loki-mode 10.11.2 → 11.0.1

package/.github/actions/issue-to-pr/action.yml

@@ -50,6 +50,10 @@ inputs:
     description: 'loki-mode version to install. Pin this for reproducible runs.'
     required: false
     default: 'latest'
+  attest:
+    description: 'Opt-in. When true, sign a GitHub build attestation (Sigstore, DSSE) over receipt.json after the run. Needs id-token: write and attestations: write on the calling job, which breaks the read-only Rule of Two job; see docs/AGENT-CHANGE-RECEIPT.md for the split.'
+    required: false
+    default: 'false'
 
 outputs:
   patch:
@@ -58,6 +62,9 @@ outputs:
   pr_body:
     description: 'Path to a PR body carrying the evidence receipt.'
     value: ${{ steps.run.outputs.pr_body }}
+  receipt:
+    description: 'Path to the sealed receipt.json copied out of the run (empty when the run produced none).'
+    value: ${{ steps.run.outputs.receipt }}
   pr_url:
     description: 'Always empty. This action no longer opens the pull request; open it from a job that runs no agent.'
     value: ''
@@ -246,6 +253,7 @@ runs:
         } > "$OUT/pr-body.md"
         echo "patch=$OUT/loki.patch" >> "$GITHUB_OUTPUT"
         echo "pr_body=$OUT/pr-body.md" >> "$GITHUB_OUTPUT"
+        if [ -f "$OUT/receipt.json" ]; then echo "receipt=$OUT/receipt.json" >> "$GITHUB_OUTPUT"; fi
 
         echo "::warning::This action does not open the pull request (Rule of Two). Upload outputs.patch and open the PR from a job that holds the write token and runs no agent; see docs/examples/loki-issue-to-pr.yml.example in asklokesh/loki-mode."
         if [ -n "$RUN_DIR" ]; then
@@ -253,3 +261,12 @@ runs:
         fi
 
         exit "$RC"
+
+    # Opt-in (attest: true). Needs `id-token: write` and `attestations: write` on the
+    # calling job. The subject is the receipt.json file itself, so
+    # `gh attestation verify receipt.json --repo OWNER/REPO` matches its sha256.
+    - name: Attest the receipt
+      if: ${{ inputs.attest == 'true' && steps.run.outputs.receipt != '' && !cancelled() }}
+      uses: actions/attest-build-provenance@v2
+      with:
+        subject-path: ${{ steps.run.outputs.receipt }}

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: An autonomous software factory that knows what it is supposed to deliver, and proves it did. Use when the user says Loki Mode or asks to build, fix or verify software autonomously.
 ---
 
-# Loki Mode v10.11.2
+# Loki Mode v11.0.1
 
 **Current entry points (Loki 10 engine):** `loki "<task>"`, `loki owner/repo#N` and `loki quick "<task>"` run the Loki 10 engine and end with a signed receipt (`loki verify`). `loki backlog owner/repo --all` runs many issues in parallel. Guide: `docs/v10/GUIDE.md`. The skill instructions below, and `loki start`, describe the legacy engine, which still ships and is being removed (`loki start owner/repo#N` still routes to it; prefer `loki owner/repo#N`).
 
@@ -483,4 +483,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v10.11.2 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**
+**v11.0.1 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**

package/VERSION

@@ -1 +1 @@
-10.11.2
+11.0.1

package/autonomy/lib/backlog.py

@@ -279,7 +279,7 @@ def main(argv):
     wt_root = top.rstrip("/") + "-backlog"
     os.makedirs(os.path.join(wt_root, "logs"), exist_ok=True)
     launcher = os.environ.get("LOKI_BACKLOG_LAUNCHER") or os.path.join(REPO_ROOT, "bin", "loki")
-    child_env = dict(env, LOKI_ENGINE="v10", LOKI_NO_BROWSER="1")
+    child_env = dict(env, LOKI_NO_BROWSER="1")
     for key, var in (("models.default", "LOKI_MODEL_DEVELOPMENT"), ("models.cheap", "LOKI_MODEL_FAST")):
         sect, name = key.split(".")
         if cfg.get(sect, {}).get(name):

package/autonomy/lib/workspace.py

@@ -205,7 +205,7 @@ def run_workspace(name, ref, workspaces, base_dir=None, launcher=None):
     run_dir = os.path.join(base_dir, ".loki", "workspaces", name, run_id)
     os.makedirs(run_dir, exist_ok=True)
     launcher = launcher or os.environ.get("LOKI_WORKSPACE_LAUNCHER") or os.path.join(REPO_ROOT, "bin", "loki")
-    child_env_base = dict(os.environ, LOKI_ENGINE="v10", LOKI_NO_BROWSER="1")
+    child_env_base = dict(os.environ, LOKI_NO_BROWSER="1")
 
     outcome, worktrees, heads, kind = {}, {}, {}, {}
     timing = {}  # repo -> {started_at, finished_at} epoch seconds

package/autonomy/loki

@@ -1676,7 +1676,6 @@ show_help() {
     echo "  loki start ./prd.md       Build from a spec (PRD file, GitHub/GitLab/Jira/Azure issue, or no arg)"
     echo "  quickstart = guided first build; quick = one small task (Loki 10 engine, no PR)."
     echo "  loki \"<task>\", loki owner/repo#N and loki quick run on the Loki 10 engine by default."
-    echo "  Previous engine: set LOKI_ENGINE=legacy or run 'loki legacy <args>'."
     echo "  Docs: https://github.com/asklokesh/loki-mode  |  Report a problem: loki crash"
     echo ""
     # CLI consolidation (Phase A): the front page presents ~17 canonical
@@ -1778,7 +1777,7 @@ show_help() {
     echo "  loki start PROJ-456           # Jira issue"
     echo "  loki start --bg ./prd.md      # Start in background"
     echo "  loki start --parallel ./prd.md   # Parallel mode (git worktrees)"
-    echo "  loki quick \"add dark mode\"  # Single-task mode (Loki 10 engine; LOKI_ENGINE=legacy for 3 iters max)"
+    echo "  loki quick \"add dark mode\"  # Single-task mode (Loki 10 engine)"
     echo "  loki tour                     # See a real sample result (no provider, no key, no spend)"
     echo "  loki demo                     # Build a sample todo app end to end"
     echo "  loki init -t saas-starter     # Scaffold from template"
@@ -16641,10 +16640,8 @@ cmd_quick() {
             echo ""
             echo "Usage: loki quick \"description of what to do\""
             echo ""
-            echo "Runs the Loki 10 engine on one small task (no PR is opened). Set"
-            echo "LOKI_ENGINE=legacy or run 'loki legacy quick ...' for the previous engine:"
-            echo "a lightweight profile, 3 iterations max, no quality council, no completion"
-            echo "gate. Best for tiny tasks. The options below apply to the previous engine."
+            echo "Runs the Loki 10 engine on one small task (no PR is opened). Best for"
+            echo "tiny tasks."
             echo ""
             echo "Examples:"
             echo "  loki quick \"add dark mode to this React app\""
@@ -18885,7 +18882,7 @@ cmd_verify() {
     local _pk_arg
     for _pk_arg in "$@"; do
         case "$_pk_arg" in
-            --pubkey|--pubkey=*) LOKI_ENGINE=v10 exec "$_LOKI_SCRIPT_DIR/../bin/loki" verify "$@" ;;
+            --pubkey|--pubkey=*) exec "$_LOKI_SCRIPT_DIR/../bin/loki" verify "$@" ;;
         esac
     done
     # --fast: deterministic checks only, in milliseconds. Measured on this repo
@@ -22215,7 +22212,7 @@ main() {
             ;;
         keys)
             # D48: public-key export lives in the Bun v10 engine; re-enter the shim on that route.
-            LOKI_ENGINE=v10 exec "$_LOKI_SCRIPT_DIR/../bin/loki" keys "$@"
+            exec "$_LOKI_SCRIPT_DIR/../bin/loki" keys "$@"
             ;;
         spec)
             cmd_spec "$@"

package/bin/loki

@@ -292,7 +292,7 @@ _loki_bun_why() {
 
 # M-08 (docs/v10/MODERNIZE.md section 2): the NEW `loki modernize <repo> --to
 # <target>` form always reaches the Loki 10 (Bun) modernize CLI, regardless of
-# LOKI_ENGINE or the default engine flip. Ahead of the v10 block below so
+# the default engine flip. Ahead of the v10 block below so
 # tonight's legacy default never blocks it; $1 is already "modernize" so "$@"
 # reproduces it as the router's own first argument without a shift.
 #
@@ -319,32 +319,35 @@ if [ "${1:-}" = "modernize" ]; then
     unset _loki_mod_a
 fi
 
