loki-mode 10.5.15 → 10.5.17

package/autonomy/loki

@@ -1627,6 +1627,7 @@ show_help() {
     echo "Build:"
     echo "  start [SPEC]     Start a build (PRD file, GitHub/GitLab/Jira/Azure issue, or no arg)"
     echo "  plan <PRD-file>  Dry-run analysis: complexity, cost, execution plan"
+    echo "  backlog <owner/repo> --all|--label X|--issues N,N   Run every matching open issue, N in parallel"
     echo "  quickstart [idea]  Guided first build: setup, idea, template, plan, go"
     echo ""
     echo "Session:"
@@ -1765,7 +1766,7 @@ show_help() {
     # missing from this list, so a new command cannot ship invisible.
     echo ""
     echo "All commands:"
-    echo "  agent analyze api assets audit bench checkpoint (cp) ci cleanup"
+    echo "  agent analyze api assets audit backlog bench checkpoint (cp) ci cleanup"
     echo "  cluster cockpit code compliance completions compound config context (ctx)"
     echo "  cost council crash dashboard demo deploy docker docs doctor dogfood"
     echo "  enterprise estimate explain export failover github grill heal help"
@@ -9306,6 +9307,32 @@ _deploy_receipt_verdict() {
     # evaluated, so no key set is written and the verdict is UNCHECKED, never
     # TAMPERED: the hash is fine, we just cannot vouch for who signed it. A
     # local key only proves "a holder of this key", not an independent build.
+    # Token SHAPE before any key lookup (mirrors engine10 checkAttestation): a present
+    # attestation that is not a string, not a 3-part JWS, or whose header/payload are not
+    # JSON with alg EdDSA is junk, so TAMPERED, never UNCHECKED, with or without a key.
+    if ! python3 -E - "$pj" >/dev/null 2>&1 <<'PYSHAPE'
+import sys
+sys.path[:] = [p for p in sys.path if p not in ("", ".")]
+import json, base64
+def dec(x):
+    return json.loads(base64.urlsafe_b64decode(x + "=" * (-len(x) % 4)))
+v = json.load(open(sys.argv[1])).get("verification") or {}
+t = v.get("attestation")
+if t is None or t == "":
+    sys.exit(0)
+if not isinstance(t, str):
+    sys.exit(1)
+parts = t.split(".")
+if len(parts) != 3 or not all(parts):
+    sys.exit(1)
+try:
+    h = dec(parts[0]); dec(parts[1])
+except Exception:
+    sys.exit(1)
+sys.exit(0 if isinstance(h, dict) and h.get("alg") == "EdDSA" else 1)
+PYSHAPE
+    then printf '%s' "TAMPERED"; return 0; fi
+
     local jwks att
     jwks="$(mktemp "${TMPDIR:-/tmp}/loki-jwks.XXXXXX")" || { printf '%s' "UNCHECKED"; return 0; }
     python3 -E - "${_LOKI_SCRIPT_DIR}" "$pj" >"$jwks" 2>/dev/null <<'PY' || true
@@ -12593,7 +12620,7 @@ cmd_config() {
             echo "  get KEY         Get a configuration value"
             echo "  example         Print an annotated config template (for --config)"
             echo "  schema          Print the key -> env-var mapping table"
-            echo "  validate FILE   Validate a config file (--config) without applying it"
+            echo "  validate [FILE] Validate loki.yaml (no FILE: repo root, then ~/.loki) or a --config file"
             echo ""
             echo "Settable keys (v6.0.0):"
             echo "  maxTier              Cost ceiling: opus, sonnet, haiku (default: opus)"
@@ -12797,14 +12824,43 @@ cmd_config_schema() {
     loki_config_generate_schema
 }
 
+# D51: headless backlog runner. One v10 issue-mode run per open issue, each in
+# its own worktree and branch, at most N in parallel (loki.yaml concurrency).
+cmd_backlog() {
+    case "${1:-}" in
+        ""|--help|-h|help)
+            echo -e "${BOLD}loki backlog${NC} - run a v10 issue-mode run for every matching open issue"
+            echo ""
+            echo "Usage: loki backlog owner/repo (--all | --label X | --issues 1,2,3) [--concurrency N] [--dry-run]"
+            echo ""
+            echo "  --all             Every open issue"
+            echo "  --label X         Open issues with label X"
+            echo "  --issues 1,2,3    Exactly these issue numbers"
+            echo "  --concurrency N   Max runs in parallel (default: loki.yaml concurrency, else 2)"
+            echo "  --dry-run         List what would run; launch nothing"
+            echo ""
+            echo "Run from a checkout of owner/repo. Each issue runs in its own worktree on loki/backlog-N."
+            echo "Config: loki.yaml (repo root, then ~/.loki/loki.yaml); see docs/loki.yaml.example."
+            echo "Exit: 0 every issue ended VERIFIED or with a PR; 3 only budget stops; 1 otherwise; 2 usage."
+            return 0
+            ;;
+    esac
+    command -v python3 >/dev/null 2>&1 || { echo -e "${RED}loki backlog: python3 is required${NC}" >&2; return 2; }
+    python3 "$_LOKI_SCRIPT_DIR/lib/backlog.py" "$@"
+}
+
 # #691: validate a config file (--config) WITHOUT applying it. Reports
 # unresolved ${VAR} refs, raw-secret literals (error), and per-value validation
 # failures. Non-zero exit on any failure.
 cmd_config_validate() {
-    local file="${1:-}"
-    if [ -z "$file" ]; then
-        echo -e "${RED}Usage: loki config validate <file>${NC}" >&2
-        return 2
+    local file="${1:-}" _loki_yaml
+    # D51: loki.yaml (UI + headless config) has its own schema; no argument
+    # validates the discovered loki.yaml (repo root, then ~/.loki/loki.yaml).
+    case "$(basename -- "$file")" in "" | loki.yaml | loki.yml | loki.yaml.example) _loki_yaml=1 ;; *) _loki_yaml=0 ;; esac
+    if [ "$_loki_yaml" = 1 ]; then
+        command -v python3 >/dev/null 2>&1 || { echo -e "${RED}config validate: python3 is required${NC}" >&2; return 2; }
+        python3 "$_LOKI_SCRIPT_DIR/lib/loki_yaml.py" validate ${file:+"$file"}
+        return $?
     fi
     if ! declare -f loki_config_validate_file >/dev/null 2>&1; then
         echo -e "${RED}config validate: config-map.sh helper not loaded${NC}" >&2
@@ -21767,6 +21823,9 @@ main() {
         assets)
             cmd_assets "$@"
             ;;
+        backlog)
+            cmd_backlog "$@"
+            ;;
         config)
             cmd_config "$@"
             ;;

package/autonomy/run.sh

@@ -245,7 +245,18 @@ if [ -z "${LOKI_QUICK_INNER:-}" ] && [ "${LOKI_VERBOSE:-0}" != "1" ] && [ "${BAS
     case "${1:-}" in */quick-prd-*.md | quick-prd-*.md)
         _qd="$(cd "$(dirname "$1")" && pwd -P)"; rm -f "$_qd/quick-receipt.txt"
         # Async with default INT/QUIT (a bare `&` child ignores them), signals forwarded.
-        ( trap - INT QUIT; LOKI_QUICK_DIR="$_qd" LOKI_QUICK_OUTER_PID=$$ LOKI_QUICK_INNER=1 exec "$BASH" "$0" "$@" >"$_qd/quick-run.log" ) &
+        # A Node/Bun parent starts us with SIGPIPE ignored, and bash cannot reset a
+        # signal ignored on entry; every `echo big | head -1` then prints "echo: write
+        # error: Broken pipe" onto the user's terminal. Re-exec the inner run through
+        # python3 with SIGPIPE back at default (SIG_DFL survives exec).
+        _qexec=("$BASH" "$0" "$@")
+        # Env differences under python (not bash): LC_CTYPE may be set when the locale is
+        # C, macOS adds __CF_USER_TEXT_ENCODING, and SIGXFSZ stays ignored.
+        # The import probe guards a python3 that exists but is broken (CLT stub, pyenv shim).
+        if command -v python3 >/dev/null 2>&1 && python3 -c 'import os,signal' >/dev/null 2>&1; then
+            _qexec=(python3 -c 'import os,signal,sys;signal.signal(signal.SIGPIPE,signal.SIG_DFL);os.execv(sys.argv[1],sys.argv[1:])' "${_qexec[@]}")
+        fi
+        ( trap - INT QUIT; LOKI_QUICK_DIR="$_qd" LOKI_QUICK_OUTER_PID=$$ LOKI_QUICK_INNER=1 exec "${_qexec[@]}" >"$_qd/quick-run.log" ) &
         _qpid=$!
         trap 'kill -INT "$_qpid" 2>/dev/null' INT
         trap 'kill -TERM "$_qpid" 2>/dev/null' TERM HUP
@@ -7429,7 +7440,22 @@ init_loki_dir() {
         fi
     fi
 
