loki-mode 10.3.1 → 10.5.0

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: Autonomous spec-driven build system with a built-in trust layer. It does not call work done until it is verified (RARV-C closure loop, 8 quality gates, completion council, verified-completion evidence gate). Triggers on "Loki Mode". Takes a spec (PRD, GitHub issue, OpenAPI doc, etc.) to deployed product with minimal human intervention. Provider-agnostic. Requires --dangerously-skip-permissions flag.
 ---
 
-# Loki Mode v10.3.1
+# Loki Mode v10.5.0
 
 **You are an autonomous agent. You make decisions. You do not ask questions. You do not stop.**
 
@@ -470,4 +470,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v10.3.1 | [Autonomi](https://www.autonomi.dev/) flagship product | ~410 lines core**
+**v10.5.0 | [Autonomi](https://www.autonomi.dev/) flagship product | ~410 lines core**

package/VERSION

@@ -1 +1 @@
-10.3.1
+10.5.0

package/bin/loki

@@ -243,6 +243,34 @@ if [ "${LOKI_LEGACY_BASH:-0}" = "1" ] || [ "${LOKI_LEGACY_BASH:-}" = "true" ]; t
     exec "$BASH_CLI" "$@"
 fi
 
+# M-08 (docs/v10/MODERNIZE.md section 2): the NEW `loki modernize <repo> --to
+# <target>` form always reaches the Loki 10 (Bun) modernize CLI, regardless of
+# LOKI_ENGINE or the default engine flip. Ahead of the v10 block below so
+# tonight's legacy default never blocks it; $1 is already "modernize" so "$@"
+# reproduces it as the router's own first argument without a shift.
+#
+# `loki modernize` is ALSO an existing legacy noun (autonomy/loki cmd_modernize,
+# `heal`/`migrate` subcommands, documented in README.md and
+# wiki/CLI-Reference.md): a plain catch-all here broke `loki heal`/`loki
+# migrate` forwarding parity and `modernize bogus`'s error-channel contract
+# (tests/cli/test-alias-forwarding.sh). --to is the one flag every valid
+# engine10 invocation requires (modernize/cli.ts: "missing --to" otherwise), so
+# it is the routing signal: only args containing --to go to engine10; bare
+# `modernize`, `--help`/`-h`/`help`, `heal`, `migrate`, and any other token
+# fall through unchanged to the existing dispatch below, which already sends
+# them to the legacy CLI today. (`--help`'s own content -- whether it should
+# also mention heal/migrate -- is modernize/cli.ts's USAGE text, outside this
+# arm's file set; left unchanged.)
+if [ "${1:-}" = "modernize" ]; then
+    for _loki_mod_a in "$@"; do
+        if [ "$_loki_mod_a" = "--to" ]; then
+            command -v bun >/dev/null 2>&1 || { echo "Error: loki modernize needs bun." >&2; exit 1; }
+            exec bun "$BUN_CLI" engine10 "$@"
+        fi
+    done
+    unset _loki_mod_a
+fi
+
 # Loki 10 engine (D29): additive; skipped entirely unless LOKI_ENGINE=v10.
 if [ "${LOKI_ENGINE:-}" = "v10" ]; then
     _e10=0

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "10.3.1"
+__version__ = "10.5.0"
 
 # Expose the control app for easy import
 try:

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 The flagship product of [Autonomi](https://www.autonomi.dev/). Loki Mode is a spec-driven autonomous builder with a built-in trust layer that takes any spec to a deployed product and verifies completion with evidence (quality gates plus a completion council), not just a "done" claim. Complete installation instructions for all platforms and use cases.
 
-**Version:** v10.3.1
+**Version:** v10.5.0
 
 ---
 

package/docs/dev/release-checklist.md

@@ -58,6 +58,30 @@ wiki/Home.md, wiki/_Sidebar.md, wiki/API-Reference.md
 README.md, docker-compose.yml            # Docker image tags (MAJOR/MINOR bumps)
 ```
 
+The CHANGELOG.md entry must be a full section, not a one-line placeholder
+(E-88): a summary line, one or more `### ` subsections (Added, Fixed, etc.)
+with a `- ` bullet for every user-visible change, and, if this version
+republishes a version that never reached npm, that version's own section
+carried forward too. `scripts/release-notes.sh <version>` extracts and
+validates this section the same way release.yml does; `.githooks/pre-push`
+runs it on any push whose remote ref is `refs/heads/main` and whose VERSION
+actually changes there, and release.yml refuses to publish the release if
+the section is missing, empty, or not fully written. release.yml runs this
+extraction BEFORE tagging (D36), so a notes failure never burns a version
+number.
+
+Carrying another version's notes forward (E-88a) is explicit only:
+`--include v1,v2,...` names the versions to append, each under its own
+"## vX.Y.Z changes (first published in vNEW)" heading; release.yml itself
+passes no `--include`, so a version that never reached npm gets its
+section written directly into the new CHANGELOG entry by hand (as done for
+10.0.1 and 10.2.1). An earlier revision auto-detected candidates from the
+section's own prose and an npm-published check; two rounds of review found
+it could still pull in a HIGHER, already-published version named only for
+context (the v9.22.13 bug: its body says "v9.24.0 is the next version on
+npm") or over-carry on a stale npm read, so auto-detect was removed
+entirely rather than patched again.
+
 ### 2. Build Dashboard Frontend
 
