ts, the fix-round target filter, project_model conventions, plus tests | MEDIUM | a CommonJS package gets a Wall test with no import.meta; a forced type error in a Wall file yields regenerate-or-discard and zero fix rounds | building@2026-10-03T23:59Z | merged@2026-10-04T00:23Z | Merged c0a1c43c2 (38c782386, review-fc23 sonnet APPROVE; nits: duplicate NOT PROVEN line for a discarded file, merged comment in verify.ts). 
+| FC-16b | FC-16 follow-ups: package_suite.ts:33 detects go by first token only (make test, GOFLAGS=x go test fall to the generic path); go -json parsing; load_owner killTree process-group kill; unittest atexit forged trailer | loki-ts/src/engine10 package_suite, load_owner, test classify, plus tests | MEDIUM | make test wrapping go test classifies with runner go; a forged unittest trailer from atexit is not a pass | merged@2026-10-04T00:55Z | Engineer fix-fc16b in worktree. From review-fc16-fc02-integ rounds 4-6. package_suite results never feed seal proof today. Also owed: an end-to-end test running a go Wall file through RealBaseTestRunner (the seal.test.ts case does not guard wall.ts). | 00:33Z: review-fc16b BLOCKED 1b3f594cb (forged go events, unittest multi-Ran); fix 626b46c74 in opus re-review. 
+| FC-22 | FC-22: (a) impacted-test selection is scoped by the Project Model, touched packages plus their real dependents (manifest or import edges), never every package; (b) a selected package with no installed deps gets the Project Model's own install command run once before verify, recorded as a check with its cwd, opt-out by config | loki-ts/src/e10ext/select.ts, project_model resolve and gather, engine10 verify pre-step, plus tests | HIGH | a backend-only change in the monorepo-fc01 fixture selects no frontend test; a selected package without node_modules gets one recorded install check; no guessed command; e10ext under 1500 | merged@2026-10-04T01:08Z | Plan docs/v10/FC21B-FC22-PLAN.md (S1 then S2 selection and S3 install). FireLater#17 gate on 10.10.5 (run e10-20261003T233414Z-30ca) PARTIAL only from 4 over-selected frontend tests (steering 23:47Z). HIGH because selection feeds verify proof. Architect plan first; e10ext is 1 line under its cap. Next train with FC-21b and FC-23. | 00:33Z: S1 merged 88e9e43fb (review-s1 APPROVE). S2 e9e04fe1d in opus review-s2; S3 cb6486550 in opus review-s3. 01:08Z: S3 merged 736f4d436 (review-s3 APPROVE on d2e61c2ff, 3627/0, tsc 0; discard.ts L2 tension to CTO). S2 merged b4022e6fb (review-s2 APPROVE on a62aba7b2, 3624/0, tsc 0) behind LOKI_E10_SCOPE default off. Before the flag flips: F1 root-owned keep test with a non-relative import, F2 verify test.scoped_out event test. The install library is wired by S4. 
+| FC-23 | FC-23: the Wall writes tests matching the package's module system and test conventions from the Project Model; a lint or type error inside a Wall file is harness-owned, the Wall file is regenerated once or discarded with a NOT PROVEN note, and no fix round is spent on it | loki-ts/src/engine10/stages/wall.ts, the fix-round target filter, project_model conventions, plus tests | MEDIUM | a CommonJS package gets a Wall test with no import.meta; a forced type error in a Wall file yields regenerate-or-discard and zero fix rounds | building@2026-10-03T23:59Z | released@2026-10-04T00:51Z | Merged c0a1c43c2 (38c782386, review-fc23 sonnet APPROVE; nits: duplicate NOT PROVEN line for a discarded file, merged comment in verify.ts). 

package/docs/v10/DEPS.md

@@ -16,6 +16,7 @@ Inventory only. No dependency, lockfile, workflow or image was changed to produc
 | `loki-ts/tests/engine10/fixtures/testmap/package.json` | `vitest` | `^2.0.0` | `5.0.3` | MAJOR | test fixture, not a real dependency |
 | `loki-ts/tests/fixtures/monorepo-fc01/backend/package.json` | `vitest` | `^1.0.0` | `5.0.3` | MAJOR | test fixture, not a real dependency |
 | `loki-ts/tests/fixtures/project-model/firelater-17/backend/package.json` | `vitest` | `^1.0.0` | `5.0.3` | MAJOR | test fixture, not a real dependency |
+| `loki-ts/tests/fixtures/monorepo-fc22/backend/package.json` | `vitest` | `^1.0.0` | `5.0.3` | MAJOR | test fixture, not a real dependency |
 | `package.json` | `@resvg/resvg-wasm` | `^2.6.2` | `2.6.2` | up-to-date |  |
 | `package.json` | `@types/node` | `^25.2.0` | `26.6.4` | MAJOR |  |
 | `package.json` | `jest` | `^29.7.0` | `30.5.2` | MAJOR |  |
@@ -75,6 +76,8 @@ Inventory only. No dependency, lockfile, workflow or image was changed to produc
 | `web-app/package.json` | `vite` | `^6.2.0` | `8.3.2` | MAJOR |  |
 | `loki-ts/tests/fixtures/monorepo-fc01/frontend/package.json` | `(none found)` | `` | `-` | n/a | test fixture; no dependencies or devDependencies declared |
 | `loki-ts/tests/fixtures/project-model/firelater-17/frontend/package.json` | `(none found)` | `` | `-` | n/a | test fixture; no dependencies or devDependencies declared |
+| `loki-ts/tests/fixtures/monorepo-fc22/package.json` | `(none found)` | `` | `-` | n/a | test fixture; no dependencies or devDependencies declared |
+| `loki-ts/tests/fixtures/monorepo-fc22/frontend/package.json` | `(none found)` | `` | `-` | n/a | test fixture; no dependencies or devDependencies declared |
 
