loki-mode 10.2.4 → 10.3.0

package/docs/v10/BOARD.md

@@ -358,14 +358,14 @@ set is declared to avoid overlap with those and with each other.
 | M-04 | Java graph via jdeps, import-scan fallback recorded | loki-ts/src/engine10/modernize/lang/java.ts, loki-ts/tests/engine10/modernize/java_graph.test.ts, loki-ts/tests/engine10/modernize/fixtures/java8/ | MEDIUM | cd loki-ts && bun test tests/engine10/modernize/java_graph.test.ts | released@2026-09-28T16:03Z | Source: MODERNIZE.md (D30). Depends on M-02. Wave E18, based on the M-02 branch, branch slice-M-04-java-graph. TL REJECT: wildcard and static imports silently dropped in the import-scan fallback. Rework wave E19. Rework r2 7713ad9b (branch slice-M-04-r2). TL REJECT (reproduced): an unresolved wildcard whose package has no local files is dropped silently (java.ts importScanGraph). Next: rework. Wave E21 (wf_39ab3f7d-8f3). r3. Rework r3 771ff0a0 TL APPROVE; merged into train E22 (9042e964): `bun test tests/engine10/` 547 pass 0 fail, tsc 0, `bash tests/test-v10-pulse.sh` 107 passed, `bash eval/loki10/test-harness.sh` 108 passed. Released in v10.2.1 (npm publish 2026-09-28T16:03Z; every cited commit is an ancestor of the v10.2.1 tag; `git merge-base --is-ancestor`). |
 | M-05 | SCC clustering, 1,500-line unit cap, topological waves | loki-ts/src/engine10/modernize/cluster.ts, loki-ts/tests/engine10/modernize/cluster.test.ts | MEDIUM | cd loki-ts && bun test tests/engine10/modernize/cluster.test.ts | released@2026-09-28T05:00Z | Source: MODERNIZE.md (D30). Depends on M-02. Built on branch worktree-wf_4601e7b3-4d8-4 (777f6cdd M-01, 212a7404 M-02, 6b00c05c M-05, 3d8edb5d M-06). TL CONCERN: cluster.ts tarjanSCC recursion overflows the stack on dependency chains of about 20-50k nodes (the M-28/M-29 scale); needs an iterative SCC. Wave E18 rework: iterative Tarjan, branch slice-M-05-iterative-scc. TL APPROVE (sonnet): iterative Tarjan 372ebe11, red on recursive (RangeError), 2000/2000 fuzz identical; merged f4d98c0b, `bun test tests/engine10/modernize/` 28 pass 0 fail. Released in v10.1.0 (npm publish 2026-09-28T05:00Z; every cited commit is an ancestor of the v10.1.0 tag; `git merge-base --is-ancestor`). |
 | M-06 | Up-front estimate (cost, time, risk), --budget math, --dry-run print | loki-ts/src/engine10/modernize/estimate.ts, loki-ts/tests/engine10/modernize/estimate.test.ts | LOW | cd loki-ts && bun test tests/engine10/modernize/estimate.test.ts | released@2026-09-28T05:00Z | Source: MODERNIZE.md (D30). Depends on M-05. Built on branch worktree-wf_4601e7b3-4d8-4 (777f6cdd M-01, 212a7404 M-02, 6b00c05c M-05, 3d8edb5d M-06). TL CONCERN: cluster.ts tarjanSCC recursion overflows the stack on dependency chains of about 20-50k nodes (the M-28/M-29 scale); needs an iterative SCC. Wave E18 with M-05, branch slice-M-05-iterative-scc. Merged f4d98c0b with M-05. Released in v10.1.0 (npm publish 2026-09-28T05:00Z; every cited commit is an ancestor of the v10.1.0 tag; `git merge-base --is-ancestor`). |
-| M-07 | modernize CLI and flag parsing; TABLE route in engine10 cli | loki-ts/src/engine10/modernize/cli.ts, loki-ts/src/engine10/cli.ts (TABLE and USAGE line only), loki-ts/tests/engine10/modernize/cli.test.ts | MEDIUM | cd loki-ts && bun test tests/engine10/modernize/cli.test.ts | building@2026-09-28T17:30Z | Source: MODERNIZE.md (D30). Depends on M-06, E-31 merged or parked. Wave E21 (wf_39ab3f7d-8f3). TL APPROVE of 13848b53, but merged after E-66/E-61/M-24 core reads exactly 5,000 (cap is under 5,000). Next: net core delta at most -1 (offset in cli.ts or dead core code), then merge. r2 TL REJECT (reproduced): modernize/cli.ts TABLE-routed but not in registry.ts (registry.test.ts red when merged); report claimed 40/0 but 39/1; --help lost its modernize line. Next: register it, keep the USAGE line, offset core elsewhere. Wave E26 (wf_9ba5fcaf-75a). Round 4. |
+| M-07 | modernize CLI and flag parsing; TABLE route in engine10 cli | loki-ts/src/engine10/modernize/cli.ts, loki-ts/src/engine10/cli.ts (TABLE and USAGE line only), loki-ts/tests/engine10/modernize/cli.test.ts | MEDIUM | cd loki-ts && bun test tests/engine10/modernize/cli.test.ts | merged@2026-09-28T18:25Z | Source: MODERNIZE.md (D30). Depends on M-06, E-31 merged or parked. Wave E21 (wf_39ab3f7d-8f3). TL APPROVE of 13848b53, but merged after E-66/E-61/M-24 core reads exactly 5,000 (cap is under 5,000). Next: net core delta at most -1 (offset in cli.ts or dead core code), then merge. r2 TL REJECT (reproduced): modernize/cli.ts TABLE-routed but not in registry.ts (registry.test.ts red when merged); report claimed 40/0 but 39/1; --help lost its modernize line. Next: register it, keep the USAGE line, offset core elsewhere. Wave E26 (wf_9ba5fcaf-75a). Round 4. r4 3c73b6cb honest (unsquashed) version; its only blocking finding (core 5,000) no longer reproduces after E-67 removed escalate.ts: merged 02c30314, core 4,977, budget/registry/cli tests 41 pass 0 fail, `bun test tests/engine10/` 654 pass (1 load-timeout, 35/0 alone), dist 18 passed. |
 | M-08 | bin/loki modernize arm to engine10 regardless of default | bin/loki (modernize arm only), tests/test-modernize-dispatch.sh | MEDIUM | bash tests/test-modernize-dispatch.sh | ready@2026-09-28T02:45Z | Source: MODERNIZE.md (D30). Depends on M-07. |
 | M-09 | py2/3 capture tracer with type-tagged JSON and branch coverage | autonomy/lib/modernize/py_capture.py, tests/test-modernize-py-capture.sh, tests/fixtures/modernize/py2/ | HIGH | bash tests/test-modernize-py-capture.sh | released@2026-09-28T14:26Z | Source: MODERNIZE.md (D30). Depends on M-01. Built a4fbf034 (branch worktree-wf_4601e7b3-4d8-5). Opus REJECT (reproduced): unsupported types (sets, Decimal, datetime, bytearray, custom classes) record as equal with no not_proven entry, so the oracle could certify unproven equivalence. Next: rework. Wave E18 rework: unsupported types yield not_proven, branch slice-M-09-not-proven-types. Opus REJECT of 3594eee5: subclasses of supported types (namedtuple, IntEnum, OrderedDict) tag as the base type with no not_proven. Rework wave E19. Rework 085bc2e0 Opus APPROVE; merged b8d40a34; `bash tests/test-modernize-py-capture.sh` Passed 50 Failed 0 Skipped 1 (no python2). Released in v10.1.1 (npm publish 2026-09-28T14:26Z; every cited commit is an ancestor of the v10.1.1 tag; `git merge-base --is-ancestor`). |
 | M-10 | Coverage-guided input search (read-only session, plateau stop) | loki-ts/src/engine10/modernize/oracle/search.ts, loki-ts/tests/engine10/modernize/search.test.ts | HIGH | cd loki-ts && bun test tests/engine10/modernize/search.test.ts | merged@2026-09-28T17:20Z | Source: MODERNIZE.md (D30). Depends on M-09. Opus REJECT (reproduced): a failed seed capture is reported as a plateau. Next: rework. r2 d7db4fb1 Opus APPROVE; merged dc827b80 (on top of v10.2.2): full `cd loki-ts && bun test` 2277 pass 0 fail, `bash tests/test-engine10-dist.sh` 18 passed, `bash tests/test-v10-pulse.sh` 117 passed. |
-| M-11 | Java capture: JUnit under JDK 8 with JaCoCo plus Randoop | autonomy/lib/modernize/java_capture.sh, loki-ts/src/engine10/modernize/oracle/java.ts, loki-ts/tests/engine10/modernize/java_capture.test.ts | HIGH | cd loki-ts && bun test tests/engine10/modernize/java_capture.test.ts | building@2026-09-28T17:30Z | Source: MODERNIZE.md (D30). Depends on M-04. Opus REJECT (reproduced): multi-line java -version breaks status.json (json_escape skips newlines). Next: rework. Wave E26 (wf_9ba5fcaf-75a). Round 3. |
+| M-11 | Java capture: JUnit under JDK 8 with JaCoCo plus Randoop | autonomy/lib/modernize/java_capture.sh, loki-ts/src/engine10/modernize/oracle/java.ts, loki-ts/tests/engine10/modernize/java_capture.test.ts | HIGH | cd loki-ts && bun test tests/engine10/modernize/java_capture.test.ts | merged@2026-09-28T18:25Z | Source: MODERNIZE.md (D30). Depends on M-04. Opus REJECT (reproduced): multi-line java -version breaks status.json (json_escape skips newlines). Next: rework. Wave E26 (wf_9ba5fcaf-75a). Round 3. r3 e476435b opus APPROVE (every C0 byte escaped as \u00XX; malformed status.json reported as its own reason); merged locally. |
 | M-12 | Oracle seal, held-out split, 80% floor, up-front NOT PROVEN | loki-ts/src/engine10/modernize/oracle/seal.ts, loki-ts/tests/engine10/modernize/oracle_seal.test.ts | HIGH | cd loki-ts && bun test tests/engine10/modernize/oracle_seal.test.ts | merged@2026-09-28T17:20Z | Source: MODERNIZE.md (D30). Depends on M-09. Opus REJECT (reproduced): delete-and-reseal defeats tamper evidence (hashes stored beside the data). Next: rework. r2 d9026ec6 Opus APPROVE (reseal refused via the append-only log); merged dc827b80 (on top of v10.2.2): full `cd loki-ts && bun test` 2277 pass 0 fail, `bash tests/test-engine10-dist.sh` 18 passed, `bash tests/test-v10-pulse.sh` 117 passed. |
-| M-13 | Equivalence checker with sealed normalizers and contract output | loki-ts/src/engine10/modernize/equiv.ts, loki-ts/tests/engine10/modernize/equiv.test.ts, loki-ts/tests/engine10/modernize/fixtures/equiv/ | HIGH | cd loki-ts && bun test tests/engine10/modernize/equiv.test.ts | building@2026-09-28T17:30Z | Source: MODERNIZE.md (D30). Depends on M-12. Wave E27 (wf_bcacb1d1-e76). |
-| M-14 | Wall pre-sealed mode: oracle plus conformance, green base is an error | loki-ts/src/engine10/stages/wall.ts (pre-sealed branch only), loki-ts/tests/engine10/modernize/wall_presealed.test.ts | HIGH | cd loki-ts && bun test tests/engine10/modernize/wall_presealed.test.ts | building@2026-09-28T17:30Z | Source: MODERNIZE.md (D30). Depends on M-12, E-54. D33: states its net core line delta; core must stay under 5,000 (92 lines of headroom shared by E-67, E-66, E-61, M-14, merge order E-67, E-66, E-61); offset any excess by deleting dead core code. Wave E27 (wf_bcacb1d1-e76). |
+| M-13 | Equivalence checker with sealed normalizers and contract output | loki-ts/src/engine10/modernize/equiv.ts, loki-ts/tests/engine10/modernize/equiv.test.ts, loki-ts/tests/engine10/modernize/fixtures/equiv/ | HIGH | cd loki-ts && bun test tests/engine10/modernize/equiv.test.ts | ready@2026-09-28T18:42Z | Source: MODERNIZE.md (D30). Depends on M-12. Wave E27 (wf_bcacb1d1-e76). Wave E27 stopped 18:37Z (founder: over budget, load 50). REJECT (reproduced): a unit whose oracle seal is NOT_PROVEN still gets a clean equivalence pass. Branch slice-M-13-equiv kept. |
+| M-14 | Wall pre-sealed mode: oracle plus conformance, green base is an error | loki-ts/src/engine10/stages/wall.ts (pre-sealed branch only), loki-ts/tests/engine10/modernize/wall_presealed.test.ts | HIGH | cd loki-ts && bun test tests/engine10/modernize/wall_presealed.test.ts | ready@2026-09-28T18:42Z | Source: MODERNIZE.md (D30). Depends on M-12, E-54. D33: states its net core line delta; core must stay under 5,000 (92 lines of headroom shared by E-67, E-66, E-61, M-14, merge order E-67, E-66, E-61); offset any excess by deleting dead core code. Wave E27 (wf_bcacb1d1-e76). Wave E27 stopped 18:37Z (founder: over budget, load 50). REJECT: branch empty (no commits). |
 | M-15 | Unit runner: card to v10 run with oracle Wall and equiv check | loki-ts/src/engine10/modernize/unit.ts, loki-ts/tests/engine10/modernize/unit.test.ts | HIGH | cd loki-ts && bun test tests/engine10/modernize/unit.test.ts | ready@2026-09-28T02:45Z | Source: MODERNIZE.md (D30). Depends on M-13, M-14. |
 | M-16 | Deterministic codemods first (futurize, OpenRewrite) or skipped | loki-ts/src/engine10/modernize/codemod.ts, loki-ts/tests/engine10/modernize/codemod.test.ts | MEDIUM | cd loki-ts && bun test tests/engine10/modernize/codemod.test.ts | released@2026-09-28T16:03Z | Source: MODERNIZE.md (D30). Depends on M-02. Built 0a8bbe6c (branch slice-M-16-codemods); TL review died on the 04:48Z access outage. Wave E21 (wf_39ab3f7d-8f3). TL review. TL APPROVE of 0a8bbe6c; merged into train E22 (9042e964): `bun test tests/engine10/` 547 pass 0 fail, tsc 0, `bash tests/test-v10-pulse.sh` 107 passed, `bash eval/loki10/test-harness.sh` 108 passed. Released in v10.2.1 (npm publish 2026-09-28T16:03Z; every cited commit is an ancestor of the v10.2.1 tag; `git merge-base --is-ancestor`). |
 | M-17 | Scheduler: N workers, worktrees, cascade, best-of-2, budget stop | loki-ts/src/engine10/modernize/scheduler.ts, loki-ts/tests/engine10/modernize/scheduler.test.ts | HIGH | cd loki-ts && bun test tests/engine10/modernize/scheduler.test.ts | ready@2026-09-28T02:45Z | Source: MODERNIZE.md (D30). Depends on M-15. |
@@ -384,7 +384,7 @@ set is declared to avoid overlap with those and with each other.