-# `loki legacy <args>` (D29/D48): the previous engine, exactly as LOKI_ENGINE=legacy.
-# Re-runs this shim with the pin so every route below is the pre-flip route.
+# `loki legacy` was removed in 11.0.0 (LEGACY-ZERO W1-01): there is one engine.
 case "${1:-}" in
     legacy)
-        shift
-        [ -f "$REPO_ROOT/autonomy/lib/engine10-legacy-notice.txt" ] && cat "$REPO_ROOT/autonomy/lib/engine10-legacy-notice.txt" >&2
-        LOKI_ENGINE=legacy exec "$SCRIPT_PATH" "$@"
+        echo "loki: 'loki legacy' was removed in Loki Mode 11.0.0. The previous engine and its engine-selection variable no longer exist; use the Loki 10 engine: loki \"<task>\", loki owner/repo#N, loki quick \"<task>\"." >&2
+        exit 2
         ;;
 esac
 
-# Loki 10 engine (D29, flipped to the default by D48 rows 7-9). LOKI_ENGINE unset
-# or v10 routes `loki "<task>"`, `loki owner/repo#N` and `loki quick "<task>"` to
-# engine10; LOKI_ENGINE=v10 (explicit) also routes status/verify/dashboard. Any
-# other value (legacy, v9, ...) skips this block: the previous engine, unchanged.
-_loki_engine_default="v10"
-case "${LOKI_ENGINE:-$_loki_engine_default}" in
+# Loki 10 engine (D29, the only engine from 11.0.0). Routes `loki "<task>"`,
+# `loki owner/repo#N`, `loki quick "<task>"`, `keys` and `verify --pubkey` to engine10.
+# shellcheck disable=SC2194
+case "v10" in
     v10)
         _e10=0
+        _e10_hard=0
         _e10_args=("$@")
         case "${1:-}" in
-            status|verify|dashboard|keys)
-                [ "${LOKI_ENGINE:-}" = "v10" ] && _e10=1
+            keys) _e10=1; _e10_hard=1 ;;
+            status|verify|dashboard)
+                if [ "$1" = "verify" ]; then
+                    for _pk in "$@"; do
+                        case "$_pk" in --pubkey|--pubkey=*) _e10=1; _e10_hard=1 ;; esac
+                    done
+                    unset _pk
+                fi
                 # Bare `loki verify` follows the newest run: a v10 run newer than the newest
                 # legacy proof is verified by v10, so a FAILED default run is never VERIFIED.
                 # Only a bare call or a v10 run id (e10-*) goes there; any flag (--fast, --pr, --json, unknown) stays on legacy verify.
-                if [ "$1" = "verify" ] && [ "$_e10" = "0" ] && [ -z "${LOKI_ENGINE:-}" ] && case "${2:-}" in ""|e10-*) true ;; *) false ;; esac; then
+                if [ "$1" = "verify" ] && [ "$_e10" = "0" ] && case "${2:-}" in ""|e10-*) true ;; *) false ;; esac; then
                     _r10=""; _p10=""
                     for _d in "${LOKI_DIR:-.loki}"/runs/e10-*/; do [ -d "$_d" ] && _r10="$_d"; done
                     for _d in "${LOKI_DIR:-.loki}"/proofs/*/proof.json; do [ -f "$_d" ] && { [ -z "$_p10" ] || [ "$_d" -nt "$_p10" ]; } && _p10="$_d"; done
@@ -380,7 +383,7 @@ case "${LOKI_ENGINE:-$_loki_engine_default}" in
         esac
         # Default (unset) mode never breaks a host: no bun, or a provider engine10 has no
         # invoker for, falls through to the legacy engine. Explicit v10 keeps its hard error.
-        if [ "$_e10" = "1" ] && [ "${LOKI_ENGINE:-}" != "v10" ]; then
+        if [ "$_e10" = "1" ] && [ "$_e10_hard" = "0" ]; then
             case "${LOKI_PROVIDER:-claude}" in
                 claude|codex|cline|aider) ;;
                 *)
@@ -404,10 +407,10 @@ case "${LOKI_ENGINE:-$_loki_engine_default}" in
         fi
         if [ "$_e10" = "1" ]; then
             _lb=$(_loki_bun)
-            [ -n "$_lb" ] || { echo "Error: LOKI_ENGINE=v10 needs bun. Install bun from https://bun.sh, or set LOKI_ENGINE=legacy to use the previous engine." >&2; exit 1; }
+            [ -n "$_lb" ] || { echo "Error: the Loki 10 engine needs bun. Install bun from https://bun.sh." >&2; exit 1; }
             exec "$_lb" "$BUN_CLI" engine10 "${_e10_args[@]}"
         fi
-        unset _e10 _e10_args
+        unset _e10 _e10_args _e10_hard
         ;;
 esac
 

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "10.11.2"
+__version__ = "11.0.1"
 
 # Expose the control app for easy import
 try:

package/docs/AGENT-CHANGE-RECEIPT.md

@@ -0,0 +1,47 @@
+# Agent Change Receipt (spec, schema loki.v10.receipt/1)
+
+An Agent Change Receipt is the JSON file a Loki 10 run seals at `.loki/runs/<run-id>/receipt.json`. It records what an agent changed, what was checked, and what was not proven. Every field below is taken from the `Receipt` interface at `loki-ts/src/engine10/types.ts:143-189`; the writer is `loki-ts/src/engine10/stages/seal.ts:257`.
+
+## Fields
+
+- `schema`: the literal `loki.v10.receipt/1`.
+- `run_id`, `repo`, `provider`, `model`, `resumed`.
+- `task`: `{ source: "text" | "issue", sha256 }`. The task text is hashed, not stored.
+- `base_sha`, `head_sha`, `tree`, `diff_sha256`: the commit range and tree the receipt covers.
+- `wall`: `{ files: [{ path, sha256 }], passed: boolean | null }`, the sealed Wall files.
+- `checks`: list of `{ name, cmd, result: "pass" | "fail" | "not_run", duration_s }`.
+- `not_proven`: list of strings naming what the run did not prove.
+- `verdict`: one of `VERIFIED`, `PARTIAL`, `ALREADY_SATISFIED`, `SPEC_CONFLICT`, `FAILED` (`types.ts:44`).
+- `evidence`: list of strings (search hits and citation for an ALREADY_SATISFIED verdict).
+- `cost`: `{ usd (number or null), input_tokens, output_tokens, measured_sessions, total_sessions, partial_usd, source? }`.
+- `time`: `{ wall_s, stages }`.
+- `events_sha256`: digest of the run event log.
+- `receipt_sha256`: sha256 of the canonical JSON with `verification` and `receipt_sha256` removed (`loki-ts/src/engine10/verify_cmd.ts:19`).
+- `verification`: `{ jwt, kid }`. `jwt` is a compact EdDSA (Ed25519) token binding the receipt hash; both are null when the receipt is unsigned (`stages/seal.ts:92-95`).
+- Optional, omitted when absent: `spec_conflict_reason`, `pre_existing_dirty`, `group`, `log_seal`.
+
+## Verify the signature
+
+    loki verify path/to/receipt.json --pubkey signer.jwk
+
+`loki verify` recomputes `receipt_sha256`, checks the Ed25519 signature, and with `--pubkey FILE` (Ed25519 JWK or PEM) checks against that key only, never the local key set (`verify_cmd.ts:121-150`). Exit codes: 0 verified, 1 tampered, 2 unchecked, 3 unsigned, 4 run outcome not verified, 66 no runs. `loki keys export` prints the signer's public JWK (`keys_cmd.ts:1`).
+
+## DSSE export
+
+`loki verify --export-dsse` prints a VERIFIED or ALREADY_SATISFIED receipt as an in-toto Statement v1 inside a DSSE envelope signed Ed25519 over the DSSE PAE bytes (`loki-ts/src/features/receipt_dsse.ts:1-33`). The subject is `git+commit:<head_sha>` with `gitCommit` (and `gitTree`) digests, the predicate type is `https://autonomi.dev/loki/receipt/v10`, and the predicate is the receipt unchanged. `loki verify` accepts that envelope file too.
+
+## GitHub attestation (opt-in)
+
+The issue-to-pr action (`.github/actions/issue-to-pr/action.yml`) takes `attest: true` (default false). It then runs `actions/attest-build-provenance` with the run's `receipt.json` (action output `receipt`) as the subject, producing a Sigstore-signed DSSE attestation tied to the repository. The calling job needs:
+
+    permissions:
+      contents: read
+      issues: read
+      id-token: write
+      attestations: write
+
+Those permissions are not read-only. The action's Rule of Two guidance keeps the agent job read-only, so if you want that boundary, upload `receipt.json` as an artifact and run `actions/attest-build-provenance` in a second job that runs no agent. Verify with:
+
+    gh attestation verify receipt.json --repo owner/repo
+
+This proves the file's sha256 was attested by a workflow in that repository. It does not replace `loki verify`, which checks the receipt's own hashes and Ed25519 signature; run both.