-    mkdir -p .loki/{state,queue,messages,logs,config,prompts,artifacts,scripts}
+    # crash.sh's disclosure sentinel can have left a regular FILE at .loki/config
+    # (LOKI_DIR is the project .loki); mkdir -p of the config DIRECTORY then fails
+    # with "File exists". Fold the file into the directory (back-compat sentinel only),
+    # but ONLY when it holds nothing except that sentinel, and NEVER for ~/.loki (a run
+    # started from $HOME): there config is the user's real settings FILE (telemetry opt-out).
+    if [ -f .loki/config ] && [ ! -L .loki/config ] \
+       && [ "$(cd .loki 2>/dev/null && pwd -P)" != "$(cd "${HOME:-/nonexistent}/.loki" 2>/dev/null && pwd -P)" ] \
+       && [ -z "$(grep -v -e '^DISCLOSURE_SHOWN=true$' -e '^[[:space:]]*$' .loki/config 2>/dev/null)" ]; then
+        mv .loki/config .loki/config.disclosure.tmp 2>/dev/null \
+            && mkdir -p .loki/config 2>/dev/null \
+            && mv .loki/config.disclosure.tmp .loki/config/disclosure 2>/dev/null
+    fi
+    # Retry once: a concurrent creator of the same dir can make the first mkdir -p
+    # fail with "File exists" (seen on CI, leaked to the quiet quick terminal).
+    mkdir -p .loki/{state,queue,messages,logs,config,prompts,artifacts,scripts} 2>/dev/null \
+        || mkdir -p .loki/{state,queue,messages,logs,config,prompts,artifacts,scripts}
     mkdir -p .loki/queue
     mkdir -p .loki/state/checkpoints
     mkdir -p .loki/artifacts/{releases,reports,backups}
@@ -7757,11 +7783,11 @@ write_dashboard_state() {
     local tasks_failed=0
 
     if [ -f ".loki/state/orchestrator.json" ]; then
-        current_phase=$(python3 -c "import json; print(json.load(open('.loki/state/orchestrator.json')).get('currentPhase', 'BOOTSTRAP'))" 2>/dev/null || echo "BOOTSTRAP")
-        version=$(python3 -c "import json; print(json.load(open('.loki/state/orchestrator.json')).get('version', 'unknown'))" 2>/dev/null || echo "unknown")
-        started_at=$(python3 -c "import json; print(json.load(open('.loki/state/orchestrator.json')).get('startedAt', ''))" 2>/dev/null || echo "")
-        tasks_completed=$(python3 -c "import json; print(json.load(open('.loki/state/orchestrator.json')).get('metrics', {}).get('tasksCompleted', 0))" 2>/dev/null || echo "0")
-        tasks_failed=$(python3 -c "import json; print(json.load(open('.loki/state/orchestrator.json')).get('metrics', {}).get('tasksFailed', 0))" 2>/dev/null || echo "0")
+        _dv=$(python3 -c "import json; print(json.load(open('.loki/state/orchestrator.json')).get('currentPhase', 'BOOTSTRAP'))" 2>/dev/null) && current_phase="$_dv"
+        _dv=$(python3 -c "import json; print(json.load(open('.loki/state/orchestrator.json')).get('version', 'unknown'))" 2>/dev/null) && version="$_dv"
+        _dv=$(python3 -c "import json; print(json.load(open('.loki/state/orchestrator.json')).get('startedAt', ''))" 2>/dev/null) && started_at="$_dv"
+        _dv=$(python3 -c "import json; print(json.load(open('.loki/state/orchestrator.json')).get('metrics', {}).get('tasksCompleted', 0))" 2>/dev/null) && tasks_completed="$_dv"
+        _dv=$(python3 -c "import json; print(json.load(open('.loki/state/orchestrator.json')).get('metrics', {}).get('tasksFailed', 0))" 2>/dev/null) && tasks_failed="$_dv"
     fi
 
     # Emit phase change event if phase has changed (checked in background monitor loop)

package/autonomy/verify.sh

@@ -3074,6 +3074,15 @@ sys.exit(0 if ok else 3)" "$lib" "$pj" 2>/dev/null || rc=$?
     declare -f _deploy_receipt_verdict >/dev/null 2>&1 || return 0
     local att
     att="$(_deploy_receipt_verdict "$pj")"
+    # D47: UNSIGNED is never a pass; --allow-unsigned / LOKI_VERIFY_ALLOW_UNSIGNED=1 accepts it, said aloud.
+    if [ "$att" = "UNSIGNED" ]; then
+        if [ "${VERIFY_ALLOW_UNSIGNED:-0}" = "1" ] || [ "${LOKI_VERIFY_ALLOW_UNSIGNED:-}" = "1" ]; then
+            printf 'attestation: UNSIGNED (accepted by --allow-unsigned; integrity not attested)\n'
+            return 0
+        fi
+        printf 'attestation: UNSIGNED, integrity not attested; refusing (pass --allow-unsigned to accept)\n'
+        return 1
+    fi
     printf 'attestation: %s\n' "$att"
     [ "$att" != "TAMPERED" ]
 }
@@ -3093,6 +3102,7 @@ verify_main() {
     VERIFY_CHECK_FRESH=0
     # Opt-in machine-readable stdout (--json). Default 0 = exactly today.
     VERIFY_JSON=0
+    VERIFY_ALLOW_UNSIGNED=0
 
     # Fail-closed defaults. These globals are read at the end of this function
     # (the VERDICT banner and the function return code). verify_compute_verdict()
@@ -3158,6 +3168,7 @@ verify_main() {
                 # verdict above stays authoritative for the exit code. Unset =
                 # exactly today's behavior. See verify_hosted_enrich().
                 VERIFY_HOSTED=1; shift ;;
+            --allow-unsigned) VERIFY_ALLOW_UNSIGNED=1; shift ;;
             --) shift; break ;;
             -*)
                 _verify_err "unknown option: $1"; verify_help; return $VERIFY_EXIT_ERROR ;;

package/completions/_loki

@@ -205,6 +205,7 @@ function _loki_commands {
         'crash:Crash report management'
         'otel:OpenTelemetry management'
         'wiki:Wiki commands'
+        'backlog:Run every matching open issue, N in parallel'
         'explain:Explain Loki concepts'
         'optimize:Optimization commands'
         'review:Code review commands'

package/completions/loki.bash

@@ -5,8 +5,8 @@ _loki_completion() {
     _init_completion || return
 
     # Main subcommands (must match autonomy/loki main case statement)
-    local main_commands="start quick monitor demo tour welcome init stop pause resume steer status next ship dashboard web serve api sandbox notify import github issue config provider reset memory compound checkpoint council dogfood projects enterprise secrets cockpit secure own handoff doctor watchdog audit metrics syslog onboard share proof receipt outcomes explain plan report cost estimate kpis stats test ci watch telemetry agent context ctx code run export review optimize heal modernize migrate cluster worktree wt trigger failover remote deploy docker mcp magic assets analyze compliance crash open otel preview quickstart rc rollback self-update sentrux setup-skill spec state template trust trust-metrics ultracode update verify voice why wiki bench cleanup logs grill docs cp version completions help"
-    local main_commands="start quick monitor demo tour welcome init stop pause resume steer status next ship dashboard web serve api sandbox notify import github issue intent config provider reset memory compound checkpoint council dogfood projects enterprise secrets cockpit secure own handoff doctor watchdog audit metrics syslog onboard share proof receipt explain plan report cost estimate kpis stats test ci watch telemetry agent context ctx code run export review optimize heal modernize migrate cluster worktree wt trigger failover remote deploy docker mcp magic assets analyze compliance crash open otel preview quickstart rc rollback self-update sentrux setup-skill spec state template trust trust-metrics ultracode update verify voice why wiki bench cleanup logs grill docs cp version completions help"
+    local main_commands="start backlog quick monitor demo tour welcome init stop pause resume steer status next ship dashboard web serve api sandbox notify import github issue config provider reset memory compound checkpoint council dogfood projects enterprise secrets cockpit secure own handoff doctor watchdog audit metrics syslog onboard share proof receipt outcomes explain plan report cost estimate kpis stats test ci watch telemetry agent context ctx code run export review optimize heal modernize migrate cluster worktree wt trigger failover remote deploy docker mcp magic assets analyze compliance crash open otel preview quickstart rc rollback self-update sentrux setup-skill spec state template trust trust-metrics ultracode update verify voice why wiki bench cleanup logs grill docs cp version completions help"
+    local main_commands="start backlog quick monitor demo tour welcome init stop pause resume steer status next ship dashboard web serve api sandbox notify import github issue intent config provider reset memory compound checkpoint council dogfood projects enterprise secrets cockpit secure own handoff doctor watchdog audit metrics syslog onboard share proof receipt explain plan report cost estimate kpis stats test ci watch telemetry agent context ctx code run export review optimize heal modernize migrate cluster worktree wt trigger failover remote deploy docker mcp magic assets analyze compliance crash open otel preview quickstart rc rollback self-update sentrux setup-skill spec state template trust trust-metrics ultracode update verify voice why wiki bench cleanup logs grill docs cp version completions help"
 
     # 1. If we are on the first argument (subcommand)
     if [[ $cword -eq 1 ]]; then

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "10.5.15"
+__version__ = "10.5.17"
 
 # Expose the control app for easy import
 try:

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 The flagship product of [Autonomi](https://www.autonomi.dev/). Loki Mode is a spec-driven autonomous builder with a built-in trust layer that takes any spec to a deployed product and verifies completion with evidence (quality gates plus a completion council), not just a "done" claim. Complete installation instructions for all platforms and use cases.
 