 ```bash

package/docs/v10/BOARD.md

@@ -359,7 +359,7 @@ set is declared to avoid overlap with those and with each other.
 | M-05 | SCC clustering, 1,500-line unit cap, topological waves | loki-ts/src/engine10/modernize/cluster.ts, loki-ts/tests/engine10/modernize/cluster.test.ts | MEDIUM | cd loki-ts && bun test tests/engine10/modernize/cluster.test.ts | released@2026-09-28T05:00Z | Source: MODERNIZE.md (D30). Depends on M-02. Built on branch worktree-wf_4601e7b3-4d8-4 (777f6cdd M-01, 212a7404 M-02, 6b00c05c M-05, 3d8edb5d M-06). TL CONCERN: cluster.ts tarjanSCC recursion overflows the stack on dependency chains of about 20-50k nodes (the M-28/M-29 scale); needs an iterative SCC. Wave E18 rework: iterative Tarjan, branch slice-M-05-iterative-scc. TL APPROVE (sonnet): iterative Tarjan 372ebe11, red on recursive (RangeError), 2000/2000 fuzz identical; merged f4d98c0b, `bun test tests/engine10/modernize/` 28 pass 0 fail. Released in v10.1.0 (npm publish 2026-09-28T05:00Z; every cited commit is an ancestor of the v10.1.0 tag; `git merge-base --is-ancestor`). |
 | M-06 | Up-front estimate (cost, time, risk), --budget math, --dry-run print | loki-ts/src/engine10/modernize/estimate.ts, loki-ts/tests/engine10/modernize/estimate.test.ts | LOW | cd loki-ts && bun test tests/engine10/modernize/estimate.test.ts | released@2026-09-28T05:00Z | Source: MODERNIZE.md (D30). Depends on M-05. Built on branch worktree-wf_4601e7b3-4d8-4 (777f6cdd M-01, 212a7404 M-02, 6b00c05c M-05, 3d8edb5d M-06). TL CONCERN: cluster.ts tarjanSCC recursion overflows the stack on dependency chains of about 20-50k nodes (the M-28/M-29 scale); needs an iterative SCC. Wave E18 with M-05, branch slice-M-05-iterative-scc. Merged f4d98c0b with M-05. Released in v10.1.0 (npm publish 2026-09-28T05:00Z; every cited commit is an ancestor of the v10.1.0 tag; `git merge-base --is-ancestor`). |
 | M-07 | modernize CLI and flag parsing; TABLE route in engine10 cli | loki-ts/src/engine10/modernize/cli.ts, loki-ts/src/engine10/cli.ts (TABLE and USAGE line only), loki-ts/tests/engine10/modernize/cli.test.ts | MEDIUM | cd loki-ts && bun test tests/engine10/modernize/cli.test.ts | merged@2026-09-28T18:25Z | Source: MODERNIZE.md (D30). Depends on M-06, E-31 merged or parked. Wave E21 (wf_39ab3f7d-8f3). TL APPROVE of 13848b53, but merged after E-66/E-61/M-24 core reads exactly 5,000 (cap is under 5,000). Next: net core delta at most -1 (offset in cli.ts or dead core code), then merge. r2 TL REJECT (reproduced): modernize/cli.ts TABLE-routed but not in registry.ts (registry.test.ts red when merged); report claimed 40/0 but 39/1; --help lost its modernize line. Next: register it, keep the USAGE line, offset core elsewhere. Wave E26 (wf_9ba5fcaf-75a). Round 4. r4 3c73b6cb honest (unsquashed) version; its only blocking finding (core 5,000) no longer reproduces after E-67 removed escalate.ts: merged 02c30314, core 4,977, budget/registry/cli tests 41 pass 0 fail, `bun test tests/engine10/` 654 pass (1 load-timeout, 35/0 alone), dist 18 passed. |
-| M-08 | bin/loki modernize arm to engine10 regardless of default | bin/loki (modernize arm only), tests/test-modernize-dispatch.sh | MEDIUM | bash tests/test-modernize-dispatch.sh | building@2026-09-28T18:58Z | Source: MODERNIZE.md (D30). Depends on M-07. Dispatched 18:58Z, sonnet engineer. |
+| M-08 | bin/loki modernize arm to engine10 regardless of default | bin/loki (modernize arm only), tests/test-modernize-dispatch.sh | MEDIUM | bash tests/test-modernize-dispatch.sh | merged@2026-09-28T19:13Z | Source: MODERNIZE.md (D30). Depends on M-07. Dispatched 18:58Z, sonnet engineer. Tech Lead REJECT r1 (engine10-dispatch count) and r2 (shadowed legacy modernize heal/migrate: alias-forwarding 204/9); APPROVE r3 766a493b (engine10 only when --to present). Merged; modernize-dispatch 18/0, engine10-dispatch 35/0, alias-forwarding 213/0 (main baseline), shard coverage 19/0, drift 6/0. |
 | M-09 | py2/3 capture tracer with type-tagged JSON and branch coverage | autonomy/lib/modernize/py_capture.py, tests/test-modernize-py-capture.sh, tests/fixtures/modernize/py2/ | HIGH | bash tests/test-modernize-py-capture.sh | released@2026-09-28T14:26Z | Source: MODERNIZE.md (D30). Depends on M-01. Built a4fbf034 (branch worktree-wf_4601e7b3-4d8-5). Opus REJECT (reproduced): unsupported types (sets, Decimal, datetime, bytearray, custom classes) record as equal with no not_proven entry, so the oracle could certify unproven equivalence. Next: rework. Wave E18 rework: unsupported types yield not_proven, branch slice-M-09-not-proven-types. Opus REJECT of 3594eee5: subclasses of supported types (namedtuple, IntEnum, OrderedDict) tag as the base type with no not_proven. Rework wave E19. Rework 085bc2e0 Opus APPROVE; merged b8d40a34; `bash tests/test-modernize-py-capture.sh` Passed 50 Failed 0 Skipped 1 (no python2). Released in v10.1.1 (npm publish 2026-09-28T14:26Z; every cited commit is an ancestor of the v10.1.1 tag; `git merge-base --is-ancestor`). |
 | M-10 | Coverage-guided input search (read-only session, plateau stop) | loki-ts/src/engine10/modernize/oracle/search.ts, loki-ts/tests/engine10/modernize/search.test.ts | HIGH | cd loki-ts && bun test tests/engine10/modernize/search.test.ts | merged@2026-09-28T17:20Z | Source: MODERNIZE.md (D30). Depends on M-09. Opus REJECT (reproduced): a failed seed capture is reported as a plateau. Next: rework. r2 d7db4fb1 Opus APPROVE; merged dc827b80 (on top of v10.2.2): full `cd loki-ts && bun test` 2277 pass 0 fail, `bash tests/test-engine10-dist.sh` 18 passed, `bash tests/test-v10-pulse.sh` 117 passed. |
 | M-11 | Java capture: JUnit under JDK 8 with JaCoCo plus Randoop | autonomy/lib/modernize/java_capture.sh, loki-ts/src/engine10/modernize/oracle/java.ts, loki-ts/tests/engine10/modernize/java_capture.test.ts | HIGH | cd loki-ts && bun test tests/engine10/modernize/java_capture.test.ts | merged@2026-09-28T18:25Z | Source: MODERNIZE.md (D30). Depends on M-04. Opus REJECT (reproduced): multi-line java -version breaks status.json (json_escape skips newlines). Next: rework. Wave E26 (wf_9ba5fcaf-75a). Round 3. r3 e476435b opus APPROVE (every C0 byte escaped as \u00XX; malformed status.json reported as its own reason); merged locally. |
@@ -411,13 +411,13 @@ set is declared to avoid overlap with those and with each other.
 | E-85 | Security Audit: a narrowly scoped gitleaks allow rule for 40-hex commit pins in eval task.json (repo.ref, merge_sha) so pinned upstream SHAs stop tripping sourcegraph-access-token; CTO approval required (posture: no blanket suppressions) | .gitleaks.toml (or the workflow config), .github/workflows/security-audit.yml | HIGH | a fixture task.json with a 40-hex ref passes; the same string in any other file or key still fails | ready@2026-09-28T18:42Z | Source: v10.2.0 Release 36440534050 blocked by a pinned werkzeug SHA; EV-11b and EV-12A/B/C add more pins. Wave E27 (wf_bcacb1d1-e76). CTO-level opus review. Wave E27 stopped 18:37Z (founder: over budget, load 50). Build 1 commit on slice-E-85-gitleaks-pins, never reviewed. |
 | DEP-01 | Dependency inventory (D35): docs/v10/DEPS.md lists every manifest (all package.json incl. @anthropic-ai/sdk and claude-agent-sdk; every requirements*.txt and pyproject.toml; every uses: in .github/workflows and .github/actions; Node, Python, Bun matrices; Docker bases, Helm images, Terraform providers, Homebrew formula) with current and latest stable, patch/minor/MAJOR, and runtime EOL; no upgrades | docs/v10/DEPS.md, scripts/dep-inventory.py | LOW | python3 scripts/dep-inventory.py regenerates DEPS.md byte-identically on a second run (network results cached); every manifest found by `git ls-files` appears | released@2026-09-28T17:16Z | Source: founder directive 15:20Z (D35). DEP workstream: max 3 builders, never ahead of E/EV/M. Round 3 2794574b TL APPROVE (sonnet) after two REJECT rounds (bump column mismatch, Node 20 claim, 0.x class, Helm drift; then a missing helm/loki-mode chart and unverified floating tags); `bash tests/test-dep-inventory.sh` 5/5, `--self-test` 23/23. Released in v10.2.2 (npm gitHead 9a59750d). |
 | E-87 | Release dispatch path: required-ci also accepts a completed workflow_dispatch Security Audit run at the exact SHA (Tests and Bun Parity stay push-only), so a tree whose VERSION is already bumped can publish after an audit fix | .github/workflows/release.yml (required-ci only), a test that runs the extracted step against a fixture run list | HIGH | fixture: dispatched audit success at the SHA counts; a dispatched audit at another SHA does not; Tests via dispatch still does not | ready@2026-09-28T18:42Z | Source: v10.2.0 Release 36443541666 waited on an audit it could never count. CTO approval required (release gate). Wave E27 (wf_bcacb1d1-e76). CTO-level opus review. Wave E27 stopped 18:37Z (founder: over budget, load 50). REJECT (reproduced): tests pass with the completed-and-success condition removed from the dispatched-audit check. Branch kept. |
-| E-88 | Release notes fully written (D36): scripts/release-notes.sh extracts the CHANGELOG section literally (dated headings), fails on a missing, empty, heading-only or placeholder section; release.yml fails instead of falling back and checks the published body; pre-push refuses a VERSION bump without a full section | scripts/release-notes.sh, .github/workflows/release.yml (extract step), .githooks/pre-push, docs/dev/release-checklist.md, tests/test-release-notes.sh | HIGH | bash tests/test-release-notes.sh; failing first against the old awk pattern | ready@2026-09-28T18:42Z | Source: founder directive 16:05Z; six releases published with "Release vX.Y.Z" bodies (backfilled). Founder 17:22Z: stopped at 70 min and re-sliced as E-88a (auto-carry removed, explicit --include only). Wave E27 (wf_bcacb1d1-e76). Wave E27 stopped 18:37Z (founder: over budget, load 50). E-88a opus APPROVE (branch slice-E-88a); merge conflicts with E-86 in .githooks/pre-push; rebase after E-99 lands (same file). |
+| E-88 | Release notes fully written (D36): scripts/release-notes.sh extracts the CHANGELOG section literally (dated headings), fails on a missing, empty, heading-only or placeholder section; release.yml fails instead of falling back and checks the published body; pre-push refuses a VERSION bump without a full section | scripts/release-notes.sh, .github/workflows/release.yml (extract step), .githooks/pre-push, docs/dev/release-checklist.md, tests/test-release-notes.sh | HIGH | bash tests/test-release-notes.sh; failing first against the old awk pattern | merged@2026-09-28T19:46Z | Source: founder directive 16:05Z; six releases published with "Release vX.Y.Z" bodies (backfilled). Founder 17:22Z: stopped at 70 min and re-sliced as E-88a (auto-carry removed, explicit --include only). Wave E27 (wf_bcacb1d1-e76). Wave E27 stopped 18:37Z (founder: over budget, load 50). E-88a opus APPROVE (branch slice-E-88a); merge conflicts with E-86 in .githooks/pre-push; rebase after E-99 lands (same file). E-88a rebased onto E-99 as slice-E-88a-r2 62774912; opus APPROVE (pre-push diff purely additive, E-99 gitleaks steps byte-identical, stdin read once, gate main-only and fail-closed, release.yml exits 1 instead of a placeholder); merged 60ce7620; release-notes 41/0, pre-push-hook 13/0, pre-push-gitleaks 43/0. Non-blocking: gate runs the working tree release-notes.sh; _cl_tmp not in the EXIT trap. |
 | E-89 | Pulse RELEASE_CADENCE (D37): violation when more than 25 minutes pass with main green (Tests and Bun Parity success at HEAD) and at least one merged-unreleased slice commit (not an ancestor of the latest published tag, docs-only commits excluded) | scripts/v10-pulse.sh (one check), tests/test-v10-pulse.sh | MEDIUM | bash tests/test-v10-pulse.sh; fixtures: green plus unreleased slice commit 26 min old fires; red main does not; docs-only commits do not; 24 min does not | merged@2026-09-28T18:42Z | Source: founder directive 16:20Z. Founder 17:22Z: stopped at 58 min; salvaged commit cce8f48a re-sliced as its own slice plus UNDERSTAFFED. Wave E27 (wf_bcacb1d1-e76). Wave E27 stopped 18:37Z (founder: over budget, load 50). TL APPROVE (sonnet) on the salvaged cce8f48a plus UNDERSTAFFED; merged locally; `bash tests/test-v10-pulse.sh` 129 passed 0 failed. |
