loki-mode 10.5.17 → 10.5.19

package/docs/v10/PROGRESS.md

@@ -1705,3 +1705,38 @@ The swarm is stopped: .loki/V10-STOP exists, the loop has no wake-ups, and the c
 - Trains: train/24 1f3c9da1 RED (E-142 board sweep: E-161 row had a `||`, fixed in 7cfd7399); train/25 b1d2ecbd superseded (same row); train/26 6d288543 = local main d449a419+ (A-117, E-157 r4, E-159 r2, D49-auto, D51-A3, D51-A4, D48-r10, D48-r6, board fix) in CI. When green: ff origin/main to 6d288543, cut 10.5.17; D49-auto then auto-promotes later releases.
 - In review: A-118 r3 b48adeacc (opus). Rework (fresh agents): A-121b r3 (sys.path guard), A-119b r3 (diff-line asserts, scoped exclude), D51-A12 r2 (Host allowlist vs DNS rebinding). Built, unreviewed or unpushed: D48-r1 gaming matrix de71397dd (needs a CTO call on the pre-red case and a duration row), D48-r2 b073d50a (opus review pending), E-162 6b9738fdc (pushed; sonnet review pending), E-163 678f2162e (unpushed; sonnet review pending). Building: D48-flip, D50 baseline eval, DOC-01, DOC-02.
 - Rules: slice pushes go from the main checkout only (the agent pre-push guard blocks agents); cancel queued slice CI for merged slices; any slice adding tests/*.sh runs the registration, E-00, shard-coverage and shellcheck guards before merge; no `|` or `||` inside BOARD cells.
+
+## 2026-10-01T03:51Z train/26 red, drops, train/27 cut; D50 baseline
+- train/26 6d288543 red: (1) E-133 map guard, committed maps had ../../ sources from a symlinked node_modules build: dist rebuilt in main f370d9aa0 (test-release-dist-guard 13/0); (2) D48-r6 doctor: caveman unsuppressed claude subcall, spawn-env guard (spawnSync without env), --fix test fails on CI: DROPPED (reverts 14ada6db2, 1ca5abd6a). A-119b r3 merge reverted 7a2467d7f (core 5024 over cap; re-land as A-119c with code out of core and add-based weakening closed).
+- A-121b r3 merged 8714c988f (one-line write keeps core 4999; verify_cmd/log_seal/budget/roundtrip 55/0, quick-receipt-order 26/0). train/27 8714c988 pushed (guards: shellcheck 0, v10-ops 67/0, shard-coverage 19/0).
+- D50 baseline merged 871ff5dc7 (METRICS.md): raw haiku 4/10, Loki+haiku 7/10 (cost/completed -14%, 1.19x time), raw sonnet 9/10, Loki+sonnet 5/10 (LOSS). Defect E-164 (lockfile dirtied by setup blocks v10 start) building.
+- Rework: A-118 r4 (3 narrow cases), D51-A12 r3 (health exempt, deploy hosts, 27 tests). DOC-01 a13ca60be done, unreviewed.
+
+## 2026-10-01T04:29Z D48 report (deadline 04:35Z) and release state
+- Releases: v10.5.17 published (Release success; npm 10.5.17 gitHead 78d8713b) and AUTO-PROMOTED by promote.yml (event workflow_run, success): dist-tags latest=10.5.17, next=10.5.17. First D49 auto-promotion.
+- train/28 red (D51-A12 host check 403 in non-dashboard tests; E-164 spawn without env): both dropped, fixed (D51-A12 r4 af58ceead, E-164 r2 be5b70070) and re-landed on main. train/29 red on Python 3.10 only (A-118 treats any pyproject edit as config when tomllib is missing): A-118 dropped (bb9658a15), r5 in progress. train/30 bb9658a1 (D51-A12 UI, E-164, DOC-02 doc sweep) in CI.
+- D48 rows (acceptance test status, honest):
+  1 gaming matrix: NOT DONE. Test built (D48-r1 de71397dd) but not merged; 20 expected-fail cases remain (A-117 shipped; A-118 r5 and A-119c still open; pre-red case needs a CTO call).
+  2 portable receipt: PARTIAL. A-117 (tamper detection incl. tail truncation) shipped in 10.5.17; `loki keys export` + `loki verify --pubkey` built (b073d50a), not yet reviewed or merged.
+  3 quiet and fast (<=8 lines, <=1.5x raw time): NOT DONE (not measured; D50 baseline shows Loki+haiku 1.19x raw haiku time).
+  4 commits only the fix on node/pytest/go repos: NOT STARTED.
+  5 exit ladder + --json schema: NOT DONE (A-118 r5 in progress; schema not started).
+  6 doctor --fix and <2s: NOT DONE (built, dropped from train/26 on CI: unsuppressed claude subcall, spawn env, test failing on CI).
+  7-9 v10 default engine + non-null cost: NOT DONE (flip slice built? builder has not reported).
+  10 loki-seal installable from the repo marketplace: PASS (shipped in 10.5.17, on latest; clean-HOME install verified).
+- D51 Phase A on latest (10.5.17): `loki backlog` + loki.yaml + Slack (v10 path). Pending on train/30: bare `loki` opens the UI with PAT onboarding and backlog complete-all.
+- D50: baseline in METRICS.md (Loki+haiku 7/10 vs raw haiku 4/10; Loki+sonnet 5/10 vs raw sonnet 9/10, a LOSS). E-164 (setup-dirtied lockfile) fixed.
+- Pacing: from 04:35Z the governor paces to about 0.48%/h of the week (about 7 engineers).
+
+## 2026-10-01T04:33Z LEAD HANDOFF STATE (paced mode from 04:35Z, about 4 engineers)
+- npm: latest=next=10.5.17 (78d8713b, auto-promoted). origin/main=78d8713b. train/30 bb9658a1 in CI (D51-A12 UI, E-164, DOC-02); when green: ff main, cut 10.5.18 (D49 auto-promotes).
+- Local main ahead of train/30: A-118 re-landed with r5 (cdc8213df, 3.10 pyproject fallback), loki-seal README install (f8ba34a34). Next train after train/30.
+- Built, not merged: D48-r1 gaming matrix de71397dd (CTO call on pre-red), D48-r2 keys export/--pubkey b073d50a (opus review), E-162 slice CI tier-down 6b9738fdc (pushed, review), E-163 live /usage governor 678f2162e (review), DOC-01 r2 README (agent finishing), D48-r6 doctor --fix (dropped; needs: caveman suppression, spawn env, CI test fix).
+- Open rows: A-119c (add-based helper weakening, keep core under cap), A-121c (CTO), A-134c, E-160 (CTO), E-161 guard, E-165 (P0 guard: mirofish test launches a live build), E-166 Jira wiring, D48 rows 3-9, D50 harness items, D51 Phase B/C.
+- Rules this session learned: re-land a dropped slice by reverting the revert, then merging the fix; rebuild dist in the main checkout after any merge touching loki-ts (no symlinked node_modules); no `|` or `||` in BOARD cells; run the registration, shard, spawn-env, dist-guard and docs-drift checks before every train.
+
+## 2026-10-01T04:58Z P0: v10.5.18 release blocked by CodeQL
+- v10.5.18 (981d9734) Release run FAILED at required-ci: Security Audit failed on CodeQL alert 607 py/command-line-injection (critical) at dashboard/api_start.py:120, plus path-injection 604-606 (lines 69, 75), all from D51-A12 onboarding (provider name from the request reaching subprocess and a file path). Not published; npm latest/next stay 10.5.17.
+- Fix forward (main already contains it): slice-P0-codeql (constant allowlists for the provider binary and secret file names) in progress; then train with it, then re-cut the release.
+- train/31 731a335d is green on Tests/Parity/Coverage but its Security Audit fails on the same alert; it will not release until the fix lands.
+- D48-flip rejected by opus (bare loki verify still legacy after a default v10 run: FAILED run reads VERIFIED); r2 in progress.