-**Version:** v10.5.15
+**Version:** v10.5.17
 
 ---
 

package/docs/exit-codes.md

@@ -63,6 +63,21 @@ Code 3 matters more than it looks. A verifier that cannot run is not a pass,
 so `[ $rc -eq 0 ]` is the only safe test for "verified" -- `[ $rc -ne 2 ]`
 would treat a broken verifier as acceptable.
 
+### UNSIGNED receipts (D47)
+
+An UNSIGNED receipt (no attestation, so its integrity is not attested) is never
+a pass, on either engine, with or without a local key. A stripped receipt must
+not rank above UNCHECKED.
+
+| Engine | UNSIGNED without the flag | With `--allow-unsigned` or `LOKI_VERIFY_ALLOW_UNSIGNED=1` |
+|---|---|---|
+| Engine10 (`loki-ts`, `verify_cmd.ts`) | exit 3, `attestation: UNSIGNED, integrity not attested; refusing (pass --allow-unsigned to accept)` | exit 0, `attestation: UNSIGNED (accepted by --allow-unsigned; integrity not attested)` |
+| Legacy shell (`autonomy/verify.sh`) | BLOCKED (non-zero) | the receipt line passes with the same accepted line |
+
+Engine10 `loki verify [run-id]` exits: 0 verified, 1 tampered, 2 unchecked,
+3 unsigned (refused), 66 no runs. The flag never changes TAMPERED or UNCHECKED,
+and verify never creates a signing key.
+
 An early draft spec listed `1=BLOCKED, 2=CONCERNS`. That ordering was rejected:
 it is not used anywhere, it has no consumers, and it inverts the
 severity-rises-with-the-code rule that every other command follows.

