loki-mode 10.5.3 → 10.5.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (69) hide show
  1. package/SKILL.md +2 -2
  2. package/VERSION +1 -1
  3. package/dashboard/__init__.py +1 -1
  4. package/docs/INSTALLATION.md +1 -1
  5. package/docs/v10/BOARD.md +48 -32
  6. package/docs/v10/DECISIONS.md +8 -0
  7. package/docs/v10/METRICS.md +8 -0
  8. package/docs/v10/PROGRESS.md +47 -0
  9. package/loki-ts/dist/loki.js +397 -396
  10. package/mcp/__init__.py +1 -1
  11. package/package.json +1 -1
  12. package/plugins/loki-mode/.claude-plugin/plugin.json +1 -1
  13. package/web-app/dist/assets/{AdminPage-ehFXpJKv.js → AdminPage-DMO4ixQY.js} +1 -1
  14. package/web-app/dist/assets/{Avatar-C9uLuUKJ.js → Avatar-DGDK3YXW.js} +1 -1
  15. package/web-app/dist/assets/{Badge-D04lByb8.js → Badge-C-QKXBt2.js} +1 -1
  16. package/web-app/dist/assets/{Button-Cdc90jOS.js → Button-BpqApKIy.js} +1 -1
  17. package/web-app/dist/assets/{CockpitPage-DpMc4t4J.js → CockpitPage-DTAsoIBL.js} +1 -1
  18. package/web-app/dist/assets/{ComparePage-J8zeg8GK.js → ComparePage-BwcE0P-o.js} +1 -1
  19. package/web-app/dist/assets/{ErrorBoundary-BOqRplm1.js → ErrorBoundary-BcGQplMu.js} +1 -1
  20. package/web-app/dist/assets/{EvidenceReceiptPanel-Ct29Di7E.js → EvidenceReceiptPanel-DAVpkapJ.js} +1 -1
  21. package/web-app/dist/assets/{GitHubIssuesPanel-Bf6WHMDR.js → GitHubIssuesPanel-CjbNyZio.js} +1 -1
  22. package/web-app/dist/assets/{GitHubPRsPanel-C8mqCP8x.js → GitHubPRsPanel-Cw0WEbNQ.js} +1 -1
  23. package/web-app/dist/assets/{HomePage-BIpnKurS.js → HomePage-DTa35Ge3.js} +2 -2
  24. package/web-app/dist/assets/{LoginPage-BOk2LDUY.js → LoginPage-gT025QLY.js} +1 -1
  25. package/web-app/dist/assets/{MagicPage-PwfF-xGw.js → MagicPage-CERNEISj.js} +1 -1
  26. package/web-app/dist/assets/{MetricsPage-CHGpvWkr.js → MetricsPage-CPfqyN8q.js} +1 -1
  27. package/web-app/dist/assets/{NotFoundPage-leYA01qB.js → NotFoundPage-B4pEQEvP.js} +1 -1
  28. package/web-app/dist/assets/{ProjectPage-CB5Fjvcw.js → ProjectPage-CFy4D-ue.js} +3 -3
  29. package/web-app/dist/assets/{ProjectsPage-BuAVn4Os.js → ProjectsPage-DoBXDsJg.js} +1 -1
  30. package/web-app/dist/assets/{SettingsPage-CUt2KyNT.js → SettingsPage-gD7jYLJB.js} +1 -1
  31. package/web-app/dist/assets/{ShowcasePage-DCM7nU1L.js → ShowcasePage-BCZEyXKR.js} +1 -1
  32. package/web-app/dist/assets/{SystemSettingsPage-C5o4mZcn.js → SystemSettingsPage-DrnWHhde.js} +1 -1
  33. package/web-app/dist/assets/{TeamsPage--pPH0jRk.js → TeamsPage-irefUlqp.js} +1 -1
  34. package/web-app/dist/assets/{TemplatesPage-u5SL-zv0.js → TemplatesPage-BbEFG28V.js} +1 -1
  35. package/web-app/dist/assets/{TerminalOutput-DRnHnRjN.js → TerminalOutput-Co7bdjKY.js} +1 -1
  36. package/web-app/dist/assets/{activity-C-kspjGM.js → activity-CszlgXyN.js} +1 -1
  37. package/web-app/dist/assets/{bell-BFdTUmHy.js → bell-CbzwwBBG.js} +1 -1
  38. package/web-app/dist/assets/{bot-E9XhV4Il.js → bot-DmY9Kc5P.js} +1 -1
  39. package/web-app/dist/assets/{check-CGy-rSo4.js → check-ENT9ADOJ.js} +1 -1
  40. package/web-app/dist/assets/{chevron-left-BcSdYhEr.js → chevron-left-DEgnxlu7.js} +1 -1
  41. package/web-app/dist/assets/{circle-alert-CGYkxHR3.js → circle-alert-CP5iGlX0.js} +1 -1
  42. package/web-app/dist/assets/{clock-B4bWtVNn.js → clock-BOavB0HQ.js} +1 -1
  43. package/web-app/dist/assets/{cloud-byNt72u1.js → cloud-C00FF8lQ.js} +1 -1
  44. package/web-app/dist/assets/{code-xml-9wUpTEVD.js → code-xml-CGOc4opI.js} +1 -1
  45. package/web-app/dist/assets/{database-BUKis5_O.js → database-fcSX-q5w.js} +1 -1
  46. package/web-app/dist/assets/{dollar-sign-C-nA2yVR.js → dollar-sign-BWQURzWW.js} +1 -1
  47. package/web-app/dist/assets/{file-code-corner-r9kRycA9.js → file-code-corner-D1nBkg5Y.js} +1 -1
  48. package/web-app/dist/assets/{file-plus-O0ZxIt9Q.js → file-plus-DCy5Ihs9.js} +1 -1
  49. package/web-app/dist/assets/{globe-C-BYjYm3.js → globe-SUpUoBAx.js} +1 -1
  50. package/web-app/dist/assets/{hammer-BiMjHdeb.js → hammer-BbTMEvdy.js} +1 -1
  51. package/web-app/dist/assets/{index-xx4T00yR.js → index-ChM1IqAt.js} +2 -2
  52. package/web-app/dist/assets/{layers-epQ4LKLP.js → layers-CslOxTwJ.js} +1 -1
  53. package/web-app/dist/assets/{loader-circle-CCCg0nWp.js → loader-circle-Bgxwf-7o.js} +1 -1
  54. package/web-app/dist/assets/{lock-CNK3HBO9.js → lock-B52waB-u.js} +1 -1
  55. package/web-app/dist/assets/{package-C0X69Vbk.js → package-B82BOXm3.js} +1 -1
  56. package/web-app/dist/assets/{plus-CO4IWZCR.js → plus-CZxgKx6c.js} +1 -1
  57. package/web-app/dist/assets/{refresh-cw-C9jHfYNV.js → refresh-cw-B_keiQxK.js} +1 -1
  58. package/web-app/dist/assets/{rotate-ccw-DwISdeOd.js → rotate-ccw-B9Uq6etF.js} +1 -1
  59. package/web-app/dist/assets/{scroll-text-D_8Uguk5.js → scroll-text-u4oVHR5b.js} +1 -1
  60. package/web-app/dist/assets/{server-J5KnitwE.js → server-DTbaeWG3.js} +1 -1
  61. package/web-app/dist/assets/{shield-alert-DG-43FH9.js → shield-alert-mH66tVRv.js} +1 -1
  62. package/web-app/dist/assets/{thumbs-up-Dgb2JDx9.js → thumbs-up-DmNwqPa_.js} +1 -1
  63. package/web-app/dist/assets/{trash-2-BlY3p6yf.js → trash-2-CfboT0AB.js} +1 -1
  64. package/web-app/dist/assets/{trending-down-DOd6_ocO.js → trending-down-WbYSPLFd.js} +1 -1
  65. package/web-app/dist/assets/{trending-up-FkVmyCy3.js → trending-up-C5UPHeNm.js} +1 -1
  66. package/web-app/dist/assets/{upload-Dw57ZJuf.js → upload-C3fNqfWN.js} +1 -1
  67. package/web-app/dist/assets/{usePolling-BF3DAuG6.js → usePolling-Ctv4vcx6.js} +1 -1
  68. package/web-app/dist/assets/{user-C032X3oq.js → user-B-sI1PvH.js} +1 -1
  69. package/web-app/dist/index.html +1 -1
package/SKILL.md CHANGED
@@ -3,7 +3,7 @@ name: loki-mode
3
3
  description: Autonomous spec-driven build system with a built-in trust layer. It does not call work done until it is verified (RARV-C closure loop, 8 quality gates, completion council, verified-completion evidence gate). Triggers on "Loki Mode". Takes a spec (PRD, GitHub issue, OpenAPI doc, etc.) to deployed product with minimal human intervention. Provider-agnostic. Requires --dangerously-skip-permissions flag.