 | E-90 | Release Manager marks BOARD rows released after publish: scripts/board-mark-released.sh <tag> flips every merged row whose merge commit is an ancestor of <tag> to released@ with the tag and the ancestry evidence; pulse MERGED_NOT_RELEASED_STALE when a merged row is already in a published tag | scripts/board-mark-released.sh, scripts/v10-pulse.sh (one check), tests/test-board-mark-released.sh | MEDIUM | bash tests/test-board-mark-released.sh; a merged row in the tag flips, one not in it stays; BOARD line count unchanged | ready@2026-09-28T18:42Z | Source: 16:20Z the BOARD showed 20 merged slices that had all shipped in v10.1.0 to v10.2.1, which read as a 20-slice release backlog. Founder 17:22Z: stopped; salvaged commit 1d9dfae7 re-sliced after E-89. Wave E27 (wf_bcacb1d1-e76). Wave E27 stopped 18:37Z (founder: over budget, load 50). Build on slice-E-90-r2 (5 commits) never reviewed; re-review as its own slice. |
-| DEP-02 | actions/checkout v4 (runs on deprecated node20) to latest major v7, SHA-pinned with a "# v7.x.y" comment in every workflow and composite action; read the v5, v6, v7 release notes and fix breaking changes (fetch-depth, persist-credentials defaults) | .github/workflows/*.yml, .github/actions/**/action.yml (uses: actions/checkout lines, plus any input the migration requires) | MEDIUM | `grep -rn "actions/checkout@" .github` shows only full-SHA pins with a v7 comment; actionlint clean; a PR run of Tests, Bun Parity and Security Audit on the slice concludes success (run id cited) | building@2026-09-28T16:30Z | Source: DEP-01 inventory (D35). A release containing workflow changes needs the tag pushed by the Release Manager (GITHUB_TOKEN lacks the workflows permission; release.yml prints the workaround). |
-| DEP-03 | actions/setup-node v4 (node20) to latest major v7, SHA-pinned with a version comment; read the v5..v7 release notes (cache and package-manager detection defaults) and fix breaking changes | .github/workflows/*.yml, .github/actions/**/action.yml (setup-node lines and required inputs) | MEDIUM | only SHA pins with a v7 comment; actionlint rc=0; PR run conclusion success (run id cited) | building@2026-09-28T16:30Z | Source: DEP-01 inventory (D35). |
-| DEP-04 | Runtime matrix: drop Node 20 (EOL 2026-04-30) from every workflow matrix, keep 22 (previous supported, users still run it) and 24, add the current stable line if the inventory shows one newer and supported; update package.json engines and docs that name Node 20 | .github/workflows/*.yml (node-version values), package.json (engines only), docs naming the Node version | MEDIUM | no node 20 left in any matrix; engines matches; PR run conclusion success on every remaining version (run id cited) | building@2026-09-28T16:30Z | Source: DEP-01 inventory (D35). |
-| E-91 | Pulse UNEVIDENCED_CLAIM and every row parser accept any slice id prefix ([A-Z]+-\d+, e.g. DEP-02, GF-1, PF-3), not a hardcoded S/E/EV/M list | scripts/v10-pulse.sh (row-id regexes only), tests/test-v10-pulse.sh | LOW | bash tests/test-v10-pulse.sh; a DEP row with "green" only in its Wall cell is not flagged, its notes cell still is | ready@2026-09-28T18:42Z | Source: pulse flagged DEP-03/DEP-04 Wall cells (df7dc134), the E-71 bug class again. Serialize after E-89/E-90 and E-79..81 (same file). Wave E27 (wf_bcacb1d1-e76). After E-90 (same file). Wave E27 stopped 18:37Z (founder: over budget, load 50). Not started. |
+| DEP-02 | actions/checkout v4 (runs on deprecated node20) to latest major v7, SHA-pinned with a "# v7.x.y" comment in every workflow and composite action; read the v5, v6, v7 release notes and fix breaking changes (fetch-depth, persist-credentials defaults) | .github/workflows/*.yml, .github/actions/**/action.yml (uses: actions/checkout lines, plus any input the migration requires) | MEDIUM | `grep -rn "actions/checkout@" .github` shows only full-SHA pins with a v7 comment; actionlint clean; a PR run of Tests, Bun Parity and Security Audit on the slice concludes success (run id cited) | parked@2026-09-28T19:52Z | Source: DEP-01 inventory (D35). A release containing workflow changes needs the tag pushed by the Release Manager (GITHUB_TOKEN lacks the workflows permission; release.yml prints the workaround). Parked 19:52Z: no agent holds it; PR #218 open (gh pr view 218: OPEN, no checks reported). Merge after the E-98 fix train per D35/D40 (DEP never ahead of E/EV/M). |
+| DEP-03 | actions/setup-node v4 (node20) to latest major v7, SHA-pinned with a version comment; read the v5..v7 release notes (cache and package-manager detection defaults) and fix breaking changes | .github/workflows/*.yml, .github/actions/**/action.yml (setup-node lines and required inputs) | MEDIUM | only SHA pins with a v7 comment; actionlint rc=0; PR run conclusion success (run id cited) | parked@2026-09-28T19:52Z | Source: DEP-01 inventory (D35). Parked 19:52Z: same as DEP-02 (PR #218). |
+| DEP-04 | Runtime matrix: drop Node 20 (EOL 2026-04-30) from every workflow matrix, keep 22 (previous supported, users still run it) and 24, add the current stable line if the inventory shows one newer and supported; update package.json engines and docs that name Node 20 | .github/workflows/*.yml (node-version values), package.json (engines only), docs naming the Node version | MEDIUM | no node 20 left in any matrix; engines matches; PR run conclusion success on every remaining version (run id cited) | parked@2026-09-28T19:52Z | Source: DEP-01 inventory (D35). Parked 19:52Z: no agent holds the rework; resumes after the E-98 fix train per D40. |
+| E-91 | Pulse UNEVIDENCED_CLAIM and every row parser accept any slice id prefix ([A-Z]+-\d+, e.g. DEP-02, GF-1, PF-3), not a hardcoded S/E/EV/M list | scripts/v10-pulse.sh (row-id regexes only), tests/test-v10-pulse.sh | LOW | bash tests/test-v10-pulse.sh; a DEP row with "green" only in its Wall cell is not flagged, its notes cell still is | merged@2026-09-28T19:53Z | Source: pulse flagged DEP-03/DEP-04 Wall cells (df7dc134), the E-71 bug class again. Serialize after E-89/E-90 and E-79..81 (same file). Wave E27 (wf_bcacb1d1-e76). After E-90 (same file). Wave E27 stopped 18:37Z (founder: over budget, load 50). Not started. Tech Lead APPROVE e311b47e; merged 039f8af2; test-v10-pulse.sh 131/0. Revealed DEP-02..04 stale building rows (parked). |
 | E-92 | P0 fix-forward: dep-inventory --self-test reached the real gh floating-tag resolver (actions/setup-node@v4), so CI without gh auth read bump unknown (Tests red since df7dc134, run 36451439320) | scripts/dep-inventory.py (self-test fixture) | HIGH | `env -u GH_TOKEN -u GITHUB_TOKEN PATH=/usr/bin:/bin python3 scripts/dep-inventory.py --self-test` rc=0; rc=1 on the previous version | released@2026-09-28T17:16Z | TL APPROVE (sonnet) on 81cdba4d: stripped-env self-test 23/23 rc=0, origin/main rc=1, fixture mutation goes red, no second network path in self_test(); merged 4f7f1487. Guard: E-93. Released in v10.2.2 (npm gitHead 9a59750d, Release run 36455687013). |
 | E-93 | Guard (D37 same-class-never-twice): tests/test-dep-inventory.sh runs --self-test under a stripped environment (no GH_TOKEN/GITHUB_TOKEN, PATH=/usr/bin:/bin, empty HOME) so a network-dependent self-test fails locally, not only in CI; GUARDS.md entry | tests/test-dep-inventory.sh, docs/v10/GUARDS.md | LOW | a self-test that calls an unstubbed fetcher fails the leg locally | merged@2026-09-28T18:00Z | Source: E-92 incident. Wave E25 (wf_46137a6b-367). TL APPROVE (sonnet); merged on main 18:00Z; `bash tests/test-dep-inventory.sh` 6 passed 0 failed. |
 | EV-12E | Upstream-first hidden-test enforcement (D38 criteria 1, 3, 4, 7, 9): validate requires hidden.provenance, hidden.sha256 and requirements[] on lg-* tasks; measure-size excludes typing-examples/, examples/, docs/; a test-harness leg applies every tasks/lg-*/shortcuts/*.patch and asserts not completed, and RED at ref is not collection-only; run.sh rows gain hidden_subset | eval/loki10/harness.py (validate only), eval/loki10/measure-size.py, eval/loki10/test-harness.sh (new section) | HIGH | fixture with a wrong sha256 fails validate rc=1; a passing shortcut fixture fails the leg; an attrs-602-shaped fixture reads medium | ready@2026-09-28T18:42Z | Source: D38. Needs EV-12S merged first (measure-size). Wave E27 (wf_bcacb1d1-e76). Wave E27 stopped 18:37Z (founder: over budget, load 50). REJECT (reproduced): RED at ref must be by assertion (criterion 7) is untested. Branch slice-EV-12E kept (4 commits). |
@@ -430,16 +430,34 @@ set is declared to avoid overlap with those and with each other.
 | DEP-05 | npm/bun patch and minor batch from docs/v10/DEPS.md (web-app, dashboard-ui, vscode-extension, root; lockfiles regenerated and committed; 0.x packages excluded) | the package.json and lockfiles DEPS.md names for patch/minor only | LOW | npm audit: no new high or critical; hallucinated-dependency guard rc=0; full Tier B plus the moat suite on a PR run | ready@2026-09-28T17:45Z | Source: DEP-01 inventory (D35). |
 | DEP-06 | Python patch and minor batch from docs/v10/DEPS.md (dashboard, mcp, web-app requirements, sdk/python pyproject; 0.x excluded) | those requirements*.txt and pyproject.toml | LOW | pip-audit: no new high or critical; guard rc=0; PR run of Tests conclusion success (run id cited) | ready@2026-09-28T17:45Z | Source: DEP-01 (D35). |
 | DEP-07 | SHA-pin every remaining tag-pinned action already on its latest major (anchore/sbom-action, anthropics/claude-code-action, contributor-assistant/github-action, oven-sh/setup-bun) with a version comment | .github/workflows/*.yml (those uses: lines only) | LOW | every uses: is a full SHA with a vX comment; actionlint rc=0; PR run | ready@2026-09-28T17:45Z | Source: DEP-01 (D35). Serialize after DEP-02/DEP-03 merge (same files). |
-| G-01 | Usage governor (D39): scripts/usage-governor.py sums usage (output, input, cache read, cache write) from ~/.claude/projects/**/*.jsonl per model, role (from workflow labels and agent types where recorded) and hour; stores founder plan-percentage readings (docs/v10/usage-readings.tsv) and fits tokens-per-percent as a labelled estimate; projects 5-hour window and weekly usage; outputs max engineers for the next hour; checks and records whether Claude Code exposes plan usage directly (statusline input rate-limit fields, /usage) and uses it when it does | scripts/usage-governor.py, docs/v10/usage-readings.tsv, tests/test-usage-governor.sh | HIGH | fixture jsonl plus readings gives a stated projection and max-engineer number; missing readings reads "uncalibrated", never a number presented as fact | building@2026-09-28T19:00Z | Source: founder 17:44Z. First in the queue; everything obeys it. r2 de8e1f76 opus REJECT: weekly reset 1h off across DST; fixes 2 and 4 unguarded. r3 dispatched 19:00Z. |
-| G-02 | Pulse BUDGET_BURN and OPUS_SHARE violations plus an hourly METRICS.md usage section (tokens per role and model, cost per merged slice, window and weekly projections, max engineers, releases per hour, merged slices per hour and per million tokens), all from G-01 | scripts/v10-pulse.sh (two checks), tests/test-v10-pulse.sh, docs/v10/METRICS.md (section header only) | MEDIUM | fixtures: opus 31% fires OPUS_SHARE; a projection of 86% fires BUDGET_BURN; uncalibrated reads UNKNOWN | ready@2026-09-28T17:50Z | Source: founder 17:44Z. Depends on G-01. Serialize after E-89..E-91 (same file). |
-| G-03 | docs/v10/SCALE.md: what the Max 20x plan sustains around the clock (from G-01 measurements and calibration), what 50 parallel engineers need (API pay-as-you-go with a rate-limit tier, or Team/Enterprise), cost per day estimates labelled as estimates, and the ramp gates (governor allows, merged slices per hour rising, merged work per token not falling) | docs/v10/SCALE.md | HIGH | every number cites a measurement or is labelled an estimate with its basis | building@2026-09-28T17:50Z | Source: founder 17:44Z. CTO (opus) authors. Billing is the founder decision. |
+| G-01 | Usage governor (D39): scripts/usage-governor.py sums usage (output, input, cache read, cache write) from ~/.claude/projects/**/*.jsonl per model, role (from workflow labels and agent types where recorded) and hour; stores founder plan-percentage readings (docs/v10/usage-readings.tsv) and fits tokens-per-percent as a labelled estimate; projects 5-hour window and weekly usage; outputs max engineers for the next hour; checks and records whether Claude Code exposes plan usage directly (statusline input rate-limit fields, /usage) and uses it when it does | scripts/usage-governor.py, docs/v10/usage-readings.tsv, tests/test-usage-governor.sh | HIGH | fixture jsonl plus readings gives a stated projection and max-engineer number; missing readings reads "uncalibrated", never a number presented as fact | merged@2026-09-28T19:09Z | Source: founder 17:44Z. First in the queue; everything obeys it. r2 de8e1f76 opus REJECT: weekly reset 1h off across DST; fixes 2 and 4 unguarded. r3 dispatched 19:00Z. r3 fa279532 opus APPROVE (DST reset fixed; fixes 2 and 4 mutation-guarded by T14/T15); merged c2ae4347; governor 25/0, logger 16/0, run-shellcheck.sh passes, shard coverage 19/0, drift 6/0. Open non-blocking: weekly tokens counted from computed Wednesday not live resets_at-7d; no test for live-reset preference; "uncalibrated" label when idle. |