package/docs/v10/BOARD.md

@@ -625,25 +625,35 @@ Source: ~/git/autonomi-dev/research/2026-09-30-adoption/SWARM-PROMPT-ADOPTION.md
 | E-155 | Incident 21:58Z: a shell test run from the MAIN checkout (633 diff-selected tests, xargs -P 4, 17:58:16 local) switched HEAD to the stale branch loki/session-1789047299-95963; main ref intact, restored by `git checkout main` 33s later. Candidates running that second: test-metrics-command, test-metrics-json-unmeasured, test-migration-post-edit-revert, test-mirofish-integration, test-magic-injection. A stray root bun.lock also appeared at 17:54. Guard: tests/run-all-tests.sh records `git symbolic-ref HEAD` + status before and fails loudly when any test changes the parent checkout branch; bisect the culprit with that guard | tests/run-all-tests.sh, culprit test | MEDIUM | guard test red when a test runs git checkout in the parent repo | merged@2026-09-30T22:27Z | process fix already applied: shell batches run only in a disposable worktree |
 | E-154c | CORRECTED PREMISE (builder, 59c1cb54): CI shards set LOKI_TEST_SHARD, not LOKI_TEST_LIST (a list-only mode that runs nothing), so sharded CI DOES run the guards; the train/14 failure was the guard test inheriting LOKI_TEST_SHARD. Slice adds shard-mode guard checks only. Original claim: the E-154/E-155 guards (run-owned signing key default, real ~/.loki/keys snapshot, parent HEAD check) are skipped whenever LOKI_TEST_LIST is set, and CI shards set it, so sharded CI runs carry NO guard: a test writing the real key dir or switching the parent branch would pass on CI. Make the guards active in shard mode too (the LOKI_TEST_LIST skip was presumably for selective local runs) and keep the guard test hermetic | tests/run-all-tests.sh, tests/test-e154-e155-guards.sh | MEDIUM | guard checks run and pass under LOKI_TEST_LIST | released@2026-10-01T01:19Z | found while fixing train/14 shard 6 Released in v10.5.14 (merge 0d8a5dce is an ancestor of v10.5.14). |
 | E-156 | Incident 22:00Z: pre-push gitleaks (generic-api-key) blocked train/11 on the key FILE NAME string `.loki/keys/receipt-ed25519.pem` (seal.ts:68, seal.test.ts:174, dist/loki.js:1244); no key material. Fixed by exact .gitleaksignore fingerprints, but any future commit that rewrites the minified dist line re-triggers and can block a release push. Durable fix needs a CTO call: a narrow `.gitleaks.toml` allowlist (regexTarget=secret, `^receipt-ed25519\.pem$`, extend defaults) pushed with LOKI_ALLOW_GITLEAKS_CONFIG_CHANGE=1 plus a test that a real key in the same position is still caught | .gitleaks.toml, tests/test-pre-push-gitleaks.sh | HIGH | real-key fixture still flagged; filename allowed | released@2026-10-01T01:19Z | CTO approval (security scan config) Released in v10.5.14 (merge 314b89fe is an ancestor of v10.5.14). |
-| E-157 | D46: Security Audit verdict reuse. (a) security-audit.yml also runs on push to train/** so every train tip gets the full --all gitleaks scan before main is fast-forwarded; (b) required-ci reuses the parent Security Audit verdict for an eligible VERSION-only bump under the existing eligibility rule (diff is VERSION plus generated version stamps only, parent run success at that exact SHA). Moat test: a non-VERSION-only bump still re-runs Security Audit. Supersedes FOUNDER-QUEUE 14 | .github/workflows/security-audit.yml, release.yml (required-ci), tests | HIGH | non-VERSION-only bump re-runs the scan | ready@2026-10-01T00:30Z | after slice-D46-ci |
-| E-159 | Pre-existing secret-scan gaps found by the E-157 r2 opus reviewer: (a) an evil merge, a merge commit whose OWN content adds a secret (merge -s ours --no-commit, token in the merge commit), is invisible to both the PARENT..SHA range scan and the --all scan (only `gitleaks dir` found it); (b) pinned gitleaks 8.30.0 exits 0 when its internal git log fails (invalid range), a latent fail-open. Fix: --diff-merges=first-parent (or -m) in --log-opts for both modes or a working-tree scan at the release SHA; guard `git rev-list RANGE` success or treat `[git] fatal` as failure | scripts/security-audit-gitleaks.sh, workflows, tests | HIGH | evil-merge and bad-range fixtures fail the scan | ready@2026-10-01T01:07Z | CI-health engineer after E-157 r3 |
+| E-157 | D46: Security Audit verdict reuse. (a) security-audit.yml also runs on push to train/** so every train tip gets the full --all gitleaks scan before main is fast-forwarded; (b) required-ci reuses the parent Security Audit verdict for an eligible VERSION-only bump under the existing eligibility rule (diff is VERSION plus generated version stamps only, parent run success at that exact SHA). Moat test: a non-VERSION-only bump still re-runs Security Audit. Supersedes FOUNDER-QUEUE 14 | .github/workflows/security-audit.yml, release.yml (required-ci), tests | HIGH | non-VERSION-only bump re-runs the scan | merged@2026-10-01T03:03Z | after slice-D46-ci; r3 opus APPROVE 57b511d2; DROPPED from train/21 (D46): STEP 1 re-indent broke S-132 normalizer parity (test-version-bump-only 28/1), reverted 7d1a0f15, r4 with CI-health |
+| E-159 | Pre-existing secret-scan gaps found by the E-157 r2 opus reviewer: (a) an evil merge, a merge commit whose OWN content adds a secret (merge -s ours --no-commit, token in the merge commit), is invisible to both the PARENT..SHA range scan and the --all scan (only `gitleaks dir` found it); (b) pinned gitleaks 8.30.0 exits 0 when its internal git log fails (invalid range), a latent fail-open. Fix: --diff-merges=first-parent (or -m) in --log-opts for both modes or a working-tree scan at the release SHA; guard `git rev-list RANGE` success or treat `[git] fatal` as failure | scripts/security-audit-gitleaks.sh, workflows, tests | HIGH | evil-merge and bad-range fixtures fail the scan | merged@2026-10-01T03:03Z | CI-health engineer after E-157 r3; r1 opus REJECT 5f33451d: stdin merge scan false-positives on real history (v10.5.13..14 rc 1), Wall checks skip in CI |
+| E-160 | D46 runner contention (peer steer 02:11Z): a green train SHA fast-forwarded to main re-runs Tests (8 shards), Bun Parity, Security Audit and First-run gate on the identical SHA, doubling runner load and queueing the next train. Proposal: on push to main, a first job checks for a successful run of the same workflow at the same SHA from a train/** push and, if found, exits success recording the reused run id (D28: same SHA = same tree); any SHA not train-tested runs in full. CTO call FIRST: OPERATING-MODEL says "Tier B full verification on every main commit (never cancelled on main)"; confirm reuse does not weaken Release required-ci, branch-conditional steps (train vs main), or the Security Audit range (base tag config). Sequence after E-157 r4 (same files) | .github/workflows/test.yml, bun-parity.yml, security-audit.yml, tests/test_release_required_ci.py | HIGH | main push of a train-green SHA records reuse and finishes in under 1 min; an untested SHA runs in full; a train-red SHA is not reused | ready@2026-10-01T02:10Z | CTO decision first; after E-157 |
+| E-161 | INCIDENT 02:46Z: an opus reviewer ran `git checkout --detach <tag>` x7 plus a `.gitleaksignore` overwrite in the SHARED main checkout (reflog 02:46:04Z to 02:46:38Z). Cause: its run-owned clone dir was deleted, the next `cd` into a new clone failed, and the shell cwd fell back to the main checkout; every later command ran there. Restored by the Chief of Staff (`git checkout main`, fafe50dd, clean). Guard: v10-guard.sh (PreToolUse) blocks `git checkout`/`git switch`/`git reset`/`git worktree remove` and writes to tracked files when cwd resolves to the main checkout and the caller is an agent (not the leader session); agent prompts use `cd DIR` followed by an exit-on-failure check. Test: a hook test with cwd=main checkout blocks a detached checkout and allows it in a worktree | scripts/v10-guard.sh, tests | HIGH | detached checkout in main checkout blocked; same in a worktree allowed | ready@2026-10-01T02:47Z | GUARDS.md entry |
+| E-162 | Founder "faster" (03:05Z): slice CI runs only Tier A plus diff-selected suites (the existing Tier A selection), Bun Parity and the structural guards; the full 8-shard Tests stays on train/** and main, and the train stays the release verdict. Frees runners and targets about 2 min slice CI | .github/workflows/test.yml (slice-* job matrix only), tests | HIGH | slice-* push runs no 8-shard matrix; train/** and main still run all 8 shards; a slice touching a suite runs that suite | ready@2026-10-01T03:01Z | after E-157 r4 (same file) |
+| D49-auto | Auto-promote to latest on Post-Release Smoke success (founder D49) | .github/workflows/promote.yml, tests/test_release_next_tag.py | HIGH | smoke-success from Release promotes; manual smoke never promotes; not-lower guard | merged@2026-10-01T03:03Z | opus APPROVE 5510b8c8. Follow-ups (D49-auto-b): not-lower guard fails OPEN on an npm error (make it fail closed); loki-mode-sdk latest has no not-lower guard; a newer queued promote can replace a pending one in a release burst |
+| D51-A3 | Headless `loki backlog owner/repo --all/--label/--issues` plus loki.yaml (schema, validator, env overrides) | autonomy/lib/backlog.py, autonomy/lib/loki_yaml.py, autonomy/loki, schemas/loki-yaml.schema.json, tests/test-backlog.sh | HIGH | backlog 47/0 | merged@2026-10-01T03:11Z | sonnet APPROVE 14ff9ae2; follow-up D51-A3b: `loki_yaml.py show` echoes a token pasted into git.token_env (redact x-secret-ref fields); no-parser test case; re-run of a failed issue discards its kept worktree |
+| D51-A4 | Slack on the v10 path (PR opened, BLOCKED, finished), webhook from the env var named by LOKI_SLACK_WEBHOOK_ENV, URL redacted, 5s bounded post | loki-ts/src/e10ext/slack_events.ts, engine10/supervisor.ts, tests | MEDIUM | slack tests 40/0 | merged@2026-10-01T03:11Z | sonnet APPROVE adb838b2; one labelled test message after it ships |