4
4
  ---
5
5
 
6
- # Loki Mode v10.5.3
6
+ # Loki Mode v10.5.5
7
7
 
8
8
  **You are an autonomous agent. You make decisions. You do not ask questions. You do not stop.**
9
9
 
@@ -470,4 +470,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
470
470
 
471
471
  ---
472
472
 
473
- **v10.5.3 | [Autonomi](https://www.autonomi.dev/) flagship product | ~410 lines core**
473
+ **v10.5.5 | [Autonomi](https://www.autonomi.dev/) flagship product | ~410 lines core**
package/VERSION CHANGED
@@ -1 +1 @@
1
- 10.5.3
1
+ 10.5.5
@@ -7,7 +7,7 @@ Modules:
7
7
  control: Session control API (start/stop/pause/resume)
8
8
  """
9
9
 
10
- __version__ = "10.5.3"
10
+ __version__ = "10.5.5"
11
11
 
12
12
  # Expose the control app for easy import
13
13
  try:
@@ -2,7 +2,7 @@
2
2
 
3
3
  The flagship product of [Autonomi](https://www.autonomi.dev/). Loki Mode is a spec-driven autonomous builder with a built-in trust layer that takes any spec to a deployed product and verifies completion with evidence (quality gates plus a completion council), not just a "done" claim. Complete installation instructions for all platforms and use cases.
4
4
 
5
- **Version:** v10.5.3
5
+ **Version:** v10.5.5
6
6
 
7
7
  ---
8
8
 
package/docs/v10/BOARD.md CHANGED
@@ -364,12 +364,12 @@ set is declared to avoid overlap with those and with each other.
364
364
  | M-10 | Coverage-guided input search (read-only session, plateau stop) | loki-ts/src/engine10/modernize/oracle/search.ts, loki-ts/tests/engine10/modernize/search.test.ts | HIGH | cd loki-ts && bun test tests/engine10/modernize/search.test.ts | released@2026-09-28T21:01Z | Source: MODERNIZE.md (D30). Depends on M-09. Opus REJECT (reproduced): a failed seed capture is reported as a plateau. Next: rework. r2 d7db4fb1 Opus APPROVE; merged dc827b80 (on top of v10.2.2): full `cd loki-ts && bun test` 2277 pass 0 fail, `bash tests/test-engine10-dist.sh` 18 passed, `bash tests/test-v10-pulse.sh` 117 passed. Released in v10.5.0 (merge 66c5e465 is an ancestor of v10.5.0). |
365
365
  | M-11 | Java capture: JUnit under JDK 8 with JaCoCo plus Randoop | autonomy/lib/modernize/java_capture.sh, loki-ts/src/engine10/modernize/oracle/java.ts, loki-ts/tests/engine10/modernize/java_capture.test.ts | HIGH | cd loki-ts && bun test tests/engine10/modernize/java_capture.test.ts | released@2026-09-28T21:01Z | Source: MODERNIZE.md (D30). Depends on M-04. Opus REJECT (reproduced): multi-line java -version breaks status.json (json_escape skips newlines). Next: rework. Wave E26 (wf_9ba5fcaf-75a). Round 3. r3 e476435b opus APPROVE (every C0 byte escaped as \u00XX; malformed status.json reported as its own reason); merged locally. Released in v10.5.0 (merge 4a11c285 is an ancestor of v10.5.0). |
366
366
  | M-12 | Oracle seal, held-out split, 80% floor, up-front NOT PROVEN | loki-ts/src/engine10/modernize/oracle/seal.ts, loki-ts/tests/engine10/modernize/oracle_seal.test.ts | HIGH | cd loki-ts && bun test tests/engine10/modernize/oracle_seal.test.ts | released@2026-09-28T21:01Z | Source: MODERNIZE.md (D30). Depends on M-09. Opus REJECT (reproduced): delete-and-reseal defeats tamper evidence (hashes stored beside the data). Next: rework. r2 d9026ec6 Opus APPROVE (reseal refused via the append-only log); merged dc827b80 (on top of v10.2.2): full `cd loki-ts && bun test` 2277 pass 0 fail, `bash tests/test-engine10-dist.sh` 18 passed, `bash tests/test-v10-pulse.sh` 117 passed. Released in v10.5.0 (merge b71d80fa is an ancestor of v10.5.0). |
367
- | M-13 | Equivalence checker with sealed normalizers and contract output | loki-ts/src/engine10/modernize/equiv.ts, loki-ts/tests/engine10/modernize/equiv.test.ts, loki-ts/tests/engine10/modernize/fixtures/equiv/ | HIGH | cd loki-ts && bun test tests/engine10/modernize/equiv.test.ts | merged@2026-09-28T21:50Z | Source: MODERNIZE.md (D30). Depends on M-12. Wave E27 (wf_bcacb1d1-e76). Wave E27 stopped 18:37Z (founder: over budget, load 50). REJECT (reproduced): a unit whose oracle seal is NOT_PROVEN still gets a clean equivalence pass. Branch slice-M-13-equiv kept. Dispatched 21:18Z sonnet (founder 17:10 staffing directive). r2 b379c171 REJECT (3 blockers), r3 89ea40ae REJECT on B3 (normalizers still caller-supplied: tolerance 1e9 after the new tree gives PROVEN). D42 (4): only fix (a), sealOracle hashes the normalizers; M-13 may edit the M-12 seal file for this only. r4 dispatched 21:42Z. r4 fe3cae28 opus APPROVE (normalizer hash in the oracle seal; tolerance 1e9 after seal gives NOT_PROVEN; hand-edited sealed.json refused; canonical hash over all 3 fields). Merged. |
368
- | M-14 | Wall pre-sealed mode: oracle plus conformance, green base is an error | loki-ts/src/engine10/stages/wall.ts (pre-sealed branch only), loki-ts/tests/engine10/modernize/wall_presealed.test.ts | HIGH | cd loki-ts && bun test tests/engine10/modernize/wall_presealed.test.ts | building@2026-09-28T21:58Z | Source: MODERNIZE.md (D30). Depends on M-12, E-54. D33: states its net core line delta; core must stay under 5,000 (92 lines of headroom shared by E-67, E-66, E-61, M-14, merge order E-67, E-66, E-61); offset any excess by deleting dead core code. Wave E27 (wf_bcacb1d1-e76). Wave E27 stopped 18:37Z (founder: over budget, load 50). REJECT: branch empty (no commits). Dispatched 21:51Z. r1 867cffab opus REJECT: crash/OOM/signal exits read as red; bare ImportError enum reads a missing third-party package as red; no file sha256 or verify; no binding to the oracle seal. r2 dispatched 21:57Z. |
369
- | M-15 | Unit runner: card to v10 run with oracle Wall and equiv check | loki-ts/src/engine10/modernize/unit.ts, loki-ts/tests/engine10/modernize/unit.test.ts | HIGH | cd loki-ts && bun test tests/engine10/modernize/unit.test.ts | ready@2026-09-28T02:45Z | Source: MODERNIZE.md (D30). Depends on M-13, M-14. Requirement from the M-13 review: call sealOracle with the card normalizers before implement, and test that ordering. |
367
+ | M-13 | Equivalence checker with sealed normalizers and contract output | loki-ts/src/engine10/modernize/equiv.ts, loki-ts/tests/engine10/modernize/equiv.test.ts, loki-ts/tests/engine10/modernize/fixtures/equiv/ | HIGH | cd loki-ts && bun test tests/engine10/modernize/equiv.test.ts | released@2026-09-28T22:26Z | Source: MODERNIZE.md (D30). Depends on M-12. Wave E27 (wf_bcacb1d1-e76). Wave E27 stopped 18:37Z (founder: over budget, load 50). REJECT (reproduced): a unit whose oracle seal is NOT_PROVEN still gets a clean equivalence pass. Branch slice-M-13-equiv kept. Dispatched 21:18Z sonnet (founder 17:10 staffing directive). r2 b379c171 REJECT (3 blockers), r3 89ea40ae REJECT on B3 (normalizers still caller-supplied: tolerance 1e9 after the new tree gives PROVEN). D42 (4): only fix (a), sealOracle hashes the normalizers; M-13 may edit the M-12 seal file for this only. r4 dispatched 21:42Z. r4 fe3cae28 opus APPROVE (normalizer hash in the oracle seal; tolerance 1e9 after seal gives NOT_PROVEN; hand-edited sealed.json refused; canonical hash over all 3 fields). Merged. Released in v10.5.3 (merge cb1ef386 is an ancestor of v10.5.3). |