+| G-02 | Pulse BUDGET_BURN and OPUS_SHARE violations plus an hourly METRICS.md usage section (tokens per role and model, cost per merged slice, window and weekly projections, max engineers, releases per hour, merged slices per hour and per million tokens), all from G-01 | scripts/v10-pulse.sh (two checks), tests/test-v10-pulse.sh, docs/v10/METRICS.md (section header only) | MEDIUM | fixtures: opus 31% fires OPUS_SHARE; a projection of 86% fires BUDGET_BURN; uncalibrated reads UNKNOWN | merged@2026-09-28T19:59Z | Source: founder 17:44Z. Depends on G-01. Serialize after E-89..E-91 (same file). Dispatched 19:09Z, sonnet engineer (G-01 merged; goes before E-90/E-91, which rebase after). Built f172b9b6 (rebased onto E-91), test-v10-pulse.sh 138/0, 7 T48 subtests red on unmodified pulse first; 46 min vs 30 budget (large pulse file). Tech Lead review 19:55Z. Tech Lead APPROVE (pulse 0.61s wall, governor keys match usage-governor.py:562-591, null max is UNKNOWN); merged. |
+| G-03 | docs/v10/SCALE.md: what the Max 20x plan sustains around the clock (from G-01 measurements and calibration), what 50 parallel engineers need (API pay-as-you-go with a rate-limit tier, or Team/Enterprise), cost per day estimates labelled as estimates, and the ramp gates (governor allows, merged slices per hour rising, merged work per token not falling) | docs/v10/SCALE.md | HIGH | every number cites a measurement or is labelled an estimate with its basis | merged@2026-09-28T19:09Z | Source: founder 17:44Z. CTO (opus) authors. Billing is the founder decision. Merged as 4708cee1 (row status was stale). |
 | G-04 | Cloud fan-out (HIGH, CTO-owned): dispatch ready slices with no file overlap with in-flight work as Claude Code cloud sessions that open PRs from their own branches; the Release Manager merges PRs whose checks concluded success with gh pr merge; every dispatch recorded in BOARD.md with its cloud session id; ramp 25 to 50 only when the governor allows and merged slices per hour rose | scripts/cloud-dispatch.sh, docs/v10/SWARM.md (one section), tests/test-cloud-dispatch.sh | HIGH | dry-run dispatch prints the exact command and the BOARD row it would write; refuses when the governor max is reached or file sets overlap | ready@2026-09-28T17:50Z | Source: founder 17:44Z. Depends on G-01 (governor) and G-03 (plan ceiling). Verify the real cloud-session CLI syntax before building. |
 | G-05 | The same fan-out as loki modernize remote-worker mode (POST /jobs kind unit, Helm worker.engine v10): align G-04 with M-23 | (design note in docs/v10/MODERNIZE.md, one section) | MEDIUM | the note maps G-04 dispatch fields to the M-23 job schema | ready@2026-09-28T17:50Z | Source: founder 17:44Z. Depends on G-04 and M-17. |
-| EV-15 | Re-run the medium tier (7 tasks, raw and v10, 2 runs each, same model) with every result file written under ~/loki-ci-logs/eval/ev15-<arm>-r<n>/ (outside any worktree) and a per-task table of which runs failed and why (hidden-test failure, timeout, no PR, cost) | eval/loki10 results (outside the repo), docs/v10/METRICS.md (one section) | HIGH | 28 rows, 0 arm_unavailable; per-task failure reasons cited from the result files | building@2026-09-28T18:42Z | Source: EV-14 evidence lost (17:36Z incident) and v10 lost on all three medium axes. Governor-gated (paid run). D40 priority 1: running (wf_4af22d00-9fb), results under ~/loki-ci-logs/eval. |
-| E-98 | Diagnose why v10 loses to raw on medium (EV-15 per-task failures): for each task v10 failed and raw completed, read the v10 run log and name the stage and cause (plan, Wall, implement, verify, fix rounds, cap), then cut fix slices | docs/v10/ENGINE.md (findings section) | HIGH | each finding cites a result file path and a log line | building@2026-09-28T18:42Z | Source: EV-14. Depends on EV-15. CTO (opus) analysis. D40 priority 1: CTO analysis runs after EV-15 in the same workflow. |
+| EV-15 | Re-run the medium tier (7 tasks, raw and v10, 2 runs each, same model) with every result file written under ~/loki-ci-logs/eval/ev15-<arm>-r<n>/ (outside any worktree) and a per-task table of which runs failed and why (hidden-test failure, timeout, no PR, cost) | eval/loki10 results (outside the repo), docs/v10/METRICS.md (one section) | HIGH | 28 rows, 0 arm_unavailable; per-task failure reasons cited from the result files | merged@2026-09-28T19:40Z | Source: EV-14 evidence lost (17:36Z incident) and v10 lost on all three medium axes. Governor-gated (paid run). D40 priority 1: running (wf_4af22d00-9fb), results under ~/loki-ci-logs/eval. Done 19:19Z: raw 10/14 $0.5085 p50 56s; v10 9/14, cost at least $0.788 (E-98 correction) p50 128s. Files durable under ~/loki-ci-logs/eval/ev15-*. |
+| E-98 | Diagnose why v10 loses to raw on medium (EV-15 per-task failures): for each task v10 failed and raw completed, read the v10 run log and name the stage and cause (plan, Wall, implement, verify, fix rounds, cap), then cut fix slices | docs/v10/ENGINE.md (findings section) | HIGH | each finding cites a result file path and a log line | merged@2026-09-28T19:40Z | Source: EV-14. Depends on EV-15. CTO (opus) analysis. D40 priority 1: CTO analysis runs after EV-15 in the same workflow. docs/v10/MEDIUM-ANALYSIS.md merged d496db89. Top cause: verify hard-codes python, so 27/27 pytest checks were not_run and no fix round ever fired. Cards E-98a..f below. |
+| E-98a | verify uses the project interpreter (.venv, venv, $VIRTUAL_ENV, python3, python); a check on a system interpreter adds a not_proven line | loki-ts/src/engine10/stages/verify.ts, loki-ts/tests/engine10/verify*.test.ts | HIGH | fixture red then green (.venv shim, no python on PATH); core +12 max | merged@2026-09-28T20:10Z | Source: MEDIUM-ANALYSIS.md. Dispatched 19:40Z sonnet; opus review. r1 31af475c opus REJECT: seal.ts never reads verify not_proven (git grep "verify?.not_proven" rc=1), so a system-interpreter pass still seals VERIFIED; $VIRTUAL_ENV trusted outside the repo. r2 dispatched 19:53Z with seal.ts added to the file set, plus ruff resolution and a behavioral red. r2 cabf16ef opus APPROVE (seal PARTIAL on verify not_proven, receipts byte-stable without the flag, realpath-scoped VIRTUAL_ENV); merged 5cdd611d; verify+seal 36/0. Combined with E-98b/c/d the core is 5003 (budget.test.ts FAIL, Received 5003): fix-forward E-111. |
+| E-111 | P0 (local main red): engine10 core is 5003 lines after E-98a/b/c/d merged (budget.test.ts Received 5003, cap 5000). Cut at least 25 lines of dead or duplicated code from loki-ts/src/engine10 (outside modernize/) with no behavior change, leaving room for E-98e (+10) | loki-ts/src/engine10 (non-modernize), no test changes except budget | MEDIUM | budget.test.ts passes at 4978 or less; cd loki-ts && bun test tests/engine10 has no new failures vs main | merged@2026-09-28T20:38Z | Source: merge of E-98a at 20:10Z. Dispatched sonnet. opus REJECT r1 (deleted prStage/intakeStage, test-engine10-dist 16/2); APPROVE r2 f286f6ec; merged f059c87a, dist rebuilt e1363c67; core 4976, engine10 668/0, dist 18/0. |
+| E-112 | v10-guard: refuse a path-wide `git checkout <ref> -- .` (or `git restore --source <ref> .`) when cwd is the main checkout, so a read-only reviewer cannot overwrite the shared tree; allowed inside .claude/worktrees/* | scripts/v10-guard.sh, tests/test-v10-guard.sh | LOW | fixture: the command in the main checkout is blocked, the same in a worktree is allowed, a single-file checkout is allowed (red first) | merged@2026-09-28T20:27Z | Source: E-98e Tech Lead review 20:19Z ran `git checkout slice-E-98e -- .` then `git checkout main -- .` in the main checkout (tree restored clean, but it could have clobbered concurrent merges). Built f4515ec9 (6 new block cases red on the old guard); Tech Lead APPROVE (7 allow probes incl. single-file checkout, branch switch, heredoc text all exit 0); merged; test-v10-guard.sh 170/0. |
+| E-113 | P0 (main red at a4623675): tests/test-release-notes.sh T9l/T9n/--include fixtures build padding with yes piped to head under pipefail; on the Linux runner only the 34-byte header was written. Generate padding without a pipe | tests/test-release-notes.sh | LOW | passes locally and under the CI condition (SIGPIPE ignored); old version shown red there | merged@2026-09-28T20:42Z | Source: Tests run on a4623675 shard 4/8: "[FAIL] T9n fixture is not in the intended size band ... 34 bytes". Passes 41/0 on macOS. Dispatched 20:39Z. Built 74ffd928 (pipe-free printf loops; macOS could not reproduce the Linux drop even under trap PIPE, so CI is the proof). Tech Lead APPROVE (bytes identical: T9l 132034, T9n 98034, T9o 224089). Merged; 41/0 locally. |
+| E-98b | a spec_conflict implement exit still runs verify and fix; receipt keeps SPEC_CONFLICT | loki-ts/src/engine10/machine.ts, loki-ts/tests/engine10/machine*.test.ts | HIGH | fake-stage test red on main; core +3 max | merged@2026-09-28T19:53Z | Source: MEDIUM-ANALYSIS.md. Dispatched 19:40Z sonnet; opus review. opus APPROVE 214b8dd2 (seal stays SPEC_CONFLICT through verify and fix; empty diff fails verify, no false pass); merged 97b80ca4; machine+budget 26/0. |
+| E-98c | existing test files append-only in the implement brief; impactedTests falls back to named files when relevant_files is empty | loki-ts/src/engine10/stages/implement.ts, its test | MEDIUM | unit test red then green; core +2 max | merged@2026-09-28T19:53Z | Source: MEDIUM-ANALYSIS.md. Dispatched 19:40Z sonnet. Tech Lead APPROVE b24f4da2; merged f4606246; implement+machine+budget 37/0. |
+| E-98d | repo map extracts Python top-level def and class names | loki-ts/src/engine10/repomap.ts, loki-ts/tests/engine10/repomap*.test.ts | MEDIUM | unit test red then green; core +4 max | merged@2026-09-28T19:53Z | Source: MEDIUM-ANALYSIS.md. Dispatched 19:40Z sonnet. Offline 7-repo check runs after merge. Tech Lead APPROVE ba31cca4 plus async def fix a1e8dc4b; merged 15859bef; 41/0 across repomap, implement, machine, budget. Offline 4/7 repos rank the upstream file in the top 8 (was 0/7; card bar 5/7, keyword-tie ceiling). |
+| E-98e | a session killed at its stage limit writes a partial-stream cost record, never cost_usd null | loki-ts/src/engine10/session.ts, loki-ts/src/engine10/cost.ts, a test | MEDIUM | fake killed stream test red then green; core +10 max | merged@2026-09-28T20:20Z | Source: MEDIUM-ANALYSIS.md. Dispatched 19:40Z sonnet. r1 blocked honestly (no per-message usage persisted before result; a fixture-only test would not be wired to a real killed session). Re-sized: sdk_stream_parser.ts running usage file plus session.ts pricing via calculateCostFromRecords; r2 dispatched 19:50Z. r2 86d7eea4: logic moved to runner/budget.ts, core -12; full bun test failure sets byte-identical to main (55 fail, 13 errors both, zero new). Tech Lead APPROVE (max-per-id dedupe test, result file wins, partial-usage- matches no result-cost- consumer, opus/sonnet priced by family). Merged 8b41ad40; 153/0 across cost, session, parser, budget, seal, verify; budget.test.ts passes again. Process note: the reviewer ran git checkout in the main checkout (read-only breach, tree restored clean). |
+| E-98f | A/B eval of Wall and cascade on medium (default, WALL=0, CASCADE=0, n=3 each), then a sizing default only if a knob wins on completions without losing on cost | eval run; loki-ts/src/engine10/sizing.ts | HIGH | chosen default at or above raw 71.4% and below $0.5085 per completed; after table published in MEDIUM-ANALYSIS.md | building@2026-09-28T20:20Z | Source: MEDIUM-ANALYSIS.md. Depends on E-98a..e merged. One combined re-run replaces the per-card re-runs (D40 cost). Dispatched 20:20Z (sonnet eval runner): E-98a..e merged locally; default, WALL=0, CASCADE=0 arms at n=3 on the 7 medium tasks, raw baseline from EV-15. |
 | E-99 | E-86 follow-ups (opus non-blocking): scan every pushed commit with the pushed tip's .gitleaksignore (what CI does) so a self-suppressing line added and removed in one push is refused; unset GITLEAKS_CONFIG and GITLEAKS_CONFIG_TOML in the hook; refuse a .gitleaks.toml change in any push (not only eval-touching ones) without LOKI_ALLOW_GITLEAKS_CONFIG_CHANGE=1; pin the installed binary sha256 in the hook | .githooks/pre-push, tests/test-pre-push-gitleaks.sh | MEDIUM | real-push fixtures for each case, failing first | merged@2026-09-28T18:58Z | Source: E-86 round-4 review C1-C3 and the forged-sidecar boundary. Opus APPROVE; merged 5ee5a630 (conflict with E-100 case 20 resolved: guard kept, E-99 message taken; gitleaks test 43/0 with binary, 19/0/24 skipped without; pre-push hook 13/0). |