+| D48-r10 | loki-seal in the repo plugin marketplace (`/plugin marketplace add asklokesh/loki-mode`, `/plugin install loki-seal@loki-mode`), README line 4 | .claude-plugin/marketplace.json, README.md, tests/test-loki-seal-marketplace.sh | MEDIUM | clean-HOME install works; marketplace test 8/0 | merged@2026-10-01T03:11Z | sonnet APPROVE 5ecab20d; nit: blank line between README lines 3 and 4 (DOC-01 owns README) |
+| P0-t15 | train/15 and train/17 red: quiet `loki quick` default output 16 lines (stderr noise: mkdir .loki/config File exists, 2 caveman bootstrap lines, echo broken pipe). Fix: caveman notices to the quiet run log, fold a sentinel-only .loki/config into the config dir (never ~/.loki), SIGPIPE reset via python3 re-exec guarded by an import probe | autonomy/run.sh, autonomy/loki, tests/test-quick-config-safety.sh | MEDIUM | default output at most 15 lines; ~/.loki/config untouched from $HOME; broken python3 still runs | released@2026-10-01T02:27Z | r1 REJECT (config clobber, python3 guard); r2 54da8960 APPROVE (config-safety 5/0, receipt-order 14/0 at 12 lines, crash-cli 57/0) Released in v10.5.16 (merge e7e39e27 is an ancestor of v10.5.16). |
 | A-113 | Stop reasons: STALLED and the fatal classifier (item 5) | see plan A-113 | HIGH | first-run-gate assertion per plan card | released@2026-10-01T01:19Z | Wave per plan section 5; one writer per file. Released in v10.5.14 (merge 0377398d is an ancestor of v10.5.14). |
 | A-114 | FALSE VERIFIED ON MAIN (found by the A-112 opus reviewer, repro m6 on 4ad430ad): bugrepo plus an unrelated red test; the agent changes only other.js; verify selects only node:other.test.js (testmap from the diff), so the task's own target test sums.test.js is never run and the run seals VERIFIED rc=0 while it is red. Fix: the relevant tests of the task-named files (hasRelevantTests / impacted(likely), the lean-path Wall stand-in) are ALWAYS selected by verify, whatever the diff touches | loki-ts/src/engine10/stages/verify.ts or testmap selection, tests | HIGH | m6 fixture seals FAILED | merged@2026-09-30T22:37Z | coordinate with A-112 (verify.ts, same target notion); P0 moat |
 | A-115 | TIER 0 (steer 22:50Z). FALSE VERIFIED ON MAIN (A-112 opus reviewer, c10 on 275b4fc0): a conftest.py that skips the target test (and the unrelated red one) seals VERIFIED rc=0, "2 passed, 2 skipped", nothing disclosed. Seal accuracy: a relevant check with more skipped tests than base, or a diff touching conftest.py / pytest.ini / pyproject [tool.pytest] / jest or node test config, must not count as a pass or as progress; list it in NOT PROVEN | loki-ts/src/engine10/stages/verify.ts, failures.ts, tests | HIGH | c10 and e9 fixtures seal FAILED or NOT VERIFIED | released@2026-10-01T00:52Z | core at the 5000 cap: needs an offset (A-150) Released in v10.5.13 (merge bdb332e3 is an ancestor of v10.5.13). |
-| A-115b | A-115 opus notes: (1) an honest fix that also appends a new test to a relevant test file, in a repo with an unrelated red test, ends STALLED/FAILED instead of PARTIAL: the edited file is excluded from progress so the unrelated red is never subtracted; allow progress when the file's pre-existing target ids went red to green; (2) the node base-count fallback sums every `pass N`/`fail N` line, so a base test printing them inflates the count (safe-direction false PARTIAL); take the last pass and last fail lines | loki-ts/src/engine10/stages/verify.ts, verify_weak.test.ts | HIGH | both fixtures | merged@2026-10-01T01:02Z | |
-| A-119 | P0 FALSE VERIFIED ON MAIN (A-115b opus reviewer, reproduced on bba2e5ec): rename the target test file and weaken its expectation (sum.test.js => sum.spec.test.js with 6 changed to 5), add a comment to sum.js: rc=0 Outcome VERIFIED, receipt shows node:sum.spec.test.js pass, sum.js still buggy. verify only sees relevant test files that still exist on head; seal writes `weakened test: sum.test.js` (seal.ts:205) but that line never downgrades the verdict. Fix: seal's `weakened test:` downgrades to PARTIAL like verify's not_proven | loki-ts/src/engine10/stages/seal.ts, tests | HIGH | rename-and-weaken fixture: not VERIFIED, rc!=0 | merged@2026-10-01T01:17Z | Tier 0 |
-| A-119b | A-119 opus review (REJECT on pre-existing holes, A-119 landed as a strict improvement): weakening still ends VERIFIED via (1) a helper file a base test imports (eq=()=>{}), (2) snapshot or fixture edits (__snapshots__/*.snap, tests/fixtures/*.json), (3) tests isTestFile (testmap.ts:51) does not recognise: __tests__/*.js, mocha test/*.js, cargo tests/*.rs, including rename to .bak. Also: verdictOf returns ALREADY_SATISFIED before the weakened downgrade when implement says already_done; package.json jest testPathIgnorePatterns and vite.config.ts test.exclude skip config detection. Fix: widen the seal.ts weakTests predicate to any changed/deleted base path under test/, tests/, __tests__/, __snapshots__/, fixtures dirs plus non-test files a base test imports; check weakened before the already_done early return; add vite.config and in-block jest keys to CFG detection | loki-ts/src/engine10/stages/seal.ts, verify.ts (CFG only), tests | HIGH | each repro gives not-VERIFIED; source-only fix and new test stay VERIFIED | building@2026-10-01T01:18Z | |
-| A-117 | FALSE VERIFIED IN `loki verify` (A-130 r2 opus reviewer): on a run whose events.jsonl was tampered (append, edit, truncate, delete), the run now ends FAILED (A-130) but the receipt on disk still says VERIFIED with no tamper mark, because the worker sealed it before the supervisor detected the tamper; `loki verify` prints verdict: VERIFIED rc=0. Fix: record the tamper on the receipt via the registered receipt.addendum event (hash-chained) or have verify check the event log hash; verify must say TAMPERED and exit non-zero | loki-ts/src/engine10/verify_cmd.ts, supervisor.ts or seal.ts, tests | HIGH | tampered-log fixture: loki verify TAMPERED rc!=0 | building@2026-10-01T01:18Z | after A-130 (supervisor.ts); r2: opus REJECT, tail truncation erases post-seal tamper, fix = signed final log line |
-| A-118 | Exit-honest policy gap on the DEFAULT path (A-115 r2 finding): legacy `loki quick` prints `Evidence Receipt: NOT VERIFIED` yet exits rc 0 on a run whose target test was skipped; G1 exit-honest counts a skipped test as green, so it does not catch this. CTO call: should legacy quick exit non-zero on NOT VERIFIED when a relevant test was skipped/weakened, and should G1 count skipped as not-green? | autonomy/run.sh (quick exit path), scripts/first-run-gate.sh G1 | HIGH | skipped-target legacy run exits non-zero; G1 treats skipped as not green | building@2026-10-01T01:17Z | D47 decided: rc 3 on tests_integrity failed (skip added, runner config changed, test file deleted/renamed); assertion edits disclosed rc 0; G1 green needs pass 2 fail 0, 9b asserts rc 3. Files: proof-generator.py, run.sh after generate_proof_of_run, first-run-gate.sh, docs/exit-codes.md. Blocks promote of `latest` |
+| A-115b | A-115 opus notes: (1) an honest fix that also appends a new test to a relevant test file, in a repo with an unrelated red test, ends STALLED/FAILED instead of PARTIAL: the edited file is excluded from progress so the unrelated red is never subtracted; allow progress when the file's pre-existing target ids went red to green; (2) the node base-count fallback sums every `pass N`/`fail N` line, so a base test printing them inflates the count (safe-direction false PARTIAL); take the last pass and last fail lines | loki-ts/src/engine10/stages/verify.ts, verify_weak.test.ts | HIGH | both fixtures | released@2026-10-01T01:53Z | Released in v10.5.15 (merge 945f58ec is an ancestor of v10.5.15). |
+| A-119 | P0 FALSE VERIFIED ON MAIN (A-115b opus reviewer, reproduced on bba2e5ec): rename the target test file and weaken its expectation (sum.test.js => sum.spec.test.js with 6 changed to 5), add a comment to sum.js: rc=0 Outcome VERIFIED, receipt shows node:sum.spec.test.js pass, sum.js still buggy. verify only sees relevant test files that still exist on head; seal writes `weakened test: sum.test.js` (seal.ts:205) but that line never downgrades the verdict. Fix: seal's `weakened test:` downgrades to PARTIAL like verify's not_proven | loki-ts/src/engine10/stages/seal.ts, tests | HIGH | rename-and-weaken fixture: not VERIFIED, rc!=0 | released@2026-10-01T01:53Z | Tier 0 Released in v10.5.15 (merge c41a2b83 is an ancestor of v10.5.15). |
+| A-119b | A-119 opus review (REJECT on pre-existing holes, A-119 landed as a strict improvement): weakening still ends VERIFIED via (1) a helper file a base test imports (eq=()=>{}), (2) snapshot or fixture edits (__snapshots__/*.snap, tests/fixtures/*.json), (3) tests isTestFile (testmap.ts:51) does not recognise: __tests__/*.js, mocha test/*.js, cargo tests/*.rs, including rename to .bak. Also: verdictOf returns ALREADY_SATISFIED before the weakened downgrade when implement says already_done; package.json jest testPathIgnorePatterns and vite.config.ts test.exclude skip config detection. Fix: widen the seal.ts weakTests predicate to any changed/deleted base path under test/, tests/, __tests__/, __snapshots__/, fixtures dirs plus non-test files a base test imports; check weakened before the already_done early return; add vite.config and in-block jest keys to CFG detection | loki-ts/src/engine10/stages/seal.ts, verify.ts (CFG only), tests | HIGH | each repro gives not-VERIFIED; source-only fix and new test stay VERIFIED | building@2026-10-01T02:18Z | |
+| A-117 | FALSE VERIFIED IN `loki verify` (A-130 r2 opus reviewer): on a run whose events.jsonl was tampered (append, edit, truncate, delete), the run now ends FAILED (A-130) but the receipt on disk still says VERIFIED with no tamper mark, because the worker sealed it before the supervisor detected the tamper; `loki verify` prints verdict: VERIFIED rc=0. Fix: record the tamper on the receipt via the registered receipt.addendum event (hash-chained) or have verify check the event log hash; verify must say TAMPERED and exit non-zero | loki-ts/src/engine10/verify_cmd.ts, supervisor.ts or seal.ts, tests | HIGH | tampered-log fixture: loki verify TAMPERED rc!=0 | merged@2026-10-01T02:50Z | after A-130 (supervisor.ts); r2: opus REJECT, tail truncation erases post-seal tamper, fix = signed final log line |
