loki-mode 10.5.2 → 10.5.3

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: Autonomous spec-driven build system with a built-in trust layer. It does not call work done until it is verified (RARV-C closure loop, 8 quality gates, completion council, verified-completion evidence gate). Triggers on "Loki Mode". Takes a spec (PRD, GitHub issue, OpenAPI doc, etc.) to deployed product with minimal human intervention. Provider-agnostic. Requires --dangerously-skip-permissions flag.
 ---
 
-# Loki Mode v10.5.2
+# Loki Mode v10.5.3
 
 **You are an autonomous agent. You make decisions. You do not ask questions. You do not stop.**
 
@@ -470,4 +470,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v10.5.2 | [Autonomi](https://www.autonomi.dev/) flagship product | ~410 lines core**
+**v10.5.3 | [Autonomi](https://www.autonomi.dev/) flagship product | ~410 lines core**

package/VERSION

@@ -1 +1 @@
-10.5.2
+10.5.3

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "10.5.2"
+__version__ = "10.5.3"
 
 # Expose the control app for easy import
 try:

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 The flagship product of [Autonomi](https://www.autonomi.dev/). Loki Mode is a spec-driven autonomous builder with a built-in trust layer that takes any spec to a deployed product and verifies completion with evidence (quality gates plus a completion council), not just a "done" claim. Complete installation instructions for all platforms and use cases.
 