368
+ | M-14 | Wall pre-sealed mode: oracle plus conformance, green base is an error | loki-ts/src/engine10/stages/wall.ts (pre-sealed branch only), loki-ts/tests/engine10/modernize/wall_presealed.test.ts | HIGH | cd loki-ts && bun test tests/engine10/modernize/wall_presealed.test.ts | merged@2026-09-28T22:09Z | Source: MODERNIZE.md (D30). Depends on M-12, E-54. D33: states its net core line delta; core must stay under 5,000 (92 lines of headroom shared by E-67, E-66, E-61, M-14, merge order E-67, E-66, E-61); offset any excess by deleting dead core code. Wave E27 (wf_bcacb1d1-e76). Wave E27 stopped 18:37Z (founder: over budget, load 50). REJECT: branch empty (no commits). Dispatched 21:51Z. r1 867cffab opus REJECT: crash/OOM/signal exits read as red; bare ImportError enum reads a missing third-party package as red; no file sha256 or verify; no binding to the oracle seal. r2 dispatched 21:57Z. r2 86d078eb (crash/signal exits not_run; inRepo on collection errors; file sha256 plus verify; oracle seal required; base_sha recorded); presealed 26/26, modernize 222/0; opus re-review 22:04Z. r2 86d078eb opus: B1, B3, B4 fixed; B2 still open (inRepo is a caller-supplied flag: name six with inRepo true gives red). r3 derives it from the repo tree. r3 ef4fa166 opus APPROVE (inRepo derived from the real tree via realpath; symlinks and .. names give not_run; verify re-runs verifySeal). Merged; modernize suite green. |
369
+ | M-15 | Unit runner: card to v10 run with oracle Wall and equiv check | loki-ts/src/engine10/modernize/unit.ts, loki-ts/tests/engine10/modernize/unit.test.ts | HIGH | cd loki-ts && bun test tests/engine10/modernize/unit.test.ts | ready@2026-09-28T22:48Z | Source: MODERNIZE.md (D30). Depends on M-13, M-14. Requirement from the M-13 review: call sealOracle with the card normalizers before implement, and test that ordering. From the M-14 review: derive the failing module from the traceback file path under the target runtime (site-packages can shadow a repo name); resolve the module part of an AttributeError so real reds are sealable; call verifyPreSealedWall and verifySeal before trusting a Wall. Dispatched 22:09Z (M-13, M-14 merged). WIND-DOWN 2026-09-28: opus r1 REJECT (B1 importer frame made a missing third-party package red; B2 PROVEN without conformance re-run or ablation) fixed at 03b35a69 on slice-M-15 (modernize plus budget 250/0, both red then green on real pytest 9.0.2). NEXT: opus r2 review of 03b35a69, then merge. |
370
370
  | M-16 | Deterministic codemods first (futurize, OpenRewrite) or skipped | loki-ts/src/engine10/modernize/codemod.ts, loki-ts/tests/engine10/modernize/codemod.test.ts | MEDIUM | cd loki-ts && bun test tests/engine10/modernize/codemod.test.ts | released@2026-09-28T16:03Z | Source: MODERNIZE.md (D30). Depends on M-02. Built 0a8bbe6c (branch slice-M-16-codemods); TL review died on the 04:48Z access outage. Wave E21 (wf_39ab3f7d-8f3). TL review. TL APPROVE of 0a8bbe6c; merged into train E22 (9042e964): `bun test tests/engine10/` 547 pass 0 fail, tsc 0, `bash tests/test-v10-pulse.sh` 107 passed, `bash eval/loki10/test-harness.sh` 108 passed. Released in v10.2.1 (npm publish 2026-09-28T16:03Z; every cited commit is an ancestor of the v10.2.1 tag; `git merge-base --is-ancestor`). |
371
371
  | M-17 | Scheduler: N workers, worktrees, cascade, best-of-2, budget stop | loki-ts/src/engine10/modernize/scheduler.ts, loki-ts/tests/engine10/modernize/scheduler.test.ts | HIGH | cd loki-ts && bun test tests/engine10/modernize/scheduler.test.ts | ready@2026-09-28T02:45Z | Source: MODERNIZE.md (D30). Depends on M-15. |
372
- | M-18 | Re-slice non-equivalent units to depth 2, then NOT PROVEN | loki-ts/src/engine10/modernize/reslice.ts, loki-ts/tests/engine10/modernize/reslice.test.ts | MEDIUM | cd loki-ts && bun test tests/engine10/modernize/reslice.test.ts | ready@2026-09-28T02:45Z | Source: MODERNIZE.md (D30). Depends on M-05, M-13. |
372
+ | M-18 | Re-slice non-equivalent units to depth 2, then NOT PROVEN | loki-ts/src/engine10/modernize/reslice.ts, loki-ts/tests/engine10/modernize/reslice.test.ts | MEDIUM | cd loki-ts && bun test tests/engine10/modernize/reslice.test.ts | merged@2026-09-28T22:35Z | Source: MODERNIZE.md (D30). Depends on M-05, M-13. Merged 20c51512 after TL r2 APPROVE (f41e7e70; reslice 13/0, modernize 241/0 on main). |
373
373
  | M-19 | Strangler targets and routes.json (py2/dual/py3, per-module release) | loki-ts/src/engine10/modernize/routes.ts, loki-ts/src/engine10/modernize/targets/python3.ts, loki-ts/src/engine10/modernize/targets/java21.ts, loki-ts/tests/engine10/modernize/routes.test.ts | MEDIUM | cd loki-ts && bun test tests/engine10/modernize/routes.test.ts | released@2026-09-28T16:03Z | Source: MODERNIZE.md (D30). Depends on M-05. Built 3299d359 (branch slice-M-19-routes); TL review died on the 04:48Z access outage. Wave E21 (wf_39ab3f7d-8f3). TL review. TL APPROVE of 3299d359; merged into train E22 (9042e964): `bun test tests/engine10/` 547 pass 0 fail, tsc 0, `bash tests/test-v10-pulse.sh` 107 passed, `bash eval/loki10/test-harness.sh` 108 passed. Released in v10.2.1 (npm publish 2026-09-28T16:03Z; every cited commit is an ancestor of the v10.2.1 tag; `git merge-base --is-ancestor`). |
374
374
  | M-20 | Wave verify: full build, integration and original suite | loki-ts/src/engine10/modernize/wave.ts, loki-ts/tests/engine10/modernize/wave.test.ts | MEDIUM | cd loki-ts && bun test tests/engine10/modernize/wave.test.ts | ready@2026-09-28T02:45Z | Source: MODERNIZE.md (D30). Depends on M-17, M-19. |
375
375
  | M-21 | Wave ship: one PR per wave with unit receipts, draft unless all proven | loki-ts/src/engine10/modernize/ship.ts, loki-ts/tests/engine10/modernize/ship.test.ts | HIGH | cd loki-ts && bun test tests/engine10/modernize/ship.test.ts | ready@2026-09-28T02:45Z | Source: MODERNIZE.md (D30). Depends on M-20. |
@@ -401,10 +401,10 @@ set is declared to avoid overlap with those and with each other.