 | M-30 | User docs for loki modernize, no dashes, commands match USAGE | docs/v10/GUIDE-MODERNIZE.md, tests/test-modernize-docs.sh | LOW | bash tests/test-modernize-docs.sh | ready@2026-09-28T02:45Z | Source: MODERNIZE.md (D30). Depends on M-07. |
 | E-66 | "Already implemented" outcome: evidence search in code, tests, docs, CHANGELOG; no change needed verdict, receipt, issue comment, no PR | loki-ts/src/engine10 (intake or plan, implement marker path, seal, pr) | HIGH | fixture with the feature ends no change needed, no implement session; fixture without proceeds | released@2026-09-28T16:03Z | Source: D32 (augmentiq #52). Opus REJECT (reproduced): no test that ALREADY_SATISFIED opens no PR; evidence search matched 652 hits for an unrelated task on this repo; confirmation need not cite files. Rework dispatched. Rework 1c7e1b09 (branch worktree-wf_b707f4ab-24f-1): all 3 blockers fixed (no-PR test F5, 0 hits for both review sentences on this repo, citation must name an existing code or test hit; evidence in receipt). Opus CONCERN: the real-repo test uses listRepoFiles capped at 2000 of 4784 files, so removing STOP_WORDS still passes; the existsSync branch of the citation check is untested. Next: small fix (full file list in that test, one existsSync test). Wave E18 small fix (uncapped file list, existsSync test), branch slice-E-66-test-fixes. Opus APPROVE of 0a64ea98 (uncapped list, existsSync test). Merge onto main conflicts in seal.ts, supervisor.ts, types.ts, rule_of_two.test.ts after E-68/E-69; rebase dispatched (wave E19). D33: states its net core line delta; core must stay under 5,000 (92 lines of headroom shared by E-67, E-66, E-61, M-14, merge order E-67, E-66, E-61); offset any excess by deleting dead core code. Rework 135ba06b Opus APPROVE, but merged it takes core to 5,189 (D33 cap 5,000; `bun test tests/engine10/budget.test.ts`). Not merged. Next: offset about 190 core lines in the same slice (dead or duplicated core code), then merge. Wave E21 (wf_39ab3f7d-8f3). r3: D33 offset. Rework r3 605f33b0 Opus APPROVE (core under 5,000 after offset); merged into train E22 (9042e964): `bun test tests/engine10/` 547 pass 0 fail, tsc 0, `bash tests/test-v10-pulse.sh` 107 passed, `bash eval/loki10/test-harness.sh` 108 passed. Released in v10.2.1 (npm publish 2026-09-28T16:03Z; every cited commit is an ancestor of the v10.2.1 tag; `git merge-base --is-ancestor`). |
 | EV-13 | Eval expected_outcome no_change_needed; aiq-52 set to it | eval/loki10/harness.py, eval/loki10/tasks/aiq-52-searchbar, test-harness.sh | HIGH | bash eval/loki10/test-harness.sh | released@2026-09-28T05:00Z | Source: D32. Opus CONCERN: a correct v10 no-change run on aiq-52 is graded as a source change. Rework dispatched. Rework APPROVE (branch worktree-wf_b707f4ab-24f-5: 19224201, e0264724): v10 Wall side effect excluded from the diff check. Not merged yet. Merged c9c15f38 (trainE18); `bash eval/loki10/test-harness.sh` 103 passed 0 failed. Released in v10.1.0 (npm publish 2026-09-28T05:00Z; every cited commit is an ancestor of the v10.1.0 tag; `git merge-base --is-ancestor`). |
-| E-67 | No pause state: unfinishable runs end as a draft PR or an issue comment with the reason within the cap; stdin never read | loki-ts/src/engine10 (machine, supervisor, worker, escalate, session) | HIGH | a stub provider that asks for input ends within the cap with a draft-PR or comment argv | building@2026-09-28T17:30Z | Source: D32. Opus REJECT (reproduced): a hung worker ended FAILED with no draft PR and no comment, after the cap. Rework dispatched. Rework ba679f4e (branch worktree-wf_b707f4ab-24f-2). Opus REJECT: at the default cap the supervisor backstop fires before the worker cap can seal; concern: the diff check misses untracked files and uncommitted work never reaches a PR. Next: rework. Held, no builder since 03:20Z (row was stale, not running). Dispatch after E-61 (session.ts) and the E-66 rebase (supervisor.ts) merge, from rework ba679f4e plus the Opus findings above. D33: states its net core line delta; core must stay under 5,000 (92 lines of headroom shared by E-67, E-66, E-61, M-14, merge order E-67, E-66, E-61); offset any excess by deleting dead core code. D33 update 14:50Z: E-66 and E-61 merged first, core is 4,998 (1 line of headroom); E-67 must be net core negative. r3 Opus REJECT (reproduced): backstopMs = max(0, capS-30)*1000 is 0 when capS <= 30, so the worker is killed at spawn. Next: rework. Wave E26 (wf_9ba5fcaf-75a). Round 5. |
+| E-67 | No pause state: unfinishable runs end as a draft PR or an issue comment with the reason within the cap; stdin never read | loki-ts/src/engine10 (machine, supervisor, worker, escalate, session) | HIGH | a stub provider that asks for input ends within the cap with a draft-PR or comment argv | merged@2026-09-28T18:25Z | Source: D32. Opus REJECT (reproduced): a hung worker ended FAILED with no draft PR and no comment, after the cap. Rework dispatched. Rework ba679f4e (branch worktree-wf_b707f4ab-24f-2). Opus REJECT: at the default cap the supervisor backstop fires before the worker cap can seal; concern: the diff check misses untracked files and uncommitted work never reaches a PR. Next: rework. Held, no builder since 03:20Z (row was stale, not running). Dispatch after E-61 (session.ts) and the E-66 rebase (supervisor.ts) merge, from rework ba679f4e plus the Opus findings above. D33: states its net core line delta; core must stay under 5,000 (92 lines of headroom shared by E-67, E-66, E-61, M-14, merge order E-67, E-66, E-61); offset any excess by deleting dead core code. D33 update 14:50Z: E-66 and E-61 merged first, core is 4,998 (1 line of headroom); E-67 must be net core negative. r3 Opus REJECT (reproduced): backstopMs = max(0, capS-30)*1000 is 0 when capS <= 30, so the worker is killed at spawn. Next: rework. Wave E26 (wf_9ba5fcaf-75a). Round 5. r5 3e38cd13 opus CONCERN with no blocking: file set widened by the CoS to include autonomy/lib/engine10-push.sh, tests/test-engine10-push.sh and loki-ts/src/engine10/types.ts (earlier opus-reviewed rounds); behaviour note: caps under about 24.8s now go straight to commit, seal and PR. Merged d4a2c620: `bun test tests/engine10/` 632 pass 0 fail, tsc 0, dist 18 passed, push 40 passed; core 4,976 (escalate.ts deleted). |
 | E-68 | Per-call deadline at the stage limit, progress every 30s, every exit code classified (125, 143 included), never "cause not classified" | loki-ts/src/engine10/session.ts, failures.ts | HIGH | per-code tests plus a grep test | released@2026-09-28T05:00Z | Source: D32. Opus REJECT (reproduced): a real limit kill reports "exit 143 (SIGTERM)" because the session child traps SIGTERM; the stub test missed it. Rework dispatched. Rework APPROVE (branch worktree-wf_b707f4ab-24f-3: 4dd05bf9, 922bd923): a limit kill is classified from the engine, not the child exit code. Not merged yet. Merged c9c15f38 (trainE18); engine10 `bun test tests/engine10/` 444 pass 0 fail. Released in v10.1.0 (npm publish 2026-09-28T05:00Z; every cited commit is an ancestor of the v10.1.0 tag; `git merge-base --is-ancestor`). |
 | E-69 | Cost shows "not measured" (or partial), never $0 when unmeasured | output.ts, pr_body.ts, seal.ts, status.ts, dashboard/page.ts, cost.ts | MEDIUM | output and receipt tests for measured, partial, unmeasured | released@2026-09-28T05:00Z | Source: D32 (EV-8 printed $0.00 with 0 tokens). TL CONCERN: genuine-zero test never exercises it; partialCost bypasses the tamper guard; dashboard lacks the partial detail. Rework dispatched. Rework APPROVE (branch worktree-wf_b707f4ab-24f-4: b9825c4c, f42a2aee, 5c66dc55). Not merged yet. Merged c9c15f38 (trainE18); engine10 `bun test tests/engine10/` 444 pass 0 fail. Released in v10.1.0 (npm publish 2026-09-28T05:00Z; every cited commit is an ancestor of the v10.1.0 tag; `git merge-base --is-ancestor`). |
 | E-70 | Dashboard shows its and the CLI's version, warns on mismatch; loki dashboard replaces an older Loki dashboard on its port, leaves a non-Loki listener alone | loki-ts/src/engine10/dashboard/ | MEDIUM | version, mismatch, replace and refuse tests | approved@2026-09-28T02:40Z | Source: D32. Built 1397a1f8, TL APPROVE. Merges in the next train. |
@@ -395,7 +395,7 @@ set is declared to avoid overlap with those and with each other.