package/docs/CLI-REFERENCE.md

@@ -1,6 +1,6 @@
 # CLI reference
 
-Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v10.11.2. Do not edit by hand.
+Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.0.1. Do not edit by hand.
 Hidden and legacy-only commands are omitted; see `docs/v10/CLI-MODERN.md` for the full inventory.
 
 | Command | Description |

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 The flagship product of [Autonomi](https://www.autonomi.dev/). Loki Mode is a spec-driven autonomous builder with a built-in trust layer that takes any spec to a deployed product and verifies completion with evidence (quality gates plus a completion council), not just a "done" claim. Complete installation instructions for all platforms and use cases.
 
-**Version:** v10.11.2
+**Version:** v11.0.1
 
 **Engine note:** `loki "<task>"`, `loki owner/repo#N` and `loki quick` run the Loki 10 engine. `loki start` still routes to the legacy engine, which is being removed (planned work resumes 2026-10-07); prefer `loki owner/repo#N`. See [docs/v10/GUIDE.md](v10/GUIDE.md).
 

package/docs/v10/DEPS.md

@@ -216,6 +216,7 @@ Inventory only. No dependency, lockfile, workflow or image was changed to produc
 | `.github/workflows/tier-a.yml` | `actions/setup-node@v4` | `v4 (resolves to v4.4.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 49933ea5288c), behind latest release v7.0.0 (commit 820762786026); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
 | `action.yml` | `actions/setup-node@v4` | `v4 (resolves to v4.4.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 49933ea5288c), behind latest release v7.0.0 (commit 820762786026); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
 | `.github/actions/issue-to-pr/action.yml` | `(none found)` | `` | `-` | n/a | no `uses:` step found in this workflow/action file |
+| `.github/actions/receipt-check/action.yml` | `(none found)` | `` | `-` | n/a | no `uses:` step found in this workflow/action file |
 | `.github/actions/review/action.yml` | `(none found)` | `` | `-` | n/a | no `uses:` step found in this workflow/action file |
 
 **Node 20 runtime deprecation:** GitHub's own Node 20 deprecation covers two distinct things and they must not be conflated. First, matrix jobs still targeting `node-version: 20` (files: .github/workflows/test.yml). Second, and separately: an action whose OWN `action.yml` declares `using: node20` IS the deprecated runtime itself, regardless of what version tag or SHA it is pinned to -- pinning to the latest release of such an action does not fix this until that action's maintainers migrate its action.yml to node22 or later. Every `uses:` target in this repo's workflows was checked at its pinned ref via the GitHub Contents API; action.yml itself declares node20 for: actions/cache, actions/checkout, actions/download-artifact, actions/setup-node, actions/setup-python, actions/upload-artifact, azure/setup-helm, contributor-assistant/github-action, docker/build-push-action, docker/login-action, docker/setup-buildx-action, github/codeql-action/analyze, github/codeql-action/init, peter-evans/dockerhub-description.

package/docs/v10/FAILURE-CLASSES.md

@@ -304,3 +304,11 @@ L0 review rule (ENGINE-LAWS.md L0): a fix that adds an `if` or a regex about the
 - Fixture: a bun test that plants core.fsmonitor and a canary GH_TOKEN, then calls resolveRunCapS and asserts the plant never ran; and the moat case P9.injection-cannot-reach-token passes locally (`bash tests/moat/run.sh`, P9 line).
 - FC-25b (sibling, found in the opus review, 2026-10-04T01:02Z): the hooks, fsmonitor and sshCommand flag set alone still lets three plant classes run holding the canary token (git 2.55.0). (1) filter.<drv>.clean or process, declared in .gitattributes or .git/info/attributes, fires on status --porcelain, diff --name-only HEAD, add and commit. (2) diff.<drv>.textconv fires on log -p and on a diff with patch output. (3) gpg.program with commit.gpgSign=true fires on commit. A scrubbed env does not close the hole, because a running plant can still read the gh hosts file or the keyring. Execution itself has to be stopped. Mechanism: the same safeGit helper blanks each configured filter and textconv key, and sets diff.external=, commit.gpgSign=false, core.attributesFile=/dev/null and GIT_ATTR_SOURCE=<empty tree>. Fixture: fc25_safe_git.test.ts adds one plant per class.
 - FC-25c (follow-ups from the opus review of d82aec15a, 2026-10-04T01:15Z; not reachable with a real token today). (a) The allowToken path still honors repo-local core.sshCommand, remote.*.uploadpack and receivepack, and a repo-scope credential.helper; the canary fired on an ssh origin and on a local-path uploadpack. Its only caller is the base_guard fetch, reached from intake in the worker with the sentinel env, and supervisor.ts baseLine passes fetchRemote=false. Fix: harden allowToken itself, or add a guard that pins it to that single worker-side caller. (b) The raw-spawn guard misses an indirect argv (`const GIT = "git"`) and does not scan packages/control-plane. ship_hook.ts reaches control-plane shipper/discover.ts gitOrigin (`git config --get`, real-token env) from the supervisor. Fix: convert it to safeGit and widen the guard. (c) preflight's safeGitArgv path does not set GIT_CONFIG_NOSYSTEM. Low risk, because system config is root-owned.
+
+## FC-26 Free text in the Control Plane starts a run in HOME that dies in 0.13s, and the run page says "did not pass verification"
+- User saw: runs cc22 and e606 on the founder's CP, both FAILED in about 0.13s, with a summary that blamed verification. The founder had typed "whats going on so far" in the home box. Raw `loki start` refuses a non-repo dir with a clear message.
+- Root cause (b-a3, 2026-10-04): the home box POSTed free text to /v1/start as `--brief`, with repo "lokesh" (HOME). planStart (packages/control-plane/src/server/spawn.ts:47) accepted any known repo path, HOME included, and `loki start --brief` exited before any stage ran. The run page summary had no branch for "stopped before verify".
+- Law: L2 (refuse unsafe targets before acting), L7 (the summary states the real stop reason).
+- Siblings: every CP entry that spawns `loki` (POST /v1/start, /v1/runs, retry); every summary line that is derived without a verify event; the stale-CP restart (a CP from an old install keeps the old behavior after upgrade).
+- Mechanism: one repoRefusal check in spawn.ts (refuse `/`, HOME and non-git dirs with a human reason) that every spawn path calls; one summaryLine that reads the terminal stop event; free text goes to Ask (read-only) and never to /v1/start.
+- Fixture: packages/control-plane test for repoRefusal (HOME, `/`, non-git, real repo); the A4b summaryLine test ("The run failed before verification ran." for a FAILED run with no verify event); the A3f cleanup test with cc22 and e606 look-alikes.