 | E-100 | P0: main Tests red on cc4992ed (run 36465466283): tests/test-pre-push-gitleaks.sh case 20 asserted a pass without the pinned gitleaks binary, which the CI runner does not have | tests/test-pre-push-gitleaks.sh | HIGH | `HOME=<empty> bash tests/test-pre-push-gitleaks.sh` 18 passed 0 failed 22 skipped; with the binary 40 passed | merged@2026-09-28T18:42Z | Built 91a47f52; the class is guarded by E-94 (changed tests re-run with an empty HOME). |
-| E-101 | Eval results durable (D40 priority 4): run.sh and harness.py write results.jsonl to ~/loki-ci-logs/eval/<run> and a redacted copy to eval/loki10/archive/; scripts/prune-worktrees.sh never removes a worktree with a live process, a commit in the last 30 minutes, or un-archived eval results | eval/loki10/run.sh, eval/loki10/harness.py, scripts/prune-worktrees.sh, tests/test-eval-archive.sh, tests/test-prune-worktrees.sh | HIGH | fixtures: live-process and un-archived worktrees kept; a planted token never reaches the in-repo archive | building@2026-09-28T18:42Z | Source: EV-14 results lost 17:36Z. Supersedes E-96. |
+| E-101 | Eval results durable (D40 priority 4): run.sh and harness.py write results.jsonl to ~/loki-ci-logs/eval/<run> and a redacted copy to eval/loki10/archive/; scripts/prune-worktrees.sh never removes a worktree with a live process, a commit in the last 30 minutes, or un-archived eval results | eval/loki10/run.sh, eval/loki10/harness.py, scripts/prune-worktrees.sh, tests/test-eval-archive.sh, tests/test-prune-worktrees.sh | HIGH | fixtures: live-process and un-archived worktrees kept; a planted token never reaches the in-repo archive | merged@2026-09-28T19:40Z | Source: EV-14 results lost 17:36Z. Supersedes E-96. Reviewer APPROVE bbe83c7a (mutation-checked all 3 prune checks and redact_row); merged 21df7d4a; prune-worktrees 26/0, eval-archive 5/0. Used at 19:40Z to prune 6 finished worktrees. |
+| E-102 | release.sh --bump-only must never leave a tree without its tracked dist: if the loki-ts build fails (for example no node_modules in a fresh worktree), exit non-zero and restore loki-ts/dist from HEAD; when the only source change is VERSION, patch the version literal in dist instead of rebuilding (no debugId or source-map path churn) | scripts/release.sh, tests/test-release-bump-dist.sh | MEDIUM | fixture: a worktree with no node_modules gives a non-zero exit with dist unchanged; a VERSION-only bump changes exactly the version literal in dist/loki.js | merged@2026-09-28T19:29Z | Source: 19:20 cut of v10.3.1: in a fresh worktree the build failed (@anthropic-ai/sdk unresolved) and deleted 4 tracked dist files; a node_modules symlink then rewrote source-map paths. Shipped by hand-patching the version literal (d811e5c3). Tech Lead APPROVE c83a07e2; merged c35d3fa7; bump-dist 7/0 (red first 3/4), bump-only 8/0, release-sh 29/0, shard coverage 19/0, drift 6/0. |
+| E-103 | release.sh --bump-only: when the build exits 0 but dist/loki.js does not embed the new version (release.sh:475-479), restore loki-ts/dist from HEAD and exit non-zero, as the build-failure path already does | scripts/release.sh, tests/test-release-bump-dist.sh | LOW | fixture: a stub build that exits 0 without writing the version gives a non-zero exit with dist byte-identical to HEAD | merged@2026-09-28T19:31Z | Source: E-102 Tech Lead review (non-blocking note). Tech Lead APPROVE 1150af81 (shared release_bump_only_fail, no duplicated restore); bump-dist 10/0 (red 9/10 first), bump-only 8/0, release-sh 29/0. |
+| E-104 | tests/test-verify.sh scenario 3 plants AKIAIOSFODNN7EXAMPLE, which gitleaks (8.30.1 on a dev Mac) allowlists as the AWS doc example, so the test goes VERIFIED/0 wherever gitleaks is installed and passes only where loki verify falls back to its regex scanner (CI). Plant a non-example secret shape and assert BLOCKED on both scanner paths | tests/test-verify.sh | LOW | run with gitleaks on PATH and with PATH stripped of it: BLOCKED/2 both ways | merged@2026-09-28T20:07Z | Source: 19:40 train fast tier: FAIL planted secret -> expected BLOCKED/2, got VERIFIED/0, reproduced on origin/main (CI green there). Env-conditional assertion class. Dispatched 19:56Z sonnet. Tech Lead APPROVE 4df867d2 (runtime-built key, gitleaks dir clean); merged f6b4865e; test-verify.sh 25/0 with gitleaks on PATH (was 24/1). |
+| E-105 | tests/check-heredoc-dollar-digit.sh flags autonomy/run.sh:5548 (`local _var="$1" _had="$2" _val="$3"`), a function body, not a python3 -c body: false positive that keeps the fast tier red on main | tests/check-heredoc-dollar-digit.sh | LOW | the run.sh:5548 shape passes; a real $1 inside python3 -c "..." still fails (red first) | merged@2026-09-28T20:07Z | Source: 19:40 train fast tier; line unchanged for 27h, identical on origin/main. Dispatched 19:56Z sonnet. Tech Lead APPROVE 685a9dd6 (closing quote may be mid-line; same 2 files scanned as main); merged 81c25e5d; checker OK on the real tree, new test PASS=2 FAIL=0. |
+| E-106 | P0: claude-agent-sdk version drift. loki-ts/package.json is 0.3.283 (9db2a4ed) but root package.json and package-lock.json pin 0.3.267 and Dockerfile:160 installs 0.3.208, so the published package resolves an SDK older than the one the engine was evaluated on. Align all pins; add tests/test-sdk-version-sync.sh so CI (not only local-ci.sh) catches drift | package.json, package-lock.json, Dockerfile, tests/test-sdk-version-sync.sh, tests/run-all-tests.sh, tests/shard-durations.tsv | MEDIUM | new test red on main (3 mismatches) then green; npm pack --dry-run succeeds | merged@2026-09-28T19:53Z | Source: 19:40 train fast tier FAIL "Agent SDK is a resolvable root dependency"; reproduced on origin/main (root 0.3.267 vs loki-ts 0.3.283). Dispatched 19:45Z sonnet. Tech Lead APPROVE 58c8150c (lock touched only the SDK; integrity matches npm view); r2 1a795932 scans git ls-files only (untracked .claude/worktrees Dockerfiles gave 14 false mismatches). Merged a58c47b6; test-sdk-version-sync.sh PASS 4/4 at 0.3.283. |
+| E-107 | Pulse SESSION_STALLED derives the Claude transcript directory from the shell cwd, so a session whose shell sits in a subdirectory (loki-ts/) reads a nonexistent project dir and reports a 108182-minute stall; resolve it from the repo root (git rev-parse --show-toplevel) | scripts/v10-pulse.sh (transcript-dir resolution only), tests/test-v10-pulse.sh | LOW | fixture: pulse run from a subdirectory reports the same minutes-since-last-turn as from the root | merged@2026-09-28T20:18Z | Source: 19:48Z pulse: SESSION_STALLED 108182.9 min right after a Bash step left cwd at loki-ts/. Serialize after E-91 and G-02 (same file). Tech Lead: logic APPROVE, REJECT for a T48 name collision with G-02; r2 823f91cb renamed to T49/T49a/T49b, merge-tree clean; merged; test-v10-pulse.sh 140/0. |
+| E-108 | release.sh --bump-only: after a rebuild it restores loki.js.map (debugId-only churn, E-72) but leaves the new debugId trailer in dist/loki.js, so the shipped loki.js and loki.js.map disagree on debugId; keep the old trailer too, so a VERSION-only bump changes exactly the version literal | scripts/release.sh, tests/test-release-bump-dist.sh | LOW | fixture: after a VERSION-only bump, git diff of dist/loki.js is exactly the version literal and its debugId equals the map debugId (red first) | merged@2026-09-28T20:07Z | Source: v10.4.0 cut 19:50Z: loki.js debugId AE3EFDC8... vs map 93B13628...; fixed by hand in 7895a698. Dispatched 19:56Z sonnet. Tech Lead APPROVE 71f2f944 (restores only the debugId trailer, never the version literal); merged 6b65aaff; bump-dist 15/0, bump-only 8/0. |
+| E-109 | usage-governor.py takes 115s (real 115.27s, full parse of every transcript) so the pulse background refresh times out and OPUS_SHARE/BUDGET_BURN read UNKNOWN every turn; scan only transcripts modified within the weekly window and cache parsed per-file results by (path, size, mtime) | scripts/usage-governor.py, tests/test-usage-governor.sh | MEDIUM | a second run over unchanged transcripts finishes in under 10s on this host; results identical to a full parse on a fixture | merged@2026-09-28T20:38Z | Source: 20:00Z pulse showed "usage governor check failed or timed out" after G-02 merged. Tech Lead REJECT r1 (warm 53s over the 10s Wall) and r2 (mtime cutoff dropped 5h-window rows after a weekly reset: 0 vs 500, reproduced); APPROVE r3 6333b8f9 (reviewer repro now 500; mkstemp cache writes). Merged; test-usage-governor 30/30; cold 12.9s, warm 4.86s (was 115s). |
+| E-110 | P0 guard for the v10.4.0 block: (a) tests/test-eval-archive.sh builds its planted secrets at runtime so the file itself has no secret shape; (b) .githooks/pre-push runs the pinned gitleaks over every pushed commit and path (not only eval fixture changes), matching the CI Security Audit, with the tip .gitleaksignore | tests/test-eval-archive.sh, .githooks/pre-push, tests/test-pre-push-gitleaks.sh | HIGH | a push adding a test file with an AKIA-shaped literal is refused locally (red first); test-eval-archive.sh passes and gitleaks dir on it finds nothing | ready@2026-09-28T20:04Z | Source: v10.4.0 Release 36475005937 required-ci failed: Security Audit gitleaks "leaks found: 3", all in bbe83c7a:tests/test-eval-archive.sh (synthetic E-101 fixtures; allowlisted by exact fingerprint in 6358e0a6). The pre-push scan only ran for eval fixture changes. |
 | E-58 | Issue-ref runs: supervisor creates runDir before the fetch child writes issue.json; makes E-47 green | loki-ts/src/engine10/supervisor.ts (one line before fetchIssueToFile), E-47 test files from 544348a7 | MEDIUM | cd loki-ts && bun test tests/engine10/issue_ref_e2e.test.ts (3 pass) | released@2026-09-28T02:38Z | Source: E-47 finding (TL reproduced). Merged 646a6cd7 (train E13): engine10 388 pass 0 fail, tsc exit 0, test-engine10-dist 18/0, test-engine10-docs 26 passed, test-harness 82/0. APPROVE (6384fff9); issue_ref_e2e 3 pass. Released v9.81.0 (npm view loki-mode time: 2026-09-28T02:38:54Z). |
 | E-59 | Receipt model and summary tokens match the provider: cost.ts takes model from the result-cost file; events.ts fold sums cache read and creation tokens; makes E-50 green | loki-ts/src/engine10/cost.ts, loki-ts/src/engine10/events.ts, E-50 test files from 716618d4 | HIGH | cd loki-ts && bun test tests/engine10/model_report.test.ts tests/engine10/output.test.ts | released@2026-09-28T02:38Z | Source: E-50 finding. Reconcile with E-44 (output.ts already folds cache tokens at render). Opus reviewer (cost numbers feed the gate). Opus CONCERN: writeResultCost writes no model, so real records still use the caller model; summary tokens at supervisor.ts still exclude cache. Rework dispatched. Merged 3ab2a8fa (train E14, rebased on main): engine10 404 pass 0 fail (402 pass 0 fail with claude removed from PATH), tsc exit 0, test-harness 86/0, test-local-ci-gitleaks 6/0, test-engine10-dist 18/0. Released v9.81.0 (npm view loki-mode time: 2026-09-28T02:38:54Z). |
 | EV-8 | v10 cost check on 5 tasks before the full arm (CEO 23:31Z): v10 arm, same model, after E-42 and E-45 merge | eval/loki10 results (gitignored) plus docs/v10/METRICS.md block | HIGH | eval/loki10/run.sh --arm v10 --tasks <5 ids> reports completed, time to PR and provider cost per task | released@2026-09-28T02:38Z | Target cost per completed task at or below $0.2363 (raw claude -p full arm). Depends on E-42, E-45, E-38 (--tasks). Incident 01:38Z: first run 0/5 on both variants measured the wrong code. The harness default arm binary is the global loki (loki --version: v9.78.0), and the main checkout node_modules still had agent SDK 0.3.267 (package.json pins 0.3.283), whose bundled Claude Code 2.1.267 rejects claude-opus-5-5, so every session exited "error" in about 1s with 0 tokens. Fixed in 7c3dea3d: bun install (node_modules 0.3.283), repro with the harness arm_env and arm_auth now completes on claude-opus-5-5 ($0.11, 13s); dist rebuilt. Rerun started with LOKI_EVAL_LOKI_BIN=<repo>/bin/loki. Guards E-61, E-62. Rerun measured (not a code slice): A 4/5 $0.5954, B 5/5 $0.3976, C (all sonnet, no plan, no Wall) 4/5 $0.294, raw 5/5 $0.2161 (~/loki-ci-logs/ev8r-{A,B,C}/results.jsonl). Gate not met on cost; D31 and E-64, E-65 follow. Released v9.81.0 (npm view loki-mode time: 2026-09-28T02:38:54Z). |