 | E-75 | Pulse main-CI check never reads UNKNOWN for a completed Tests run: fall back to `gh run list --commit <sha> --workflow Tests` when the cached check fails, and report RED with the run id | scripts/v10-pulse.sh (main CI check only), tests/test-v10-pulse.sh | MEDIUM | bash tests/test-v10-pulse.sh; a stubbed gh whose check call fails but whose run list says failure yields CI_RED, not UNKNOWN | released@2026-09-28T16:03Z | Source: main red at 5404b0c6, e26bf52b, 983dda58 (Tests run 36377688703) while the pulse printed Main CI UNKNOWN each turn. Wave E21 (wf_39ab3f7d-8f3). TL APPROVE of 8e989837; merged into train E22 (9042e964): `bun test tests/engine10/` 547 pass 0 fail, tsc 0, `bash tests/test-v10-pulse.sh` 107 passed, `bash eval/loki10/test-harness.sh` 108 passed. Released in v10.2.1 (npm publish 2026-09-28T16:03Z; every cited commit is an ancestor of the v10.2.1 tag; `git merge-base --is-ancestor`). |
 | E-76 | Split the engine10 budget test per D33: core under 5,000, modernize/ under 4,000, core never imports modernize | loki-ts/tests/engine10/budget.test.ts | LOW | cd loki-ts && bun test tests/engine10/budget.test.ts; core limit 4900 turns test 1 red | released@2026-09-28T05:00Z | Source: D33 (CTO). Main red since 5404b0c6 on the combined 5,288 count. TL APPROVE (sonnet) on 797705bc: `bun test tests/engine10/budget.test.ts` 3 pass exit 0, core 4907, modernize 381, core limit 4900 goes red; merged 84fbf9b4, full `bun test tests/engine10/` 474 pass 0 fail. Released in v10.1.0 (npm publish 2026-09-28T05:00Z; every cited commit is an ancestor of the v10.1.0 tag; `git merge-base --is-ancestor`). |
 | E-77 | Pulse SESSION_STALLED violation: no assistant turn for more than 20 minutes while the /loop is active (armed wakeup or live workflow), reading the newest session transcript mtime | scripts/v10-pulse.sh (one new check), tests/test-v10-pulse.sh | MEDIUM | bash tests/test-v10-pulse.sh; a fixture transcript 25 minutes old with an active-loop marker yields SESSION_STALLED, 10 minutes old does not, no marker does not | released@2026-09-28T16:03Z | Source: founder 14:00Z; session stalled 04:48Z to about 14:00Z on "organization has disabled Claude subscription access", pulse raised nothing. Wave E21 (wf_39ab3f7d-8f3). TL APPROVE of 409adb68; merged into train E22 (9042e964): `bun test tests/engine10/` 547 pass 0 fail, tsc 0, `bash tests/test-v10-pulse.sh` 107 passed, `bash eval/loki10/test-harness.sh` 108 passed. Marker .loki/state/loop-active. Released in v10.2.1 (npm publish 2026-09-28T16:03Z; every cited commit is an ancestor of the v10.2.1 tag; `git merge-base --is-ancestor`). |
-| EV-14 | v10 against raw on the medium and large tiers (same model, same tasks, both arms), gate table per tier for the default-flip decision (E-31) | eval/loki10 results, docs/v10/METRICS.md (one section) | HIGH | eval/loki10/run.sh per tier for arms raw and v10; every task has a row in both arms, none arm_unavailable; METRICS.md table cites the result files | building@2026-09-28T17:30Z | Source: founder priority 14:00Z (flip v10 to default once it beats raw on the measured tiers). Depends on EV-11 and EV-12 merged; paid run, one tier at a time. D34: may run on 5 real large tasks, 2 runs per arm; flip only if v10 is at or better than raw on completions, cost per completed and p50. D38: runs now on medium (small already measured), 2 runs per arm; claim limited to small plus medium, medium labelled not shortcut audited. Wave E25 (wf_46137a6b-367). Medium measurement running. |
+| EV-14 | v10 against raw on the medium and large tiers (same model, same tasks, both arms), gate table per tier for the default-flip decision (E-31) | eval/loki10 results, docs/v10/METRICS.md (one section) | HIGH | eval/loki10/run.sh per tier for arms raw and v10; every task has a row in both arms, none arm_unavailable; METRICS.md table cites the result files | merged@2026-09-28T18:00Z | Source: founder priority 14:00Z (flip v10 to default once it beats raw on the measured tiers). Depends on EV-11 and EV-12 merged; paid run, one tier at a time. D34: may run on 5 real large tasks, 2 runs per arm; flip only if v10 is at or better than raw on completions, cost per completed and p50. D38: runs now on medium (small already measured), 2 runs per arm; claim limited to small plus medium, medium labelled not shortcut audited. Wave E25 (wf_46137a6b-367). Medium measurement running. Medium measured (0afef9e4, harness at 8f2179cd, claude-opus-5-5, 7 tasks x 2 runs): raw 12/14 (85.7%), $0.5119 per completed, p50 70s; v10 10/14 (71.4%), $0.5395, p50 83s. v10 worse on all three axes; default stays legacy (D38). Result files lost in the 17:36Z worktree incident; EV-15 re-runs with persisted results. |
 | E-78 | v10-guard also blocks moving main without a checkout: `git branch -f main`, `git update-ref refs/heads/main` and `git checkout -B main` | scripts/v10-guard.sh (RULE2 only), tests/test-v10-guard.sh | MEDIUM | bash tests/test-v10-guard.sh; each spelling is refused while on another branch, `git branch -f other` still allowed | released@2026-09-28T16:03Z | Source: 14:12Z the Chief of Staff realigned local main with `git branch -f main origin/main` after RULE2 refused `git reset --hard`; the guard did not see it (harmless there: only an unpushed local merge was dropped, work kept on slice-E-66-r2). First build CONCERN (sonnet TL): update-ref check matches refs/heads/main anywhere in the args, blocking `git update-ref refs/heads/other refs/heads/main`. Next: match the target ref position only. r2 b6e5b389 TL APPROVE; `bash tests/test-v10-guard.sh` ALL TESTS PASSED. Released in v10.2.1 (npm publish 2026-09-28T16:03Z; every cited commit is an ancestor of the v10.2.1 tag; `git merge-base --is-ancestor`). |
 | E-79 | Pulse LOW_READY counts M-NN rows whose Depends-on slices are all merged or released as ready, and names the ones blocked by dependencies | scripts/v10-pulse.sh (ready count only), tests/test-v10-pulse.sh | LOW | bash tests/test-v10-pulse.sh; an M row ready with deps merged counts, one with an unmerged dep does not | merged@2026-09-28T17:20Z | Source: pulse reported 3 to 4 ready while M-08, M-30 and other M rows were ready (14:12Z). E-79..E-81 branch REJECT (reproduced): widening ID_RE makes M rows visible, so IDLE_BUILDERS names dependency-blocked M rows as dispatch targets. Next: IDLE_BUILDERS reuses LOW_READY dependency filter. branch slice-E-79-81-r2 TL APPROVE; merged dc827b80 (on top of v10.2.2): full `cd loki-ts && bun test` 2277 pass 0 fail, `bash tests/test-engine10-dist.sh` 18 passed, `bash tests/test-v10-pulse.sh` 117 passed. |
 | E-80 | Pulse PROGRESS.md age never negative: parse the entry timestamp as UTC and clamp future timestamps to a FUTURE_TIMESTAMP note | scripts/v10-pulse.sh (PROGRESS age only), tests/test-v10-pulse.sh | LOW | bash tests/test-v10-pulse.sh; an entry stamped 10 minutes ahead reads a note, not "-10 min ago" | merged@2026-09-28T17:20Z | Source: pulse printed "PROGRESS.md last entry: -6 min ago" at 04:39Z. branch slice-E-79-81-r2 TL APPROVE; merged dc827b80 (on top of v10.2.2): full `cd loki-ts && bun test` 2277 pass 0 fail, `bash tests/test-engine10-dist.sh` 18 passed, `bash tests/test-v10-pulse.sh` 117 passed. |
@@ -408,24 +408,38 @@ set is declared to avoid overlap with those and with each other.
 | EV-12D | INDEX.md large rows and counts; synthetic lg-* noted rejected (D34), legacy moved to M-27 | eval/loki10/tasks/INDEX.md | LOW | measure-size rc=0 over all tiers; large count at least 5 on main; validate rc=0 | ready@2026-09-28T14:55Z | Source: D34. Depends on EV-12S, EV-12A, EV-12B, EV-12C. |
 | E-83 | P0 fix-forward: main Tests red on 9d483688 (run 36438012977): modernize codemod spawn without env (spawn env guard) and the prStage bundle marker deleted by the E-66 line offset (dist test) | loki-ts/src/engine10/modernize/codemod.ts, loki-ts/src/engine10/stages/pr.ts | HIGH | `bun test tests/runner/spawn_env_guard.test.ts`; `bash tests/test-engine10-dist.sh` | released@2026-09-28T16:03Z | TL APPROVE (sonnet) on 10391f4a, both reverts reproduce red; merged c5ace6e1: full `cd loki-ts && bun test` 2239 pass 0 fail, dist test 18 passed 0 failed, core 4,999. Released in v10.2.1 (npm publish 2026-09-28T16:03Z; every cited commit is an ancestor of the v10.2.1 tag; `git merge-base --is-ancestor`). |
 | E-84 | Pulse TRAIN_LATE reads the last train push from the reflog of refs/remotes/origin/main (moves on every push and on fetches of others' pushes), then push-*.log, then UNKNOWN | scripts/v10-pulse.sh (last_train_push_epoch only), tests/test-v10-pulse.sh | MEDIUM | bash tests/test-v10-pulse.sh; fixture: temp repo plus bare remote, a real `git push` makes the check read under 1 min with no push-*.log present; no reflog and no logs reads UNKNOWN | released@2026-09-28T16:03Z | Source: founder 15:09Z; TRAIN_LATE read 681.9 min while trains were pushed at 14:42Z and later, because plain `git push` writes no push-*.log. TL APPROVE (sonnet) on eeace3f6: `bash tests/test-v10-pulse.sh` 109 passed 0 failed; against the old pulse 106 passed 3 failed; live pulse after merge reads "Minutes since last train push: 12.1". Released in v10.2.1 (npm publish 2026-09-28T16:03Z; every cited commit is an ancestor of the v10.2.1 tag; `git merge-base --is-ancestor`). |
-| E-85 | Security Audit: a narrowly scoped gitleaks allow rule for 40-hex commit pins in eval task.json (repo.ref, merge_sha) so pinned upstream SHAs stop tripping sourcegraph-access-token; CTO approval required (posture: no blanket suppressions) | .gitleaks.toml (or the workflow config), .github/workflows/security-audit.yml | HIGH | a fixture task.json with a 40-hex ref passes; the same string in any other file or key still fails | building@2026-09-28T17:30Z | Source: v10.2.0 Release 36440534050 blocked by a pinned werkzeug SHA; EV-11b and EV-12A/B/C add more pins. Wave E27 (wf_bcacb1d1-e76). CTO-level opus review. |
+| E-85 | Security Audit: a narrowly scoped gitleaks allow rule for 40-hex commit pins in eval task.json (repo.ref, merge_sha) so pinned upstream SHAs stop tripping sourcegraph-access-token; CTO approval required (posture: no blanket suppressions) | .gitleaks.toml (or the workflow config), .github/workflows/security-audit.yml | HIGH | a fixture task.json with a 40-hex ref passes; the same string in any other file or key still fails | ready@2026-09-28T18:42Z | Source: v10.2.0 Release 36440534050 blocked by a pinned werkzeug SHA; EV-11b and EV-12A/B/C add more pins. Wave E27 (wf_bcacb1d1-e76). CTO-level opus review. Wave E27 stopped 18:37Z (founder: over budget, load 50). Build 1 commit on slice-E-85-gitleaks-pins, never reviewed. |
 | DEP-01 | Dependency inventory (D35): docs/v10/DEPS.md lists every manifest (all package.json incl. @anthropic-ai/sdk and claude-agent-sdk; every requirements*.txt and pyproject.toml; every uses: in .github/workflows and .github/actions; Node, Python, Bun matrices; Docker bases, Helm images, Terraform providers, Homebrew formula) with current and latest stable, patch/minor/MAJOR, and runtime EOL; no upgrades | docs/v10/DEPS.md, scripts/dep-inventory.py | LOW | python3 scripts/dep-inventory.py regenerates DEPS.md byte-identically on a second run (network results cached); every manifest found by `git ls-files` appears | released@2026-09-28T17:16Z | Source: founder directive 15:20Z (D35). DEP workstream: max 3 builders, never ahead of E/EV/M. Round 3 2794574b TL APPROVE (sonnet) after two REJECT rounds (bump column mismatch, Node 20 claim, 0.x class, Helm drift; then a missing helm/loki-mode chart and unverified floating tags); `bash tests/test-dep-inventory.sh` 5/5, `--self-test` 23/23. Released in v10.2.2 (npm gitHead 9a59750d). |