401
401
  | E-80 | Pulse PROGRESS.md age never negative: parse the entry timestamp as UTC and clamp future timestamps to a FUTURE_TIMESTAMP note | scripts/v10-pulse.sh (PROGRESS age only), tests/test-v10-pulse.sh | LOW | bash tests/test-v10-pulse.sh; an entry stamped 10 minutes ahead reads a note, not "-10 min ago" | released@2026-09-28T21:01Z | Source: pulse printed "PROGRESS.md last entry: -6 min ago" at 04:39Z. branch slice-E-79-81-r2 TL APPROVE; merged dc827b80 (on top of v10.2.2): full `cd loki-ts && bun test` 2277 pass 0 fail, `bash tests/test-engine10-dist.sh` 18 passed, `bash tests/test-v10-pulse.sh` 117 passed. Released in v10.5.0 (merge dc827b80 is an ancestor of v10.5.0). |
402
402
  | E-81 | Pulse flags a git worktree registered inside the repo root outside .claude/worktrees (a reviewer created m16-review/ at the root) | scripts/v10-pulse.sh (one check), tests/test-v10-pulse.sh | LOW | bash tests/test-v10-pulse.sh; a fixture worktree at <repo>/x yields STRAY_WORKTREE, one under .claude/worktrees does not | released@2026-09-28T21:01Z | Source: 04:45Z m16-review/ at the repo root blocked the release bump clean-tree check. branch slice-E-79-81-r2 TL APPROVE; merged dc827b80 (on top of v10.2.2): full `cd loki-ts && bun test` 2277 pass 0 fail, `bash tests/test-engine10-dist.sh` 18 passed, `bash tests/test-v10-pulse.sh` 117 passed. Released in v10.5.0 (merge dc827b80 is an ancestor of v10.5.0). |
403
403
  | E-82 | budget.test.ts computes the file lists inside a named test so a read error surfaces as a failed test, not a describe-time throw | loki-ts/tests/engine10/budget.test.ts | LOW | cd loki-ts && bun test tests/engine10/budget.test.ts | released@2026-09-28T16:03Z | Source: E-76 TL non-blocking note (797705bc). TL APPROVE; merged 9042e964, budget test 3 pass. Released in v10.2.1 (npm publish 2026-09-28T16:03Z; every cited commit is an ancestor of the v10.2.1 tag; `git merge-base --is-ancestor`). |
404
- | EV-12S | Size gate: eval/loki10/measure-size.py (files = touched non-test .py, lines = added non-blank; medium at least 2 files; large at least 4 files, at least 150 lines, above medium max), refdiffs for the medium tasks, run in test-harness.sh | eval/loki10/measure-size.py, eval/loki10/refdiff/pub-*.diff, eval/loki10/test-harness.sh (new section only) | LOW | rc=0 on the medium tasks (attrs-1313 reads 4 files, 74 lines); rc=1 on a 3-file 149-line large fixture, a missing refdiff, and --online with an unreachable source | building@2026-09-28T14:55Z | Source: D34. |
405
- | EV-12A | Large tasks from real upstream PRs, pool pallets/* (werkzeug incl. #3005/#3006, flask, jinja, click): at least 2 | eval/loki10/tasks/lg-<repo>-<issue>/, eval/loki10/refdiff/lg-<repo>-<issue>.diff (own tasks only) | MEDIUM | per task: measure-size --online rc=0; RED at ref, GREEN at merge_sha via run.sh; no-op not completed; full revert and leave-one-file-out mutants fail; validate rc=0 | building@2026-09-28T14:55Z | Source: D34. |
406
- | EV-12B | Large tasks from real upstream PRs, pool attrs, more-itertools, packaging, jsonschema, humanize, faker, arrow: at least 2 | same pattern, own tasks only | MEDIUM | as EV-12A | building@2026-09-28T14:55Z | Source: D34. |
407
- | EV-12C | Large tasks from real upstream PRs, pool httpx, rich, marshmallow, requests: at least 2 | same pattern, own tasks only | MEDIUM | as EV-12A | building@2026-09-28T14:55Z | Source: D34. |
404
+ | EV-12S | Size gate: eval/loki10/measure-size.py (files = touched non-test .py, lines = added non-blank; medium at least 2 files; large at least 4 files, at least 150 lines, above medium max), refdiffs for the medium tasks, run in test-harness.sh | eval/loki10/measure-size.py, eval/loki10/refdiff/pub-*.diff, eval/loki10/test-harness.sh (new section only) | LOW | rc=0 on the medium tasks (attrs-1313 reads 4 files, 74 lines); rc=1 on a 3-file 149-line large fixture, a missing refdiff, and --online with an unreachable source | parked@2026-09-28T22:22Z | Source: D34. Drift audit 22:22Z: no live agent, wave E27 stopped 18:37Z (founder, over budget); parked until restaffed. |
405
+ | EV-12A | Large tasks from real upstream PRs, pool pallets/* (werkzeug incl. #3005/#3006, flask, jinja, click): at least 2 | eval/loki10/tasks/lg-<repo>-<issue>/, eval/loki10/refdiff/lg-<repo>-<issue>.diff (own tasks only) | MEDIUM | per task: measure-size --online rc=0; RED at ref, GREEN at merge_sha via run.sh; no-op not completed; full revert and leave-one-file-out mutants fail; validate rc=0 | parked@2026-09-28T22:22Z | Source: D34. Drift audit 22:22Z: no live agent, wave E27 stopped 18:37Z (founder, over budget); parked until restaffed. |
406
+ | EV-12B | Large tasks from real upstream PRs, pool attrs, more-itertools, packaging, jsonschema, humanize, faker, arrow: at least 2 | same pattern, own tasks only | MEDIUM | as EV-12A | parked@2026-09-28T22:22Z | Source: D34. Drift audit 22:22Z: no live agent, wave E27 stopped 18:37Z (founder, over budget); parked until restaffed. |
407
+ | EV-12C | Large tasks from real upstream PRs, pool httpx, rich, marshmallow, requests: at least 2 | same pattern, own tasks only | MEDIUM | as EV-12A | parked@2026-09-28T22:22Z | Source: D34. Drift audit 22:22Z: no live agent, wave E27 stopped 18:37Z (founder, over budget); parked until restaffed. |
408
408
  | EV-12D | INDEX.md large rows and counts; synthetic lg-* noted rejected (D34), legacy moved to M-27 | eval/loki10/tasks/INDEX.md | LOW | measure-size rc=0 over all tiers; large count at least 5 on main; validate rc=0 | ready@2026-09-28T14:55Z | Source: D34. Depends on EV-12S, EV-12A, EV-12B, EV-12C. |
409
409
  | E-83 | P0 fix-forward: main Tests red on 9d483688 (run 36438012977): modernize codemod spawn without env (spawn env guard) and the prStage bundle marker deleted by the E-66 line offset (dist test) | loki-ts/src/engine10/modernize/codemod.ts, loki-ts/src/engine10/stages/pr.ts | HIGH | `bun test tests/runner/spawn_env_guard.test.ts`; `bash tests/test-engine10-dist.sh` | released@2026-09-28T16:03Z | TL APPROVE (sonnet) on 10391f4a, both reverts reproduce red; merged c5ace6e1: full `cd loki-ts && bun test` 2239 pass 0 fail, dist test 18 passed 0 failed, core 4,999. Released in v10.2.1 (npm publish 2026-09-28T16:03Z; every cited commit is an ancestor of the v10.2.1 tag; `git merge-base --is-ancestor`). |
410
410
  | E-84 | Pulse TRAIN_LATE reads the last train push from the reflog of refs/remotes/origin/main (moves on every push and on fetches of others' pushes), then push-*.log, then UNKNOWN | scripts/v10-pulse.sh (last_train_push_epoch only), tests/test-v10-pulse.sh | MEDIUM | bash tests/test-v10-pulse.sh; fixture: temp repo plus bare remote, a real `git push` makes the check read under 1 min with no push-*.log present; no reflog and no logs reads UNKNOWN | released@2026-09-28T16:03Z | Source: founder 15:09Z; TRAIN_LATE read 681.9 min while trains were pushed at 14:42Z and later, because plain `git push` writes no push-*.log. TL APPROVE (sonnet) on eeace3f6: `bash tests/test-v10-pulse.sh` 109 passed 0 failed; against the old pulse 106 passed 3 failed; live pulse after merge reads "Minutes since last train push: 12.1". Released in v10.2.1 (npm publish 2026-09-28T16:03Z; every cited commit is an ancestor of the v10.2.1 tag; `git merge-base --is-ancestor`). |
@@ -412,8 +412,8 @@ set is declared to avoid overlap with those and with each other.