-**Version:** v10.5.2
+**Version:** v10.5.3
 
 ---
 

package/docs/v10/BOARD.md

@@ -364,9 +364,9 @@ set is declared to avoid overlap with those and with each other.
 | M-10 | Coverage-guided input search (read-only session, plateau stop) | loki-ts/src/engine10/modernize/oracle/search.ts, loki-ts/tests/engine10/modernize/search.test.ts | HIGH | cd loki-ts && bun test tests/engine10/modernize/search.test.ts | released@2026-09-28T21:01Z | Source: MODERNIZE.md (D30). Depends on M-09. Opus REJECT (reproduced): a failed seed capture is reported as a plateau. Next: rework. r2 d7db4fb1 Opus APPROVE; merged dc827b80 (on top of v10.2.2): full `cd loki-ts && bun test` 2277 pass 0 fail, `bash tests/test-engine10-dist.sh` 18 passed, `bash tests/test-v10-pulse.sh` 117 passed. Released in v10.5.0 (merge 66c5e465 is an ancestor of v10.5.0). |
 | M-11 | Java capture: JUnit under JDK 8 with JaCoCo plus Randoop | autonomy/lib/modernize/java_capture.sh, loki-ts/src/engine10/modernize/oracle/java.ts, loki-ts/tests/engine10/modernize/java_capture.test.ts | HIGH | cd loki-ts && bun test tests/engine10/modernize/java_capture.test.ts | released@2026-09-28T21:01Z | Source: MODERNIZE.md (D30). Depends on M-04. Opus REJECT (reproduced): multi-line java -version breaks status.json (json_escape skips newlines). Next: rework. Wave E26 (wf_9ba5fcaf-75a). Round 3. r3 e476435b opus APPROVE (every C0 byte escaped as \u00XX; malformed status.json reported as its own reason); merged locally. Released in v10.5.0 (merge 4a11c285 is an ancestor of v10.5.0). |
 | M-12 | Oracle seal, held-out split, 80% floor, up-front NOT PROVEN | loki-ts/src/engine10/modernize/oracle/seal.ts, loki-ts/tests/engine10/modernize/oracle_seal.test.ts | HIGH | cd loki-ts && bun test tests/engine10/modernize/oracle_seal.test.ts | released@2026-09-28T21:01Z | Source: MODERNIZE.md (D30). Depends on M-09. Opus REJECT (reproduced): delete-and-reseal defeats tamper evidence (hashes stored beside the data). Next: rework. r2 d9026ec6 Opus APPROVE (reseal refused via the append-only log); merged dc827b80 (on top of v10.2.2): full `cd loki-ts && bun test` 2277 pass 0 fail, `bash tests/test-engine10-dist.sh` 18 passed, `bash tests/test-v10-pulse.sh` 117 passed. Released in v10.5.0 (merge b71d80fa is an ancestor of v10.5.0). |
-| M-13 | Equivalence checker with sealed normalizers and contract output | loki-ts/src/engine10/modernize/equiv.ts, loki-ts/tests/engine10/modernize/equiv.test.ts, loki-ts/tests/engine10/modernize/fixtures/equiv/ | HIGH | cd loki-ts && bun test tests/engine10/modernize/equiv.test.ts | building@2026-09-28T21:42Z | Source: MODERNIZE.md (D30). Depends on M-12. Wave E27 (wf_bcacb1d1-e76). Wave E27 stopped 18:37Z (founder: over budget, load 50). REJECT (reproduced): a unit whose oracle seal is NOT_PROVEN still gets a clean equivalence pass. Branch slice-M-13-equiv kept. Dispatched 21:18Z sonnet (founder 17:10 staffing directive). r2 b379c171 REJECT (3 blockers), r3 89ea40ae REJECT on B3 (normalizers still caller-supplied: tolerance 1e9 after the new tree gives PROVEN). D42 (4): only fix (a), sealOracle hashes the normalizers; M-13 may edit the M-12 seal file for this only. r4 dispatched 21:42Z. |
-| M-14 | Wall pre-sealed mode: oracle plus conformance, green base is an error | loki-ts/src/engine10/stages/wall.ts (pre-sealed branch only), loki-ts/tests/engine10/modernize/wall_presealed.test.ts | HIGH | cd loki-ts && bun test tests/engine10/modernize/wall_presealed.test.ts | ready@2026-09-28T18:42Z | Source: MODERNIZE.md (D30). Depends on M-12, E-54. D33: states its net core line delta; core must stay under 5,000 (92 lines of headroom shared by E-67, E-66, E-61, M-14, merge order E-67, E-66, E-61); offset any excess by deleting dead core code. Wave E27 (wf_bcacb1d1-e76). Wave E27 stopped 18:37Z (founder: over budget, load 50). REJECT: branch empty (no commits). |
-| M-15 | Unit runner: card to v10 run with oracle Wall and equiv check | loki-ts/src/engine10/modernize/unit.ts, loki-ts/tests/engine10/modernize/unit.test.ts | HIGH | cd loki-ts && bun test tests/engine10/modernize/unit.test.ts | ready@2026-09-28T02:45Z | Source: MODERNIZE.md (D30). Depends on M-13, M-14. |
+| M-13 | Equivalence checker with sealed normalizers and contract output | loki-ts/src/engine10/modernize/equiv.ts, loki-ts/tests/engine10/modernize/equiv.test.ts, loki-ts/tests/engine10/modernize/fixtures/equiv/ | HIGH | cd loki-ts && bun test tests/engine10/modernize/equiv.test.ts | merged@2026-09-28T21:50Z | Source: MODERNIZE.md (D30). Depends on M-12. Wave E27 (wf_bcacb1d1-e76). Wave E27 stopped 18:37Z (founder: over budget, load 50). REJECT (reproduced): a unit whose oracle seal is NOT_PROVEN still gets a clean equivalence pass. Branch slice-M-13-equiv kept. Dispatched 21:18Z sonnet (founder 17:10 staffing directive). r2 b379c171 REJECT (3 blockers), r3 89ea40ae REJECT on B3 (normalizers still caller-supplied: tolerance 1e9 after the new tree gives PROVEN). D42 (4): only fix (a), sealOracle hashes the normalizers; M-13 may edit the M-12 seal file for this only. r4 dispatched 21:42Z. r4 fe3cae28 opus APPROVE (normalizer hash in the oracle seal; tolerance 1e9 after seal gives NOT_PROVEN; hand-edited sealed.json refused; canonical hash over all 3 fields). Merged. |