-| E-87 | Release dispatch path: required-ci also accepts a completed workflow_dispatch Security Audit run at the exact SHA (Tests and Bun Parity stay push-only), so a tree whose VERSION is already bumped can publish after an audit fix | .github/workflows/release.yml (required-ci only), a test that runs the extracted step against a fixture run list | HIGH | fixture: dispatched audit success at the SHA counts; a dispatched audit at another SHA does not; Tests via dispatch still does not | building@2026-09-28T17:30Z | Source: v10.2.0 Release 36443541666 waited on an audit it could never count. CTO approval required (release gate). Wave E27 (wf_bcacb1d1-e76). CTO-level opus review. |
-| E-88 | Release notes fully written (D36): scripts/release-notes.sh extracts the CHANGELOG section literally (dated headings), fails on a missing, empty, heading-only or placeholder section; release.yml fails instead of falling back and checks the published body; pre-push refuses a VERSION bump without a full section | scripts/release-notes.sh, .github/workflows/release.yml (extract step), .githooks/pre-push, docs/dev/release-checklist.md, tests/test-release-notes.sh | HIGH | bash tests/test-release-notes.sh; failing first against the old awk pattern | building@2026-09-28T17:30Z | Source: founder directive 16:05Z; six releases published with "Release vX.Y.Z" bodies (backfilled). Founder 17:22Z: stopped at 70 min and re-sliced as E-88a (auto-carry removed, explicit --include only). Wave E27 (wf_bcacb1d1-e76). |
-| E-89 | Pulse RELEASE_CADENCE (D37): violation when more than 25 minutes pass with main green (Tests and Bun Parity success at HEAD) and at least one merged-unreleased slice commit (not an ancestor of the latest published tag, docs-only commits excluded) | scripts/v10-pulse.sh (one check), tests/test-v10-pulse.sh | MEDIUM | bash tests/test-v10-pulse.sh; fixtures: green plus unreleased slice commit 26 min old fires; red main does not; docs-only commits do not; 24 min does not | building@2026-09-28T17:30Z | Source: founder directive 16:20Z. Founder 17:22Z: stopped at 58 min; salvaged commit cce8f48a re-sliced as its own slice plus UNDERSTAFFED. Wave E27 (wf_bcacb1d1-e76). |
-| E-90 | Release Manager marks BOARD rows released after publish: scripts/board-mark-released.sh <tag> flips every merged row whose merge commit is an ancestor of <tag> to released@ with the tag and the ancestry evidence; pulse MERGED_NOT_RELEASED_STALE when a merged row is already in a published tag | scripts/board-mark-released.sh, scripts/v10-pulse.sh (one check), tests/test-board-mark-released.sh | MEDIUM | bash tests/test-board-mark-released.sh; a merged row in the tag flips, one not in it stays; BOARD line count unchanged | building@2026-09-28T17:30Z | Source: 16:20Z the BOARD showed 20 merged slices that had all shipped in v10.1.0 to v10.2.1, which read as a 20-slice release backlog. Founder 17:22Z: stopped; salvaged commit 1d9dfae7 re-sliced after E-89. Wave E27 (wf_bcacb1d1-e76). |
+| E-87 | Release dispatch path: required-ci also accepts a completed workflow_dispatch Security Audit run at the exact SHA (Tests and Bun Parity stay push-only), so a tree whose VERSION is already bumped can publish after an audit fix | .github/workflows/release.yml (required-ci only), a test that runs the extracted step against a fixture run list | HIGH | fixture: dispatched audit success at the SHA counts; a dispatched audit at another SHA does not; Tests via dispatch still does not | ready@2026-09-28T18:42Z | Source: v10.2.0 Release 36443541666 waited on an audit it could never count. CTO approval required (release gate). Wave E27 (wf_bcacb1d1-e76). CTO-level opus review. Wave E27 stopped 18:37Z (founder: over budget, load 50). REJECT (reproduced): tests pass with the completed-and-success condition removed from the dispatched-audit check. Branch kept. |
+| E-88 | Release notes fully written (D36): scripts/release-notes.sh extracts the CHANGELOG section literally (dated headings), fails on a missing, empty, heading-only or placeholder section; release.yml fails instead of falling back and checks the published body; pre-push refuses a VERSION bump without a full section | scripts/release-notes.sh, .github/workflows/release.yml (extract step), .githooks/pre-push, docs/dev/release-checklist.md, tests/test-release-notes.sh | HIGH | bash tests/test-release-notes.sh; failing first against the old awk pattern | ready@2026-09-28T18:42Z | Source: founder directive 16:05Z; six releases published with "Release vX.Y.Z" bodies (backfilled). Founder 17:22Z: stopped at 70 min and re-sliced as E-88a (auto-carry removed, explicit --include only). Wave E27 (wf_bcacb1d1-e76). Wave E27 stopped 18:37Z (founder: over budget, load 50). E-88a opus APPROVE (branch slice-E-88a); merge conflicts with E-86 in .githooks/pre-push; rebase after E-99 lands (same file). |
+| E-89 | Pulse RELEASE_CADENCE (D37): violation when more than 25 minutes pass with main green (Tests and Bun Parity success at HEAD) and at least one merged-unreleased slice commit (not an ancestor of the latest published tag, docs-only commits excluded) | scripts/v10-pulse.sh (one check), tests/test-v10-pulse.sh | MEDIUM | bash tests/test-v10-pulse.sh; fixtures: green plus unreleased slice commit 26 min old fires; red main does not; docs-only commits do not; 24 min does not | merged@2026-09-28T18:42Z | Source: founder directive 16:20Z. Founder 17:22Z: stopped at 58 min; salvaged commit cce8f48a re-sliced as its own slice plus UNDERSTAFFED. Wave E27 (wf_bcacb1d1-e76). Wave E27 stopped 18:37Z (founder: over budget, load 50). TL APPROVE (sonnet) on the salvaged cce8f48a plus UNDERSTAFFED; merged locally; `bash tests/test-v10-pulse.sh` 129 passed 0 failed. |
+| E-90 | Release Manager marks BOARD rows released after publish: scripts/board-mark-released.sh <tag> flips every merged row whose merge commit is an ancestor of <tag> to released@ with the tag and the ancestry evidence; pulse MERGED_NOT_RELEASED_STALE when a merged row is already in a published tag | scripts/board-mark-released.sh, scripts/v10-pulse.sh (one check), tests/test-board-mark-released.sh | MEDIUM | bash tests/test-board-mark-released.sh; a merged row in the tag flips, one not in it stays; BOARD line count unchanged | ready@2026-09-28T18:42Z | Source: 16:20Z the BOARD showed 20 merged slices that had all shipped in v10.1.0 to v10.2.1, which read as a 20-slice release backlog. Founder 17:22Z: stopped; salvaged commit 1d9dfae7 re-sliced after E-89. Wave E27 (wf_bcacb1d1-e76). Wave E27 stopped 18:37Z (founder: over budget, load 50). Build on slice-E-90-r2 (5 commits) never reviewed; re-review as its own slice. |
 | DEP-02 | actions/checkout v4 (runs on deprecated node20) to latest major v7, SHA-pinned with a "# v7.x.y" comment in every workflow and composite action; read the v5, v6, v7 release notes and fix breaking changes (fetch-depth, persist-credentials defaults) | .github/workflows/*.yml, .github/actions/**/action.yml (uses: actions/checkout lines, plus any input the migration requires) | MEDIUM | `grep -rn "actions/checkout@" .github` shows only full-SHA pins with a v7 comment; actionlint clean; a PR run of Tests, Bun Parity and Security Audit on the slice concludes success (run id cited) | building@2026-09-28T16:30Z | Source: DEP-01 inventory (D35). A release containing workflow changes needs the tag pushed by the Release Manager (GITHUB_TOKEN lacks the workflows permission; release.yml prints the workaround). |
 | DEP-03 | actions/setup-node v4 (node20) to latest major v7, SHA-pinned with a version comment; read the v5..v7 release notes (cache and package-manager detection defaults) and fix breaking changes | .github/workflows/*.yml, .github/actions/**/action.yml (setup-node lines and required inputs) | MEDIUM | only SHA pins with a v7 comment; actionlint rc=0; PR run conclusion success (run id cited) | building@2026-09-28T16:30Z | Source: DEP-01 inventory (D35). |
 | DEP-04 | Runtime matrix: drop Node 20 (EOL 2026-04-30) from every workflow matrix, keep 22 (previous supported, users still run it) and 24, add the current stable line if the inventory shows one newer and supported; update package.json engines and docs that name Node 20 | .github/workflows/*.yml (node-version values), package.json (engines only), docs naming the Node version | MEDIUM | no node 20 left in any matrix; engines matches; PR run conclusion success on every remaining version (run id cited) | building@2026-09-28T16:30Z | Source: DEP-01 inventory (D35). |
-| E-91 | Pulse UNEVIDENCED_CLAIM and every row parser accept any slice id prefix ([A-Z]+-\d+, e.g. DEP-02, GF-1, PF-3), not a hardcoded S/E/EV/M list | scripts/v10-pulse.sh (row-id regexes only), tests/test-v10-pulse.sh | LOW | bash tests/test-v10-pulse.sh; a DEP row with "green" only in its Wall cell is not flagged, its notes cell still is | building@2026-09-28T17:30Z | Source: pulse flagged DEP-03/DEP-04 Wall cells (df7dc134), the E-71 bug class again. Serialize after E-89/E-90 and E-79..81 (same file). Wave E27 (wf_bcacb1d1-e76). After E-90 (same file). |
+| E-91 | Pulse UNEVIDENCED_CLAIM and every row parser accept any slice id prefix ([A-Z]+-\d+, e.g. DEP-02, GF-1, PF-3), not a hardcoded S/E/EV/M list | scripts/v10-pulse.sh (row-id regexes only), tests/test-v10-pulse.sh | LOW | bash tests/test-v10-pulse.sh; a DEP row with "green" only in its Wall cell is not flagged, its notes cell still is | ready@2026-09-28T18:42Z | Source: pulse flagged DEP-03/DEP-04 Wall cells (df7dc134), the E-71 bug class again. Serialize after E-89/E-90 and E-79..81 (same file). Wave E27 (wf_bcacb1d1-e76). After E-90 (same file). Wave E27 stopped 18:37Z (founder: over budget, load 50). Not started. |
 | E-92 | P0 fix-forward: dep-inventory --self-test reached the real gh floating-tag resolver (actions/setup-node@v4), so CI without gh auth read bump unknown (Tests red since df7dc134, run 36451439320) | scripts/dep-inventory.py (self-test fixture) | HIGH | `env -u GH_TOKEN -u GITHUB_TOKEN PATH=/usr/bin:/bin python3 scripts/dep-inventory.py --self-test` rc=0; rc=1 on the previous version | released@2026-09-28T17:16Z | TL APPROVE (sonnet) on 81cdba4d: stripped-env self-test 23/23 rc=0, origin/main rc=1, fixture mutation goes red, no second network path in self_test(); merged 4f7f1487. Guard: E-93. Released in v10.2.2 (npm gitHead 9a59750d, Release run 36455687013). |
-| E-93 | Guard (D37 same-class-never-twice): tests/test-dep-inventory.sh runs --self-test under a stripped environment (no GH_TOKEN/GITHUB_TOKEN, PATH=/usr/bin:/bin, empty HOME) so a network-dependent self-test fails locally, not only in CI; GUARDS.md entry | tests/test-dep-inventory.sh, docs/v10/GUARDS.md | LOW | a self-test that calls an unstubbed fetcher fails the leg locally | building@2026-09-28T17:30Z | Source: E-92 incident. Wave E25 (wf_46137a6b-367). |
-| EV-12E | Upstream-first hidden-test enforcement (D38 criteria 1, 3, 4, 7, 9): validate requires hidden.provenance, hidden.sha256 and requirements[] on lg-* tasks; measure-size excludes typing-examples/, examples/, docs/; a test-harness leg applies every tasks/lg-*/shortcuts/*.patch and asserts not completed, and RED at ref is not collection-only; run.sh rows gain hidden_subset | eval/loki10/harness.py (validate only), eval/loki10/measure-size.py, eval/loki10/test-harness.sh (new section) | HIGH | fixture with a wrong sha256 fails validate rc=1; a passing shortcut fixture fails the leg; an attrs-602-shaped fixture reads medium | building@2026-09-28T17:30Z | Source: D38. Needs EV-12S merged first (measure-size). Wave E27 (wf_bcacb1d1-e76). |