+| A-118 | Exit-honest policy gap on the DEFAULT path (A-115 r2 finding): legacy `loki quick` prints `Evidence Receipt: NOT VERIFIED` yet exits rc 0 on a run whose target test was skipped; G1 exit-honest counts a skipped test as green, so it does not catch this. CTO call: should legacy quick exit non-zero on NOT VERIFIED when a relevant test was skipped/weakened, and should G1 count skipped as not-green? | autonomy/run.sh (quick exit path), scripts/first-run-gate.sh G1 | HIGH | skipped-target legacy run exits non-zero; G1 treats skipped as not green | building@2026-10-01T02:15Z | D47 decided: rc 3 on tests_integrity failed (skip added, runner config changed, test file deleted/renamed); assertion edits disclosed rc 0; G1 green needs pass 2 fail 0, 9b asserts rc 3. Files: proof-generator.py, run.sh after generate_proof_of_run, first-run-gate.sh, docs/exit-codes.md. Blocks promote of `latest`; built df404970, opus review |
 | A-112b | A-112 readability debt: subtractBase in verify.ts was folded to reach 4999 of 5000 core lines (9 lines over 200 chars, longest 347; un/progress/base-run loop each on one line). Unfold when A-150 frees budget; no behaviour change | loki-ts/src/engine10/stages/verify.ts | MEDIUM | budget test plus verify_prered unchanged | ready@2026-09-30T22:37Z | after A-150 |
 | A-113b | A-110 opus notes on A-113: (1) under the CLI invoker (LOKI_E10_INVOKER=cli) the provider child stderr never reaches the fatal classifier (the *-impl.stderr.log is empty), so a credit/auth failure printed on plain stderr gives stop:null and burns the fix rounds; (2) machine.ts re-records the previous signature when a verify crashes, so a crashed verify counts toward a stall. Fix both in session.ts/machine.ts, with end-to-end tests through the real worker | loki-ts/src/engine10/session.ts, machine.ts, tests | HIGH | CLI stderr credit line stops fatal; crashed verify does not count as a stall repeat | released@2026-10-01T01:19Z | keep the A-110 escalated emit; the A-110 reviewer plugin probe is a good e2e template Released in v10.5.14 (merge 0377398d is an ancestor of v10.5.14). |
 | A-121 | v10 signs and verifies natively (item 3) | see plan A-121 | HIGH | first-run-gate assertion per plan card | released@2026-10-01T00:52Z | Wave per plan section 5; one writer per file. Released in v10.5.13 (merge 08b31271 is an ancestor of v10.5.13). |
 | A-122 | Delete the GPG signing layer (item 3, deletion) | see plan A-122 | HIGH | first-run-gate assertion per plan card | released@2026-10-01T00:52Z | Wave per plan section 5; one writer per file. Released in v10.5.13 (merge cb738c36 is an ancestor of v10.5.13). |
-| A-121b | A-121 opus note: a receipt downgrade exits 0. Anyone can edit the body, recompute receipt_sha256 and null the jwt to get UNSIGNED rc 0 on `loki verify`, and the legacy deploy gate refuses UNSIGNED but the v10 verify does not. Decide the signed-by-default policy: once a local key exists, UNSIGNED on a receipt from this machine exits non-zero (or the receipt records its kid outside the hashed body) | loki-ts/src/engine10/verify_cmd.ts, stages/seal.ts, tests | HIGH | downgrade fixture exits non-zero | building@2026-10-01T01:17Z | D47 decided: UNSIGNED exits 3 on both engines (verify_cmd.ts EXIT_BY_VERDICT, autonomy/verify.sh _verify_receipt_digest), --allow-unsigned / LOKI_VERIFY_ALLOW_UNSIGNED=1 accepts with explicit line; update tests/test-engine10-live-pr.sh 115-122; verify never creates a key |
+| A-121b | A-121 opus note: a receipt downgrade exits 0. Anyone can edit the body, recompute receipt_sha256 and null the jwt to get UNSIGNED rc 0 on `loki verify`, and the legacy deploy gate refuses UNSIGNED but the v10 verify does not. Decide the signed-by-default policy: once a local key exists, UNSIGNED on a receipt from this machine exits non-zero (or the receipt records its kid outside the hashed body) | loki-ts/src/engine10/verify_cmd.ts, stages/seal.ts, tests | HIGH | downgrade fixture exits non-zero | building@2026-10-01T02:33Z | D47 decided: UNSIGNED exits 3 on both engines (verify_cmd.ts EXIT_BY_VERDICT, autonomy/verify.sh _verify_receipt_digest), --allow-unsigned / LOKI_VERIFY_ALLOW_UNSIGNED=1 accepts with explicit line; update tests/test-engine10-live-pr.sh 115-122; verify never creates a key |
+| A-121c | A-121b opus finding B: legacy `loki verify` passes a WELL-FORMED token with an unknown kid at rc 0 (`attestation: UNCHECKED`, `VERDICT: VERIFIED`) with or without the local key; engine10 gives rc 2. A forger can always mint such a token, so on legacy a downgrade-to-foreign-kid is a pass. D47 kept legacy UNCHECKED unchanged because it also covers honest cross-machine verification. CTO call: make legacy UNCHECKED non-zero (parity with engine10 rc 2), now that D48 row 2 adds `loki verify --pubkey` as the honest cross-machine path? Also: a missing .loki/state/last-proof-id.txt makes legacy verify skip the receipt check entirely and pass (pre-existing, A-134) | autonomy/loki (_deploy_receipt_verdict, verify), tests | HIGH | unknown-kid forged token exits non-zero on legacy; honest cross-machine path documented | ready@2026-10-01T02:33Z | CTO decision first; after A-121b |
 | A-110 | One named outcome, fixed exit ladder, --json (items 1 and 5) | see plan A-110 | HIGH | first-run-gate assertion per plan card | released@2026-10-01T00:52Z | Wave per plan section 5; one writer per file. Released in v10.5.13 (merge 47ac1ccc is an ancestor of v10.5.13). |
 | A-112 | Baseline subtract: judge only the delta (item 5) | see plan A-112 | HIGH | first-run-gate assertion per plan card | released@2026-10-01T00:52Z | Wave per plan section 5; one writer per file. Released in v10.5.13 (merge 69f1a910 is an ancestor of v10.5.13). |
 | A-123 | Doctor: only the selected provider blocks, one Ready line (item 3) | see plan A-123 | MEDIUM | first-run-gate assertion per plan card | released@2026-10-01T00:52Z | Wave per plan section 5; one writer per file. Released in v10.5.13 (merge 275b4fc0 is an ancestor of v10.5.13). |
 | A-134 | Legacy: receipt after the final commit, chatter behind --verbose (item 2) | see plan A-134 | MEDIUM | first-run-gate assertion per plan card | released@2026-10-01T00:52Z | Wave per plan section 5; one writer per file. Released in v10.5.13 (merge 7d3edf96 is an ancestor of v10.5.13). |
-| A-134b | A-134 opus notes: (1) standalone autonomy/verify.sh prints no attestation line (only `loki verify` has _deploy_receipt_verdict); print `attestation: UNCHECKED (run via loki verify)` instead of silence; (2) the quiet failure tail grep `[Ff]ailed` matched the RALPH system-prompt line and printed ~1.5k chars; anchor to `^\[(ERROR|WARN)\]` or cap line length; (3) the quiet inner run starts as a background job so its stdin is /dev/null even from a TTY: pause-mode keypress resume changes for quiet runs; (4) `loki quick --verbose` is also the A-122 cmd_quick flag, done | autonomy/verify.sh, autonomy/run.sh | MEDIUM | each note has a test | review@2026-10-01T01:23Z | |
+| A-134b | A-134 opus notes: (1) standalone autonomy/verify.sh prints no attestation line (only `loki verify` has _deploy_receipt_verdict); print `attestation: UNCHECKED (run via loki verify)` instead of silence; (2) the quiet failure tail grep `[Ff]ailed` matched the RALPH system-prompt line and printed ~1.5k chars; anchor to `^\[(ERROR|WARN)\]` or cap line length; (3) the quiet inner run starts as a background job so its stdin is /dev/null even from a TTY: pause-mode keypress resume changes for quiet runs; (4) `loki quick --verbose` is also the A-122 cmd_quick flag, done | autonomy/verify.sh, autonomy/run.sh | MEDIUM | each note has a test | building@2026-10-01T02:24Z | |
+| A-134c | A-134b r1 review finding: provider call sites in autonomy/run.sh (mainline claude -p at about 25455/25460, provider_invoke_argv about 1050/1053) do not redirect stdin, so under LOKI_VERBOSE=1 (and any non-quiet path) a parent stdin pipe that never closes blocks `claude -p` reading stdin (pre-existing). Fix: `< /dev/null` at provider invocations that pass the prompt as an argument | autonomy/run.sh (provider call sites only), providers/*.sh, tests | MEDIUM | never-closing stdin pipe: verbose `loki quick` completes under timeout 60 | ready@2026-10-01T01:37Z | |
 | A-130 | v10 quiet by default (item 2) | see plan A-130 | MEDIUM | first-run-gate assertion per plan card | released@2026-10-01T01:19Z | Wave per plan section 5; one writer per file. Released in v10.5.14 (merge a518bfea is an ancestor of v10.5.14). |
-| A-130b | A-130 Reason line prints first_error from a failing check verbatim (capped at 200 chars, control chars stripped) but unredacted: a `ghp_` token in a test failure line reaches the terminal. No TS redactor is reachable from engine10 core (only autonomy/lib/proof_redact.py). Port the token patterns to a small TS helper outside core or redact first_error where it is captured in verify | loki-ts/src (util), verify.ts or output.ts, tests | MEDIUM | ghp_/sk- token in first_error prints redacted | review@2026-10-01T01:22Z | |
+| A-130b | A-130 Reason line prints first_error from a failing check verbatim (capped at 200 chars, control chars stripped) but unredacted: a `ghp_` token in a test failure line reaches the terminal. No TS redactor is reachable from engine10 core (only autonomy/lib/proof_redact.py). Port the token patterns to a small TS helper outside core or redact first_error where it is captured in verify | loki-ts/src (util), verify.ts or output.ts, tests | MEDIUM | ghp_/sk- token in first_error prints redacted | released@2026-10-01T02:27Z | ; sonnet APPROVE be50510f (redaction before cap, parity with proof_redact.py) Released in v10.5.16 (merge f214a0fa is an ancestor of v10.5.16). |