412
412
  | DEP-01 | Dependency inventory (D35): docs/v10/DEPS.md lists every manifest (all package.json incl. @anthropic-ai/sdk and claude-agent-sdk; every requirements*.txt and pyproject.toml; every uses: in .github/workflows and .github/actions; Node, Python, Bun matrices; Docker bases, Helm images, Terraform providers, Homebrew formula) with current and latest stable, patch/minor/MAJOR, and runtime EOL; no upgrades | docs/v10/DEPS.md, scripts/dep-inventory.py | LOW | python3 scripts/dep-inventory.py regenerates DEPS.md byte-identically on a second run (network results cached); every manifest found by `git ls-files` appears | released@2026-09-28T17:16Z | Source: founder directive 15:20Z (D35). DEP workstream: max 3 builders, never ahead of E/EV/M. Round 3 2794574b TL APPROVE (sonnet) after two REJECT rounds (bump column mismatch, Node 20 claim, 0.x class, Helm drift; then a missing helm/loki-mode chart and unverified floating tags); `bash tests/test-dep-inventory.sh` 5/5, `--self-test` 23/23. Released in v10.2.2 (npm gitHead 9a59750d). |
413
413
  | E-87 | Release dispatch path: required-ci also accepts a completed workflow_dispatch Security Audit run at the exact SHA (Tests and Bun Parity stay push-only), so a tree whose VERSION is already bumped can publish after an audit fix | .github/workflows/release.yml (required-ci only), a test that runs the extracted step against a fixture run list | HIGH | fixture: dispatched audit success at the SHA counts; a dispatched audit at another SHA does not; Tests via dispatch still does not | ready@2026-09-28T18:42Z | Source: v10.2.0 Release 36443541666 waited on an audit it could never count. CTO approval required (release gate). Wave E27 (wf_bcacb1d1-e76). CTO-level opus review. Wave E27 stopped 18:37Z (founder: over budget, load 50). REJECT (reproduced): tests pass with the completed-and-success condition removed from the dispatched-audit check. Branch kept. |
414
414
  | E-88 | Release notes fully written (D36): scripts/release-notes.sh extracts the CHANGELOG section literally (dated headings), fails on a missing, empty, heading-only or placeholder section; release.yml fails instead of falling back and checks the published body; pre-push refuses a VERSION bump without a full section | scripts/release-notes.sh, .github/workflows/release.yml (extract step), .githooks/pre-push, docs/dev/release-checklist.md, tests/test-release-notes.sh | HIGH | bash tests/test-release-notes.sh; failing first against the old awk pattern | released@2026-09-28T21:01Z | Source: founder directive 16:05Z; six releases published with "Release vX.Y.Z" bodies (backfilled). Founder 17:22Z: stopped at 70 min and re-sliced as E-88a (auto-carry removed, explicit --include only). Wave E27 (wf_bcacb1d1-e76). Wave E27 stopped 18:37Z (founder: over budget, load 50). E-88a opus APPROVE (branch slice-E-88a); merge conflicts with E-86 in .githooks/pre-push; rebase after E-99 lands (same file). E-88a rebased onto E-99 as slice-E-88a-r2 62774912; opus APPROVE (pre-push diff purely additive, E-99 gitleaks steps byte-identical, stdin read once, gate main-only and fail-closed, release.yml exits 1 instead of a placeholder); merged 60ce7620; release-notes 41/0, pre-push-hook 13/0, pre-push-gitleaks 43/0. Non-blocking: gate runs the working tree release-notes.sh; _cl_tmp not in the EXIT trap. Released in v10.5.0 (merge 60ce7620 is an ancestor of v10.5.0). |
415
- | E-89 | Pulse RELEASE_CADENCE (D37): violation when more than 25 minutes pass with main green (Tests and Bun Parity success at HEAD) and at least one merged-unreleased slice commit (not an ancestor of the latest published tag, docs-only commits excluded) | scripts/v10-pulse.sh (one check), tests/test-v10-pulse.sh | MEDIUM | bash tests/test-v10-pulse.sh; fixtures: green plus unreleased slice commit 26 min old fires; red main does not; docs-only commits do not; 24 min does not | merged@2026-09-28T18:42Z | Source: founder directive 16:20Z. Founder 17:22Z: stopped at 58 min; salvaged commit cce8f48a re-sliced as its own slice plus UNDERSTAFFED. Wave E27 (wf_bcacb1d1-e76). Wave E27 stopped 18:37Z (founder: over budget, load 50). TL APPROVE (sonnet) on the salvaged cce8f48a plus UNDERSTAFFED; merged locally; `bash tests/test-v10-pulse.sh` 129 passed 0 failed. |
416
- | E-90 | Release Manager marks BOARD rows released after publish: scripts/board-mark-released.sh <tag> flips every merged row whose merge commit is an ancestor of <tag> to released@ with the tag and the ancestry evidence; pulse MERGED_NOT_RELEASED_STALE when a merged row is already in a published tag | scripts/board-mark-released.sh, scripts/v10-pulse.sh (one check), tests/test-board-mark-released.sh | MEDIUM | bash tests/test-board-mark-released.sh; a merged row in the tag flips, one not in it stays; BOARD line count unchanged | merged@2026-09-28T21:30Z | Source: 16:20Z the BOARD showed 20 merged slices that had all shipped in v10.1.0 to v10.2.1, which read as a 20-slice release backlog. Founder 17:22Z: stopped; salvaged commit 1d9dfae7 re-sliced after E-89. Wave E27 (wf_bcacb1d1-e76). Wave E27 stopped 18:37Z (founder: over budget, load 50). Build on slice-E-90-r2 (5 commits) never reviewed; re-review as its own slice. Dispatched 21:14Z sonnet (fresh; the E27 branch was never reviewed). Tech Lead APPROVE bd7d75f7 (anchored slice grep, ancestry-only flips, atomic write); merged 7b1f7e3d; run for v10.5.0 flipped 42 rows (c62f3cb0). |
415
+ | E-89 | Pulse RELEASE_CADENCE (D37): violation when more than 25 minutes pass with main green (Tests and Bun Parity success at HEAD) and at least one merged-unreleased slice commit (not an ancestor of the latest published tag, docs-only commits excluded) | scripts/v10-pulse.sh (one check), tests/test-v10-pulse.sh | MEDIUM | bash tests/test-v10-pulse.sh; fixtures: green plus unreleased slice commit 26 min old fires; red main does not; docs-only commits do not; 24 min does not | released@2026-09-28T22:02Z | Source: founder directive 16:20Z. Founder 17:22Z: stopped at 58 min; salvaged commit cce8f48a re-sliced as its own slice plus UNDERSTAFFED. Wave E27 (wf_bcacb1d1-e76). Wave E27 stopped 18:37Z (founder: over budget, load 50). TL APPROVE (sonnet) on the salvaged cce8f48a plus UNDERSTAFFED; merged locally; `bash tests/test-v10-pulse.sh` 129 passed 0 failed. Released in v10.5.2 (merge bd7d75f7 is an ancestor of v10.5.2). |
416
+ | E-90 | Release Manager marks BOARD rows released after publish: scripts/board-mark-released.sh <tag> flips every merged row whose merge commit is an ancestor of <tag> to released@ with the tag and the ancestry evidence; pulse MERGED_NOT_RELEASED_STALE when a merged row is already in a published tag | scripts/board-mark-released.sh, scripts/v10-pulse.sh (one check), tests/test-board-mark-released.sh | MEDIUM | bash tests/test-board-mark-released.sh; a merged row in the tag flips, one not in it stays; BOARD line count unchanged | released@2026-09-28T22:02Z | Source: 16:20Z the BOARD showed 20 merged slices that had all shipped in v10.1.0 to v10.2.1, which read as a 20-slice release backlog. Founder 17:22Z: stopped; salvaged commit 1d9dfae7 re-sliced after E-89. Wave E27 (wf_bcacb1d1-e76). Wave E27 stopped 18:37Z (founder: over budget, load 50). Build on slice-E-90-r2 (5 commits) never reviewed; re-review as its own slice. Dispatched 21:14Z sonnet (fresh; the E27 branch was never reviewed). Tech Lead APPROVE bd7d75f7 (anchored slice grep, ancestry-only flips, atomic write); merged 7b1f7e3d; run for v10.5.0 flipped 42 rows (c62f3cb0). Released in v10.5.2 (merge 7b1f7e3d is an ancestor of v10.5.2). |
417
417
  | DEP-02 | actions/checkout v4 (runs on deprecated node20) to latest major v7, SHA-pinned with a "# v7.x.y" comment in every workflow and composite action; read the v5, v6, v7 release notes and fix breaking changes (fetch-depth, persist-credentials defaults) | .github/workflows/*.yml, .github/actions/**/action.yml (uses: actions/checkout lines, plus any input the migration requires) | MEDIUM | `grep -rn "actions/checkout@" .github` shows only full-SHA pins with a v7 comment; actionlint clean; a PR run of Tests, Bun Parity and Security Audit on the slice concludes success (run id cited) | parked@2026-09-28T19:52Z | Source: DEP-01 inventory (D35). A release containing workflow changes needs the tag pushed by the Release Manager (GITHUB_TOKEN lacks the workflows permission; release.yml prints the workaround). Parked 19:52Z: no agent holds it; PR #218 open (gh pr view 218: OPEN, no checks reported). Merge after the E-98 fix train per D35/D40 (DEP never ahead of E/EV/M). |
418
418
  | DEP-03 | actions/setup-node v4 (node20) to latest major v7, SHA-pinned with a version comment; read the v5..v7 release notes (cache and package-manager detection defaults) and fix breaking changes | .github/workflows/*.yml, .github/actions/**/action.yml (setup-node lines and required inputs) | MEDIUM | only SHA pins with a v7 comment; actionlint rc=0; PR run conclusion success (run id cited) | parked@2026-09-28T19:52Z | Source: DEP-01 inventory (D35). Parked 19:52Z: same as DEP-02 (PR #218). |
419
419
  | DEP-04 | Runtime matrix: drop Node 20 (EOL 2026-04-30) from every workflow matrix, keep 22 (previous supported, users still run it) and 24, add the current stable line if the inventory shows one newer and supported; update package.json engines and docs that name Node 20 | .github/workflows/*.yml (node-version values), package.json (engines only), docs naming the Node version | MEDIUM | no node 20 left in any matrix; engines matches; PR run conclusion success on every remaining version (run id cited) | parked@2026-09-28T19:52Z | Source: DEP-01 inventory (D35). Parked 19:52Z: no agent holds the rework; resumes after the E-98 fix train per D40. |
@@ -427,9 +427,9 @@ set is declared to avoid overlap with those and with each other.