-| EV-12F | Retrofit lg-werkzeug-1513, 1680, 1769 and lg-httpx-1522 to D38 criteria 1-9 (requirements map, upstream-later tests first, authored public-API tests, sha256 freeze, saved shortcuts as must-fail fixtures from ~/loki-ci-logs/ev12-shortcuts/) | eval/loki10/tasks/lg-werkzeug-{1513,1680,1769}/, lg-httpx-1522/, their refdiffs | HIGH | per task: RED by assertion, GREEN at merge, every Ri-omission mutant fails, every shortcut fails, regression files pass, validate rc=0; independent opus 45-minute shortcut attempt passes nothing | building@2026-09-28T17:30Z | Source: D38. Two engineers (task pairs). Wave E25 (wf_46137a6b-367). Two engineers (task pairs). |
-| EV-12G | Retrofit lg-httpx-1550, lg-httpx-3319, lg-attrs-660 to D38, then new upstream PRs (with later upstream tests first) until the large tier holds 10 | eval/loki10/tasks/lg-httpx-{1550,3319}/, lg-attrs-660/, new lg-* dirs, their refdiffs | HIGH | as EV-12F; at least 5 passing on main before the EV-14 large runs | building@2026-09-28T17:30Z | Source: D38. Wave E25 (wf_46137a6b-367). |
-| E-94 | Guard for red main df7dc134 (a test passed locally only because gh was authenticated): local-ci fast tier re-runs every changed test file under a stripped environment (no GH_TOKEN, gh or network credentials) and fails on a difference | scripts/local-ci.sh (one check), tests/test-local-ci-hermetic.sh, docs/v10/GUARDS.md | MEDIUM | a fixture test that calls gh fails the check; the pre-E-92 dep-inventory.py is caught | building@2026-09-28T17:30Z | Source: founder 17:22Z (each red main becomes a pre-merge guard). Wave E27 (wf_bcacb1d1-e76). |
-| E-95 | Guard for red main 8f2179cd (App Runner Watchdog Health fixture server never came up; rerun 36453069628 passed): free port by binding 0, readiness poll up to 10s with a clear message; 20/20 under parallel load | tests/test-app-runner-watchdog-health.sh, docs/v10/GUARDS.md | LOW | 20 consecutive passes while 4 parallel pulse suites run | building@2026-09-28T17:30Z | Source: founder 17:22Z. Wave E27 (wf_bcacb1d1-e76). |
-| E-86 | Pre-push gitleaks for eval task fixtures (founder 15:16Z): pinned v8.30.0 with hardcoded checksums, every pushed commit scanned in dir mode from the pushed commit (not the working tree), refusal names file, line and rule, never the secret | .githooks/pre-push, scripts/install-gitleaks.sh, tests/test-pre-push-gitleaks.sh, .gitleaksignore | HIGH | real-push fixtures: a sourcegraph URL plus 40-hex pin is refused; opus security review | building@2026-09-28T17:30Z | Source: v10.2.0 blocked by gitleaks. Rounds 1-3 opus REJECT with reproduced fail-opens (non-ASCII dirs, unfetched force-push, working-tree scan, checksum bypass; intermediate commits; root commits, history leak, case collisions). Round 4 building as one squashed commit off main. |
+| E-93 | Guard (D37 same-class-never-twice): tests/test-dep-inventory.sh runs --self-test under a stripped environment (no GH_TOKEN/GITHUB_TOKEN, PATH=/usr/bin:/bin, empty HOME) so a network-dependent self-test fails locally, not only in CI; GUARDS.md entry | tests/test-dep-inventory.sh, docs/v10/GUARDS.md | LOW | a self-test that calls an unstubbed fetcher fails the leg locally | merged@2026-09-28T18:00Z | Source: E-92 incident. Wave E25 (wf_46137a6b-367). TL APPROVE (sonnet); merged on main 18:00Z; `bash tests/test-dep-inventory.sh` 6 passed 0 failed. |
+| EV-12E | Upstream-first hidden-test enforcement (D38 criteria 1, 3, 4, 7, 9): validate requires hidden.provenance, hidden.sha256 and requirements[] on lg-* tasks; measure-size excludes typing-examples/, examples/, docs/; a test-harness leg applies every tasks/lg-*/shortcuts/*.patch and asserts not completed, and RED at ref is not collection-only; run.sh rows gain hidden_subset | eval/loki10/harness.py (validate only), eval/loki10/measure-size.py, eval/loki10/test-harness.sh (new section) | HIGH | fixture with a wrong sha256 fails validate rc=1; a passing shortcut fixture fails the leg; an attrs-602-shaped fixture reads medium | ready@2026-09-28T18:42Z | Source: D38. Needs EV-12S merged first (measure-size). Wave E27 (wf_bcacb1d1-e76). Wave E27 stopped 18:37Z (founder: over budget, load 50). REJECT (reproduced): RED at ref must be by assertion (criterion 7) is untested. Branch slice-EV-12E kept (4 commits). |
+| EV-12F | Retrofit lg-werkzeug-1513, 1680, 1769 and lg-httpx-1522 to D38 criteria 1-9 (requirements map, upstream-later tests first, authored public-API tests, sha256 freeze, saved shortcuts as must-fail fixtures from ~/loki-ci-logs/ev12-shortcuts/) | eval/loki10/tasks/lg-werkzeug-{1513,1680,1769}/, lg-httpx-1522/, their refdiffs | HIGH | per task: RED by assertion, GREEN at merge, every Ri-omission mutant fails, every shortcut fails, regression files pass, validate rc=0; independent opus 45-minute shortcut attempt passes nothing | ready@2026-09-28T18:00Z | Source: D38. Two engineers (task pairs). Wave E25 (wf_46137a6b-367). Two engineers (task pairs). Wave E25 opus REJECT on every retrofitted task (requirements not covering the sized refdiff, -k deselecting the only Ri test, deprecation requirements untested, shortcuts that omit stated requirements still passing). Deprioritized at 18:00Z behind EV-15 and E-98: the flip is blocked by the medium-tier result regardless of the large tier. |
+| EV-12G | Retrofit lg-httpx-1550, lg-httpx-3319, lg-attrs-660 to D38, then new upstream PRs (with later upstream tests first) until the large tier holds 10 | eval/loki10/tasks/lg-httpx-{1550,3319}/, lg-attrs-660/, new lg-* dirs, their refdiffs | HIGH | as EV-12F; at least 5 passing on main before the EV-14 large runs | ready@2026-09-28T18:00Z | Source: D38. Wave E25 (wf_46137a6b-367). Wave E25 opus REJECT on every retrofitted task (requirements not covering the sized refdiff, -k deselecting the only Ri test, deprecation requirements untested, shortcuts that omit stated requirements still passing). Deprioritized at 18:00Z behind EV-15 and E-98: the flip is blocked by the medium-tier result regardless of the large tier. |
+| E-94 | Guard for red main df7dc134 (a test passed locally only because gh was authenticated): local-ci fast tier re-runs every changed test file under a stripped environment (no GH_TOKEN, gh or network credentials) and fails on a difference | scripts/local-ci.sh (one check), tests/test-local-ci-hermetic.sh, docs/v10/GUARDS.md | MEDIUM | a fixture test that calls gh fails the check; the pre-E-92 dep-inventory.py is caught | merged@2026-09-28T18:42Z | Source: founder 17:22Z (each red main becomes a pre-merge guard). Wave E27 (wf_bcacb1d1-e76). Wave E27 stopped 18:37Z (founder: over budget, load 50). TL APPROVE; merged locally; `bash tests/test-local-ci-hermetic.sh` 18 passed 0 failed. |
+| E-95 | Guard for red main 8f2179cd (App Runner Watchdog Health fixture server never came up; rerun 36453069628 passed): free port by binding 0, readiness poll up to 10s with a clear message; 20/20 under parallel load | tests/test-app-runner-watchdog-health.sh, docs/v10/GUARDS.md | LOW | 20 consecutive passes while 4 parallel pulse suites run | merged@2026-09-28T18:42Z | Source: founder 17:22Z. Wave E27 (wf_bcacb1d1-e76). Wave E27 stopped 18:37Z (founder: over budget, load 50). TL APPROVE; merged locally; `bash tests/test-app-runner-watchdog-health.sh` 12 passed 0 failed. |
+| E-86 | Pre-push gitleaks for eval task fixtures (founder 15:16Z): pinned v8.30.0 with hardcoded checksums, every pushed commit scanned in dir mode from the pushed commit (not the working tree), refusal names file, line and rule, never the secret | .githooks/pre-push, scripts/install-gitleaks.sh, tests/test-pre-push-gitleaks.sh, .gitleaksignore | HIGH | real-push fixtures: a sourcegraph URL plus 40-hex pin is refused; opus security review | merged@2026-09-28T18:05Z | Source: v10.2.0 blocked by gitleaks. Rounds 1-3 opus REJECT with reproduced fail-opens (non-ASCII dirs, unfetched force-push, working-tree scan, checksum bypass; intermediate commits; root commits, history leak, case collisions). Round 4 building as one squashed commit off main. Round 4 8f9baace opus APPROVE (every earlier reproduction refuses; fresh-clone Security Audit gitleaks rc=0 with the branch merged); merged on main; `bash tests/test-pre-push-gitleaks.sh` 40 passed 0 failed. Follow-ups in E-99. |
+| E-96 | Safe worktree pruning: scripts/prune-worktrees.sh removes a .claude/worktrees entry only when it is not locked, has no process with a cwd inside it (lsof), and its branch has no commit or file change in the last 30 minutes measured with git and stat (never find -newermt), refusing when any check cannot run; the pulse WORKTREE_COUNT NEXT ACTION names the script | scripts/prune-worktrees.sh, tests/test-prune-worktrees.sh, scripts/v10-pulse.sh (NEXT ACTION text only) | MEDIUM | fixture: a worktree with a live process inside is kept; an idle one is removed; an unsupported check refuses | ready@2026-09-28T17:40Z | Source: 17:36Z incident: the Chief of Staff pruned by `find -newermt "-25 minutes"` (unsupported on BSD find, matched nothing) and force-removed 7 live builder worktrees (M-07 r4, M-11 r3, EV-14, EV-12F-a, EV-12G, E-95, E-87); every branch had its work committed, uncommitted edits since the last commit were lost. |
+| DEP-05 | npm/bun patch and minor batch from docs/v10/DEPS.md (web-app, dashboard-ui, vscode-extension, root; lockfiles regenerated and committed; 0.x packages excluded) | the package.json and lockfiles DEPS.md names for patch/minor only | LOW | npm audit: no new high or critical; hallucinated-dependency guard rc=0; full Tier B plus the moat suite on a PR run | ready@2026-09-28T17:45Z | Source: DEP-01 inventory (D35). |
+| DEP-06 | Python patch and minor batch from docs/v10/DEPS.md (dashboard, mcp, web-app requirements, sdk/python pyproject; 0.x excluded) | those requirements*.txt and pyproject.toml | LOW | pip-audit: no new high or critical; guard rc=0; PR run of Tests conclusion success (run id cited) | ready@2026-09-28T17:45Z | Source: DEP-01 (D35). |
+| DEP-07 | SHA-pin every remaining tag-pinned action already on its latest major (anchore/sbom-action, anthropics/claude-code-action, contributor-assistant/github-action, oven-sh/setup-bun) with a version comment | .github/workflows/*.yml (those uses: lines only) | LOW | every uses: is a full SHA with a vX comment; actionlint rc=0; PR run | ready@2026-09-28T17:45Z | Source: DEP-01 (D35). Serialize after DEP-02/DEP-03 merge (same files). |
+| G-01 | Usage governor (D39): scripts/usage-governor.py sums usage (output, input, cache read, cache write) from ~/.claude/projects/**/*.jsonl per model, role (from workflow labels and agent types where recorded) and hour; stores founder plan-percentage readings (docs/v10/usage-readings.tsv) and fits tokens-per-percent as a labelled estimate; projects 5-hour window and weekly usage; outputs max engineers for the next hour; checks and records whether Claude Code exposes plan usage directly (statusline input rate-limit fields, /usage) and uses it when it does | scripts/usage-governor.py, docs/v10/usage-readings.tsv, tests/test-usage-governor.sh | HIGH | fixture jsonl plus readings gives a stated projection and max-engineer number; missing readings reads "uncalibrated", never a number presented as fact | building@2026-09-28T17:50Z | Source: founder 17:44Z. First in the queue; everything obeys it. |
+| G-02 | Pulse BUDGET_BURN and OPUS_SHARE violations plus an hourly METRICS.md usage section (tokens per role and model, cost per merged slice, window and weekly projections, max engineers, releases per hour, merged slices per hour and per million tokens), all from G-01 | scripts/v10-pulse.sh (two checks), tests/test-v10-pulse.sh, docs/v10/METRICS.md (section header only) | MEDIUM | fixtures: opus 31% fires OPUS_SHARE; a projection of 86% fires BUDGET_BURN; uncalibrated reads UNKNOWN | ready@2026-09-28T17:50Z | Source: founder 17:44Z. Depends on G-01. Serialize after E-89..E-91 (same file). |