 ## Python (requirements*.txt)
 

package/docs/v10/FAILURE-CLASSES.md

@@ -287,3 +287,20 @@ L0 review rule (ENGINE-LAWS.md L0): a fix that adds an `if` or a regex about the
 - Siblings: every harness-authored file that later runs under the user's tooling (Wall tests, presealed Wall in modernize, generated fixtures); every place a fix round can target a file the model is forbidden to edit.
 - Mechanism: the Wall reads the package's module system and test conventions from the Project Model (type, module, test runner, import style) and writes to match; a lint or type error located inside a Wall file is harness-owned: the Wall file is regenerated once or discarded with a NOT PROVEN note, and no fix round is ever spent on it.
 - Fixture: loki-ts/tests/engine10/fc23_wall_conventions.test.ts (a CommonJS package: the Wall brief carries the convention and an import.meta Wall file is discarded with a NOT PROVEN note; a Wall-only tsc error yields not_run, owner harness, zero grouped failures; control: a user-code type error still fails and gets a fix round). Readers: loki-ts/src/project_model/conventions.ts, loki-ts/src/util/wall_owned.ts.
+
+## FC-24 Agent-written code in the runner's process can forge a pass (summary and exit code)
+- User saw: nothing yet (found in the FC-16b round 2 review, 2026-10-04). Reproduced at f28b15d78 with pytest on python 3.14.6: a conftest.py `pytest_sessionfinish` hook writes "===== 5 passed in 0.01s =====" and calls `os._exit(0)`; the only test is `assert False`; classifyCheck returns {"result":"pass","n":5}. The Go form (init or TestMain prints RUN and PASS for a failing test, then os.Exit(0)) defeated every name check in FC-16b.
+- Law: L2 (fail closed on trust), L3 (what ran is the evidence); Seal accuracy.
+- Siblings (code-path reasoning, only pytest and go reproduced): unittest (atexit or os._exit before the real trailer), jest and vitest (config, globalSetup, setupFiles patch stdout or call process.exit(0)), bun test (preload), node --test (--import or --require hooks), cargo (the test binary is the code), npm test (an arbitrary script). A harness-owned reporter or result file (pytest plugin, jest reporter, JUnit XML) is written inside the same process, so it is forgeable too.
+- Mechanism: none closes it per runner. The runner's summary and exit code come from a process that runs agent-written code. Decision: a test pass is recorded as runner-reported, not tamper-proof (a known L2 limit). Go exit 0 is never a pass (FC-16b, not_run, owner harness, honest L5 reason) because Go has no parseable summary that survives the forgery at lower cost. Candidate later mechanisms: harness re-runs each named Wall test in a fresh process with harness-controlled entry and flags (setup code still runs), and the receipt states the limit in its evidence text.
+- Fixture: the FC-16b forgery fixtures (go init/TestMain early exit asserts not_run); a pytest conftest forgery fixture that documents the limit is a follow-up slice, not a fix.
+
+## FC-25 A git call from the token-holding supervisor runs a plant in the agent's repo config (moat P9 red since v10.10.4)
+- User saw: nothing visible; the moat job of Tests has failed on main since 4fa4e8015 (runs 37160286598 through 37165257952, all "REGRESSION P9.injection-cannot-reach-token": "a plant in the agent's repo config ran holding the real GitHub token: fsmonitor"). 65ce2060b was the last green. The range touched no bash, only loki-ts.
+- Law: L2 (fail closed on trust); moat P9 Rule of Two.
+- Suspect: FC-21 (881f1275f) added util/run_cap.ts resolveRunCapS, called at engine10/supervisor.ts:330 before the worker spawns. It runs `git ls-files` in repoDir with env process.env, which still holds the token. Local probe (git, 2026-10-04): a repo with core.fsmonitor set to a recorder script fires it on plain `git ls-files` with GH_TOKEN in env; `git diff --name-only` and `git status --porcelain` did not fire in that probe.
+- Siblings: every git call made by a process that holds the token (supervisor, CLI before withholding) with cwd in the agent's repo: run_cap.ts, runner/load_owner.ts changedSince and worktree add (when called outside the worker), and any later addition. supervisor.ts:206 and e10ext/commit_filter.ts already pass core.fsmonitor=false and core.hooksPath=/dev/null.
+- Mechanism: one shared helper for git in the agent's repo from a trusted process: hardened config (core.fsmonitor=false, core.hooksPath=/dev/null, and no credential helper) plus a token-free env; plus a static guard that fails on a git spawn in loki-ts/src that does not use it, or is not listed with a reason.
+- Fixture: a bun test that plants core.fsmonitor and a canary GH_TOKEN, then calls resolveRunCapS and asserts the plant never ran; and the moat case P9.injection-cannot-reach-token passes locally (`bash tests/moat/run.sh`, P9 line).
+- FC-25b (sibling, found in the opus review, 2026-10-04T01:02Z): the hooks, fsmonitor and sshCommand flag set alone still lets three plant classes run holding the canary token (git 2.55.0). (1) filter.<drv>.clean or process, declared in .gitattributes or .git/info/attributes, fires on status --porcelain, diff --name-only HEAD, add and commit. (2) diff.<drv>.textconv fires on log -p and on a diff with patch output. (3) gpg.program with commit.gpgSign=true fires on commit. A scrubbed env does not close the hole, because a running plant can still read the gh hosts file or the keyring. Execution itself has to be stopped. Mechanism: the same safeGit helper blanks each configured filter and textconv key, and sets diff.external=, commit.gpgSign=false, core.attributesFile=/dev/null and GIT_ATTR_SOURCE=<empty tree>. Fixture: fc25_safe_git.test.ts adds one plant per class.
+- FC-25c (follow-ups from the opus review of d82aec15a, 2026-10-04T01:15Z; not reachable with a real token today). (a) The allowToken path still honors repo-local core.sshCommand, remote.*.uploadpack and receivepack, and a repo-scope credential.helper; the canary fired on an ssh origin and on a local-path uploadpack. Its only caller is the base_guard fetch, reached from intake in the worker with the sentinel env, and supervisor.ts baseLine passes fetchRemote=false. Fix: harden allowToken itself, or add a guard that pins it to that single worker-side caller. (b) The raw-spawn guard misses an indirect argv (`const GIT = "git"`) and does not scan packages/control-plane. ship_hook.ts reaches control-plane shipper/discover.ts gitOrigin (`git config --get`, real-token env) from the supervisor. Fix: convert it to safeGit and widen the guard. (c) preflight's safeGitArgv path does not set GIT_CONFIG_NOSYSTEM. Low risk, because system config is root-owned.