+| M-14 | Wall pre-sealed mode: oracle plus conformance, green base is an error | loki-ts/src/engine10/stages/wall.ts (pre-sealed branch only), loki-ts/tests/engine10/modernize/wall_presealed.test.ts | HIGH | cd loki-ts && bun test tests/engine10/modernize/wall_presealed.test.ts | building@2026-09-28T21:58Z | Source: MODERNIZE.md (D30). Depends on M-12, E-54. D33: states its net core line delta; core must stay under 5,000 (92 lines of headroom shared by E-67, E-66, E-61, M-14, merge order E-67, E-66, E-61); offset any excess by deleting dead core code. Wave E27 (wf_bcacb1d1-e76). Wave E27 stopped 18:37Z (founder: over budget, load 50). REJECT: branch empty (no commits). Dispatched 21:51Z. r1 867cffab opus REJECT: crash/OOM/signal exits read as red; bare ImportError enum reads a missing third-party package as red; no file sha256 or verify; no binding to the oracle seal. r2 dispatched 21:57Z. |
+| M-15 | Unit runner: card to v10 run with oracle Wall and equiv check | loki-ts/src/engine10/modernize/unit.ts, loki-ts/tests/engine10/modernize/unit.test.ts | HIGH | cd loki-ts && bun test tests/engine10/modernize/unit.test.ts | ready@2026-09-28T02:45Z | Source: MODERNIZE.md (D30). Depends on M-13, M-14. Requirement from the M-13 review: call sealOracle with the card normalizers before implement, and test that ordering. |
 | M-16 | Deterministic codemods first (futurize, OpenRewrite) or skipped | loki-ts/src/engine10/modernize/codemod.ts, loki-ts/tests/engine10/modernize/codemod.test.ts | MEDIUM | cd loki-ts && bun test tests/engine10/modernize/codemod.test.ts | released@2026-09-28T16:03Z | Source: MODERNIZE.md (D30). Depends on M-02. Built 0a8bbe6c (branch slice-M-16-codemods); TL review died on the 04:48Z access outage. Wave E21 (wf_39ab3f7d-8f3). TL review. TL APPROVE of 0a8bbe6c; merged into train E22 (9042e964): `bun test tests/engine10/` 547 pass 0 fail, tsc 0, `bash tests/test-v10-pulse.sh` 107 passed, `bash eval/loki10/test-harness.sh` 108 passed. Released in v10.2.1 (npm publish 2026-09-28T16:03Z; every cited commit is an ancestor of the v10.2.1 tag; `git merge-base --is-ancestor`). |
 | M-17 | Scheduler: N workers, worktrees, cascade, best-of-2, budget stop | loki-ts/src/engine10/modernize/scheduler.ts, loki-ts/tests/engine10/modernize/scheduler.test.ts | HIGH | cd loki-ts && bun test tests/engine10/modernize/scheduler.test.ts | ready@2026-09-28T02:45Z | Source: MODERNIZE.md (D30). Depends on M-15. |
 | M-18 | Re-slice non-equivalent units to depth 2, then NOT PROVEN | loki-ts/src/engine10/modernize/reslice.ts, loki-ts/tests/engine10/modernize/reslice.test.ts | MEDIUM | cd loki-ts && bun test tests/engine10/modernize/reslice.test.ts | ready@2026-09-28T02:45Z | Source: MODERNIZE.md (D30). Depends on M-05, M-13. |
@@ -441,24 +441,27 @@ set is declared to avoid overlap with those and with each other.
 | E-111 | P0 (local main red): engine10 core is 5003 lines after E-98a/b/c/d merged (budget.test.ts Received 5003, cap 5000). Cut at least 25 lines of dead or duplicated code from loki-ts/src/engine10 (outside modernize/) with no behavior change, leaving room for E-98e (+10) | loki-ts/src/engine10 (non-modernize), no test changes except budget | MEDIUM | budget.test.ts passes at 4978 or less; cd loki-ts && bun test tests/engine10 has no new failures vs main | released@2026-09-28T21:01Z | Source: merge of E-98a at 20:10Z. Dispatched sonnet. opus REJECT r1 (deleted prStage/intakeStage, test-engine10-dist 16/2); APPROVE r2 f286f6ec; merged f059c87a, dist rebuilt e1363c67; core 4976, engine10 668/0, dist 18/0. Released in v10.5.0 (merge f059c87a is an ancestor of v10.5.0). |
 | E-112 | v10-guard: refuse a path-wide `git checkout <ref> -- .` (or `git restore --source <ref> .`) when cwd is the main checkout, so a read-only reviewer cannot overwrite the shared tree; allowed inside .claude/worktrees/* | scripts/v10-guard.sh, tests/test-v10-guard.sh | LOW | fixture: the command in the main checkout is blocked, the same in a worktree is allowed, a single-file checkout is allowed (red first) | released@2026-09-28T21:01Z | Source: E-98e Tech Lead review 20:19Z ran `git checkout slice-E-98e -- .` then `git checkout main -- .` in the main checkout (tree restored clean, but it could have clobbered concurrent merges). Built f4515ec9 (6 new block cases red on the old guard); Tech Lead APPROVE (7 allow probes incl. single-file checkout, branch switch, heredoc text all exit 0); merged; test-v10-guard.sh 170/0. Released in v10.5.0 (merge 06c01b6c is an ancestor of v10.5.0). |
 | E-113 | P0 (main red at a4623675): tests/test-release-notes.sh T9l/T9n/--include fixtures build padding with yes piped to head under pipefail; on the Linux runner only the 34-byte header was written. Generate padding without a pipe | tests/test-release-notes.sh | LOW | passes locally and under the CI condition (SIGPIPE ignored); old version shown red there | released@2026-09-28T21:01Z | Source: Tests run on a4623675 shard 4/8: "[FAIL] T9n fixture is not in the intended size band ... 34 bytes". Passes 41/0 on macOS. Dispatched 20:39Z. Built 74ffd928 (pipe-free printf loops; macOS could not reproduce the Linux drop even under trap PIPE, so CI is the proof). Tech Lead APPROVE (bytes identical: T9l 132034, T9n 98034, T9o 224089). Merged; 41/0 locally. Released in v10.5.0 (merge f6c3add4 is an ancestor of v10.5.0). |
-| E-114 | CI Security Audit gitleaks must not trust a pushed .gitleaks.toml or new .gitleaksignore entries: scan with the default rules plus the config from the previous release tag (or refuse the job when the pushed range changes .gitleaks.toml), and report any .gitleaksignore line added in the range for review | .github/workflows/security-audit.yml, tests/test-security-audit-config.sh | HIGH | a workflow-level test (act or a script that runs the same step) shows a range that adds a zero-rule .gitleaks.toml plus a secret fails the job (red first) | building@2026-09-28T21:13Z | Source: E-110 opus review 21:09Z: the gitleaks step (security-audit.yml:276) loads the checkout own .gitleaks.toml, so the same zero-rule config trick that bypassed the pre-push scan works against CI (no --config at security-audit.yml:276). CTO-level change to a release gate. Dispatched 21:11Z sonnet; opus review before merge. |