package/docs/v10/DECISIONS.md

@@ -383,3 +383,39 @@ Loki's definition: "autonomous software factory that runs with the knowledge of
 4. Recording the kid outside the hash and markers inside the body were rejected: verification is already unhashed and a forger can rewrite any body field.
 5. `--allow-unsigned` or LOKI_VERIFY_ALLOW_UNSIGNED=1 accepts UNSIGNED with an explicit line. It never changes TAMPERED or UNCHECKED, and verify never creates a key.
 6. Both slices (A-118, A-121b) are HIGH tier with red-first fixtures (skip, config, rename, downgrade, fresh HOME). They land before `latest` is promoted, together with A-115.
+
+## D48 (founder, relayed by autonomi-dev-dc at 02:35Z): "10/10 on everything" by 04:35Z
+1. Ten rows, each with a CI acceptance test, scored against the best competitor; 10/10 means the test passes in CI, never a claim. Quality bar and the Never list unchanged; D46 cadence continues.
+2. Rows: (1) gaming matrix on both engines ends non-VERIFIED with rc != 0; (2) portable receipt: `loki keys export` + `loki verify --pubkey`; (3) quiet default output at most 8 lines, real-mode wall within 1.5x raw `claude -p`; (4) first-run gate on node:test, pytest and go test repos, only fix files change; (5) exit ladder on legacy quick plus a --json schema validated against real output; (6) `loki doctor --fix`, doctor under 2s; (7-9) lean v10 engine default for `loki "<task>"`, issue mode and `loki quick` on next, legacy escape hatch kept, non-null cost on every gate run; (10) repo-root .claude-plugin/marketplace.json listing packages/loki-seal, tested in a clean Claude Code HOME, one README install line.
+3. Rows 7-9 flip the default only after A-117, A-118 and A-119b are merged and the gaming matrix (row 1) passes; until then they are built behind the existing flag.
+4. Staffing is bounded by machine load (max 28) and the worktree cap (15); rows run in waves, not all at once. Status per row is written to PROGRESS.md at 03:35Z and 04:35Z as pass, fail or not started, with what is missing.
+
+## D49 (founder, CONFIRMED directly in the Release Manager session at 02:42Z): promote to `latest` now and auto-promote every release
+- Relayed text: "everything should be released asap, no holding of anything done so far as well", "and going forward". Asks to promote 10.5.16 to `latest` now and trigger promote.yml automatically after every Release.
+- Not applied by the Release Manager because it contradicts the standing instruction in this session ("NEVER run promote or move `latest`") and SWARM-PROMPT-ADOPTION, and a peer relay is not the founder's direct approval for a hard-to-reverse, user-facing change. Awaiting the founder's direct confirmation in the Release Manager session. Prepared evidence: first-run gate stub against the npm-installed 10.5.16.
+- 02:42Z: the founder answered directly in the Release Manager session: "Apply D49 fully" and, for D48 rows 7-9, "Flip on next now". Applied: the first-run gate stub on the npm-installed 10.5.16 passed (0 assertions failed, wall 34s); promote.yml dispatched for 10.5.16 (run 36807172046). Auto-promotion on every green Release (stub gate plus Post-Release Smoke) is a slice. A-117, A-118, A-119b and the real-provider run are no longer `latest` blockers; they ship as they land.
+
+## D50 (founder, relayed by autonomi-dev-dc at 02:45Z): the harness is the product; proof is the floor
+1. Finish only the in-flight proof work (A-117, A-118, A-119b, gaming matrix, verify --pubkey); move most engineers to the harness.
+2. North-star metric: model lift on our own eval (hidden tests, small and medium tiers): Loki+model vs raw `claude -p` same model, and Loki+cheap vs raw stronger. Targets: Loki+haiku >= raw sonnet completion at lower cost; Loki+sonnet >= raw opus at lower cost; Loki+X never below raw X, and at most 1.2x its time. Full matrix in METRICS.md, losses included; a slice that lowers lift is dropped.
+3. Harness items, one slice each: (1) intent contract; (2) context engine (symbol retrieval, real commands, ranked pack per model budget); (3) project memory in .loki/knowledge with decay; (4) cross-repo and user knowledge sources via .loki/config.yaml, read-only; (5) model-adaptive profiles in model_catalog.json, step routing, escalate only on a failing check; (6) speed (parallel context, cached prefix, trimming, impacted tests, harness overhead under 5s); (7) cost (cascade, caps, measured cost on every provider); (8) enterprise config (allowed models and endpoints, budgets, redaction, an audit log of model calls; no certification claims).
+4. Context and memory live in loki-ts/src/engine10/context/ with their own line budget set by the CTO; the 5000-line core cap (D33) stays.
+5. Order: multi-model baseline eval first, then items 1, 2, 3 and 6 in parallel, then 5 and 4 (8 with 4). Eval runs count against the usage governor.
+
+## D51 (founder, relayed by autonomi-dev-dc at 02:55Z): the product surface the harness powers
+1. Local: install, `loki` opens a browser UI; onboarding (provider, GitHub PAT stored 0600, repo); a backlog view with complete-selected or complete-all, each issue its own worktree, branch and PR with receipt and evidence; live status, BLOCKED questions answerable in the UI.
+2. Headless parity: `loki backlog owner/repo --all|--label|--issues`, one loki.yaml driving both UI and headless (provider and models, git auth env var, repos, concurrency, budgets, knowledge sources, notifications). Slack via autonomy/notify.sh on the v10 path.
+3. 10x defined: merge-ready PRs per hour of wall clock and per hour of human attention on a 20-issue backlog vs one raw Claude Code session; target 10x on both, from parallelism, zero babysitting and attached evidence. Measured and published.
+4. Reuse dashboard/, notify.sh, deploy/helm, docker-compose, terraform, playwright-verify.sh and issue-providers.sh; delete UI and endpoints that do not serve the flow. One UI, one config file, one engine.
+5. Phase A (today): first-run UI, backlog view, headless plus loki.yaml, Slack. Phase B: workspaces, cross-repo runs, combined integration testing with evidence. Phase C: one container image, Helm and ECS, org connect, audit log.
+
+## D39 amendment (founder, relayed 03:16Z): "Sprint, then pace"
+1. Full speed until the D48 deadline at 04:35Z.
+2. From 04:35Z the governor paces to about 0.48% of the weekly limit per hour (projected <= 75% used at the 2026-10-07T17:00Z reset), about 7 concurrent engineers at today's burn; the ceiling is recomputed hourly from new /usage readings (docs/v10/usage-readings.tsv; first reading 2026-10-01T03:14Z: window 11%, weekly 25%).
+3. Priority inside the paced budget: release flow, then D50 harness and lift eval, then D51 Phase A, then docs, then the remaining D48 polish.
+4. Builders run as cloud sessions first (the 250 USD cloud credit is used before plan usage).
+5. If the 5h window passes 80%, pause new work until it resets; never let a run die mid-release.
+
+## D52 (founder, relayed 03:25Z) and overnight mandate (03:40Z): least tokens, fastest release
+1. Target about 10x less plan usage per merged slice and per release, measured from `claude -p "/usage"`. Haiku for mechanical work, sonnet to build, opus only for moat or latest-moving reviews; `model:` set explicitly on every agent; small briefs with file paths; read line ranges, not whole files; agent returns of 10 lines or fewer; fresh agent per slice; the lead session hands off at about 120k context.
+2. Overnight until about 11:00Z: sprint to 04:35Z, then pace (D39 amendment). Priority: release flow, D48 rows plus the 04:35Z report, D51 Phase A ready to test (LOKI MORNING TEST in PROGRESS), D50 lift baseline then harness slices, docs, then D51 Phase B/C as budget allows. docs/v10/MORNING-BRIEF.md (60 lines or fewer) at 10:30Z, honest about what is not done.

package/docs/v10/FOUNDER-QUEUE.md

@@ -20,3 +20,4 @@ this file; each item says what the loop does meanwhile.
 | 13 | 2026-09-30 | Repo `.claude/settings.json` hooks use relative paths (`bash autonomy/hooks/session-init.sh`, `validate-bash.sh`, `track-metrics.sh`, `store-episode.sh`, lines 9, 20, 31, 42), so they fail ("No such file or directory") whenever a session or agent's cwd is not the repo root (gate worktrees, /private/tmp train checkouts). validate-bash.sh is a PreToolUse guard, so it may silently not guard there. Proposed: `bash "$CLAUDE_PROJECT_DIR/autonomy/hooks/<name>.sh"`, exiting 0 quietly when the variable is unset. Raised by the steering session 22:50Z. | Claude Code configuration; agents may not edit it on a peer's request. | Leaves the file unchanged; hook errors continue outside the repo root. | RESOLVED 2026-10-01T00:30Z: Loki approved "fix the hooks"; slice-F13-hook-paths (65dc1411) merged on train/15. |
 | 14 | 2026-10-01 | Move the full-history `gitleaks --all` scan out of the Release path (to nightly plus every push to main, still blocking there), keeping a base-tag-to-tip range scan in Release. Relayed by the steering session as part of D46. | Weakens a release-blocking security gate; needs the founder directly, not a relay. | Release keeps the `--all` scan; E-156 removes the recurring false positive at the source. | SUPERSEDED 2026-10-01T00:30Z: Security Audit verdict reuse for VERSION-only bumps keeps the full --all scan scope (steering session 00:28Z); filed for the CI-health engineer. |
 | 15 | 2026-10-01 | Run the REAL-provider first-run gate on the published `next` build: `CLAUDE_CODE_OAUTH_TOKEN=<token from "claude setup-token"> bash scripts/first-run-gate.sh --real --installed loki-mode@10.5.13` (or ANTHROPIC_API_KEY). The swarm has no provider credential in its environment and does not read stored secrets; the gate's throwaway HOME cannot use the keychain login. Stub mode on the installed npm package runs meanwhile. | Credential only the founder holds. | The promote milestone (real gate pass on a `next` version) stays blocked; stub-mode evidence only. |
+| 16 | 2026-10-01 | A Slack incoming-webhook URL for testing D51 item 4 (notify.sh on the v10 path: PR opened, BLOCKED, backlog finished). Provide it as an env var (for example `LOKI_SLACK_WEBHOOK_URL`) in the Release Manager session, never in a file or chat. | Needs a credential only the founder holds. | Until then notify.sh is tested against a local mock webhook; the real end-to-end check runs once the env var is set. | open |