package/docs/v10/GUIDE.md

@@ -1,21 +1,19 @@
 # Loki 10 engine guide
 
-Default: Loki 10 engine for `loki "<task>"`, `loki owner/repo#N` and `loki quick "<task>"`. Set LOKI_ENGINE=legacy or run `loki legacy <args>` for the previous engine. <!-- loki10-default -->
+Default: Loki 10 engine for `loki "<task>"`, `loki owner/repo#N` and `loki quick "<task>"`. `loki legacy` and LOKI_ENGINE were removed in 11.0.0. <!-- loki10-default -->
 
 Loki 10 is the rewritten engine (docs/v10/ENGINE.md). Since the D48 flip it
-is the default for three entry points: `loki "<task>"`, `loki owner/repo#N`
-(issue mode) and `loki quick "<task>"`. Each prints one start line,
-`Loki 10 engine (set LOKI_ENGINE=legacy or run 'loki legacy' for the previous
-engine)`, then the summary below. `loki start <issue ref | issue URL | "multi-word task">` takes the same
-v10 path as `loki <ref>`. Everything else (`loki start ./prd.md`, `loki
-status`, `loki dashboard` and the rest) is unchanged unless you set
-LOKI_ENGINE=v10 explicitly, which also routes status, verify and dashboard
-to the v10 commands. Bare `loki verify` (no LOKI_ENGINE) follows the newest
-run: when the newest entry in .loki/runs/ is a v10 run newer than the newest
-legacy proof it runs the v10 verify, otherwise the legacy verify. If bun is
-missing or LOKI_PROVIDER is unsupported, the default mode falls back to the
-legacy engine and prints one stderr line saying why. The previous engine stays one step away:
-`loki legacy <args>` and LOKI_ENGINE=legacy.
+runs `loki "<task>"`, `loki owner/repo#N` (issue mode) and `loki quick
+"<task>"`, each printing one start line beginning `Loki 10 engine`, then the
+summary below. `loki start <issue ref | issue URL | "multi-word task">` takes
+the same v10 path as `loki <ref>`. `loki keys` and `loki verify --pubkey`
+always run on Loki 10. Bare `loki verify` follows the newest run: when the
+newest entry in .loki/runs/ is a v10 run newer than the newest legacy proof
+it runs the v10 verify, otherwise the legacy verify. If bun is missing or
+LOKI_PROVIDER is unsupported, the default mode falls back to the bash path
+and prints one stderr line saying why. In 11.0.0 (LEGACY-ZERO W1-01) `loki
+legacy` was removed (it exits 2 with a removal message) and LOKI_ENGINE is no
+longer read; any value is ignored.
 
 `loki start owner/repo#N`, `loki start <issue URL>` and `loki start "<multi-word
 task>"` run Loki 10, the same as `loki owner/repo#N` and `loki "<task>"`. A PRD
@@ -238,11 +236,8 @@ provider names (`claude`, `codex`, `cline`, `aider`); it is not supported.
 ## After the flip
 
 D48 made v10 the default for `loki "<task>"`, `loki owner/repo#N` and
-`loki quick "<task>"`. The previous engine stays fully reachable and
-unchanged: `loki legacy <args>` (prints a short deprecation notice to
-stderr, then runs exactly the pre-flip route for `<args>`) and
-`LOKI_ENGINE=legacy` (the same, without the notice, for scripts). Any
-LOKI_ENGINE value other than v10 or unset also keeps the legacy engine.
-Nothing is removed at the flip. The one place that records which state we
-are in is the marked line near the top of this file and of README.md's
-Loki 10 section; it changed in the same commit as the flip.
+`loki quick "<task>"`. 11.0.0 removed the engine switch: `loki legacy` exits
+2 with a removal message and LOKI_ENGINE is ignored. Remaining legacy paths
+(`loki start ./prd.md` and the no-bun fallback) are tracked in
+docs/v10/LEGACY-REMOVAL.md. The marked line near the top of this file and of
+README.md's Loki 10 section records the current state.