package/docs/v10/PROGRESS.md

@@ -2237,3 +2237,9 @@ The swarm is stopped: .loki/V10-STOP exists, the loop has no wake-ups, and the c
 - FC-23 (Wall module system): first full bun test failed 3 (two L0 guards, one brief test); fixed by key-based reading. Commit and gate evidence requested.
 - Building: FC-16b, S1 (Project Model graph). Main CI on 04c8915a9 pending; npm latest=10.10.5.
 - Usage: week 83 percent, session 28 percent at 00:02Z. Stop new seats at 90 percent (D87).
+
+## 2026-10-04T00:53Z (CoS)
+- v10.11.0 released: release run 37165257915 success, promote.yml success, `npm view loki-mode dist-tags` = { latest: '10.11.0', next: '10.11.0' }. Steering smoke PASS 00:50Z (VERIFIED in 39s, $0.10). FC-23 released (549a14850).
+- P0 FC-25: the Tests moat job has been red on main since 4fa4e8015 (runs 37160286598 through 37165257952, REGRESSION P9.injection-cannot-reach-token: fsmonitor plant ran holding the canary token). Last green is 65ce2060b = v10.10.3. Suspect: run_cap.ts `git ls-files` from the token-holding supervisor (supervisor.ts:330); a local probe fired an fsmonitor plant on plain `git ls-files`. Row a79dc2f2a. Engineer fix-fc25-p9 (sonnet) is building safeGit() plus a sweep plus a guard; opus review next; 10.11.1 needs P9 green on the release commit (not waived by D88). Rollback is not via promote.yml (it refuses to go backwards); a manual dist-tag move needs the founder's direct word.
+- FC-24 (dc4671ee8): in-process runner forgery (pytest conftest repro at f28b15d78) is a known L2 limit; a pass is runner-reported.
+- In review: FC-16b round 3 8859584c7, FC-22 S2 a62aba7b2, FC-22 S3 d2e61c2ff (all opus). Building: FC-22 S5. Seats are frozen except P0 and FireLater#17 (week 84 percent at 00:43Z).