package/docs/v10/PROGRESS.md

@@ -1646,3 +1646,62 @@ The swarm is stopped: .loki/V10-STOP exists, the loop has no wake-ups, and the c
 - Release run success; `npm view loki-mode@10.5.14 version gitHead` = 10.5.14 / 2f4462b7; dist-tags next=10.5.14, latest=10.5.10 (unchanged); release body 17 lines.
 - D46 tally this hour: next releases 1 (10.5.14) vs target 3-6; trains cut 1 (train/17), red 1, dropped 0. Shortfall cause: the main-resident quiet-output flake (P0-t15 in rework).
 - OPUS_SHARE 33.7% vs 30%: no new opus seats until it drops; the open opus work is the A-117 r2 builder (resumed) only.
+
+## 2026-10-01T01:32Z train/18 cut
+- train/18 = 37267ebd (local main d5d679a4: A-119 merge c41a2b83 + docs, plus dist rebuild), pushed by SHA 01:34Z (`git ls-remote origin refs/heads/train/18` = 37267ebd). Tier B watcher armed.
+- P0-t15 round 2 at 54da8960 in sonnet re-review; train/19 = train/18 + P0-t15 when approved.
+- In review: A-130b (be50510f), A-134b (3bbec935). Building: A-117 r2, A-118, A-121b, A-119b (7edf4ae0 awaiting one clean full run).
+- Seats capped by worktrees 15/15 and load about 15-25; no new seats this tick.
+
+## 2026-10-01T01:41Z train/18 green, v10.5.15 cut, train/20 cut
+- train/18 37267ebd: Tests, Bun Parity, Coverage (baseline) all success (watcher b3l054ag3, 01:38:25Z). origin/main fast-forwarded 2f4462b7..37267ebd.
+- v10.5.15 release commit a7945d67 (parent 37267ebd == origin/main; `release.sh --check-clean` rc=0), pushed by SHA. Contents: A-119, A-115b. Watcher armed for Release run, npm version/gitHead, next == 10.5.15, latest unchanged (10.5.10).
+- train/19 89bf645b (P0-t15) is superseded for main because it lacks the release commit; train/20 c57eb914 = train/19 + main (release merge c908a37f), pushed 01:43Z, Tier B watcher armed.
+- D46 tally: trains cut 3 this hour (18, 19, 20), red 0 of the finished ones.
+
+## 2026-10-01T01:51Z trains 19/20 red on one lint line; train/21 carries the fix
+- train/19 89bf645b and train/20 c57eb914: Tests failed only in "ShellCheck Linting" (SC2088, a quoted "~/.loki/config" in tests/test-quick-config-safety.sh line 71, from P0-t15). The quiet-output 16-line failure did not recur (failparse on job 110179389806 lists only ShellCheck). Fixed forward on main 1be4bbe9 (run-shellcheck.sh rc=0); train/21 2ebfa3a1 = train/20 + fix + E-157, in Tier B.
+- v10.5.15 a7945d67: Release run queued at 01:48Z.
+- Reviews: E-157 r3 APPROVE (merged), A-130b APPROVE (merged), E-159 REJECT (rework), A-117 r2 REJECT (back-compat for old receipts; key-env tests), A-118/A-119b/A-134b r2 in review.
+- D46 tally this hour: next releases 1 confirmed (10.5.14) + 1 pending (10.5.15); trains cut 18/19/20/21, red 19 and 20 (one lint line), dropped 0. OPUS_SHARE 36% (HIGH reviews only); load about 25 of 28, no new seats.
+
+## 2026-10-01T02:01Z v10.5.15 published; train/21 dropped E-157; train/22 cut
+- v10.5.15: Release run success; npm 10.5.15 gitHead a7945d67 (matches); dist-tags next=10.5.15, latest=10.5.10 (unchanged); release body carries the full CHANGELOG section.
+- train/21 2ebfa3a1 red: Shell tests shard 1, tests/test-version-bump-only.sh 28/1 (S-132 normalizer parity). Cause E-157 (release.yml STEP 1 heredoc re-indented 10 to 12 spaces). D46 drop: E-157 merge reverted on local main 7d1a0f15 (test then 29/0), back to CI-health for r4.
+- train/22 dd9842c6 = train/20 + main (SC2088 fix, A-130b, E-157 revert); release.yml identical to train/20; test-version-bump-only 29/0 and shellcheck clean locally. Tier B watcher armed.
+- D46 tally (rolling hour): next releases 2 (10.5.14 01:19Z, 10.5.15 01:54Z); trains cut 5 (18-22), red 3 (19, 20 lint; 21 E-157), dropped 1 (E-157).
+
+## 2026-10-01T02:08Z train/22 green, v10.5.16 cut
+- train/22 dd9842c6: Tests, Bun Parity, Coverage (baseline) all success (02:07:32Z). origin/main fast-forwarded a7945d67..dd9842c6 (the v10.5.15 Release run had completed success).
+- v10.5.16 release commit f522c12f (parent dd9842c6 == origin/main; --check-clean rc=0), pushed by SHA. Contents: P0-t15 (quiet quick stderr noise, sentinel-only config fold, guarded SIGPIPE re-exec), A-130b (Reason line redaction). E-157 net zero (reverted). Watcher armed; latest must stay 10.5.10.
+
+## 2026-10-01T02:25Z train/23 red, A-134b dropped
+- train/23 de366303 (A-134b): Tests red in 3 shards, all from A-134b's new tests/test-quick-quiet-tail.sh: registered in no runner (D44 guard, shard 1; D44-C structural, shard 6), and an unescalated `timeout 150` at line 53 (E-00 guard, shard 7). Bun Parity and Coverage success.
+- D46 drop: A-134b merge reverted on local main 3924bc3f; local main now has no code diff from origin/main (`git diff --stat origin/main main -- . ':!docs'` empty), so no replacement train. A-134b back to its builder (register plus shard row, timeout -k).
+- Process miss (mine): I merged A-134b on the reviewer's conditional approval without the repo-wide test-file guards. New rule in memory: any slice adding tests/*.sh runs the registration, E-00 and shellcheck guards before merge.
+- v10.5.16 Release run still in progress at 02:23Z. D46 hour 02:00Z: 0 confirmed so far (10.5.16 pending), trains cut 22 and 23, red 1 (23), dropped A-134b.
+
+## 2026-10-01T02:45Z D49: 10.5.16 promoted to latest
+- Founder confirmed D49 and the D48 engine flip directly in this session (02:42Z). First-run gate stub on the npm-installed 10.5.16: 0 assertions failed, wall 34s (scripts/first-run-gate.sh --installed loki-mode@10.5.16). promote.yml run 36807172046: completed success. npm dist-tags now {"latest":"10.5.16","next":"10.5.16"} (was latest 10.5.10).
+- Slices pushed to origin for slice CI during review: slice-A-117, slice-A-121b(-r2), slice-A-118, slice-A-134b-r4, slice-E-157-r4, slice-E-159-r2.
+- Reviews in flight (opus, HIGH): A-117 r3, A-118 r2, A-121b r2, E-157 r4 + E-159 r2. D48 wave 1 building (sonnet): gaming matrix (row 1), portable verify (row 2), doctor --fix (row 6), loki-seal marketplace (row 10).
+
+## 2026-10-01T02:47Z INCIDENT: main checkout detached by a reviewer (restored)
+- The E-157/E-159 opus reviewer ran a 7-tag `git checkout --detach` loop with a `.gitleaksignore` overwrite in the shared main checkout (reflog 02:46:04Z to 02:46:38Z): a failed `cd` into a new clone left its cwd in the main checkout. It stopped on request; nothing left running (its report). Restored: `git checkout main` gives main at fafe50dd, `git status --porcelain` shows only the pre-existing untracked .git-pulse-fix.patch; PROGRESS.md 1687 and BOARD.md 652 lines intact. Guard slice E-161. During the window the pulse misread BOARD and PROGRESS from the old tree.
+
+## 2026-10-01T03:01Z "faster" levers (founder via peer, 03:05Z)
+- Baseline (before): median opus review about 20-23 min (A-121b r1 22m46s, A-117 r3 about 39 min under load); slice CI is the full 8-shard Tests (about 12-15 min, runner-queued); train cadence: 22 to 24 cut 02:00Z-02:51Z; releases in the 02:00Z hour: 1 (10.5.16), plus a promotion to latest.
+- Applied now: (1) opus reviews only for moat, latest-moving and signing slices; sonnet, 10-min cap, for the rest; slices under 150 changed lines. (3) New builders launch as remote (cloud) agents, so local load is reviewers, gate and Release Captain only. (4) A train is cut on any green reviewed slice, every 10-15 min, even while the previous train is in CI.
+- (2) Slice CI tier-down is BOARD E-162, sequenced after E-157 r4 because both edit test.yml.
+- After-numbers go in the 03:35Z entry.
+
+## 2026-10-01T03:08Z usage governor calibrated; pacing decided; A-118 r3
+- First usage reading in docs/v10/usage-readings.tsv: 2026-10-01T03:14:00Z, window 11%, weekly 25%. Founder pacing (D39 amendment): sprint to 04:35Z, then about 0.48%/h (about 7 engineers).
+- A-118 r2 opus REJECT (4 blockers: multi-line pyproject addopts and unittest @skip bypasses; pagination `{ skip: n }` and new shared config files falsely accused); r3 with the builder.
+- Pushed for slice CI: slice-D51-A3 14ff9ae2 (backlog plus loki.yaml), slice-D51-A4 adb838b2 (Slack on v10). slice-D51-A12 and slice-D48-r6 were blocked by pre-push gitleaks on synthetic strings; a fix agent is moving both to source-level fixes.
+
+## 2026-10-01T03:25Z LEAD HANDOFF STATE (read this first on resume)
+- npm: latest=next=10.5.16 (f522c12f). origin/main=f522c12f. Release worktree: scratchpad/rel-1056; train worktree: scratchpad/t14.
+- Trains: train/24 1f3c9da1 RED (E-142 board sweep: E-161 row had a `||`, fixed in 7cfd7399); train/25 b1d2ecbd superseded (same row); train/26 6d288543 = local main d449a419+ (A-117, E-157 r4, E-159 r2, D49-auto, D51-A3, D51-A4, D48-r10, D48-r6, board fix) in CI. When green: ff origin/main to 6d288543, cut 10.5.17; D49-auto then auto-promotes later releases.
+- In review: A-118 r3 b48adeacc (opus). Rework (fresh agents): A-121b r3 (sys.path guard), A-119b r3 (diff-line asserts, scoped exclude), D51-A12 r2 (Host allowlist vs DNS rebinding). Built, unreviewed or unpushed: D48-r1 gaming matrix de71397dd (needs a CTO call on the pre-red case and a duration row), D48-r2 b073d50a (opus review pending), E-162 6b9738fdc (pushed; sonnet review pending), E-163 678f2162e (unpushed; sonnet review pending). Building: D48-flip, D50 baseline eval, DOC-01, DOC-02.
+- Rules: slice pushes go from the main checkout only (the agent pre-push guard blocks agents); cancel queued slice CI for merged slices; any slice adding tests/*.sh runs the registration, E-00, shard-coverage and shellcheck guards before merge; no `|` or `||` inside BOARD cells.