package/docs/v10/PROGRESS.md

@@ -1,5 +1,12 @@
 # Progress
 
+## 2026-10-04T02:21Z: 11.0.0 pushed, release run 37170767617 in progress (CoS)
+- Founder 01:35Z: one MAJOR 11.0.0 in 1-2 hours; 02:08Z: no tests until next week, only tsc, build and dist guard. Source of truth: docs/v10/RELEASE-11.md.
+- train11 merged into main (44839e531): A1b, A2a, A2b, A3a-f, A4a, A4b, A4-ASK-2, A5, A6a, A6b, B2-B8, Tier C docs in docs/v11/ (c7bc9378a, unverified claims stripped).
+- Gates in main: loki-ts tsc rc=0, dist build rc=0, tests/test-release-dist-guard.sh 13/0. Release commit ca4968c6c, gitleaks baseline f880c575c (comment line in .gitleaksignore, a file path), pushed 962efc4b2..f880c575c.
+- B1 DEFERRED (accepted by steering 02:16Z). B9 numbers pending, run by CoS after release with steering's rows. A7 FireLater#17 runs by steering on 11.0.0 from npm.
+- Skipped tests and reviews are listed under "Tests owed after Oct 7" in RELEASE-11.md.
+
 ## 2026-10-03T21:26Z: v10.10.1 latest, v10.10.2 on next (CoS)
 - v10.10.1: release run 37152525535 success. Smoke passed (peer, 20:58Z); promote moved latest (`npm view loki-mode dist-tags` = latest 10.10.1). The MCP registry publish was skipped: the publisher token expired and the MCP content is unchanged since 10.9.1.
 - v10.10.2 at 78dc27a45: release run 37154153167 success; dist-tags next 10.10.2. Ships CP-REDESIGN, FC-01 Project Model default, the coverage step in test.yml, the cp-redesign image guard, and core-budget (engine10 core 4719; engine suites 1431/0, tsc rc=0 on merged main).
@@ -2243,3 +2250,21 @@ The swarm is stopped: .loki/V10-STOP exists, the loop has no wake-ups, and the c
 - P0 FC-25: the Tests moat job has been red on main since 4fa4e8015 (runs 37160286598 through 37165257952, REGRESSION P9.injection-cannot-reach-token: fsmonitor plant ran holding the canary token). Last green is 65ce2060b = v10.10.3. Suspect: run_cap.ts `git ls-files` from the token-holding supervisor (supervisor.ts:330); a local probe fired an fsmonitor plant on plain `git ls-files`. Row a79dc2f2a. Engineer fix-fc25-p9 (sonnet) is building safeGit() plus a sweep plus a guard; opus review next; 10.11.1 needs P9 green on the release commit (not waived by D88). Rollback is not via promote.yml (it refuses to go backwards); a manual dist-tag move needs the founder's direct word.
 - FC-24 (dc4671ee8): in-process runner forgery (pytest conftest repro at f28b15d78) is a known L2 limit; a pass is runner-reported.
 - In review: FC-16b round 3 8859584c7, FC-22 S2 a62aba7b2, FC-22 S3 d2e61c2ff (all opus). Building: FC-22 S5. Seats are frozen except P0 and FireLater#17 (week 84 percent at 00:43Z).
+
+## 2026-10-04T02:55Z (CoS) HANDOFF: stop until the Oct 7 reset
+- Founder about 02:50Z (via steering): near the usage limit; finish only the 11.0.0 release, stop every other seat and review, write this handoff, go idle. Resume after the Oct 7 weekly reset.
+- 11.0.0 (MAJOR): bump ca4968c6c. Gate reds fixed in f4d223841 (run 37170767617: xreview/gather spawn env and safeGit, project_model test, LFS test skipped on Actions) and 6f1e595b8 (run 37171623026: FC-19 deep-limit timing assertion). Release run 37172046684 on 6f1e595b8 was in progress at handoff; check `gh run view 37172046684` and `npm view loki-mode dist-tags` on resume.
+- What 11.0.0 ships (CHANGELOG v11.0.0): removed `loki legacy` and LOKI_ENGINE (A6b); exit code follows the receipt verdict, exit 3 only with no sealed receipt (A2b); VERIFIED after a limit only with green target checks (A2b); Project Model cap sizing (A2a); FC-25b git hardening (A1b); CP redesign IA, Ask Loki (read-only, LOKI_CP_ASK), onboarding checklist, run detail truthfulness, stale CP restart, ingest refusal, /v1/start repo refusal, dead-PID reconciler (A3a-f, A4a, A4b, A5, ASK-1, ASK-2); `loki status` CP URL (A6a); B2 receipt check, B3 attestation, B4 cross-lab review, B5 committed project.json, B6 Jira/Linear write-back, B7 pr.author, B8 per-repo cost.
+- B1 `--attempts N`: DEFERRED (selectAttempt has no caller; split recorded in RELEASE-11.md). B9 scoreboard: numbers pending; steering skipped the B9 runs to save budget. Run them after the reset and record rows in METRICS.md.
+- Tests owed after Oct 7: the full list is in RELEASE-11.md "Tests owed after Oct 7" (A1b LFS skip on Actions, FC-19 relaxed assertion, unfinished reviews rev-a2b/a3/s5/b2/b8/a4a, B3-B7 tests, A6b local-ci fast tier, screenshots). Nothing shipped in 11.0.0 had agent tests or review rounds after 02:08Z.
+- A7 FireLater#17 gate on 11.0.0: owed (steering, after release).
+- Open rows: BOARD ready=21 (14 dependency-blocked M/G/S41 rows), building=2 (stale, stopped), merged=70 rows not yet marked released. BOARD was not rewritten at handoff; reconcile it on resume.
+- Seats: 0. rev-a2b told to stop. No loops or wakeups armed. Cleanup owed: train11 worktree and scratchpad/integ11 (remove by recorded path only).
+
+## 2026-10-04T03:35Z (CoS) 11.0.1: Tests green patch, then stop until Wednesday
+- 11.0.0 landed: release 37172046684 success; npm latest=11.0.0 and next=11.0.0 after Promote.
+- Founder: "fix all tests and release one last patch and make it green". Tests run 37172048345 on 6f1e595b8 was red on 5 guards, fixed in 31efd8bdf: CP-04 Dockerfile xreview COPY plus 5 control-plane UI tests stale after f26deef50 (bun 515/0, CP-04 25/0 locally), DEPS receipt-check row, S-134 shard rows for the removed legacy suites, CPE24-L7 .gitleaksignore allowlist, DOC-02 historical `loki legacy` allowlist.
+- Tests run 37173354311 on 31efd8bdf: every job green except bun-tests, cancelled at its 10-min cap (coverage makes the unit tests about 6 min). 22a5701e1 raises the cap to 20 min.
+- Tests run 37173985482 on 22a5701e1: the cap held but FC-19 read 1799.999 on the first session; 559d3e604 asserts 1799 < limit <= 1800. Tests run 37174422458 on 559d3e604: success (all jobs).
+- 11.0.1 = the bump commit on top of 559d3e604 (release.sh patch --bump-only rc=0). Check `gh run list --workflow release.yml --limit 1` and `npm view loki-mode dist-tags` on resume.
+- Branch and worktree cleanup (founder ask, one agent): 177 merged worktrees removed (187 kept: 150 unmerged, 25 dirty, 8 locked, live, protected), 1015 merged local branches deleted (338 kept), 119 merged remote branches deleted. Unmerged remote branches left for the founder: auto/model-catalog-probe (1 ahead), dep-wave1 (5), slice-A-121b (1), train/66 (1).