427
427
  | E-95 | Guard for red main 8f2179cd (App Runner Watchdog Health fixture server never came up; rerun 36453069628 passed): free port by binding 0, readiness poll up to 10s with a clear message; 20/20 under parallel load | tests/test-app-runner-watchdog-health.sh, docs/v10/GUARDS.md | LOW | 20 consecutive passes while 4 parallel pulse suites run | released@2026-09-28T21:01Z | Source: founder 17:22Z. Wave E27 (wf_bcacb1d1-e76). Wave E27 stopped 18:37Z (founder: over budget, load 50). TL APPROVE; merged locally; `bash tests/test-app-runner-watchdog-health.sh` 12 passed 0 failed. Released in v10.5.0 (merge 08dd38f4 is an ancestor of v10.5.0). |
428
428
  | E-86 | Pre-push gitleaks for eval task fixtures (founder 15:16Z): pinned v8.30.0 with hardcoded checksums, every pushed commit scanned in dir mode from the pushed commit (not the working tree), refusal names file, line and rule, never the secret | .githooks/pre-push, scripts/install-gitleaks.sh, tests/test-pre-push-gitleaks.sh, .gitleaksignore | HIGH | real-push fixtures: a sourcegraph URL plus 40-hex pin is refused; opus security review | released@2026-09-28T21:01Z | Source: v10.2.0 blocked by gitleaks. Rounds 1-3 opus REJECT with reproduced fail-opens (non-ASCII dirs, unfetched force-push, working-tree scan, checksum bypass; intermediate commits; root commits, history leak, case collisions). Round 4 building as one squashed commit off main. Round 4 8f9baace opus APPROVE (every earlier reproduction refuses; fresh-clone Security Audit gitleaks rc=0 with the branch merged); merged on main; `bash tests/test-pre-push-gitleaks.sh` 40 passed 0 failed. Follow-ups in E-99. Released in v10.5.0 (merge d7ce074b is an ancestor of v10.5.0). |
429
429
  | E-96 | Safe worktree pruning: scripts/prune-worktrees.sh removes a .claude/worktrees entry only when it is not locked, has no process with a cwd inside it (lsof), and its branch has no commit or file change in the last 30 minutes measured with git and stat (never find -newermt), refusing when any check cannot run; the pulse WORKTREE_COUNT NEXT ACTION names the script | scripts/prune-worktrees.sh, tests/test-prune-worktrees.sh, scripts/v10-pulse.sh (NEXT ACTION text only) | MEDIUM | fixture: a worktree with a live process inside is kept; an idle one is removed; an unsupported check refuses | parked@2026-09-28T18:58Z | Source: 17:36Z incident: the Chief of Staff pruned by `find -newermt "-25 minutes"` (unsupported on BSD find, matched nothing) and force-removed 7 live builder worktrees (M-07 r4, M-11 r3, EV-14, EV-12F-a, EV-12G, E-95, E-87); every branch had its work committed, uncommitted edits since the last commit were lost. Superseded by E-101 (same prune-worktrees.sh scope). |
430
- | DEP-05 | npm/bun patch and minor batch from docs/v10/DEPS.md (web-app, dashboard-ui, vscode-extension, root; lockfiles regenerated and committed; 0.x packages excluded) | the package.json and lockfiles DEPS.md names for patch/minor only | LOW | npm audit: no new high or critical; hallucinated-dependency guard rc=0; full Tier B plus the moat suite on a PR run | merged@2026-09-28T21:31Z | Source: DEP-01 inventory (D35). Dispatched 21:18Z sonnet (founder 17:10 staffing directive). Tech Lead REJECT 82e35ffa: @types/vscode ^1.138 with engines.vscode ^1.85 (types expose APIs older users lack); rework drops that bump. r2 31c06cc2 restores @types/vscode ^1.85.0 (extension compile passes); merged cdec9666. web-app high audit findings 2 to 0. |
431
- | DEP-06 | Python patch and minor batch from docs/v10/DEPS.md (dashboard, mcp, web-app requirements, sdk/python pyproject; 0.x excluded) | those requirements*.txt and pyproject.toml | LOW | pip-audit: no new high or critical; guard rc=0; PR run of Tests conclusion success (run id cited) | merged@2026-09-28T21:30Z | Source: DEP-01 (D35). Dispatched 21:18Z sonnet (founder 17:10 staffing directive). Tech Lead APPROVE ecb628bd (no SQLAlchemy 2.1 removals used; tests mcp 59/0, web-app 164/0, dashboard 39/0; 5 pip-audit findings pre-existing, no fix). Merged 4b009c21. |
432
- | DEP-07 | SHA-pin every remaining tag-pinned action already on its latest major (anchore/sbom-action, anthropics/claude-code-action, contributor-assistant/github-action, oven-sh/setup-bun) with a version comment | .github/workflows/*.yml (those uses: lines only) | LOW | every uses: is a full SHA with a vX comment; actionlint rc=0; PR run | merged@2026-09-28T21:30Z | Source: DEP-01 (D35). Serialize after DEP-02/DEP-03 merge (same files). Dispatched 21:18Z sonnet (founder 17:10 staffing directive). Tech Lead APPROVE b2c49a12 (4 SHAs match current tag targets; only uses lines changed). Merged 3da32438. |
430
+ | DEP-05 | npm/bun patch and minor batch from docs/v10/DEPS.md (web-app, dashboard-ui, vscode-extension, root; lockfiles regenerated and committed; 0.x packages excluded) | the package.json and lockfiles DEPS.md names for patch/minor only | LOW | npm audit: no new high or critical; hallucinated-dependency guard rc=0; full Tier B plus the moat suite on a PR run | released@2026-09-28T22:02Z | Source: DEP-01 inventory (D35). Dispatched 21:18Z sonnet (founder 17:10 staffing directive). Tech Lead REJECT 82e35ffa: @types/vscode ^1.138 with engines.vscode ^1.85 (types expose APIs older users lack); rework drops that bump. r2 31c06cc2 restores @types/vscode ^1.85.0 (extension compile passes); merged cdec9666. web-app high audit findings 2 to 0. Released in v10.5.2 (merge cdec9666 is an ancestor of v10.5.2). |
431
+ | DEP-06 | Python patch and minor batch from docs/v10/DEPS.md (dashboard, mcp, web-app requirements, sdk/python pyproject; 0.x excluded) | those requirements*.txt and pyproject.toml | LOW | pip-audit: no new high or critical; guard rc=0; PR run of Tests conclusion success (run id cited) | released@2026-09-28T22:02Z | Source: DEP-01 (D35). Dispatched 21:18Z sonnet (founder 17:10 staffing directive). Tech Lead APPROVE ecb628bd (no SQLAlchemy 2.1 removals used; tests mcp 59/0, web-app 164/0, dashboard 39/0; 5 pip-audit findings pre-existing, no fix). Merged 4b009c21. Released in v10.5.2 (merge 4b009c21 is an ancestor of v10.5.2). |
432
+ | DEP-07 | SHA-pin every remaining tag-pinned action already on its latest major (anchore/sbom-action, anthropics/claude-code-action, contributor-assistant/github-action, oven-sh/setup-bun) with a version comment | .github/workflows/*.yml (those uses: lines only) | LOW | every uses: is a full SHA with a vX comment; actionlint rc=0; PR run | released@2026-09-28T22:02Z | Source: DEP-01 (D35). Serialize after DEP-02/DEP-03 merge (same files). Dispatched 21:18Z sonnet (founder 17:10 staffing directive). Tech Lead APPROVE b2c49a12 (4 SHAs match current tag targets; only uses lines changed). Merged 3da32438. Released in v10.5.2 (merge 3da32438 is an ancestor of v10.5.2). |
433
433
  | G-01 | Usage governor (D39): scripts/usage-governor.py sums usage (output, input, cache read, cache write) from ~/.claude/projects/**/*.jsonl per model, role (from workflow labels and agent types where recorded) and hour; stores founder plan-percentage readings (docs/v10/usage-readings.tsv) and fits tokens-per-percent as a labelled estimate; projects 5-hour window and weekly usage; outputs max engineers for the next hour; checks and records whether Claude Code exposes plan usage directly (statusline input rate-limit fields, /usage) and uses it when it does | scripts/usage-governor.py, docs/v10/usage-readings.tsv, tests/test-usage-governor.sh | HIGH | fixture jsonl plus readings gives a stated projection and max-engineer number; missing readings reads "uncalibrated", never a number presented as fact | released@2026-09-28T21:01Z | Source: founder 17:44Z. First in the queue; everything obeys it. r2 de8e1f76 opus REJECT: weekly reset 1h off across DST; fixes 2 and 4 unguarded. r3 dispatched 19:00Z. r3 fa279532 opus APPROVE (DST reset fixed; fixes 2 and 4 mutation-guarded by T14/T15); merged c2ae4347; governor 25/0, logger 16/0, run-shellcheck.sh passes, shard coverage 19/0, drift 6/0. Open non-blocking: weekly tokens counted from computed Wednesday not live resets_at-7d; no test for live-reset preference; "uncalibrated" label when idle. Released in v10.5.0 (merge c2ae4347 is an ancestor of v10.5.0). |
434
434
  | G-02 | Pulse BUDGET_BURN and OPUS_SHARE violations plus an hourly METRICS.md usage section (tokens per role and model, cost per merged slice, window and weekly projections, max engineers, releases per hour, merged slices per hour and per million tokens), all from G-01 | scripts/v10-pulse.sh (two checks), tests/test-v10-pulse.sh, docs/v10/METRICS.md (section header only) | MEDIUM | fixtures: opus 31% fires OPUS_SHARE; a projection of 86% fires BUDGET_BURN; uncalibrated reads UNKNOWN | released@2026-09-28T21:01Z | Source: founder 17:44Z. Depends on G-01. Serialize after E-89..E-91 (same file). Dispatched 19:09Z, sonnet engineer (G-01 merged; goes before E-90/E-91, which rebase after). Built f172b9b6 (rebased onto E-91), test-v10-pulse.sh 138/0, 7 T48 subtests red on unmodified pulse first; 46 min vs 30 budget (large pulse file). Tech Lead review 19:55Z. Tech Lead APPROVE (pulse 0.61s wall, governor keys match usage-governor.py:562-591, null max is UNKNOWN); merged. Released in v10.5.0 (merge 8f93cb9f is an ancestor of v10.5.0). |
435
435
  | G-03 | docs/v10/SCALE.md: what the Max 20x plan sustains around the clock (from G-01 measurements and calibration), what 50 parallel engineers need (API pay-as-you-go with a rate-limit tier, or Team/Enterprise), cost per day estimates labelled as estimates, and the ramp gates (governor allows, merged slices per hour rising, merged work per token not falling) | docs/v10/SCALE.md | HIGH | every number cites a measurement or is labelled an estimate with its basis | released@2026-09-28T21:01Z | Source: founder 17:44Z. CTO (opus) authors. Billing is the founder decision. Merged as 4708cee1 (row status was stale). Released in v10.5.0 (merge 62b495a5 is an ancestor of v10.5.0). |
@@ -441,37 +441,53 @@ set is declared to avoid overlap with those and with each other.