package/docs/walkthrough/README.md

@@ -11,16 +11,10 @@ Interactive HTML walkthroughs demonstrating Loki Mode's capabilities. Each file
 | `comparison.html` | **Feature Comparison** -- Side-by-side comparison of Loki Mode vs alternative AI build tools with interactive feature matrix | 26 KB |
 | `gallery.html` | **Project Gallery** -- Showcase of 24 example projects built with Loki Mode across SaaS, CLI, mobile, and enterprise categories | 37 KB |
 | `video-placeholder.html` | **Build Process Animation** -- CSS-animated walkthrough of the build process with terminal replay and phase transitions | 25 KB |
-| `build-demo.html` | **Full Build Video Demo** -- Replay of a complete SaaS dashboard build showing all 12 iterations with timeline and progress tracking | 18 KB |
-| `ide-demo.html` | **Purple Lab IDE Demo** -- Interactive mockup of the browser-based Purple Lab IDE with file explorer, editor, and Loki Mode status panel | 17 KB |
-| `enterprise-demo.html` | **Enterprise Features Demo** -- Audit logging, RBAC, security architecture, compliance, and governance capabilities for organizations | 13 KB |
-| `provider-race-demo.html` | **Multi-Provider Race Demo** -- Animated race comparing Claude, Codex, and Gemini building the same app simultaneously | 17 KB |
-| `memory-demo.html` | **Memory System Demo** -- Interactive exploration of episodic, semantic, and procedural memory layers with progressive disclosure | 19 KB |
-| `dashboard-demo.html` | **Dashboard Monitoring Demo** -- Real-time monitoring dashboard mockup with build log, agent status, task queue, and KPI tracking | 17 KB |
 
 ## Hub Page
 
-Open `hub.html` for a landing page that links to all walkthroughs with descriptions and categories.
+Open `hub.html` for a landing page that links to the walkthroughs with descriptions and categories.
 
 ## How to View