package/docs/v10/GUARDS.md

@@ -615,7 +615,7 @@ previously mismarked two merged guards (S-16, S-74) as PENDING.
   restore) and a clean rerun showed `Results: 6 passed, 0 failed`, exit 0.
   Run: `bash tests/test-dep-inventory.sh`.
 
-## 17. Hardcoded fixture ports raced concurrent runs of the same test (E-95)
+## 18. Hardcoded fixture ports raced concurrent runs of the same test (E-95)
 
 - **Incident:** commit `8f2179cd`, Tests run `36453069628`,
   `tests/test-app-runner-watchdog-health.sh` failed with "healthy fixture
@@ -657,7 +657,7 @@ previously mismarked two merged guards (S-16, S-74) as PENDING.
   concurrent `test-v10-pulse.sh` copies completed clean, exit 0, over the
   same window). `bash -n` and `shellcheck` both clean on the file.
 
-## 17. A local pass depended on `gh` being authenticated on the dev Mac (E-94)
+## 19. A local pass depended on `gh` being authenticated on the dev Mac (E-94)
 
 - **Incident:** `tests/test-dep-inventory.sh` passed locally and failed on
   the CI runner. Root-caused to `scripts/dep-inventory.py`'s `self_test()`:
@@ -754,3 +754,46 @@ previously mismarked two merged guards (S-16, S-74) as PENDING.
   directly against this worktree, found the one real in-scope change and
   returned `hermetic-clean` in 5.6s, well inside the 60s budget. Run:
   `bash tests/test-local-ci-hermetic.sh`.
+
+## 20. Eval results lost when a worktree was force-removed (E-96/EV-14, E-101)
+
+- **Incident:** `eval/loki10/results/*/results.jsonl` is gitignored
+  (`eval/loki10/.gitignore`), so it exists only inside the worktree that ran
+  the eval. The 17:36Z pruning incident (guard 5's family, PROGRESS.md)
+  force-removed 7 live builder worktrees including EV-14's; that eval's
+  per-run results were destroyed with it (METRICS.md 18:00Z note) and could
+  not be re-audited.
+- **Root cause with evidence:** nothing ever copied `results.jsonl` outside
+  the worktree that produced it, and no existing prune tool checked for
+  un-copied results before removing a worktree.
+- **The guard:** `eval/loki10/harness.py` `cmd_run` now writes a redacted
+  copy of every row (`redact_row`: drops the `arm_stdout`/`arm_stderr`/etc.
+  log paths and any secret-shaped string) to both
+  `${LOKI_EVAL_ARCHIVE:-$HOME/loki-ci-logs/eval}/<run-name>/results.jsonl`
+  (outside the repo) and the committed `eval/loki10/archive/<run-name>.results.jsonl`,
+  per row inside the same lock that writes the worktree-local copy, so a
+  killed run keeps what it already archived. `scripts/prune-worktrees.sh`
+  refuses to remove a worktree that has a `results.jsonl` whose `run_id`s
+  are not all present in an archived copy, and separately refuses to remove
+  one with a live process inside it (`lsof -d cwd -Fn`) or a branch commit
+  less than 30 minutes old (`git log -1 --format=%ct`) -- any check that
+  cannot run (lsof missing/broken, unparseable JSON) REFUSES rather than
+  guessing. No file-age signal (`stat`, `find -newermt`, etc.) is used
+  anywhere in it.
+- **The test that proves it fires:** `tests/test-prune-worktrees.sh` keeps a
+  worktree with a live process inside it, keeps one whose results are not
+  yet archived, removes one whose results ARE archived (positive control),
+  and refuses everything when `lsof` is stubbed to fail. Deleting any one of
+  the three new checks from `scripts/prune-worktrees.sh` (live-process,
+  30-minute, or archived-results) turns the corresponding case red: 24
+  passed / 2 failed each time, vs. 26 passed / 0 failed with the check in
+  place. `tests/test-eval-archive.sh` plants a token
+  (`sk-ant-plantedTOKEN9999`, a GitHub-token-shaped string, and a
+  `KEY=VALUE`-shaped one) in a synthetic row and asserts none of it survives
+  `redact_row`, that the log paths are gone, that real fields (`task`,
+  `run_id`, `harness_sha`, `cost_usd`) survive intact, and that the redacted
+  rows still `summarize_rows()` correctly (an empty/over-stripped archive
+  would otherwise pass the secret check too). Replacing `redact_row` with a
+  no-op (`return dict(row)`) reproduces the incident directly: the planted
+  secret and the log paths both survive.
+  Run: `bash tests/test-prune-worktrees.sh && bash tests/test-eval-archive.sh`.