+| G-03 | docs/v10/SCALE.md: what the Max 20x plan sustains around the clock (from G-01 measurements and calibration), what 50 parallel engineers need (API pay-as-you-go with a rate-limit tier, or Team/Enterprise), cost per day estimates labelled as estimates, and the ramp gates (governor allows, merged slices per hour rising, merged work per token not falling) | docs/v10/SCALE.md | HIGH | every number cites a measurement or is labelled an estimate with its basis | building@2026-09-28T17:50Z | Source: founder 17:44Z. CTO (opus) authors. Billing is the founder decision. |
+| G-04 | Cloud fan-out (HIGH, CTO-owned): dispatch ready slices with no file overlap with in-flight work as Claude Code cloud sessions that open PRs from their own branches; the Release Manager merges PRs whose checks concluded success with gh pr merge; every dispatch recorded in BOARD.md with its cloud session id; ramp 25 to 50 only when the governor allows and merged slices per hour rose | scripts/cloud-dispatch.sh, docs/v10/SWARM.md (one section), tests/test-cloud-dispatch.sh | HIGH | dry-run dispatch prints the exact command and the BOARD row it would write; refuses when the governor max is reached or file sets overlap | ready@2026-09-28T17:50Z | Source: founder 17:44Z. Depends on G-01 (governor) and G-03 (plan ceiling). Verify the real cloud-session CLI syntax before building. |
+| G-05 | The same fan-out as loki modernize remote-worker mode (POST /jobs kind unit, Helm worker.engine v10): align G-04 with M-23 | (design note in docs/v10/MODERNIZE.md, one section) | MEDIUM | the note maps G-04 dispatch fields to the M-23 job schema | ready@2026-09-28T17:50Z | Source: founder 17:44Z. Depends on G-04 and M-17. |
+| EV-15 | Re-run the medium tier (7 tasks, raw and v10, 2 runs each, same model) with every result file written under ~/loki-ci-logs/eval/ev15-<arm>-r<n>/ (outside any worktree) and a per-task table of which runs failed and why (hidden-test failure, timeout, no PR, cost) | eval/loki10 results (outside the repo), docs/v10/METRICS.md (one section) | HIGH | 28 rows, 0 arm_unavailable; per-task failure reasons cited from the result files | building@2026-09-28T18:42Z | Source: EV-14 evidence lost (17:36Z incident) and v10 lost on all three medium axes. Governor-gated (paid run). D40 priority 1: running (wf_4af22d00-9fb), results under ~/loki-ci-logs/eval. |
+| E-98 | Diagnose why v10 loses to raw on medium (EV-15 per-task failures): for each task v10 failed and raw completed, read the v10 run log and name the stage and cause (plan, Wall, implement, verify, fix rounds, cap), then cut fix slices | docs/v10/ENGINE.md (findings section) | HIGH | each finding cites a result file path and a log line | building@2026-09-28T18:42Z | Source: EV-14. Depends on EV-15. CTO (opus) analysis. D40 priority 1: CTO analysis runs after EV-15 in the same workflow. |
+| E-99 | E-86 follow-ups (opus non-blocking): scan every pushed commit with the pushed tip's .gitleaksignore (what CI does) so a self-suppressing line added and removed in one push is refused; unset GITLEAKS_CONFIG and GITLEAKS_CONFIG_TOML in the hook; refuse a .gitleaks.toml change in any push (not only eval-touching ones) without LOKI_ALLOW_GITLEAKS_CONFIG_CHANGE=1; pin the installed binary sha256 in the hook | .githooks/pre-push, tests/test-pre-push-gitleaks.sh | MEDIUM | real-push fixtures for each case, failing first | ready@2026-09-28T18:05Z | Source: E-86 round-4 review C1-C3 and the forged-sidecar boundary. |
+| E-100 | P0: main Tests red on cc4992ed (run 36465466283): tests/test-pre-push-gitleaks.sh case 20 asserted a pass without the pinned gitleaks binary, which the CI runner does not have | tests/test-pre-push-gitleaks.sh | HIGH | `HOME=<empty> bash tests/test-pre-push-gitleaks.sh` 18 passed 0 failed 22 skipped; with the binary 40 passed | merged@2026-09-28T18:42Z | Built 91a47f52; the class is guarded by E-94 (changed tests re-run with an empty HOME). |
+| E-101 | Eval results durable (D40 priority 4): run.sh and harness.py write results.jsonl to ~/loki-ci-logs/eval/<run> and a redacted copy to eval/loki10/archive/; scripts/prune-worktrees.sh never removes a worktree with a live process, a commit in the last 30 minutes, or un-archived eval results | eval/loki10/run.sh, eval/loki10/harness.py, scripts/prune-worktrees.sh, tests/test-eval-archive.sh, tests/test-prune-worktrees.sh | HIGH | fixtures: live-process and un-archived worktrees kept; a planted token never reaches the in-repo archive | building@2026-09-28T18:42Z | Source: EV-14 results lost 17:36Z. Supersedes E-96. |
 | E-58 | Issue-ref runs: supervisor creates runDir before the fetch child writes issue.json; makes E-47 green | loki-ts/src/engine10/supervisor.ts (one line before fetchIssueToFile), E-47 test files from 544348a7 | MEDIUM | cd loki-ts && bun test tests/engine10/issue_ref_e2e.test.ts (3 pass) | released@2026-09-28T02:38Z | Source: E-47 finding (TL reproduced). Merged 646a6cd7 (train E13): engine10 388 pass 0 fail, tsc exit 0, test-engine10-dist 18/0, test-engine10-docs 26 passed, test-harness 82/0. APPROVE (6384fff9); issue_ref_e2e 3 pass. Released v9.81.0 (npm view loki-mode time: 2026-09-28T02:38:54Z). |
 | E-59 | Receipt model and summary tokens match the provider: cost.ts takes model from the result-cost file; events.ts fold sums cache read and creation tokens; makes E-50 green | loki-ts/src/engine10/cost.ts, loki-ts/src/engine10/events.ts, E-50 test files from 716618d4 | HIGH | cd loki-ts && bun test tests/engine10/model_report.test.ts tests/engine10/output.test.ts | released@2026-09-28T02:38Z | Source: E-50 finding. Reconcile with E-44 (output.ts already folds cache tokens at render). Opus reviewer (cost numbers feed the gate). Opus CONCERN: writeResultCost writes no model, so real records still use the caller model; summary tokens at supervisor.ts still exclude cache. Rework dispatched. Merged 3ab2a8fa (train E14, rebased on main): engine10 404 pass 0 fail (402 pass 0 fail with claude removed from PATH), tsc exit 0, test-harness 86/0, test-local-ci-gitleaks 6/0, test-engine10-dist 18/0. Released v9.81.0 (npm view loki-mode time: 2026-09-28T02:38:54Z). |
 | EV-8 | v10 cost check on 5 tasks before the full arm (CEO 23:31Z): v10 arm, same model, after E-42 and E-45 merge | eval/loki10 results (gitignored) plus docs/v10/METRICS.md block | HIGH | eval/loki10/run.sh --arm v10 --tasks <5 ids> reports completed, time to PR and provider cost per task | released@2026-09-28T02:38Z | Target cost per completed task at or below $0.2363 (raw claude -p full arm). Depends on E-42, E-45, E-38 (--tasks). Incident 01:38Z: first run 0/5 on both variants measured the wrong code. The harness default arm binary is the global loki (loki --version: v9.78.0), and the main checkout node_modules still had agent SDK 0.3.267 (package.json pins 0.3.283), whose bundled Claude Code 2.1.267 rejects claude-opus-5-5, so every session exited "error" in about 1s with 0 tokens. Fixed in 7c3dea3d: bun install (node_modules 0.3.283), repro with the harness arm_env and arm_auth now completes on claude-opus-5-5 ($0.11, 13s); dist rebuilt. Rerun started with LOKI_EVAL_LOKI_BIN=<repo>/bin/loki. Guards E-61, E-62. Rerun measured (not a code slice): A 4/5 $0.5954, B 5/5 $0.3976, C (all sonnet, no plan, no Wall) 4/5 $0.294, raw 5/5 $0.2161 (~/loki-ci-logs/ev8r-{A,B,C}/results.jsonl). Gate not met on cost; D31 and E-64, E-65 follow. Released v9.81.0 (npm view loki-mode time: 2026-09-28T02:38:54Z). |

package/docs/v10/DECISIONS.md

@@ -305,3 +305,17 @@ One entry per decision: context, choice, why, how to reverse. Newest last.
 - Rejected: shortcut-size thresholds and deletion-only bars (they mismeasure delivered accuracy); an alternative oracle (only its regression part is kept).
 - Amends D34's EV-14 clause: EV-14 and the E-31 flip may proceed on small plus medium. The claim is limited to those tiers; medium is labelled "not shortcut audited"; no large, "any size" or 2-5x claim. The large re-check runs at 5 tasks and a loss on any axis reverts the default. Large completion is published on both the verbatim subset and the full set, and the stricter governs.
 - Cards: EV-12E (enforcement), EV-12F and EV-12G (retrofits, then new tasks to 10). Ruled by the CTO (opus) on the Chief of Staff's request.
+
+## D39. 2026-09-28: usage governor first; engineers are an output of the budget (founder directive 17:44Z)
+
+- Plan: Claude Max 20x; two limits, a 5-hour session window and a weekly limit resetting Wednesday 13:00 ET. Every agent draws on both (local, workflow, cloud); opus draws faster than sonnet; model pinning stays.
+- Budget: projected 5-hour window usage at or below 85% at window end; weekly at or below 90% by the reset. The governor sets the next hour's maximum engineers from measured burn per engineer. Cut order when tight: cloud engineers, then MEDIUM and LOW local engineers, then opus reviewers down to the HIGH minimum; never the Release Manager or a P0. Spend on release blockers, then EV-14 and the flip, then engine accuracy, then modernization.
+- On a limit ("limit reached", 429, or the org-access error of 2026-09-28): checkpoint, stop dispatching, resume after the reset; never lose finished work.
+- Pulse: BUDGET_BURN (projection over 85% window or 90% weekly) and OPUS_SHARE (opus over 30% of output tokens in the last hour). METRICS.md hourly: tokens per role and model, cost per merged slice, window and weekly projection, current max engineers, releases per hour, merged slices per hour and per million tokens.
+- Measured from ~/.claude/projects/**/*.jsonl, counted once per API response (Claude Code repeats usage on every content-block row, so a per-row sum double counts; corrected by the G-03 CTO review): last 1h output 1.87M tokens (sonnet 1.62M, opus 0.24M, opus share 13%), cache read 0.634B; last 5h output 6.01M. About 14 concurrent local agents on average in that hour (8 to 21 per 5-minute slot); local transcripts only, so a lower bound. Plan percentage per token is not yet calibrated: until a founder reading arrives, no new engineers are dispatched beyond the waves already running (baseline: about 16 agents took the window from low to 91% on 2026-09-27).
+- Scaling to 50 (cloud fan-out, remote workers) is gated on the governor and on merged slices per token rising; SCALE.md states what the Max plan sustains and what 50 would need (billing is the founder's call).
+
+## D40. 2026-09-28: fix v10 before scaling; cut cost; results are durable (founder directive 18:36Z)
+
+- Order: (1) failure analysis of the medium tier (EV-14: raw 12/14, v10 10/14): for each task raw completed and v10 did not, name the stage that lost it from the v10 event log, fix the cause, re-run those tasks, publish before and after; target v10 at or above raw on medium, then the small plus medium flip (D38). (2) Cut cost: cache reads dominate spend; subagents get short slice cards and fresh contexts; the Chief of Staff stops re-reading long files; cost per merged slice is measured before and after. (3) Headcount holds at the governor's current level; no ramp toward 50 until v10 beats raw on medium and cost per merged slice has dropped. (4) Eval result files are never lost again: durable copies outside the repo and a redacted in-repo archive before any worktree is removed, with a guard (E-101). (5) Over-budget agents are stopped and re-sliced; load stays under 28.
+- Actions 18:40Z: wave E27 stopped (over budget, load 50); its four approved slices (E-89, E-94, E-95, E-88a) are kept and three merged; the rest re-sliced from their committed branches. EV-15 (medium re-run, results under ~/loki-ci-logs/eval) and E-98 (CTO stage-by-stage analysis) and E-101 (durability guard) dispatched.