-| E-115 | Verify: a passing lint on a system ruff adds its own not_proven line ("lint ran on the system ruff") instead of reusing "tests ran on the system interpreter" | loki-ts/src/engine10/stages/verify.ts, loki-ts/tests/engine10/verify.test.ts | LOW | unit test: system ruff pass gives the lint line, not the tests line (red first); core stays under 5000 | ready@2026-09-28T21:31Z | Source: E-98a r2 opus review (advisory). Held 21:31Z: worktree cap (15). |
+| E-114 | CI Security Audit gitleaks must not trust a pushed .gitleaks.toml or new .gitleaksignore entries: scan with the default rules plus the config from the previous release tag (or refuse the job when the pushed range changes .gitleaks.toml), and report any .gitleaksignore line added in the range for review | .github/workflows/security-audit.yml, tests/test-security-audit-config.sh | HIGH | a workflow-level test (act or a script that runs the same step) shows a range that adds a zero-rule .gitleaks.toml plus a secret fails the job (red first) | merged@2026-09-28T21:49Z | Source: E-110 opus review 21:09Z: the gitleaks step (security-audit.yml:276) loads the checkout own .gitleaks.toml, so the same zero-rule config trick that bypassed the pre-push scan works against CI (no --config at security-audit.yml:276). CTO-level change to a release gate. Dispatched 21:11Z sonnet; opus review before merge. opus REJECT r1 (event.before chain from an ungated push, repro "no leaks found"), REJECT r2 (no-tag fallback to origin/main~1 fails open), APPROVE r3 b30c2870 (base = last release tag; no tag: default rules and any tip .gitleaks.toml refused); also fixed the scan-coverage baseline shape broken by 6358e0a6. Merged; audit-config 15/0, scan-coverage 31/0. |
+| E-115 | Verify: a passing lint on a system ruff adds its own not_proven line ("lint ran on the system ruff") instead of reusing "tests ran on the system interpreter" | loki-ts/src/engine10/stages/verify.ts, loki-ts/tests/engine10/verify.test.ts | LOW | unit test: system ruff pass gives the lint line, not the tests line (red first); core stays under 5000 | ready@2026-09-28T22:01Z | Source: E-98a r2 opus review (advisory). Held 21:31Z: worktree cap (15). Held 22:01Z: touches core verify.ts while S41-16 has core at 4997/5000. |
 | E-116 | seal.test.ts has no SPEC_CONFLICT case: add real-seal tests (not a copy of seal.ts:110) proving SPEC_CONFLICT survives verify pass, verify fail plus fix, and never upgrades to VERIFIED | loki-ts/tests/engine10/seal.test.ts | LOW | new cases red on a mutated seal.ts that drops the spec_conflict branch | merged@2026-09-28T21:31Z | Source: E-98b opus review note 4. Built fbc79ac9 (4 real-seal tests; red when seal.ts:109 removed); Tech Lead review 21:30Z. Tech Lead APPROVE fbc79ac9 (imports the real sealStage; gap test honest); merged; seal.test.ts 18/0. |
 | E-117 | Pulse DEPENDS_ON parsing: expand range shorthand ("Depends on E-98a..e", "M-20..M-23") into each id so a dependency on b..e is not silently dropped | scripts/v10-pulse.sh (dependency parse only), tests/test-v10-pulse.sh | LOW | fixture: "Depends on E-98a..c" with E-98b unmerged is blocked (red first) | merged@2026-09-28T21:43Z | Source: E-91 Tech Lead review. Dispatched 21:31Z sonnet. Tech Lead REJECT 5f59bfed: numeric range uncapped (M-1..M-9999 expands to 9999 ids into the injected pulse); r2 caps at 50. r2 d99963e3 caps numeric spans at 50 (the Tech Lead blocker); merged; test-v10-pulse.sh 146/0. |
-| E-118 | Usage governor leftovers from G-01 review: a non-numeric used_percentage or a non-dict rate_limits in a live reading must be ignored, not crash; the "uncalibrated" label must not show when calibration exists but no engineers were active | scripts/usage-governor.py, tests/test-usage-governor.sh | LOW | fixtures for each case (red first); 30/30 existing still pass | ready@2026-09-28T21:31Z | Source: G-01 r2/r3 opus review non-blocking notes. Held 21:31Z: worktree cap (15). |
-| E-119 | pre-push: the pushed-range .gitleaks.toml check (pre-push:319) swallows a git rev-list error with an or-true, which reads as "config unchanged" and restores the tip config; fail closed on a non-zero rc | .githooks/pre-push, tests/test-pre-push-gitleaks.sh | LOW | a stubbed git rev-list failure refuses the push (red first) | ready@2026-09-28T21:20Z | Source: E-110 r2 opus review nit 4. |
+| E-118 | Usage governor leftovers from G-01 review: a non-numeric used_percentage or a non-dict rate_limits in a live reading must be ignored, not crash; the "uncalibrated" label must not show when calibration exists but no engineers were active | scripts/usage-governor.py, tests/test-usage-governor.sh | LOW | fixtures for each case (red first); 30/30 existing still pass | building@2026-09-28T22:01Z | Source: G-01 r2/r3 opus review non-blocking notes. Held 21:31Z: worktree cap (15). Dispatched 22:01Z. |
+| E-119 | pre-push: the pushed-range .gitleaks.toml check (pre-push:319) swallows a git rev-list error with an or-true, which reads as "config unchanged" and restores the tip config; fail closed on a non-zero rc | .githooks/pre-push, tests/test-pre-push-gitleaks.sh | LOW | a stubbed git rev-list failure refuses the push (red first) | merged@2026-09-28T21:47Z | Source: E-110 r2 opus review nit 4. Built 22bc9931 (case 35 red on the pre-fix hook: push succeeded rc=0); opus APPROVE (one code path changed; case 28 still refuses the corrupted range); merged; pre-push-gitleaks 54/0, pre-push-hook 13/0. |