441
441
  | E-111 | P0 (local main red): engine10 core is 5003 lines after E-98a/b/c/d merged (budget.test.ts Received 5003, cap 5000). Cut at least 25 lines of dead or duplicated code from loki-ts/src/engine10 (outside modernize/) with no behavior change, leaving room for E-98e (+10) | loki-ts/src/engine10 (non-modernize), no test changes except budget | MEDIUM | budget.test.ts passes at 4978 or less; cd loki-ts && bun test tests/engine10 has no new failures vs main | released@2026-09-28T21:01Z | Source: merge of E-98a at 20:10Z. Dispatched sonnet. opus REJECT r1 (deleted prStage/intakeStage, test-engine10-dist 16/2); APPROVE r2 f286f6ec; merged f059c87a, dist rebuilt e1363c67; core 4976, engine10 668/0, dist 18/0. Released in v10.5.0 (merge f059c87a is an ancestor of v10.5.0). |
442
442
  | E-112 | v10-guard: refuse a path-wide `git checkout <ref> -- .` (or `git restore --source <ref> .`) when cwd is the main checkout, so a read-only reviewer cannot overwrite the shared tree; allowed inside .claude/worktrees/* | scripts/v10-guard.sh, tests/test-v10-guard.sh | LOW | fixture: the command in the main checkout is blocked, the same in a worktree is allowed, a single-file checkout is allowed (red first) | released@2026-09-28T21:01Z | Source: E-98e Tech Lead review 20:19Z ran `git checkout slice-E-98e -- .` then `git checkout main -- .` in the main checkout (tree restored clean, but it could have clobbered concurrent merges). Built f4515ec9 (6 new block cases red on the old guard); Tech Lead APPROVE (7 allow probes incl. single-file checkout, branch switch, heredoc text all exit 0); merged; test-v10-guard.sh 170/0. Released in v10.5.0 (merge 06c01b6c is an ancestor of v10.5.0). |
443
443
  | E-113 | P0 (main red at a4623675): tests/test-release-notes.sh T9l/T9n/--include fixtures build padding with yes piped to head under pipefail; on the Linux runner only the 34-byte header was written. Generate padding without a pipe | tests/test-release-notes.sh | LOW | passes locally and under the CI condition (SIGPIPE ignored); old version shown red there | released@2026-09-28T21:01Z | Source: Tests run on a4623675 shard 4/8: "[FAIL] T9n fixture is not in the intended size band ... 34 bytes". Passes 41/0 on macOS. Dispatched 20:39Z. Built 74ffd928 (pipe-free printf loops; macOS could not reproduce the Linux drop even under trap PIPE, so CI is the proof). Tech Lead APPROVE (bytes identical: T9l 132034, T9n 98034, T9o 224089). Merged; 41/0 locally. Released in v10.5.0 (merge f6c3add4 is an ancestor of v10.5.0). |
444
- | E-114 | CI Security Audit gitleaks must not trust a pushed .gitleaks.toml or new .gitleaksignore entries: scan with the default rules plus the config from the previous release tag (or refuse the job when the pushed range changes .gitleaks.toml), and report any .gitleaksignore line added in the range for review | .github/workflows/security-audit.yml, tests/test-security-audit-config.sh | HIGH | a workflow-level test (act or a script that runs the same step) shows a range that adds a zero-rule .gitleaks.toml plus a secret fails the job (red first) | merged@2026-09-28T21:49Z | Source: E-110 opus review 21:09Z: the gitleaks step (security-audit.yml:276) loads the checkout own .gitleaks.toml, so the same zero-rule config trick that bypassed the pre-push scan works against CI (no --config at security-audit.yml:276). CTO-level change to a release gate. Dispatched 21:11Z sonnet; opus review before merge. opus REJECT r1 (event.before chain from an ungated push, repro "no leaks found"), REJECT r2 (no-tag fallback to origin/main~1 fails open), APPROVE r3 b30c2870 (base = last release tag; no tag: default rules and any tip .gitleaks.toml refused); also fixed the scan-coverage baseline shape broken by 6358e0a6. Merged; audit-config 15/0, scan-coverage 31/0. |
444
+ | E-114 | CI Security Audit gitleaks must not trust a pushed .gitleaks.toml or new .gitleaksignore entries: scan with the default rules plus the config from the previous release tag (or refuse the job when the pushed range changes .gitleaks.toml), and report any .gitleaksignore line added in the range for review | .github/workflows/security-audit.yml, tests/test-security-audit-config.sh | HIGH | a workflow-level test (act or a script that runs the same step) shows a range that adds a zero-rule .gitleaks.toml plus a secret fails the job (red first) | released@2026-09-28T22:26Z | Source: E-110 opus review 21:09Z: the gitleaks step (security-audit.yml:276) loads the checkout own .gitleaks.toml, so the same zero-rule config trick that bypassed the pre-push scan works against CI (no --config at security-audit.yml:276). CTO-level change to a release gate. Dispatched 21:11Z sonnet; opus review before merge. opus REJECT r1 (event.before chain from an ungated push, repro "no leaks found"), REJECT r2 (no-tag fallback to origin/main~1 fails open), APPROVE r3 b30c2870 (base = last release tag; no tag: default rules and any tip .gitleaks.toml refused); also fixed the scan-coverage baseline shape broken by 6358e0a6. Merged; audit-config 15/0, scan-coverage 31/0. Released in v10.5.3 (merge 8b62cd2b is an ancestor of v10.5.3). |
445
445
  | E-115 | Verify: a passing lint on a system ruff adds its own not_proven line ("lint ran on the system ruff") instead of reusing "tests ran on the system interpreter" | loki-ts/src/engine10/stages/verify.ts, loki-ts/tests/engine10/verify.test.ts | LOW | unit test: system ruff pass gives the lint line, not the tests line (red first); core stays under 5000 | ready@2026-09-28T22:01Z | Source: E-98a r2 opus review (advisory). Held 21:31Z: worktree cap (15). Held 22:01Z: touches core verify.ts while S41-16 has core at 4997/5000. |
446
- | E-116 | seal.test.ts has no SPEC_CONFLICT case: add real-seal tests (not a copy of seal.ts:110) proving SPEC_CONFLICT survives verify pass, verify fail plus fix, and never upgrades to VERIFIED | loki-ts/tests/engine10/seal.test.ts | LOW | new cases red on a mutated seal.ts that drops the spec_conflict branch | merged@2026-09-28T21:31Z | Source: E-98b opus review note 4. Built fbc79ac9 (4 real-seal tests; red when seal.ts:109 removed); Tech Lead review 21:30Z. Tech Lead APPROVE fbc79ac9 (imports the real sealStage; gap test honest); merged; seal.test.ts 18/0. |
447
- | E-117 | Pulse DEPENDS_ON parsing: expand range shorthand ("Depends on E-98a..e", "M-20..M-23") into each id so a dependency on b..e is not silently dropped | scripts/v10-pulse.sh (dependency parse only), tests/test-v10-pulse.sh | LOW | fixture: "Depends on E-98a..c" with E-98b unmerged is blocked (red first) | merged@2026-09-28T21:43Z | Source: E-91 Tech Lead review. Dispatched 21:31Z sonnet. Tech Lead REJECT 5f59bfed: numeric range uncapped (M-1..M-9999 expands to 9999 ids into the injected pulse); r2 caps at 50. r2 d99963e3 caps numeric spans at 50 (the Tech Lead blocker); merged; test-v10-pulse.sh 146/0. |
448