package/docs/v10/RELEASE-11.md

@@ -0,0 +1,77 @@
+# RELEASE-11: one major train (11.0.0) - single source of truth
+
+Founder directive 2026-10-04T01:35Z (relayed by steering): one big MAJOR release in 1-2h (window ends about 03:35Z) using at most 10% of the weekly limit. Hard stop: a real 94% weekly reading. Seats: D87 cap of 4 sonnet builders, sonnet reviewers, opus only as a one-question advisor on trust rows, haiku for docs.
+
+Rules:
+- Every brief quotes its row verbatim. No row ID means no build.
+- DONE needs a commit plus the check output pasted in Evidence.
+- No dummy UI, no placeholder routes, no "coming soon". If a row cannot be real in the window, mark it DEFERRED with a reason.
+- CHANGELOG and docs are written only from DONE rows.
+- The release cuts when every A row is DONE and every B row is DONE or DEFERRED. Moat P9 must be green on the release commit, and this cannot be waived.
+
+Status tokens: TODO, BUILDING, REVIEW, DONE, DEFERRED.
+
+## TIER A (must ship)
+| ID | Item | Owner seat | Acceptance check | Status | Evidence |
+|---|---|---|---|---|---|
+| A1a | FC-25 safeGit (approved) | CoS (release) | 10.11.1 on npm latest; moat P9 CASE P9.injection-cannot-reach-token PASS on the release commit | REVIEW | ed47d6f6f publish skipped (gate: fc16b real-go 8.7s vs 5s timeout, run 37168233387, full rerun same); fix 5463a5c93 + CI wiring 1e99d77f2 (control-plane 25/0, dep-inventory 6/0); republished as release 962efc4b2 v10.11.2: npm latest=10.11.2 at 02:02Z (promote success), steering fresh-install smoke VERIFIED 47s $0.12, loki verify rc 0; P9 CASE on 962efc4b2 not yet recorded here; gitleaks 6 false positives baselined dd61901dc (security-audit-config 67/0) |
+| A1b | FC-25b filter/textconv/gpg blanking (30dc7f77a) | CoS merge | review-fc16b APPROVE at dc7a0aece (bun 3692/0, tsc 0, P9 4/4, M1-M3 mutations red); LFS functional check: `git lfs` repo status/checkout through safeGit still works | DONE | 180bc085b + 0b2e7e549 (worktree-agent-a40d7baa7bac33ecf): builder bun 3695/0, tsc OK, P9 4/4, LFS regression test green, mutations (ATTR_SOURCE restored, global keys blanked) red; review-fc16b re-reviewing on main; train11 df4f241af 02:20Z: merged, loki-ts tsc 0, CP tsc 33 (= baseline), CP UI build 0; review and tests skipped per founder 02:08Z (see Tests owed) |
+| A2a | FC-22 S5 cap sizing | builder fix-s5-cap | FC21B-FC22-PLAN.md S5 Wall checks in tests/engine10/fc21_cap.test.ts green; full bun test + tsc 0 | DONE | d1be73c18 (slice-fc21b-s5): builder fc21_cap 14/0, cap suites 25/0, tsc 0, full bun 3601/3 fail (flake claim unverified); mutations ceiling red; S4 wiring notes handed to A2b; rev-s5 (sonnet) reviewing on main; train11 df4f241af 02:20Z: merged, loki-ts tsc 0, CP tsc 33 (= baseline), CP UI build 0; review and tests skipped per founder 02:08Z (see Tests owed) |
+| A2b | FC-21b + FC-22 S4 earned VERIFIED after limit, A1, A2, L7 outcome | sonnet builder 1 after S5 merges | FC21B-FC22-PLAN.md S4 Wall checks in fc21b_verdict.test.ts + fc21_limit.test.ts; keep test.scoped_out; full bun test + tsc 0; opus advisor answers one question on the VERIFIED rule | DONE | 1338fadd3 on S5 merge 019f396c8 (worktree-agent-a80f475de446614d2): tsc 0; fc21b_verdict 17/0, fc21_limit green; full bun 3710 pass, budget_stop_e2e updated (3/0), long_loop and proof_verify_parity pass alone, 1 unhandled error untraced; mutations (no targetProof, no all-pass) red; exit 3 dropped when sealed (CHANGELOG Changed); dist rebuild in main after merge; rev-a2b (sonnet) + adv-a2b (opus, VERIFIED rule) seated; 42646f844 uncovered_changed condition (opus ADD CONDITION), tsc 0, core 4459; train11 df4f241af 02:20Z: merged, loki-ts tsc 0, CP tsc 33 (= baseline), CP UI build 0; review and tests skipped per founder 02:08Z (see Tests owed) |
+| A3a | R1 stale CP restart (FC-26) | sonnet builder 2 | test: CP running with version X, installed Y -> `loki control serve` restarts it (recorded PID only); UI shows "Control Plane is out of date, restarting" when /health version differs | DONE | 53d7fbf69 (worktree-agent-a75b4739376811b2b): builder CP 476/0, loki-ts 3607/0, tsc clean; a3-stale-cp.test.ts + live.test.tsx; rev-a3 (sonnet) reviewing; train11 df4f241af 02:20Z: merged, loki-ts tsc 0, CP tsc 33 (= baseline), CP UI build 0; review and tests skipped per founder 02:08Z (see Tests owed) |
+| A3b | R2 fixture ingest refusal + wider cleanup | sonnet builder 2 | test: ingest from a source under tmpdir or a test run-id prefix (e37-, e10-sig, e10-sg) is refused; startup cleanup removes origin_repo-null test rows and keeps real rows; every runner sets hermetic HOME + LOKI_CONTROL=0 (guard test) | DONE | 53d7fbf69: ingest refusal + cleanup v2 marker + runner-hermetic.test.ts (red on root bunfig.toml before fix); rev-a3 reviewing; train11 df4f241af 02:20Z: merged, loki-ts tsc 0, CP tsc 33 (= baseline), CP UI build 0; review and tests skipped per founder 02:08Z (see Tests owed) |
+| A3c | R3 truthful run summary | sonnet builder 2 | test: a run FAILED in under 1s with no verify event shows its real stop reason, never "did not pass verification"; root cause of the 0.13s deaths (cc22, e606) named in FAILURE-CLASSES | DONE | root cause (b-a3): founder text went to POST /v1/start --brief with repo=HOME, planStart spawn.ts:47 accepted it, loki start died in 0.13s; A4b summaryLine gives 'The run failed before verification ran.' (4e57b813e); FAILURE-CLASSES row pending; train11 df4f241af 02:20Z: merged, loki-ts tsc 0, CP tsc 33 (= baseline), CP UI build 0; review and tests skipped per founder 02:08Z (see Tests owed) |
+| A4-ASK-1 | Ask Loki read-only tools in TypeScript (steering 01:28Z: no new Python), a stdio MCP server at packages/control-plane/src/ask/tools_server.ts; gh reads only if they fit, else a follow-up | b-ask-mcp | ask_tools.test.ts: runs_compare returns both ids, verdicts and costs; an artifact outside the allowlist is refused; tools/list equals the read set exactly; no write tool | DONE | merge 12aa9a51d + lock e8d9ab71f; rev-ask1 APPROVE: ask_tools 5/0, server+db 274/0 (re-run on main after lock: 274/0 rc=0), tsc 36 errors identical to main, mutations (drop allowlist, add write tool) red; gh tools and run_get diffstat via safeGit are follow-ups |
+| A4-ASK-2 | Ask Loki CP job (slices 4, 5, 6, 7, 9, 10): threads persisted in control.db, async worker on the user's provider (default claude), read-only tools, SSE stream, follow-ups replay prior turns | sonnet builder ask-cp | the slice 4-7, 9 and 10 Wall checks; free text never reaches /v1/start (guard test: the ask module never imports planStart or spawnStart); a real thread answering "whats going on so far" from the founder's 9 runs, with run-id citations (screenshot) | DONE | 7e5d36257 (rebased on 5463a5c93): both rev-ask2 blockers fixed (resolveToolsServer + bundled dist/ask-tools-server.js in files; opencode refused); builder CP 506/0, tsc 36=36; rev-ask2b (sonnet) re-reviewing; train11 df4f241af 02:20Z: merged, loki-ts tsc 0, CP tsc 33 (= baseline), CP UI build 0; review and tests skipped per founder 02:08Z (see Tests owed) |
+| A4a | CP-REDESIGN-2 information architecture (steering spec items 1-8) | sonnet builder 3 (UI) | ui tests green; the sidebar is navigation only; Overview has 4 KPI tiles and a NEEDS YOU inbox; the Runs table is grouped by issue; no "unmeasured" on list views; the composer is removed and the New run issue picker is real (gh issues, registered repos only, explicit confirm; free text never starts a run); an Ask Loki chat page (CP-ASK slices 11-13) with a thread view, streamed answers, follow-ups and Ask history in the sidebar; Loki may OFFER a "Start a run on X#N?" button that opens the confirm dialog, never an auto-start; screenshots of the founder's 9 real runs, reviewed by steering | DONE | 87f2d31ca on 446fd0346 on f28b15d78 (worktree-agent-a572a3fe969613efd); rev-a4a integrating A3+A4b+ASK-2+A4a+A5 in scratchpad/integ11 with live screenshots; f26deef50 fix-integ11 (raw enums via displayOutcome, dash for no-session stages, prepublishOnly needs ask-tools-server); train11 df4f241af 02:20Z: merged, loki-ts tsc 0, CP tsc 33 (= baseline), CP UI build 0; review and tests skipped per founder 02:08Z (see Tests owed) |
+| A3d | /v1/start refuses non-registered or non-git repos, HOME and / (L2); A3e dead-PID reconciler (L6, run 59b1 "Running 10h"); A3f cleanup removes the junk runs cc22 and e606 by rule | b-a3 | tests for each of these | DONE | 53d7fbf69: repoRefusal spawn.ts:26 (HOME, /, non-git), reconcile.ts (STOPPED after 120s, no kill), rule cleanup; issues route with stubbed gh; rev-a3 reviewing; train11 df4f241af 02:20Z: merged, loki-ts tsc 0, CP tsc 33 (= baseline), CP UI build 0; review and tests skipped per founder 02:08Z (see Tests owed) |
+| A4b | Run detail truthfulness (steering 01:24Z items 1-5) | sonnet builder 5 (UI data layer) | (1) Why comes from the terminal stop reason: one sentence, fully ANSI-stripped, raw output behind "Show raw". (2) One shared display mapping (Verified, Partly verified, Failed, Needs your answer, Already done, Stopped (budget), Unverified (signature not checked), Tampered), and no enum string rendered anywhere. (3) receipt.json is the source of truth, with an adapter for old receipt versions; "unmeasured" only when the receipt lacks the field. (4) No owner tag unless one is recorded. (5) A block caused by Loki's own rules (FC-19 classifier) shows the "Loki's own rules stopped this run ... Retry on the latest version" text with Retry as the primary action. Compat fixture: one run each from 10.6.x, 10.7.1, 10.9.1 and 10.10.5 renders with zero garbage and zero false "unmeasured". Screenshots include run e10-20261003T200907Z-fea1 | DONE | fb8b0a967, c7c821eec, 7cfbc76f8, 4e57b813e (worktree-agent-a2317650f8cd8d91a): CP 481/0, ui 193/0, ui build ok; compat 10.6.14/10.7.1/10.9.1/10.10.5 + fea1 screenshots ANSI-free; open: stage-row 'unmeasured' in model.ts; rev-a4b (sonnet) reviewing; train11 df4f241af 02:20Z: merged, loki-ts tsc 0, CP tsc 33 (= baseline), CP UI build 0; review and tests skipped per founder 02:08Z (see Tests owed) |