package/docs/v10/GUARDS.md

@@ -569,3 +569,188 @@ previously mismarked two merged guards (S-16, S-74) as PENDING.
   old `test-start-update-hint.sh`) reproduces the incident directly: exit 1,
   reporting both `9.99.0` lines by file:line. Run:
   `bash tests/test-no-stale-future-version.sh`.
+
+## 17. `--self-test` reached the network only in CI, not locally (E-92)
+
+- **Incident:** `scripts/dep-inventory.py --self-test` passed on the
+  engineer's machine but went red on main in CI. The fixture for
+  `actions/setup-node@v4` stubbed only the `gh_release` cache bucket; ref
+  `v4` also matches the bare-major-tag pattern in `collect_actions`, which
+  resolves it through `resolve_floating_tag()` and the `floating_tag` cache
+  bucket. With that bucket unstubbed, the resolver fell through to a real
+  `gh api` call. Locally that call succeeded (a working, authenticated `gh`
+  was on PATH), so the fixture's gap was invisible; in CI (no `gh`, no auth,
+  no network) it failed, `resolve_entry["ok"]` was `False`, and the row's
+  bump fell back to `"unknown"` instead of the expected `"MAJOR"`.
+- **Root cause with evidence:** commit `81cdba4d` ("stub the floating_tag
+  cache in --self-test for actions/setup-node@v4") states it directly: the
+  self-test "passed locally only because gh happened to be authenticated
+  there." No leg of `tests/test-dep-inventory.sh` ran the self-test with
+  `gh`/network absent, so the environment gap that separates "green
+  locally" from "green in CI" was never exercised before main did it for
+  real.
+- **The guard:** `tests/test-dep-inventory.sh` T6 runs
+  `python3 scripts/dep-inventory.py --self-test` under
+  `env -i HOME=<empty temp dir> PATH=/usr/bin:/bin`, which drops
+  `GH_TOKEN`/`GITHUB_TOKEN` and every other inherited variable and wipes
+  `gh`'s own `~/.config/gh` auth store by emptying `HOME`; it also excludes
+  `gh` from PATH wherever it is installed outside `/usr/bin:/bin` (true on
+  this machine: `/opt/homebrew/bin/gh`). Either way -- `gh` absent, or
+  present but with no credentials to present -- any cache bucket a fixture
+  forgets to stub hits a `gh api` call that fails the way it failed in CI,
+  instead of a developer's real, authenticated one. This does not block
+  outbound network access; the npm/PyPI/endoflife fetchers can still reach
+  it, so an unstubbed bucket for one of those is not caught by T6.
+- **The test that proves it fires:** reproduced the incident directly by
+  removing the `floating_tag` fixture E-92 added (the
+  `cache4.data["floating_tag"] = {...}` block for
+  `actions/setup-node@v4`, `scripts/dep-inventory.py` lines 1281-1286) and
+  running `bash tests/test-dep-inventory.sh`: T1 (the script's own
+  self-test, run with the developer's normal, authenticated `gh`) still
+  showed `[PASS] dep-inventory.py --self-test passed` -- proving the
+  existing leg is blind to this class -- while T6 showed `[FAIL]
+  self-test failed unauthenticated/gh-less`; overall `Results: 5 passed, 1
+  failed`, exit 1. The fixture was then restored from a backup
+  (`git diff --quiet scripts/dep-inventory.py` exit 0, confirming an exact
+  restore) and a clean rerun showed `Results: 6 passed, 0 failed`, exit 0.
+  Run: `bash tests/test-dep-inventory.sh`.
+
+## 17. Hardcoded fixture ports raced concurrent runs of the same test (E-95)
+
+- **Incident:** commit `8f2179cd`, Tests run `36453069628`,
+  `tests/test-app-runner-watchdog-health.sh` failed with "healthy fixture
+  server never came up (cannot validate no-restart case)" and passed on an
+  unmodified rerun of the same SHA.
+- **Root cause with evidence:** the fixture hardcoded three TCP ports
+  (`CLOSED_PORT=59731`, `HEALTHY_PORT=59732`, `API_PORT=59733`) and polled
+  readiness for only ~3s (15 iterations of `sleep 0.2`). Any other process
+  bound to the same port at that moment -- another worktree running this
+  exact fixture concurrently (this swarm runs 12+ engineers in parallel
+  worktrees on one machine), or a leftover process from a prior killed
+  run -- makes the `python3 -m http.server "$HEALTHY_PORT"` bind fail (or,
+  on kernels where `SO_REUSEADDR` lets a second bind coexist with an active
+  listener, makes it non-deterministic which socket answers), so the fixed
+  3s readiness window times out with no HTTP server ever answering; a
+  rerun once the colliding process is gone passes with no code change.
+  Verified locally (Darwin): holding port 59732 with an `SO_REUSEADDR`
+  listener during a run did NOT reproduce a bind failure here -- macOS/BSD
+  `SO_REUSEADDR` allows a second bind to coexist with an active listener,
+  which Linux (the actual CI runner) does not; the hardcoded-port class is
+  confirmed by code inspection and by the incident report, not by a local
+  bind-conflict repro, which is honestly reported as platform-dependent
+  here.
+- **The guard:** `tests/test-app-runner-watchdog-health.sh` (this slice)
+  adds a `pick_free_port()` helper (binds `("127.0.0.1", 0)`, reads back the
+  OS-assigned port, closes the socket) and uses it for `CLOSED_PORT`,
+  `HEALTHY_PORT` and `API_PORT` instead of any fixed literal, so the fixture
+  can never collide with another instance of itself or a stale leftover
+  regardless of kernel `SO_REUSEADDR` semantics. Readiness polling was also
+  widened from ~3s to 10s (50 iterations), and both server fixtures now log
+  to a file (`healthy_server.log`, `api404_server.log`) whose tail is
+  included in the failure message alongside the actual port, so a genuine
+  future timeout is diagnosable instead of a bare "never came up".
+- **The test that proves it fires:** `tests/test-app-runner-watchdog-health.sh`
+  is itself the guard (fixed-port fixtures were the bug, not a separate
+  probe of them). Run 20 times back to back while 4 parallel copies of
+  `tests/test-v10-pulse.sh` provided CPU load: 20/20 passed
+  (`bash tests/test-app-runner-watchdog-health.sh`, run in a loop; all 4
+  concurrent `test-v10-pulse.sh` copies completed clean, exit 0, over the
+  same window). `bash -n` and `shellcheck` both clean on the file.
+
+## 17. A local pass depended on `gh` being authenticated on the dev Mac (E-94)
+
+- **Incident:** `tests/test-dep-inventory.sh` passed locally and failed on
+  the CI runner. Root-caused to `scripts/dep-inventory.py`'s `self_test()`:
+  one resolver path (the `actions/setup-node@v4` floating-tag lookup) had no
+  fixture in its stub cache, so a cache miss fell through to a real `gh api`
+  call. That call succeeds silently wherever `gh` happens to be authenticated
+  (this Mac) and fails wherever it is not (the CI runner, which has neither
+  `gh` nor `GH_TOKEN`/`GITHUB_TOKEN`) -- so local-ci reported green on a test
+  that was never actually hermetic, and CI became the discovery channel
+  instead of push time.
+- **Root cause with evidence:** replaying the pre-fix file directly (`git
+  show 4f7f1487^1:scripts/dep-inventory.py` extracted to a temp path, then
+  `python3 <that path> --self-test`) passes on this machine (23/23 `[PASS]`
+  lines, real `gh api` reachable) and fails under a stripped environment
+  (`env -i HOME=<fresh dir> PATH=/usr/bin:/bin:<bun+python3 only>`) with
+  exactly one failure: `[FAIL]
+  actions: Bump is measured against the release lookup` -- the same
+  resolver path, the same missing fixture, now unable to reach `gh`. E-92
+  (`4f7f1487`) fixed this specific instance by adding the missing
+  `floating_tag` cache fixture; nothing stopped the next uncached fallthrough
+  in the next test file from shipping the same way.
+- **The guard:** `scripts/local-ci.sh`'s `_lci_hermetic_scan` (fast-tier
+  step `"hermetic changed-tests (no gh/network, E-94)"`, on `_FAST_KEEP`,
+  called from the SERIAL spine AFTER section 7's `bun install` -- not right
+  after `harvest_lanes`: a fresh worktree has no `loki-ts/node_modules`
+  until section 7 installs it, so a changed `loki-ts/tests/*.test.ts` file's
+  normal `bun test` would fail for a missing-toolchain reason and the scan
+  would silently never actually check it. Like section 3's pytest gates, it
+  runs a NORMAL pass against real `HOME`/repo state, which is exactly the
+  class of check #588 pins off the concurrent background lanes). For every
+  real test file this branch changed vs `origin/main` (merge-base diff,
+  basename-anchored to `test[-_]*.sh`/`test[-_]*.py` under `tests/` or
+  `*.test.ts` under `loki-ts/tests/` -- NOT a bare extension match, so
+  `tests/run-all-tests.sh` and a `loki-ts/tests/**/fixtures/*.ts` data file
+  are never swept in as if they were runnable suites), it runs the file once
+  normally and once under `env -i` with a fresh `HOME`, and `PATH` set to a
+  private directory (listed FIRST, not last) holding ONLY symlinks to a
+  short, curated list of the real, ambient interpreter/runtime binaries a
+  test legitimately needs (`bash`, `bun`, `python3`, `node`, `timeout`) --
+  never `gh`, then `/usr/bin:/bin`. Measured, not assumed, on each point: a
+  bare-last-position PATH let `/usr/bin`'s own Xcode-stub `python3` shadow
+  the real one for any bare `python3` call (including a test's OWN internal
+  one, like `test-dep-inventory.sh`'s `python3 "$SCRIPT" --self-test`);
+  macOS's `/bin/bash` is 3.2 with no `mapfile`/`declare -A`, false-failing
+  any test written against a modern bash; `node` and `timeout` are not on
+  `/usr/bin` on this class of machine either, and real in-scope tests call
+  both directly; and a fresh `HOME` alone breaks any package installed under
+  `~/Library/Python/.../site-packages` (fastapi among them), so
+  `PYTHONUSERBASE` is preserved from the real machine to keep those
+  importable without reintroducing a credential -- all four false-positive
+  classes have nothing to do with credentials and would otherwise have
+  blocked a legitimate push. `env -i` alone already drops every inherited
+  variable, so `GH_TOKEN`/`GITHUB_TOKEN` need no separate unset;
+  `GIT_CONFIG_NOSYSTEM=1` additionally blocks the macOS system gitconfig's
+  `credential.helper=osxkeychain` (a fixed path, unrelated to `HOME`, that a
+  fresh `HOME` alone does not neutralize -- the identical leak class as
+  `gh`, just through `/usr/bin/git`). A file that passes normally but fails
+  stripped is reported by name; a file already failing (or timing out)
+  normally is counted separately and never claimed as hermetic-clean.
+  Skipped (not silently passed) when the branch changed no in-scope file, or
+  when no `timeout`
+  binary is on PATH (fail-closed, matching the gitleaks/shellcheck posture).
+  Fails closed the other way too: this is a keep-list member, so it cannot
+  be silently deferred out of the fast (pre-push) tier.
+- **The test that proves it fires:** `tests/test-local-ci-hermetic.sh`
+  (registered in `tests/run-all-tests.sh` and `tests/shard-durations.tsv`,
+  18 cases: 12 static + 6 live). Static assertions confirm the scope, the
+  stripped-env shape (bindir-first PATH, `PYTHONUSERBASE`,
+  `GIT_CONFIG_NOSYSTEM`, the curated `bash`/`bun`/`python3`/`node`/`timeout`
+  symlink list), the serial (not background-lane) call site, the keep-list
+  membership, and both skip paths. The live half awk-extracts the REAL
+  `_lci_hermetic_scan` function body out of `scripts/local-ci.sh` (never a
+  mirrored reimplementation) and runs it against disposable fixture repos: a
+  new test that calls `gh` directly passes normally and fails stripped, so
+  the scan fails and names it (gated on `gh` actually being reachable
+  normally and actually unreachable under a bare `/usr/bin:/bin`, not
+  assumed); a hermetic-clean new test, a `mapfile`/`declare -A` (bash4+-only)
+  test, and a test shelling out to `node`/`timeout` directly all pass both
+  runs; the actual pre-E-92 `scripts/dep-inventory.py` (`git show
+  4f7f1487^1:scripts/dep-inventory.py`), replayed through a copy of the real
+  test wrapper, is caught (gated on the old self-test actually passing
+  normally first); and the REAL, current (post-E-92) `dep-inventory.py` and
+  `test-dep-inventory.sh` from this repo, replayed verbatim, pass both runs
+  -- the must-not-regress case, since a scan that cannot survive the exact
+  file it was written to guard would block every future push that touches
+  it. Verified red-then-green by hand: pointed at `origin/main`'s
+  `scripts/local-ci.sh` (no `_lci_hermetic_scan` at all) the suite goes 0
+  passed / 12 failed; restored, it is 18/18 (16/16 before the node/timeout
+  scenario was added). A mutation that widens the stripped `PATH` back to
+  the ambient one (`PATH="$PATH:$spath"`) flips exactly the gh-calling
+  scenario to FAIL while every other case stays green, confirming the live
+  half is not vacuous. Dogfooded on this branch's own commit adding this
+  file: the real (non-test-harness) `_lci_hermetic_scan`, sourced and called
+  directly against this worktree, found the one real in-scope change and
+  returned `hermetic-clean` in 5.6s, well inside the 60s budget. Run:
+  `bash tests/test-local-ci-hermetic.sh`.