 | E-120 | Seal: carry implement.spec_conflict_reason into receipt.json and receipt.md so a SPEC_CONFLICT verdict states why | loki-ts/src/engine10/stages/seal.ts, loki-ts/tests/engine10/seal.test.ts | LOW | the E-116 documenting test flips to asserting the reason is present (red first); core stays under 5000 | merged@2026-09-28T21:44Z | Source: E-116 engineer finding (seal.ts reads only implement.exit and tests_reverted). Dispatched 21:31Z sonnet. opus REJECT b0f0dce3: reason rendered raw into receipt.md (a newline plus heading forges VERIFIED); r2 46eeb56d neutralizes it; core 4982; opus re-review 21:42Z. opus APPROVE r2 46eeb56d (injection repro stays on one inline-code line; backticks neutralized; key omitted when absent); merged; seal+budget 23/0. |
-| S41-16 | P0: Wall red-on-base is vacuous without python (launch error counted as failed on base) | see docs/v10/SCORECARD-PLAN.md | HIGH | per SCORECARD-PLAN.md card | building@2026-09-28T21:42Z | Source: D41, Architect plan 7f671f5c. Depends on D42. D42 (3) confirmed P0; merges before any wave-1 card touching wall, verify or Seal. Dispatched 21:42Z. |
+| E-121 | Pulse ID_RE and DEPENDS_ON_ID_RE reject ids with digits in the prefix (S41-01), so all 16 S41 rows are invisible to the building/ready counts and budgets; accept [A-Z]+[0-9]*-[0-9]+[a-z]? | scripts/v10-pulse.sh (id regexes only), tests/test-v10-pulse.sh | LOW | fixture: a building S41-01 row is counted and a "Depends on S41-06" is honored (red first) | merged@2026-09-28T21:58Z | Source: 21:50Z pulse showed building=0 while S41-01, S41-02, S41-16 were building. Dispatched 21:51Z. Built f94ab0da (T52/T53 red first); Tech Lead APPROVE (full-match on cell 0 and Depends clause only); merged; test-v10-pulse.sh 149/0. |
+| E-122 | Scorecard headline pair (loki on sonnet vs raw opus) is green on cost only at 0.5x raw or less, per D41; add the rule and a test | eval/loki10/scorecard, eval/loki10/test-scorecard.sh | LOW | fixture at 0.6x raw cost is red on the headline pair, 0.5x is green (red first) | building@2026-09-28T22:01Z | Source: S41-02 Tech Lead review note 5. Depends on S41-02. Dispatched 22:01Z. |
+| E-123 | tests/test-security-scan-coverage.sh runs only in local-ci.sh, never in CI, so its .gitleaksignore baseline drifted unnoticed (6358e0a6); register it in tests/run-all-tests.sh and shard-durations so CI Tests run it | tests/run-all-tests.sh, tests/shard-durations.tsv | LOW | test-shard-coverage.sh lists it; the suite passes on main (31/0) | building@2026-09-28T22:01Z | Source: E-114 opus review item 4. Depends on E-114. Dispatched 22:01Z. |
+| S41-16 | P0: Wall red-on-base is vacuous without python (launch error counted as failed on base) | see docs/v10/SCORECARD-PLAN.md | HIGH | per SCORECARD-PLAN.md card | building@2026-09-28T21:58Z | Source: D41, Architect plan 7f671f5c. Depends on D42. D42 (3) confirmed P0; merges before any wave-1 card touching wall, verify or Seal. Dispatched 21:42Z. r1 55e427ab opus REJECT: not_run never reaches seal (seal.ts:117 ignores not_run, so pass 1 fail 0 not_run 1 seals ALREADY_SATISFIED: a new false verdict); jest/vitest/bun non-zero exit without a parsed count read as red; AttributeError/NameError anywhere counted as repo red; system-interpreter results must be not_run. r2 dispatched 21:58Z. |
 | S41-01 | Harness: accept partial-stream cost, allowlist LOKI_E10_CASCADE, new row fields | see docs/v10/SCORECARD-PLAN.md | MEDIUM | per SCORECARD-PLAN.md card | building@2026-09-28T21:42Z | Source: D41, Architect plan 7f671f5c. Depends on none. Dispatched 21:41Z. |
-| S41-02 | Scorecard tool: per-tier completion, cost per completed, p50, raw vs loki, into METRICS.md | see docs/v10/SCORECARD-PLAN.md | LOW | per SCORECARD-PLAN.md card | building@2026-09-28T21:42Z | Source: D41, Architect plan 7f671f5c. Depends on none. Dispatched 21:41Z. |
-| S41-03 | Arm runner for raw sonnet, raw opus, loki on sonnet (LOKI_EVAL_MODEL) plus OAuth auth guard | see docs/v10/SCORECARD-PLAN.md | MEDIUM | per SCORECARD-PLAN.md card | ready@2026-09-28T21:41Z | Source: D41, Architect plan 7f671f5c. Depends on none. |
-| S41-04 | First-turn prefix measurement (tokens by type per stage) | see docs/v10/SCORECARD-PLAN.md | LOW | per SCORECARD-PLAN.md card | ready@2026-09-28T21:41Z | Source: D41, Architect plan 7f671f5c. Depends on none. |
+| S41-02 | Scorecard tool: per-tier completion, cost per completed, p50, raw vs loki, into METRICS.md | see docs/v10/SCORECARD-PLAN.md | LOW | per SCORECARD-PLAN.md card | merged@2026-09-28T21:54Z | Source: D41, Architect plan 7f671f5c. Depends on none. Dispatched 21:41Z. Built 42c0d88d (21/0; null-cost mutation flips n/a red to green, caught); replay reproduces E-98f exactly; EV-15 medium red on all 3 columns. Tech Lead review 21:51Z. Tech Lead APPROVE (definitions match section 2; replayed all 3 E-98f arms exactly). Merged. |
+| S41-03 | Arm runner for raw sonnet, raw opus, loki on sonnet (LOKI_EVAL_MODEL) plus OAuth auth guard | see docs/v10/SCORECARD-PLAN.md | MEDIUM | per SCORECARD-PLAN.md card | review@2026-09-28T22:01Z | Source: D41, Architect plan 7f671f5c. Depends on none. Dispatched 21:51Z. Built de741f04 (dry-run for 3 arms; red evidence only proved file existence); Tech Lead review 22:00Z checks the auth guard decision itself. |