package/docs/v10/MEDIUM-ANALYSIS.md

@@ -0,0 +1,181 @@
+# E-98: why v10 loses to raw `claude -p` on the medium tier (EV-15)
+
+Source data: EV-15 (2026-09-28, harness `cc4992ed`, v10.2.5, `claude-opus-5-5`, 7 `pub-*` medium tasks, 2 runs per arm, 900s cap). The engine10 code this analysis cites is unchanged between `cc4992ed` and `origin/main` `d811e5c3` (`git diff --stat cc4992ed origin/main -- loki-ts/src/engine10` is empty).
+All paths below are relative to `/Users/lokesh/loki-ci-logs/eval/` (called EV below). `EV/ev15-summary.md` and `EV/ev15-stage-detail.md` are the run summaries.
+
+The founder's "12/14 vs 10/14" comes from EV-14. Its result files were lost when a worktree was force-removed (E-96/E-101). EV-15 re-ran the tier: raw 10/14, v10 9/14. The numbers here are EV-15's, and every claim cites an EV-15 file.
+
+## 1. Outcome per task-run
+
+| task | raw r1 | raw r2 | v10 r1 | v10 r2 | class |
+|---|---|---|---|---|---|
+| pub-jinja-1413 | pass | pass | **miss** | **miss** | **v10 loss (2)** |
+| pub-werkzeug-3105 | miss | miss (hidden_pass, no push) | miss | miss | shared miss |
+| pub-werkzeug-3271 | miss | miss | miss | pass | shared miss, one v10 win |
+| attrs-1313, click-2869, faker-1817, werkzeug-3121 | pass | pass | pass | pass | tie (v10 slower/costlier) |
+
+Only two task-runs were completed by raw and missed by v10: pub-jinja-1413 r1 and r2.
+- werkzeug-3105: both arms fail the same hidden test with the same error. `EV/ev15-v10-r{1,2}/logs/pub-werkzeug-3105*/grade_hidden.stdout.log` and `EV/ev15-raw-claude-r1/logs/pub-werkzeug-3105*/grade_hidden.stdout.log` all show `FAILED tests/test_routing.py::test_no_duplicate_head_options - DuplicateRuleError: / -> a`.
+- werkzeug-3271 r1: both arms fail with `FAILED tests/test_wrappers.py::test_user_agent - Failed: DID NOT WARN`.
+- These are task difficulty, not v10 stage losses.
+
+## 2. Failure table (v10 losses, with log citations)
+
+Event logs:
+- `EV/ev15-engine/v10-r1/pub-jinja-1413.v10.71372932a4ef/.loki/runs/e10-20260928T185044Z-5451/events.jsonl` (r1)
+- `EV/ev15-engine/v10-r2/pub-jinja-1413.v10.78270c64e4ab/.loki/runs/e10-20260928T190755Z-60df/events.jsonl` (r2)
+
+Hidden grade, in both runs (`EV/ev15-v10-r{1,2}/logs/pub-jinja-1413*/grade_hidden.stdout.log`):
+- Result: `2 failed, 12 passed`.
+- The failing tests are `TestSet::test_set_invalid` and `TestSet::test_namespace_redefined`, both `DID NOT RAISE TemplateRuntimeError`.
+- Both tests passed at baseline (`baseline.stdout.log`: only `test_namespace_set_tuple` failed).
+- So v10 broke the namespace runtime check. These are regressions in existing tests, not a missing feature.
+- Raw (opus) kept the check: `EV/ev15-raw-claude-r1/logs/pub-jinja-1413*/grade_hidden.stdout.log` shows `14 passed`.
+
+| run | stage that lost it | exact event lines | cause (one sentence) |
+|---|---|---|---|
+| jinja r1 | implement brief, then early exit past verify | seq21 `stage.completed implement {"exit": "spec_conflict", ..., "spec_conflict_reason": "plan step 8 requires adding tests to the existing tests/test_core_tags.py, but the rules make existing test files read-only ...", "impacted_tests": []}`; seq22 `stage.started commit` directly after it (no verify stage); seq25 `receipt.sealed ... "verdict": "SPEC_CONFLICT"` | The brief rule "existing test files are read-only" (implement.ts:33) turned a normal task into `spec_conflict`, and `earlyExit` (machine.ts:55) then skipped verify and the fix loop, so a sonnet diff that regressed two existing tests shipped untested. |
+| jinja r2 | verify (blind), so no fix round | seq32 `stage.completed implement {"exit": "done", ..., "impacted_tests": ["examples/basic/loki_wall_test_namespace_tuple_assign.py"]}`; `test.result verify {"name": "pytest:tests/test_core_tags.py", "cmd": "python -m pytest -q tests/test_core_tags.py", "result": "not_run", "reason": "python not found on PATH"}`; no `fix` event; seq45 `run.completed {"verdict": "PARTIAL", ...}` | Verify picked the right file (`tests/test_core_tags.py` contains both regressed tests), but ran it as `python`. The host has only `python3` (`which python` prints `python not found`), and the task's own `work/.venv` was never tried, so the check was `not_run`, `failures_grouped` stayed empty, and the fix loop never started. |
+
+What each session actually ran:
+- jinja r2 (`.loki/logs/bash-audit.jsonl`): the implementer ran only the Wall test, with system `python3` and `PYTHONPATH=src`. It never ran `tests/test_core_tags.py`.
+- Its log (`iteration-e10-20260928T190755Z-60df-impl.log`) says it added new tests "after `test_namespace_macro`". Seal's `weakened test: tests/test_core_tags.py` fires on any modification (seal.ts:176), not only on weakening.
+- The two regressed tests are therefore most likely still intact in the sandbox. A working verify would then have failed them. This is likely, not proven: the EV-15 working trees are gone, so the E-98a/E-98b re-run settles it.
+- jinja r1 needed two fixes to reach a fix round: the interpreter fix, and a verify that still runs after `spec_conflict`.
+
+## 3. Engine-wide facts (all 14 v10 event logs)
+
+Commands: the scripts `dump.py`, `sumall.py` and `cost.py` read every `EV/ev15-engine/v10-r*/*/.loki/runs/*/events.jsonl`.
+
+- **Verify never ran a test.**
+  - 27 of 27 `test.result` pytest checks are `not_run` / `python not found on PATH`.
+  - 9 of 9 ruff checks are `not_run` / `ruff not found on PATH`.
+  - 0 checks passed and 0 failed.
+  - There were 0 `fix` events in 14 runs. The fix loop is gated on `failures_grouped` (machine.ts:54), which can only fill from a `fail`.
+- **Verify was skipped in 5 of 14 runs.** Implement exited `spec_conflict` in jinja r1, werkzeug-3121 r1 and r2, and werkzeug-3271 r1 and r2.
+  - 4 of the 5 reasons cite the read-only rule for existing test files.
+  - 3121 r1 cites a Wall test that contradicts the plan.
+  - 9 verify stages completed, 5 did not start.
+- **The implementer is never told which existing tests to run.**
+  - Implement reported `impacted_tests: []` in 9 of 14 runs. The 5 non-empty ones are faker x2 (`tests/test_proxy.py`, lean path) and 3 Wall-test-only lists.
+  - Root cause: `repomap.ts` extracts symbols only with a JS `export` regex (`SYMBOL_RE`, repomap.ts:23). Every Python repo gets `entries: []`. For example, jinja r2 `repomap.json` has 118 files and 0 entries.
+  - So `selectRelevantFiles` returns `[]` (`"relevant_files": []` in 8 of 8 plan stages).
+  - Then `impactedTests` (implement.ts:17) takes `[]` from `??` and never falls back to `namedFiles`.
+- **Implement always ran on sonnet; raw ran on opus.**
+  - Every `session.started implement` has `"model": "claude-sonnet-5"`, because of the E-64 cascade (implement.ts:68, sizing.ts:63).
+  - Escalation to the run model happens only in a fix round with a test failure (fix.ts:60). That cannot happen while verify is blind.
+  - So on this harness the cascade is sonnet-only. This contributes to jinja, but is not proven as a cause: EV-14 v10 passed jinja 2/2.
+- **Wall hit its 90s limit in 5 of 14 runs:** 3105 r1 and r2, 3121 r2, 3271 r2, click r2.
+  - Evidence: `stage.failed wall {"reason": "limit"}` and `session.ended wall exit=killed dur=90.0`.
+  - Wall sealed at least one test in only 3 of 14 runs (3121 r1, 3271 r1, jinja r2).
+  - The one jinja Wall test was written under `examples/basic/`. The implementer reports that it was defective: `test_recursive_loop_matches_bug_report` references an undefined `id`.
+
+## 4. Cost: where v10 spends that raw does not
+
+Measured from `cost` events (`usd` non-null) and from raw `arm_stdout.log` usage:
+
+| | usd | cache read tokens | cache write tokens | output tokens |
+|---|---|---|---|---|
+| raw, 14 runs | $5.09 | 4.79M | 0.29M | 89k |
+| v10 implement (sonnet), 14 | $4.91 | 9.23M | 0.41M | 137k |
+| v10 wall (sonnet), 8 measured + 4 unmeasured | $1.11 | 0.32M | 0.15M | 40k |
+| v10 plan (opus), 8 | $0.90 | 0.30M | 0.06M | 16k |
+| v10 intake (sonnet, lean path), 2 | $0.17 | 0.08M | 0.03M | 1k |
+| **v10 total measured** | **$7.09** | 9.93M | 0.66M | 195k |
+
+- **Correction to EV-15's lower bound.** Measured v10 spend is at least $7.09, over 9 completions, so cost per completed is at least **$0.788**, not $0.5788. EV-15 summed only the 10 costed rows. It dropped the measured plan and implement dollars inside the 4 null rows ($0.32, $0.59, $0.25, $0.72 before Wall). Raw is $0.5085, so v10 is at least 55% more per completed task.
+- **Priority-2 gap, root cause.** All 4 `cost_usd: null` rows (3105 r1 and r2, 3121 r2, 3271 r2) are runs where Wall was killed at its limit.
+  - Evidence: `cost wall usd=None ... in=0 out=0`. Only `result-cost-*-impl.json` and `result-cost-*-plan.json` exist under `.loki/metrics/` (for example 3105 r1).
+  - A killed session never receives the SDK result message, so no cost file is written. `iteration-2.json` is Wall's efficiency record.
+- **Overhead stages.** Plan, Wall and intake cost $2.18, which is 31% of v10's measured spend. Wall bought a sealed test in 3 of 14 runs.
+- **Latency.** Implement waits for the whole `["plan", "wall"]` group. When Wall is killed at 90s beside a 15-31s plan, that adds about 60-75s before implement starts.
+- **Implement burns 1.9x raw's cache reads** (9.23M vs 4.79M), on a cheaper model. Most of it is in the long runs:
+  - attrs r2: 286s, 2.49M cache read, $0.97.
+  - jinja r2: 360s, 2.34M, $0.94.
+  - werkzeug-3105 r2: 1.11M, $0.47.
+  - werkzeug-3271 r2: 239s, 0.94M, $0.63.
+  - The brief gives no test to run, so the session explores instead of converging.
+
+Completed runs where v10 was slower or costlier than raw on the same task and run:
+- attrs r2: $1.06 and 317s vs $0.28 and 60s. Implement ran 286s.
+- click r2: 212s vs 49s. Wall was killed at 90s, then implement ran 121s.
+- faker r2: 128s vs 227s, a v10 win on time.
+- 3121 r2: 141s vs 29s. Wall was killed at 90s, then implement ended in `spec_conflict`.
+- 3271 r2: 330s, a v10 win. Wall was killed at 90s, then implement ran 239s.
+
+In every slow case the time went to Wall hitting its limit, or to a long implement session with no test to run.
+
+## 5. Root causes, ranked by lost completions explained
+
+| rank | cause | lost completions explained | other effect |
+|---|---|---|---|
+| 1 | Verify runs pytest as bare `python`: not on PATH, and the task `.venv` is ignored (verify.ts:31) | 2 of 2 (r2 directly; r1 once cause 2 is fixed) | 27/27 checks `not_run`; 0 fix rounds; cascade escalation unreachable |
+| 2 | `spec_conflict` early exit skips verify and fix (machine.ts:55), triggered by the "existing test files are read-only" rule (implement.ts:33) | 1 (jinja r1) | 5/14 runs unverified; 4 of the 5 caused by the read-only rule |
+| 3 | Implementer is given no impacted tests: Python repomap has 0 entries (repomap.ts:23), and `[]` blocks the `namedFiles` fallback (implement.ts:17) | contributing to 2 (the implementer never ran `test_core_tags.py`) | 9/14 implement runs had no tests to run; long, cache-heavy sessions |
+| 4 | Implement pinned to sonnet by the cascade, with escalation only through verify failures | contributing, unproven (EV-14 v10 passed jinja 2/2) | cheaper tokens, but 1.9x the cache reads |
+| 5 | Wall 90s limit kills and low yield | 0 | all 4 null-cost rows; +60-75s latency; 3/14 useful |
+
+## 6. Fix slice cards
+
+D33: the core is 4,942 lines against a 5,000 cap, so there are 58 lines of headroom. Card deltas below total +34 or fewer. IDs are E-98a to E-98f, to avoid clashing with an E-102 that exists on a local main.
+
+Re-running the failed tasks uses `eval/loki10/run.sh` with a separate `--out` per run. There is no `--runs` flag, so use n=3 per task: EV-14 passed jinja 2/2, so n=2 cannot tell a fix from noise. Copy each run's `work/.loki` out before cleanup (E-101), with the output under `/Users/lokesh/loki-ci-logs/eval/e98-*`.
+
+### E-98a: verify uses the project interpreter
+- Goal: pytest checks run on the repo's own environment, so a regression shows up as `fail` and drives a fix round.
+- File set:
+  - `loki-ts/src/engine10/stages/verify.ts`: `runnerCmd` resolves `<repoDir>/.venv/bin/python`, then `<repoDir>/venv/bin/python`, then `$VIRTUAL_ENV/bin/python`, then `python3`, then `python`.
+  - The same file: each check records the interpreter it used. A check that ran on a system interpreter adds "tests ran on the system interpreter" to not_proven, because system `python3` imported the installed Jinja2 3.1.6, not `src/`, in jinja r2.
+  - `loki-ts/tests/engine10/verify*.test.ts`.
+  - Net core delta: at most +12.
+- Wall check:
+  - Red first: a fixture with a `.venv/bin/python` shim and no `python` on PATH gives `not_run` before the change and `pass`/`fail` after. A second fixture with system python3 only records `interpreter: system` plus the not_proven line.
+  - Then `eval/loki10/run.sh --arm v10 --tasks pub-jinja-1413 --out /Users/lokesh/loki-ci-logs/eval/e98a-r{1,2,3}`.
+  - Expected: `test.result` for `pytest:tests/test_core_tags.py` is `pass` or `fail` (never `not_run`) in 3 of 3 runs, and completed in at least 2 of 3.
+- Budget: 30 min. Tier: HIGH (verify).
+
+### E-98b: spec_conflict still verifies
+- Goal: a `spec_conflict` implement exit still runs verify and the fix loop. Only `already_satisfied` short-circuits. The receipt keeps the `SPEC_CONFLICT` verdict and reason.
+- File set: `loki-ts/src/engine10/machine.ts` (`earlyExit`, plus the verdict carry-through only if seal needs it), `loki-ts/tests/engine10/machine*.test.ts`. Net core delta: at most +3.
+- Wall check:
+  - A fake-stage test: implement `spec_conflict`, then verify runs, then a `fail` triggers `fix`, then seal still says `SPEC_CONFLICT`. It must fail on current main.
+  - Then re-run `pub-jinja-1413`, `pub-werkzeug-3121` and `pub-werkzeug-3271` at n=3 into `EV/e98b-*`, with E-98a merged.
+  - Expected: every run with a `spec_conflict` exit has a `stage.completed verify`. Completions are at least EV-15's on these tasks (jinja 0/2, 3121 2/2, 3271 1/2).
+- Budget: 30 min. Tier: HIGH (moat flow).
+
+### E-98c: brief allows adding tests; impacted tests fall back
+- Goal: existing test files are append-only (add new test functions, never edit or delete existing ones). Wall files stay read-only and are restored as today; seal.ts:176 still reports any modification. `impactedTests` falls back to `namedFiles` when `relevant_files` is empty, not only when it is missing.
+- File set: `loki-ts/src/engine10/stages/implement.ts` (the brief line at :33, and `impactedTests` at :17 using `?.length ?` in place of `??`), plus its test. Net core delta: at most +2.
+- Wall check:
+  - A unit test: a brief with `relevant_files: []` and a task naming `parser.py` lists that file's tests.
+  - Re-run `pub-werkzeug-3121` and `pub-werkzeug-3271` at n=3 into `EV/e98c-*`.
+  - Expected: no run exits `spec_conflict` citing read-only existing tests (4 of 14 did in EV-15), and completions do not drop.
+- Budget: 15 min. Tier: MEDIUM.
+
+### E-98d: Python symbols in the repo map
+- Goal: `buildRepoMap` extracts Python top-level `def` and `class` names, alongside the JS `export` regex, so `selectRelevantFiles` and the impacted-test map work on Python repos.
+- File set: `loki-ts/src/engine10/repomap.ts`, `loki-ts/tests/engine10/repomap*.test.ts`. Net core delta: at most +4 (a second regex applied to `.py`).
+- Wall check:
+  - Offline, no model: on each of the 7 medium task repos at their `repo_ref`, `relevant_files` is non-empty and contains the file the upstream refdiff touches (`eval/loki10/refdiff/`). At least 5 of 7 must pass. EV-15 had 0 of 7, 8 of 8 plan stages empty.
+  - Keyword ties across a package directory are a known ceiling. Record the rank of the upstream file.
+- Budget: 30 min. Tier: MEDIUM.
+
+### E-98e: killed sessions still report cost
+- Goal: a session killed at its stage limit writes a cost record from the per-message usage already streamed, marked `source: "partial-stream"`, so the harness row is never `cost_usd: null` because Wall was killed.
+- File set: `loki-ts/src/engine10/session.ts`, `loki-ts/src/engine10/cost.ts`, and a test. Net core delta: at most +10, or offset by deleting dead code in cost.ts.
+- Wall check:
+  - A unit test: a fake stream killed after 2 assistant messages gives a non-null usd equal to the summed usage price.
+  - Re-run `pub-werkzeug-3105`, `pub-werkzeug-3121` and `pub-werkzeug-3271` at n=3 into `EV/e98e-*`.
+  - Expected: `cost_usd` is non-null on every row, and `eval/loki10/summarize` reports a numeric `cost_per_completed`.
+- Budget: 30 min. Tier: MEDIUM.
+
+### E-98f: A/B of Wall and cascade on medium (eval-first, then a sizing change)
+- Goal: measure whether Wall (`LOKI_E10_WALL=0`) and the sonnet cascade (`LOKI_E10_CASCADE=0`) pay for themselves on medium, with E-98a to E-98c merged. Only if a knob wins on completions without losing on cost, change `sizing.ts` so that `size: "normal"` takes that path by default.
+- File set: an eval run only, then `loki-ts/src/engine10/sizing.ts` (at most +3 core lines) and its test.
+- Wall check:
+  - All 7 medium tasks at n=3 per arm: default, `LOKI_E10_WALL=0`, `LOKI_E10_CASCADE=0`, into `EV/e98f-{default,nowall,nocascade}-r{1,2,3}`.
+  - The chosen default must be at or above raw's EV-15 10/14 rate (71.4%) on completions, and below raw's $0.5085 on cost per completed.
+  - The results are published in this file as the "after" table.
+- Budget: 60 min of eval, then a 15 min code change. Tier: HIGH (it changes the default flow).
+
+Order: a, b, c, d and e in parallel (their file sets do not overlap), then f. The "after" table for the founder is the E-98f default arm next to section 1 above.