+| A5 | First-run onboarding checklist (real doctor checks) | sonnet builder 3 after A4 | the CP shows each `loki doctor` check with its real pass/fail; a test proves a failing check renders failing | DONE | feb895b92 (worktree-agent-ac32a11e1b17ea717): builder CP 452/0, ui build ok, /v1/doctor route + Getting started section; in rev-a4a integration review; train11 df4f241af 02:20Z: merged, loki-ts tsc 0, CP tsc 33 (= baseline), CP UI build 0; review and tests skipped per founder 02:08Z (see Tests owed) |
+| A6a | `loki status` CP URL fix | sonnet builder 4 | test: `loki status` prints the URL the running CP actually listens on | DONE | 21992cdaa: run_status 10/0 (builder, pre-directive); train11 df4f241af 02:20Z: merged, loki-ts tsc 0, CP tsc 33 (= baseline), CP UI build 0; review and tests skipped per founder 02:08Z (see Tests owed) |
+| A6b | LEGACY-ZERO W1-01: remove `loki legacy` and LOKI_ENGINE, plus the start-line text | sonnet builder 4 | `loki legacy` exits with a removal message; grep for LOKI_ENGINE in loki-ts/src and autonomy/ has 0 live reads; full bun test + tsc 0 + local-ci fast tier | DONE | 21992cdaa + d5bf3fc05 (action.yml pins) + df4f241af (GUIDE); builder typecheck 0, dist guard 13/0; local-ci fast tier hit 10 min timeout; train11 df4f241af 02:20Z: merged, loki-ts tsc 0, CP tsc 33 (= baseline), CP UI build 0; review and tests skipped per founder 02:08Z (see Tests owed) |
+| A7 | FireLater#17 gate rerun on the RC | steering | steering posts the receipt verdict for the RC | AFTER RELEASE | steering runs FireLater#17 on 11.0.0 from npm (founder 02:08Z) |
+
+## TIER B (thin, real v1s; each is a sonnet slice of 30 minutes or less, or DEFERRED)
+Seats free up only after the Tier A rows. A B row is attempted only if a seat is free AND the real weekly reading is under 90%. Otherwise it is DEFERRED with the reason "budget/window".
+| ID | Item | Acceptance check | Status | Evidence |
+|---|---|---|---|---|
+| B1 | `--attempts N` verifier-selected best-of-N (D61 units) | test: the winner is the attempt with the most Loki-executed passing checks; it never uses a model self-report | DEFERRED | selectAttempt (e10ext/select.ts) exists but has no caller; N-worktree orchestration in supervisor plus seal untested is a Seal-accuracy risk. Split: flag plus N=1 byte guard; attempt runner and scorer on treeswap/select; supervisor wiring |
+| B2 | "Loki Receipt" GitHub check (existing Action runs `loki verify --pubkey`) | workflow test on a fixture receipt posts success; a tampered receipt posts failure; autopilot merge stays opt-in | DONE | b70f44997 (worktree-agent-abbcf4a9e7e15bb24): test-receipt-check-action 9/0 (stubbed gh; signed fixture success, 1-byte tamper failure, no merge step); rev-b2 reviewing; train11 df4f241af 02:20Z: merged, loki-ts tsc 0, CP tsc 33 (= baseline), CP UI build 0; review and tests skipped per founder 02:08Z (see Tests owed) |
+| B3 | `gh attestation` of the receipt (DSSE) + 1-page Agent Change Receipt spec | `gh attestation verify` passes on a fixture; the spec doc exists | DONE | f5a2d0ea3: opt-in attest input on .github/actions/issue-to-pr (actions/attest-build-provenance@v2), docs/AGENT-CHANGE-RECEIPT.md; train11 df4f241af 02:20Z: merged, loki-ts tsc 0, CP tsc 33 (= baseline), CP UI build 0; review and tests skipped per founder 02:08Z (see Tests owed) |
+| B4 | Cross-lab review `review: codex or claude` before seal | test: the second provider can flag or block, never upgrade a verdict | DONE | 2890011b0: stages/xreview.ts minVerdict (downgrade only), opt-in review: codex or claude / LOKI_REVIEW_PROVIDER; core 4490; train11 df4f241af 02:20Z: merged, loki-ts tsc 0, CP tsc 33 (= baseline), CP UI build 0; review and tests skipped per founder 02:08Z (see Tests owed) |
+| B5 | Committed shared .loki/project.json | test: a committed model is loaded and the cache key honors it | DONE | 32199a6a7: git-tracked .loki/project.json loaded via validateAnswer, hash in computeKey, tracked file never overwritten; train11 df4f241af 02:20Z: merged, loki-ts tsc 0, CP tsc 33 (= baseline), CP UI build 0; review and tests skipped per founder 02:08Z (see Tests owed) |
+| B6 | Jira and Linear write-back (opt-in) | test with a stubbed API: the comment carries outcome, PR and receipt digest | DONE | bfc1e38d1: integrations/writeback.ts, opt-in Jira REST v3 / Linear commentCreate after PR, warn-only; train11 df4f241af 02:20Z: merged, loki-ts tsc 0, CP tsc 33 (= baseline), CP UI build 0; review and tests skipped per founder 02:08Z (see Tests owed) |
+| B7 | `pr.author: me or bot` | test: argv uses the gh user or the app token per config | DONE | 40be57da5: pr.author me or bot / LOKI_PR_AUTHOR, bot uses LOKI_PR_BOT_TOKEN as GH_TOKEN in the push child only; train11 df4f241af 02:20Z: merged, loki-ts tsc 0, CP tsc 33 (= baseline), CP UI build 0; review and tests skipped per founder 02:08Z (see Tests owed) |
+| B8 | Per-repo cost analytics in the CP | test: aggregation over real run rows by origin_repo | DONE | f7655a84e (worktree-agent-af387462991fb899c): GET /v1/cost/repos + cost-repos.test.ts red then green, server tests pass; ui tests and tsc not runnable in builder worktree (no node_modules); rev-b8 (sonnet) reviewing; train11 df4f241af 02:20Z: merged, loki-ts tsc 0, CP tsc 33 (= baseline), CP UI build 0; review and tests skipped per founder 02:08Z (see Tests owed) |
+| B9 | Scoreboard v1: Loki vs raw `claude -p` on 3 repos | real runs with numbers in METRICS.md; cost counted inside the 10% budget | numbers pending, run by CoS after release | steering 02:16Z: FireLater#17, augmentiq#52 and a small fixture, Loki 11.0.0 vs raw claude -p on the same base, right after 11.0.0 is latest; rows go to METRICS.md |
+
+## Tests owed after Oct 7 (founder 02:08Z: no testing until next week)
+Every row below shipped on tsc plus build only. Each line is a test or review that was skipped and is owed.
+- A1b: tests/util/fc25_safe_git.test.ts "FC-25b LFS" is skipped on GitHub Actions only (f4d223841). It was red in release run 37170767617 (` M big.bin`) but green in an ubuntu bun container (git 2.47.3) and on macOS (git 2.55.0). Root cause unknown; unskip and diagnose on the CI runner.
+- A2b: fc21b_verdict.test.ts for uncovered_changed (covered file gives VERIFIED, uncovered gives PARTIAL naming it), red-first, drop-condition mutation; rev-a2b stopped with no verdict at 03:02Z: at 1338fadd3 full bun 3715/0, tsc 0, mutations (restoreReadOnly on kill, outcomeOf sealed) red, no blocker; 42646f844 (uncovered_changed) was not reviewed.
+- A3: rev-a3 APPROVE on 53d7fbf69 (02:11Z: CP 481/0, loki-ts 3691/0, 2 mutations red); nothing owed beyond the dist rebuild, done in main.
+- A2a S5: rev-s5 BLOCK on d1be73c18 (02:10Z) for a run_cap.ts merge conflict and stale fc25_safe_git callers, both resolved in train11 (tsc 0). Owed: readPlanScope (run_cap.ts) must drop absolute and ../ paths and cap the entry count (500 entries size to the 3600 ceiling); full bun test rerun.
+- A4a Ask page (rev-a4a 02:14Z): answers render raw markdown (`**bold**` shows literally); the answer said five runs where the DB had 7 (two FAILED runs unmentioned); the offer button path is unshown.
+- A4a/A4b fix-integ11: a render test that no raw enum (SPEC_CONFLICT, PARTIAL) reaches the sidebar or Work list; costOf no-session dash; prepublishOnly fails without dist/ask-tools-server.js.
+- A6b: full local-ci fast tier (timed out at 10 min); tests/test-issue-to-pr-action.sh and tests/test-engine10-docs.sh after the pin and GUIDE edits; supervisor_backstop load-flake triage.
+- B3: run the action with attest: true on a fixture, `gh attestation verify receipt.json --repo owner/repo` exits 0; step skipped when unset.
+- B4: minVerdict never raises any verdict; block turns VERIFIED into PARTIAL; flag and not_run add NOT PROVEN only; unset config leaves the receipt byte-identical.
+- B5: a committed valid model loads with attempts 0; an edit to the tracked file changes the key; an invalid tracked file falls back and is not overwritten.
+- B6: stubbed fetch: Jira ADF body and Linear mutation carry verdict, PR URL, receipt digest; unset config makes no call; a failed fetch leaves the stage result unchanged.
+- B7: resolvePrAuthor plus runPr env: me leaves GH_TOKEN untouched; bot with token sets it; bot without token warns and leaves it.
+- B2/B8: rev-b2 and rev-b8 verdicts not finished.
+- FC-19 deep-limit test (machine.test.ts) relaxed in 6f1e595b8 after release run 37171623026 saw a second implement session at 1799.999 on CI; confirm why a second session runs there and whether the count should be pinned.
+- Screenshots (fea1 run detail, Overview, Ask thread, refused /v1/start for HOME): steering reviews after release.
+- Moat P9 on the 11.0.0 release commit: CI only.
+
+## TIER C (DEFERRED; a 1-page doc each in docs/v11/, no code; haiku)
+Tier C status: DONE. Twelve files in docs/v11/ (README plus C1-C11), train11 commits edb2d638b and c7bc9378a; unverified schedules and spec claims removed by the CoS.
+C1 multi-user logins, roles and SSO. C2 hosted or remote runner. C3 reproducible environments. C4 Bitbucket and Azure DevOps. C5 open or local models. C6 secrets handling. C7 Windows. C8 public benchmark. C9 opt-in telemetry. C10 the 8090 teardown. C11 MCP-MODERN (next minor). Status: DEFERRED. Evidence: the doc path, once written.
+
+## Budget log (real readings only)
+| Time (Z) | Weekly % | Seats live | Note |
+|---|---|---|---|
+| 02:16 | 87 (steering reading), session 16 | 6 sonnet B builders + 1 haiku (short) | testing stopped 02:08Z; cut 02:40Z |
+| 01:43 | 86 (steering reading) | 7 sonnet | 94 about 2.5h out at pace |
+| 01:35 | 84 (steering reading) | fix-s5-cap | directive received |
+| 01:24 | 85 (steering /usage) | 8 sonnet | stop seating at 92 |