+| S41-04 | First-turn prefix measurement (tokens by type per stage) | see docs/v10/SCORECARD-PLAN.md | LOW | per SCORECARD-PLAN.md card | merged@2026-09-28T21:57Z | Source: D41, Architect plan 7f671f5c. Depends on none. Dispatched 21:51Z. Built 71a0d28d; Tech Lead APPROVE (implement row re-derived from 58 impl.json files: mean 982,144, p50 654,959 cache_read, exact); merged. Implement is the re-reading hotspot (982K cache read per task vs 45-68K for intake, plan, Wall). |
 | S41-05 | Attempt-selection rule (pure function in e10ext/select.ts) | see docs/v10/SCORECARD-PLAN.md | HIGH | per SCORECARD-PLAN.md card | ready@2026-09-28T21:41Z | Source: D41, Architect plan 7f671f5c. Depends on D42. |
 | S41-12 | Tree swap helper for parallel attempts | see docs/v10/SCORECARD-PLAN.md | HIGH | per SCORECARD-PLAN.md card | ready@2026-09-28T21:41Z | Source: D41, Architect plan 7f671f5c. Depends on D42. |
 | S41-06 | Baseline scorecard (eval only) on small and medium, all arms | see docs/v10/SCORECARD-PLAN.md | HIGH | per SCORECARD-PLAN.md card | ready@2026-09-28T21:41Z | Source: D41, Architect plan 7f671f5c. Depends on S41-01, S41-02, S41-03, S41-04. |
 | S41-07 | Plan on the cheap model | see docs/v10/SCORECARD-PLAN.md | MEDIUM | per SCORECARD-PLAN.md card | ready@2026-09-28T21:41Z | Source: D41, Architect plan 7f671f5c. Depends on S41-06. |
 | S41-08 | Top model and deterministic-failure escalation | see docs/v10/SCORECARD-PLAN.md | HIGH | per SCORECARD-PLAN.md card | ready@2026-09-28T21:41Z | Source: D41, Architect plan 7f671f5c. Depends on S41-06. |
-| S41-09 | Lean stable prefix (flag) | see docs/v10/SCORECARD-PLAN.md | MEDIUM | per SCORECARD-PLAN.md card | ready@2026-09-28T21:41Z | Source: D41, Architect plan 7f671f5c. Depends on S41-04. |
+| S41-09 | Lean stable prefix (flag) | see docs/v10/SCORECARD-PLAN.md | MEDIUM | per SCORECARD-PLAN.md card | building@2026-09-28T22:01Z | Source: D41, Architect plan 7f671f5c. Depends on S41-04. Dispatched 22:01Z. |
 | S41-14 | Wall in parallel with implement (item 4, target p50 not worse) | see docs/v10/SCORECARD-PLAN.md | HIGH | per SCORECARD-PLAN.md card | parked@2026-09-28T21:42Z | Source: D41, Architect plan 7f671f5c. Depends on D42, S41-16. D42 (2): deferred; E-98f shows no speed win (Wall-off p50 214s vs 209s) and it touches the moat. Reopen only if Wall is at least 15% of p50, with the Wall sealed and proven red on a clean base before any implement diff. |
 | S41-10 | Relevant context and a static-first brief | see docs/v10/SCORECARD-PLAN.md | MEDIUM | per SCORECARD-PLAN.md card | ready@2026-09-28T21:41Z | Source: D41, Architect plan 7f671f5c. Depends on S41-09. |
 | S41-11 | Rule-based trajectory trimming (flag) | see docs/v10/SCORECARD-PLAN.md | MEDIUM | per SCORECARD-PLAN.md card | ready@2026-09-28T21:41Z | Source: D41, Architect plan 7f671f5c. Depends on S41-09. |
@@ -480,7 +483,7 @@ set is declared to avoid overlap with those and with each other.
 | E-107 | Pulse SESSION_STALLED derives the Claude transcript directory from the shell cwd, so a session whose shell sits in a subdirectory (loki-ts/) reads a nonexistent project dir and reports a 108182-minute stall; resolve it from the repo root (git rev-parse --show-toplevel) | scripts/v10-pulse.sh (transcript-dir resolution only), tests/test-v10-pulse.sh | LOW | fixture: pulse run from a subdirectory reports the same minutes-since-last-turn as from the root | released@2026-09-28T21:01Z | Source: 19:48Z pulse: SESSION_STALLED 108182.9 min right after a Bash step left cwd at loki-ts/. Serialize after E-91 and G-02 (same file). Tech Lead: logic APPROVE, REJECT for a T48 name collision with G-02; r2 823f91cb renamed to T49/T49a/T49b, merge-tree clean; merged; test-v10-pulse.sh 140/0. Released in v10.5.0 (merge 697c6e55 is an ancestor of v10.5.0). |
 | E-108 | release.sh --bump-only: after a rebuild it restores loki.js.map (debugId-only churn, E-72) but leaves the new debugId trailer in dist/loki.js, so the shipped loki.js and loki.js.map disagree on debugId; keep the old trailer too, so a VERSION-only bump changes exactly the version literal | scripts/release.sh, tests/test-release-bump-dist.sh | LOW | fixture: after a VERSION-only bump, git diff of dist/loki.js is exactly the version literal and its debugId equals the map debugId (red first) | released@2026-09-28T21:01Z | Source: v10.4.0 cut 19:50Z: loki.js debugId AE3EFDC8... vs map 93B13628...; fixed by hand in 7895a698. Dispatched 19:56Z sonnet. Tech Lead APPROVE 71f2f944 (restores only the debugId trailer, never the version literal); merged 6b65aaff; bump-dist 15/0, bump-only 8/0. Released in v10.5.0 (merge 6b65aaff is an ancestor of v10.5.0). |
 | E-109 | usage-governor.py takes 115s (real 115.27s, full parse of every transcript) so the pulse background refresh times out and OPUS_SHARE/BUDGET_BURN read UNKNOWN every turn; scan only transcripts modified within the weekly window and cache parsed per-file results by (path, size, mtime) | scripts/usage-governor.py, tests/test-usage-governor.sh | MEDIUM | a second run over unchanged transcripts finishes in under 10s on this host; results identical to a full parse on a fixture | released@2026-09-28T21:01Z | Source: 20:00Z pulse showed "usage governor check failed or timed out" after G-02 merged. Tech Lead REJECT r1 (warm 53s over the 10s Wall) and r2 (mtime cutoff dropped 5h-window rows after a weekly reset: 0 vs 500, reproduced); APPROVE r3 6333b8f9 (reviewer repro now 500; mkstemp cache writes). Merged; test-usage-governor 30/30; cold 12.9s, warm 4.86s (was 115s). Released in v10.5.0 (merge da1832a3 is an ancestor of v10.5.0). |