package/docs/v10/METRICS.md

@@ -260,3 +260,75 @@ All arms on claude-opus-5-5, 29 small tasks with hidden tests, fresh clone per r
 - Lean configuration misses: aiq-52-searchbar, pub-humanize-174. It matches raw on completion and time and is 32% cheaper; it does not meet the 2x targets and is not the default until E-64 lands and is re-measured.
 - Lean-session evidence, 5 tasks (EV-8 D/E, not the full arm): opus lean 4/5 at $0.1571 per completed, p50 28s; sonnet lean 4/5 at $0.1519, p50 27.5s; raw opus on the same 5: 5/5, $0.2161, p50 41s (~/loki-ci-logs/ev8r-{D,E}/results.jsonl). The lean small path is not the default yet (E-64 in rework).
 - Medium and large tiers: not built (EV-11 3 of 15 verified, EV-12 in rework). No "2-5x" claim.
+
+## Loki 10 gate report, medium tier (upstream tests, deletion-mutant audited, not shortcut audited) (2026-09-28, D38; EV-14)
+
+Evidence note (Chief of Staff, 18:00Z): the per-run result files (eval/loki10/results/ev14-medium-{raw,v10}-r{1,2}/results.jsonl, gitignored) were lost when the EV-14 worktree was force-removed in the 17:36Z pruning incident (PROGRESS.md, E-96). The table below is the run agent's report from those files before removal (commit 0afef9e4); it cannot be re-audited. EV-15 re-runs the tier with results kept outside any worktree.
+
+D38 permits the flip decision on small plus medium; medium is explicitly "not
+shortcut audited" (no requirements map, no independent shortcut-attempt
+review, unlike the large tier's D38 criteria). All 7 medium tasks (`pub-*`
+with `"tier": "medium"`) carry upstream-verbatim hidden tests with at least
+one deletion-mutant check recorded in their `NOTES.md` (see
+`eval/loki10/tasks/pub-attrs-1313/NOTES.md` for one worked example). Both
+arms on claude-opus-5-5 (same model as the small-tier gate), harness
+8f2179cdea1544f855eca0ec4c8a18b525cad152 (origin/main, not dirty), fresh
+clone per run, provider-sourced cost only, 2 runs per arm, `--parallel 3`,
+900s cap per task. `loki-ts/node_modules` reinstalled from `bun.lock`
+(`bun install --frozen-lockfile`) before the v10 runs per E-62.
+
+| arm | completed | rate | cost per completed | p50 / p90 time to PR | arm_unavailable | invalid |
+|---|---|---|---|---|---|---|
+| raw `claude -p` | 12/14 | 85.7% | $0.5119 | 70s / 239s | 0 | 0 |
+| v10 (default knobs, main 8f2179cd) | 10/14 | 71.4% | $0.5395 | 83s / 100s | 0 | 0 |
+
+Per-run breakdown (`eval/loki10/summarize <file> --markdown`, all under
+`eval/loki10/results/`, the harness's normal `--out` location; none of these
+are committed, see below):
+
+| run | file | completed | cost per completed | p50 / p90 |
+|---|---|---|---|---|
+| raw r1 | `eval/loki10/results/ev14-medium-raw-r1/results.jsonl` | 5/7 | $0.6194 | 102s / 149s |
+| raw r2 | `eval/loki10/results/ev14-medium-raw-r2/results.jsonl` | 7/7 | $0.4352 | 69s / 256s |
+| v10 r1 | `eval/loki10/results/ev14-medium-v10-r1/results.jsonl` | 5/7 | $0.5702 | 83s / 121s |
+| v10 r2 | `eval/loki10/results/ev14-medium-v10-r2/results.jsonl` | 5/7 | $0.5088 | 98s / 100s |
+
+The pooled row is not something `summarize` can produce directly: it dedupes
+to the newest row per `(task, arm)`, which would silently drop one of the two
+runs per task. The pooled numbers were computed by hand over the 14
+concatenated rows per arm (both runs, un-deduped), reimplementing
+`summarize`'s own rules: completion rate over evaluated runs; cost per
+completed = total `cost_usd` of every evaluated run in the pool divided by
+the number completed (this is "evaluated", not "completed only" -- confirmed
+by reproducing raw r1's own $0.6194 figure by hand); p50/p90 by nearest-rank
+over completed runs' `time_to_pr_s`. The pooling script reproduced all four
+single-run files' own `summarize --markdown` numbers exactly (completed
+count, cost per completed, p50 and p90) before its pooled output was
+trusted. All 28 task-runs (7 tasks x 2 arms x 2 runs) came back
+`status: ok`; none were `arm_unavailable`, `auth_unavailable`,
+`harness_error` or `task_invalid`.
+
+Misses: raw-claude missed `pub-faker-1817` and `pub-werkzeug-3271` (both
+hidden-test failures, r1 only; r2 was 7/7). v10 missed `pub-werkzeug-3105`
+and `pub-werkzeug-3271` in both runs (hidden-test failures both times).
+
+Verdict per axis, v10 vs raw on this tier:
+- Completions: v10 is WORSE (71.4% vs 85.7%; 10/14 vs 12/14).
+- Cost per completed task: v10 is WORSE (higher; $0.5395 vs $0.5119, about
+  5.4% more expensive).
+- p50 time to PR: v10 is WORSE (slower; 83s vs 70s, about 19% slower). v10's
+  p90 (100s) beats raw's p90 (239s, `pub-werkzeug-3271`); raw's single
+  slowest run was `pub-werkzeug-3105` r2 at 256s, rank 12 of 12, past the p90
+  cutoff so it does not set the p90 value. Neither changes the p50 verdict.
+
+v10 is not at or better than raw on any of the three axes on this tier. This
+does not by itself change the small-tier default decision (D30: default
+stays legacy, v10 opt-in); it is additional evidence for whoever rules on the
+flip under D38's small-plus-medium scope.
+
+No result file was committed: `eval/loki10/.gitignore` ignores the whole
+`results/` directory (the README also warns to treat `--out` as sensitive,
+since `arm_stdout.log` can hold env), so there are no harness result files
+tracked in git to commit, matching every earlier EV entry in this file. Only
+this METRICS.md section is committed. The raw result files above remain on
+disk in this worktree at `eval/loki10/results/ev14-medium-{raw,v10}-r{1,2}/`.

package/docs/v10/PROGRESS.md

@@ -1,5 +1,21 @@
 # Progress
 
+## 2026-09-28T18:25Z: 14:00 slot shipped; governor numbers corrected
+- 14:00 slot: v10.2.5 cut 18:06:00Z (b72c4f7e) after Tests went green on 1f955851 at 18:05:17Z; publish-npm 18:14:09Z; npm gitHead b72c4f7e; GitHub body backfilled (5 lines).
+- Burn accounting settled (three tries): rows sharing a message id are streaming snapshots (output_tokens grows, e.g. 5, 5, 467; cache fields repeat), so the right count is the maximum per message id. Last hour 1.79M output (sonnet 84%, opus 15%), 0.726B cache read; last 5h 6.43M output. G-01 now uses max-per-message (real run: 6.53M output in 5h, 37 active agents, 45.9K output per engineer-hour) and ships usage-statusline-logger.sh: Claude Code gives a statusLine command rate_limits.five_hour and seven_day used_percentage, which is the source of truth once wired. Still uncalibrated: no plan reading yet.
+- Merged locally for the next train: E-86 (pre-push gitleaks, opus APPROVE round 4), M-11, E-67 (core 4,976 after deleting escalate.ts), M-07 (fits at 4,977 once E-67 landed). Full-suite failures seen at load 48 were timeouts that pass alone.
+
+## 2026-09-28T18:00Z: EV-14 says no flip; v10.2.4 out; governor first
+- EV-14 medium tier (7 tasks, 2 runs per arm, claude-opus-5-5, harness at 8f2179cd): raw 12/14 completed (85.7%), $0.5119 per completed, p50 70s; v10 10/14 (71.4%), $0.5395, p50 83s. v10 is worse on completions, cost and p50; the default stays legacy (D38). Per-run result files were lost in the 17:36Z worktree incident (numbers survive in METRICS.md from commit 0afef9e4); EV-15 re-runs with results kept outside worktrees and E-98 diagnoses the v10 losses.
+- EV-12 large retrofits (EV-12F-a, EV-12F-b, EV-12G): opus REJECT on every task; deprioritized behind EV-15 and E-98, since the flip is blocked by the medium result regardless of the large tier.
+- v10.2.4 (13:40 slot): cut 17:42:40Z (22730334), publish-npm done 17:51:04Z (Release run 36460058157).
+- Founder 17:44Z (D39): usage governor first. Burn counted once per API response: last hour 1.87M output (sonnet 1.62M, opus 0.24M, opus share 13%), 0.634B cache read. G-01 governor building; G-03 SCALE.md merged (Max 20x sustains about 5 to 16 engineers around the clock, ESTIMATE, uncalibrated; 50 engineers at API list price about $11.5K to $14.5K per day, ESTIMATE). New dispatch frozen until calibrated; waiting on a founder plan-percentage reading.
+
+## 2026-09-28T17:40Z: release slots measured; staffing; worktree incident
+- Slot log (cut = release commit pushed; publish = npm time). v10.2.3 detail: cut 17:27:02Z, publish-npm job done 17:34:47Z, npm time 17:40:56Z (`npm view loki-mode time`), GitHub body backfilled from CHANGELOG (placeholder until E-88a lands). 13:00 local slot: skipped, main red (8f2179cd Tests failure, rerun success at 17:05Z). v10.2.2: cut 17:07Z (9a59750d), npm 17:16Z. 13:20 slot: cut late at 17:27:02Z as v10.2.3 (d366d9de) after Tests went green on 4f6b441d at 17:26Z; publish-npm success by 17:35Z. Next train pushed 17:35:35Z (1f04c040, EV-12S) for the 13:40 slot.
+- Staffing: founder 17:22Z (keep 12 or more building). The BOARD showed 5 because rows were not flipped when waves were dispatched; now 19 rows building. E-88 (70 min) and E-89/E-90 (58 min) stopped and re-sliced; the salvaged E-89 and E-90 commits are reviewed as their own slices. RELEASE_CADENCE and UNDERSTAFFED are in E-89 (wave E27). Guards for today's red mains: E-94 (changed tests re-run without credentials, pre-merge) and E-95 (watchdog fixture readiness).
+- Incident 17:36Z: pruning worktrees with `find -newermt "-25 minutes"` (unsupported on BSD find, matched nothing) force-removed 7 live builder worktrees (M-07 r4, M-11 r3, EV-14, EV-12F-a, EV-12G, E-95, E-87). Every branch had its work committed (`git log origin/main..<branch>` shows 1 to 9 commits, the latest 3 to 48 minutes old); edits after the last commit were lost. Guard E-96 (safe prune script); memory recorded.
+
 ## 2026-09-28T17:10Z: v10.2.2 cut (npm gitHead 9a59750d); two red mains handled (E-92 at 4f7f1487, flake rerun 36453069628 success); D38; drift audit (turn 486)
 - Main red at df7dc134 to 793870f3 (Tests run 36451439320): the DEP-01 self-test reached the real gh floating-tag resolver and read bump unknown on the CI runner. P0 fix E-92 (81cdba4d, TL APPROVE; stripped-env self-test rc=0 vs rc=1 on the old code), merged 4f7f1487. Guard E-93 (stripped-env leg) building.
 - 8f2179cd then failed once on "App Runner Watchdog Health" (healthy fixture server never came up); `gh run rerun 36453069628 --failed` concluded success on the same SHA, so it was a flake, not a code change.