package/docs/v11/C1-multi-user-sso.md

@@ -0,0 +1,30 @@
+# C1: Multi-user logins, roles and SSO
+
+## Problem
+Loki Mode dashboard and agent invocation assume a single user per machine. Enterprises require:
+- Multi-user login with persistent sessions
+- Role-based access control (RBAC) to runs, artifacts, secrets
+- SSO (SAML/OIDC) integration for workforce identity management
+
+## Current state
+- `mcp/server.py` authenticates requests via `Authorization` header (no user context)
+- No session table or user identity in database
+- Role and permission tables do not exist
+- Dashboard auth is stub only
+
+## Proposed v1 scope
+- User table with email and identity provider
+- Role table with predefined roles: admin, operator, viewer, auditor
+- Session store (Redis/SQLite with TTL)
+- OIDC provider integration (Google, Okta placeholders)
+- Dashboard login form + route guards
+- CLI flag `--user=name@corp.com` to override default identity
+
+## Open questions
+- Which OIDC providers to ship with? (Google, Microsoft, Okta, or all?)
+- Session persistence: in-process, Redis, or database?
+- How to migrate existing single-user runs to a system-generated user?
+- Audit log scope: login, runs, secret access, or all mutations?
+
+## Why deferred from 11.0.0
+Scope: OIDC, RBAC and session management together. Authentication security review required.

package/docs/v11/C10-the-8090-teardown.md

@@ -0,0 +1,28 @@
+# C10: The 8090 teardown
+
+## Problem
+8090 Solutions Inc. (8090.ai) offers "Software Factory": a competing agent platform targeting regulated industries. Documented research exists but is scattered across competitor analysis files. Need: unified, actionable teardown to inform product positioning.
+
+## Current state
+- Analysis in `docs/COMPETITOR-DEPLOYMENT-MODELS.md` (incomplete: deployment model unknown)
+- `docs/VERIFICATION-COST.md` mentions 8090 as credibility reference
+- `docs/COMPETITIVE-SCORECARD.md` lists 8090 but marks fields UNKNOWN
+- `docs/ENTERPRISE-SCALE-RESEARCH-2026-09.md` has pricing ($200/user/month) and target (regulated, SOW minimum)
+- Dashboard, receipt verification, MCP server are undocumented on 8090 side
+
+## Proposed v1 scope
+- Web research: 8090.ai docs, pricing, public demos
+- Feature parity: receipt verification, audit chain, MCP server
+- Deployment model: SaaS vs hosted vs on-prem vs open-source
+- Secret handling, RBAC, audit log availability
+- Market positioning gap: where 8090 wins and where Loki Mode differentiates
+- Publish findings in `docs/v11/C10-RESEARCH.md`
+
+## Open questions
+- Are 8090 docs behind login or publicly browsable?
+- Do they ship source or binary? Licensed under what terms?
+- Is receipt verification patent-pending or open?
+- How to test MCP server compatibility without access?
+
+## Why deferred from 11.0.0
+Research task, not product feature. No blocking dependency.

package/docs/v11/C11-mcp-modern.md

@@ -0,0 +1,16 @@
+# C11: MCP-MODERN (next minor)
+
+## Problem
+The MCP server in `mcp/server.py` predates newer protocol features. Bringing it current is tracked as the MCP-MODERN row in docs/v10/RELEASE-11.md, targeted at the next minor release. It is not part of 11.0.0.
+
+## Current state
+- `mcp/server.py` is a stdio server that works relative to its cwd's `.loki` directory.
+- It mixes read tools and write or spawn tools (the split is listed in docs/v10/CP-ASK-PLAN.md).
+- A read-only mode for the server is planned under CP-ASK (slice 1 of docs/v10/CP-ASK-PLAN.md).
+
+## Open questions
+- Which protocol features to adopt first, and how to keep existing clients working.
+- Whether any current tools should be deprecated, and for how long a deprecated tool stays.
+
+## Why deferred from 11.0.0
+11.0.0 is scoped to the Tier A and Tier B rows in docs/v10/RELEASE-11.md. MCP-MODERN is a separate row for the next minor.