-| E-110 | P0 guard for the v10.4.0 block: (a) tests/test-eval-archive.sh builds its planted secrets at runtime so the file itself has no secret shape; (b) .githooks/pre-push runs the pinned gitleaks over every pushed commit and path (not only eval fixture changes), matching the CI Security Audit, with the tip .gitleaksignore | tests/test-eval-archive.sh, .githooks/pre-push, tests/test-pre-push-gitleaks.sh | HIGH | a push adding a test file with an AKIA-shaped literal is refused locally (red first); test-eval-archive.sh passes and gitleaks dir on it finds nothing | merged@2026-09-28T21:20Z | Source: v10.4.0 Release 36475005937 required-ci failed: Security Audit gitleaks "leaks found: 3", all in bbe83c7a:tests/test-eval-archive.sh (synthetic E-101 fixtures; allowlisted by exact fingerprint in 6358e0a6). The pre-push scan only ran for eval fixture changes. r1 ad35af15 opus REJECT: tip .gitleaks.toml disables the scan under PRE_PUSH_SKIP=1 (reviewer repro: zero-rule config plus AKIA secret landed as 743d143a on a scratch remote). r2 dispatched 21:10Z. r2 01d09027 opus APPROVE (reviewer attack refused with and without the config override; stub timeout exit 124 refuses); merged fd74149f; pre-push-gitleaks 53/0, pre-push-hook 13/0, release-notes 41/0, eval-archive 5/0. |
+| E-110 | P0 guard for the v10.4.0 block: (a) tests/test-eval-archive.sh builds its planted secrets at runtime so the file itself has no secret shape; (b) .githooks/pre-push runs the pinned gitleaks over every pushed commit and path (not only eval fixture changes), matching the CI Security Audit, with the tip .gitleaksignore | tests/test-eval-archive.sh, .githooks/pre-push, tests/test-pre-push-gitleaks.sh | HIGH | a push adding a test file with an AKIA-shaped literal is refused locally (red first); test-eval-archive.sh passes and gitleaks dir on it finds nothing | released@2026-09-28T21:40Z | Source: v10.4.0 Release 36475005937 required-ci failed: Security Audit gitleaks "leaks found: 3", all in bbe83c7a:tests/test-eval-archive.sh (synthetic E-101 fixtures; allowlisted by exact fingerprint in 6358e0a6). The pre-push scan only ran for eval fixture changes. r1 ad35af15 opus REJECT: tip .gitleaks.toml disables the scan under PRE_PUSH_SKIP=1 (reviewer repro: zero-rule config plus AKIA secret landed as 743d143a on a scratch remote). r2 dispatched 21:10Z. r2 01d09027 opus APPROVE (reviewer attack refused with and without the config override; stub timeout exit 124 refuses); merged fd74149f; pre-push-gitleaks 53/0, pre-push-hook 13/0, release-notes 41/0, eval-archive 5/0. Released in v10.5.1 (merge fd74149f is an ancestor of v10.5.1). |
 | E-58 | Issue-ref runs: supervisor creates runDir before the fetch child writes issue.json; makes E-47 green | loki-ts/src/engine10/supervisor.ts (one line before fetchIssueToFile), E-47 test files from 544348a7 | MEDIUM | cd loki-ts && bun test tests/engine10/issue_ref_e2e.test.ts (3 pass) | released@2026-09-28T02:38Z | Source: E-47 finding (TL reproduced). Merged 646a6cd7 (train E13): engine10 388 pass 0 fail, tsc exit 0, test-engine10-dist 18/0, test-engine10-docs 26 passed, test-harness 82/0. APPROVE (6384fff9); issue_ref_e2e 3 pass. Released v9.81.0 (npm view loki-mode time: 2026-09-28T02:38:54Z). |
 | E-59 | Receipt model and summary tokens match the provider: cost.ts takes model from the result-cost file; events.ts fold sums cache read and creation tokens; makes E-50 green | loki-ts/src/engine10/cost.ts, loki-ts/src/engine10/events.ts, E-50 test files from 716618d4 | HIGH | cd loki-ts && bun test tests/engine10/model_report.test.ts tests/engine10/output.test.ts | released@2026-09-28T02:38Z | Source: E-50 finding. Reconcile with E-44 (output.ts already folds cache tokens at render). Opus reviewer (cost numbers feed the gate). Opus CONCERN: writeResultCost writes no model, so real records still use the caller model; summary tokens at supervisor.ts still exclude cache. Rework dispatched. Merged 3ab2a8fa (train E14, rebased on main): engine10 404 pass 0 fail (402 pass 0 fail with claude removed from PATH), tsc exit 0, test-harness 86/0, test-local-ci-gitleaks 6/0, test-engine10-dist 18/0. Released v9.81.0 (npm view loki-mode time: 2026-09-28T02:38:54Z). |
 | EV-8 | v10 cost check on 5 tasks before the full arm (CEO 23:31Z): v10 arm, same model, after E-42 and E-45 merge | eval/loki10 results (gitignored) plus docs/v10/METRICS.md block | HIGH | eval/loki10/run.sh --arm v10 --tasks <5 ids> reports completed, time to PR and provider cost per task | released@2026-09-28T02:38Z | Target cost per completed task at or below $0.2363 (raw claude -p full arm). Depends on E-42, E-45, E-38 (--tasks). Incident 01:38Z: first run 0/5 on both variants measured the wrong code. The harness default arm binary is the global loki (loki --version: v9.78.0), and the main checkout node_modules still had agent SDK 0.3.267 (package.json pins 0.3.283), whose bundled Claude Code 2.1.267 rejects claude-opus-5-5, so every session exited "error" in about 1s with 0 tokens. Fixed in 7c3dea3d: bun install (node_modules 0.3.283), repro with the harness arm_env and arm_auth now completes on claude-opus-5-5 ($0.11, 13s); dist rebuilt. Rerun started with LOKI_EVAL_LOKI_BIN=<repo>/bin/loki. Guards E-61, E-62. Rerun measured (not a code slice): A 4/5 $0.5954, B 5/5 $0.3976, C (all sonnet, no plan, no Wall) 4/5 $0.294, raw 5/5 $0.2161 (~/loki-ci-logs/ev8r-{A,B,C}/results.jsonl). Gate not met on cost; D31 and E-64, E-65 follow. Released v9.81.0 (npm view loki-mode time: 2026-09-28T02:38:54Z). |