package/docs/v10/METRICS.md

@@ -124,6 +124,8 @@ out of pending.txt until S-19's stricter pass bar is also in the tree, or
 the merge itself becomes a ratchet regression. S-19 promoted to the
 critical path and reviewed immediately.
 
+## Usage (hourly, from scripts/usage-governor.py)
+
 ## CI: Tests workflow shell-tests sharding (S-81, supersedes S-70)
 
 S-70 resharded shell-tests 4 -> 8 with a plain `idx % n` split and measured

package/docs/v10/PROGRESS.md

@@ -1,5 +1,21 @@
 # Progress
 
+## 2026-09-28T20:17Z: v10.4.0 blocked by gitleaks, re-released as v10.4.1; E-98 fixes landing; drift audit (turn 576)
+- 19:40 slot, late: v10.4.0 cut 19:50:24Z (7895a698: G-01, M-08, E-101, E-102, E-103). Release 36475005937 FAILED at required-ci: Security Audit gitleaks "leaks found: 3", all in bbe83c7a:tests/test-eval-archive.sh, synthetic E-101 redaction fixtures (AKIAABCD..., sk-ant-planted..., a token string). Not published; no tag.
+- P0 response (20:02Z to 20:14Z): exact fingerprints allowlisted with a reason (6358e0a6, local gitleaks on d811e5c3..HEAD: no leaks found); Tests and Bun Parity green on it; v10.4.1 cut 20:14:04Z (30afbd07) carrying the 10.4.0 notes. Watcher on Release, npm and body. Guard E-110 (HIGH): pre-push scans every pushed commit and path, fixtures built at runtime. Root cause: pre-push ran gitleaks only for eval fixture pushes while CI scans everything.
+- Release tooling found at the cuts: release.sh left a new debugId in dist/loki.js while restoring the map (fixed by hand twice; guard E-108 merged locally 6b65aaff, 15/0).
+- E-98 medium fixes merged locally: E-98b (97b80ca4, spec_conflict verifies, opus APPROVE), E-98c (f4606246), E-98d (15859bef) (Python repo map incl. async def; offline 4/7 repos rank the upstream file top 8, was 0/7), E-98a (5cdd611d, verify interpreter plus seal: a system-interpreter pass can never seal VERIFIED; opus APPROVE r2; I re-ran the seal mutation: old seal.ts fails 2 of 14 seal tests). Combined core is 5003 lines (budget.test.ts FAIL): P0 E-111 trims it before any engine train ships. E-98e (killed-session cost) in rework: +42 core lines against +10, and 55 full-suite failures not yet baselined against main.
+- Also merged locally: E-106 P0 (claude-agent-sdk pins aligned to 0.3.283; root had 0.3.267 and Dockerfile 0.3.208 for 20h), E-88a (release body gate, opus APPROVE), E-91 (pulse ids), G-02 (OPUS_SHARE, BUDGET_BURN), E-104, E-105.
+- Drift audit: G-02 checks read UNKNOWN because the governor takes 115s (E-109 building). SESSION_STALLED misreads from a subdirectory or worktree (E-107, rework for a test-name collision). DEP-02..04 were stale "building" rows with no agent (parked). Load 2.7, 12 worktrees; headcount held per D40 while E-98f waits on E-111.
+
+## 2026-09-28T19:42Z: 19:20 slot shipped (v10.3.1); medium failure explained; 7 builders on the fixes
+- 19:20 slot: v10.3.1 cut 19:22:09Z (d811e5c3: E-99, M-30); Release 36471746478 success, publish-npm 19:30:56Z (cut to publish 8m47s), npm latest 10.3.1 gitHead d811e5c3. GitHub body came out as the placeholder "Release v10.3.1" (2 lines); backfilled from CHANGELOG (9 lines). E-88a (the enforcement) is being rebased onto E-99 now.
+- Release blocker found at the cut: release.sh --bump-only in a fresh worktree deleted 4 tracked dist files when the build failed. Guard E-102 merged (c35d3fa7, test red 3/4 first, then 7/0) and E-103 for the build-ok-but-no-version branch (cd3d3d26, 10/0).
+- EV-15 (medium re-run, durable files in ~/loki-ci-logs/eval/ev15-*): raw 10/14, $0.5085, p50 56s; v10 9/14, at least $0.788 per completed (E-98 correction), p50 128s. No flip.
+- E-98 (docs/v10/MEDIUM-ANALYSIS.md, d496db89): v10's verify stage hard-codes `python`; this host has only `python3`, so 27/27 pytest and 9/9 ruff checks were not_run and no fix round fired in any of 14 runs. The only raw-won/v10-lost task (jinja-1413 x2) broke two existing tests a working verify would have caught. Other causes: spec_conflict skips verify (5/14), empty Python repo map (0 symbols, 9/14 implement runs had no tests to run), Wall killed at 90s (5/14, all 4 null-cost rows).
+- Dispatched 19:40Z (sonnet): E-98a (verify interpreter), E-98b (spec_conflict still verifies), E-98c (append-only tests, impacted-test fallback), E-98d (Python repo map), E-98e (killed-session cost), E-88a rebase, E-91 (pulse id regex: E-98a..e and G-02 were invisible to the building count). E-98f (A/B of Wall and cascade, n=3 per arm) follows as one combined re-run.
+- Merged locally for the 19:40 train: G-01 (governor, opus APPROVE r3 fa279532), M-08 (modernize dispatch, Tech Lead APPROVE r3 766a493b, alias-forwarding 213/0), E-102, E-103, E-101 (durable eval results plus safe prune, used to remove 6 finished worktrees). Fast tier: two failures, both pre-existing on origin/main and env-conditional (E-104 gitleaks allowlists the AWS example key; E-105 heredoc checker false positive at run.sh:5548).
+
 ## 2026-09-28T19:04Z: drift audit (turn 528)
 - M-08 (modernize arm in bin/loki) first build would have turned test-engine10-dispatch.sh red (it counted exactly 1 engine10 line). Fixed in-slice (7feff1f8): exactly 2 exec lines, one per named arm, red on a stray third; 35/0 and 13/0. Tech Lead review running.
 - M-30 guide: Tech Lead REJECT, the --resume example id failed MID_RE (exit 2 when copied). Rework adds a MID_RE check over every id in the guide.