package/docs/v10/METRICS.md

@@ -376,3 +376,43 @@ above EV-14's 85.7% and cost at or below EV-15's $0.5085 per completed. No
 E-98f arm reaches 85.7% (nowall highest at 76.2%), and no arm's cost per
 completed is a clean number (`n/a` in all three, see the null-cost note in
 MEDIUM-ANALYSIS.md). No arm meets the rule; `sizing.ts` is unchanged.
+
+## S41-04 Per-stage token table (before-measurement)
+
+Reference for S41-09/S41-10/S41-11 to be judged against. Source: every
+`result-cost-*.json` in `~/loki-ci-logs/eval/e98f-engine/{default,nocascade,nowall}-r{1,2,3}/*/.loki/metrics/`
+(all 9 preserved E-98f run copies, no new eval spend). One row per task
+instance (result-cost files with the same stage suffix inside one task's
+`.loki` dir are summed first, e.g. two `fix1` rounds); mean/p50 taken across
+those task instances. `verify` and `seal` are deterministic (no SDK call,
+no result-cost file) so they have no token row.
+
+| stage | n (task instances) | mean input | p50 input | mean cache_read | p50 cache_read | mean cache_write | p50 cache_write | mean output | p50 output |
+|---|---|---|---|---|---|---|---|---|---|
+| intake (`already-done`) | 18 | 6 | 4 | 46,305 | 29,937 | 8,742 | 8,399 | 590 | 495 |
+| plan | 36 | 10 | 10 | 44,547 | 44,290 | 8,784 | 8,896 | 2,038 | 2,044 |
+| wall | 16 | 7 | 6 | 67,611 | 55,318 | 14,512 | 15,098 | 5,530 | 5,735 |
+| implement | 58 | 51 | 42 | 982,144 | 654,959 | 33,750 | 28,301 | 10,893 | 8,354 |
+| fix (round 1) | 10 | 13 | 10 | 116,340 | 69,232 | 10,765 | 10,668 | 2,256 | 2,004 |
+| fix (round 2) | 4 | 10 | 7 | 78,512 | 47,776 | 6,691 | 5,748 | 2,463 | 2,196 |
+| verify | n/a | - | - | - | - | - | - | - | - |
+| seal | n/a | - | - | - | - | - | - | - | - |
+
+Cache-read share of every token summed across all rows above: 94.5%
+(61,960,744 of 65,568,766 total tokens). This is a raw token-count share,
+not the dollar-weighted "76% of spend" in D41 item 2 (`docs/v10/DECISIONS.md:326`);
+cache reads price far below input/output tokens, so a lower spend share at a
+higher token share is expected, not a contradiction.
+
+First-turn prefix size (`first_turn_prompt_tokens`, added by S41-04's
+`consumeSdkStream` change): **not measurable from these preserved runs** --
+the field did not exist when E-98f ran, and only the final aggregated
+`result-cost-*.json` and cumulative `partial-usage-*.json` files were kept
+(no raw per-message stream-json), so it cannot be backfilled. It will start
+populating in the next run made with this slice merged (e.g. S41-06's
+baseline eval); no new eval was run here per the standing E-98f-only
+instruction for this slice.
+
+Command: `python3` one-off aggregation of the `result-cost-*.json` files
+under `~/loki-ci-logs/eval/e98f-engine/*/*/.loki/metrics/`, grouped by the
+stage suffix after `result-cost-e10-<ts>-<hash>-`.