- | E-118 | Usage governor leftovers from G-01 review: a non-numeric used_percentage or a non-dict rate_limits in a live reading must be ignored, not crash; the "uncalibrated" label must not show when calibration exists but no engineers were active | scripts/usage-governor.py, tests/test-usage-governor.sh | LOW | fixtures for each case (red first); 30/30 existing still pass | building@2026-09-28T22:01Z | Source: G-01 r2/r3 opus review non-blocking notes. Held 21:31Z: worktree cap (15). Dispatched 22:01Z. |
449
- | E-119 | pre-push: the pushed-range .gitleaks.toml check (pre-push:319) swallows a git rev-list error with an or-true, which reads as "config unchanged" and restores the tip config; fail closed on a non-zero rc | .githooks/pre-push, tests/test-pre-push-gitleaks.sh | LOW | a stubbed git rev-list failure refuses the push (red first) | merged@2026-09-28T21:47Z | Source: E-110 r2 opus review nit 4. Built 22bc9931 (case 35 red on the pre-fix hook: push succeeded rc=0); opus APPROVE (one code path changed; case 28 still refuses the corrupted range); merged; pre-push-gitleaks 54/0, pre-push-hook 13/0. |
450
- | E-120 | Seal: carry implement.spec_conflict_reason into receipt.json and receipt.md so a SPEC_CONFLICT verdict states why | loki-ts/src/engine10/stages/seal.ts, loki-ts/tests/engine10/seal.test.ts | LOW | the E-116 documenting test flips to asserting the reason is present (red first); core stays under 5000 | merged@2026-09-28T21:44Z | Source: E-116 engineer finding (seal.ts reads only implement.exit and tests_reverted). Dispatched 21:31Z sonnet. opus REJECT b0f0dce3: reason rendered raw into receipt.md (a newline plus heading forges VERIFIED); r2 46eeb56d neutralizes it; core 4982; opus re-review 21:42Z. opus APPROVE r2 46eeb56d (injection repro stays on one inline-code line; backticks neutralized; key omitted when absent); merged; seal+budget 23/0. |
451
- | E-121 | Pulse ID_RE and DEPENDS_ON_ID_RE reject ids with digits in the prefix (S41-01), so all 16 S41 rows are invisible to the building/ready counts and budgets; accept [A-Z]+[0-9]*-[0-9]+[a-z]? | scripts/v10-pulse.sh (id regexes only), tests/test-v10-pulse.sh | LOW | fixture: a building S41-01 row is counted and a "Depends on S41-06" is honored (red first) | merged@2026-09-28T21:58Z | Source: 21:50Z pulse showed building=0 while S41-01, S41-02, S41-16 were building. Dispatched 21:51Z. Built f94ab0da (T52/T53 red first); Tech Lead APPROVE (full-match on cell 0 and Depends clause only); merged; test-v10-pulse.sh 149/0. |
452
- | E-122 | Scorecard headline pair (loki on sonnet vs raw opus) is green on cost only at 0.5x raw or less, per D41; add the rule and a test | eval/loki10/scorecard, eval/loki10/test-scorecard.sh | LOW | fixture at 0.6x raw cost is red on the headline pair, 0.5x is green (red first) | building@2026-09-28T22:01Z | Source: S41-02 Tech Lead review note 5. Depends on S41-02. Dispatched 22:01Z. |
453
- | E-123 | tests/test-security-scan-coverage.sh runs only in local-ci.sh, never in CI, so its .gitleaksignore baseline drifted unnoticed (6358e0a6); register it in tests/run-all-tests.sh and shard-durations so CI Tests run it | tests/run-all-tests.sh, tests/shard-durations.tsv | LOW | test-shard-coverage.sh lists it; the suite passes on main (31/0) | building@2026-09-28T22:01Z | Source: E-114 opus review item 4. Depends on E-114. Dispatched 22:01Z. |
454
- | S41-16 | P0: Wall red-on-base is vacuous without python (launch error counted as failed on base) | see docs/v10/SCORECARD-PLAN.md | HIGH | per SCORECARD-PLAN.md card | building@2026-09-28T21:58Z | Source: D41, Architect plan 7f671f5c. Depends on D42. D42 (3) confirmed P0; merges before any wave-1 card touching wall, verify or Seal. Dispatched 21:42Z. r1 55e427ab opus REJECT: not_run never reaches seal (seal.ts:117 ignores not_run, so pass 1 fail 0 not_run 1 seals ALREADY_SATISFIED: a new false verdict); jest/vitest/bun non-zero exit without a parsed count read as red; AttributeError/NameError anywhere counted as repo red; system-interpreter results must be not_run. r2 dispatched 21:58Z. |
455
- | S41-01 | Harness: accept partial-stream cost, allowlist LOKI_E10_CASCADE, new row fields | see docs/v10/SCORECARD-PLAN.md | MEDIUM | per SCORECARD-PLAN.md card | building@2026-09-28T21:42Z | Source: D41, Architect plan 7f671f5c. Depends on none. Dispatched 21:41Z. |
456
- | S41-02 | Scorecard tool: per-tier completion, cost per completed, p50, raw vs loki, into METRICS.md | see docs/v10/SCORECARD-PLAN.md | LOW | per SCORECARD-PLAN.md card | merged@2026-09-28T21:54Z | Source: D41, Architect plan 7f671f5c. Depends on none. Dispatched 21:41Z. Built 42c0d88d (21/0; null-cost mutation flips n/a red to green, caught); replay reproduces E-98f exactly; EV-15 medium red on all 3 columns. Tech Lead review 21:51Z. Tech Lead APPROVE (definitions match section 2; replayed all 3 E-98f arms exactly). Merged. |
457
- | S41-03 | Arm runner for raw sonnet, raw opus, loki on sonnet (LOKI_EVAL_MODEL) plus OAuth auth guard | see docs/v10/SCORECARD-PLAN.md | MEDIUM | per SCORECARD-PLAN.md card | review@2026-09-28T22:01Z | Source: D41, Architect plan 7f671f5c. Depends on none. Dispatched 21:51Z. Built de741f04 (dry-run for 3 arms; red evidence only proved file existence); Tech Lead review 22:00Z checks the auth guard decision itself. |
458
- | S41-04 | First-turn prefix measurement (tokens by type per stage) | see docs/v10/SCORECARD-PLAN.md | LOW | per SCORECARD-PLAN.md card | merged@2026-09-28T21:57Z | Source: D41, Architect plan 7f671f5c. Depends on none. Dispatched 21:51Z. Built 71a0d28d; Tech Lead APPROVE (implement row re-derived from 58 impl.json files: mean 982,144, p50 654,959 cache_read, exact); merged. Implement is the re-reading hotspot (982K cache read per task vs 45-68K for intake, plan, Wall). |
459
- | S41-05 | Attempt-selection rule (pure function in e10ext/select.ts) | see docs/v10/SCORECARD-PLAN.md | HIGH | per SCORECARD-PLAN.md card | ready@2026-09-28T21:41Z | Source: D41, Architect plan 7f671f5c. Depends on D42. |
460
- | S41-12 | Tree swap helper for parallel attempts | see docs/v10/SCORECARD-PLAN.md | HIGH | per SCORECARD-PLAN.md card | ready@2026-09-28T21:41Z | Source: D41, Architect plan 7f671f5c. Depends on D42. |
446
+ | E-116 | seal.test.ts has no SPEC_CONFLICT case: add real-seal tests (not a copy of seal.ts:110) proving SPEC_CONFLICT survives verify pass, verify fail plus fix, and never upgrades to VERIFIED | loki-ts/tests/engine10/seal.test.ts | LOW | new cases red on a mutated seal.ts that drops the spec_conflict branch | released@2026-09-28T22:02Z | Source: E-98b opus review note 4. Built fbc79ac9 (4 real-seal tests; red when seal.ts:109 removed); Tech Lead review 21:30Z. Tech Lead APPROVE fbc79ac9 (imports the real sealStage; gap test honest); merged; seal.test.ts 18/0. Released in v10.5.2 (merge f4087942 is an ancestor of v10.5.2). |
447
+ | E-117 | Pulse DEPENDS_ON parsing: expand range shorthand ("Depends on E-98a..e", "M-20..M-23") into each id so a dependency on b..e is not silently dropped | scripts/v10-pulse.sh (dependency parse only), tests/test-v10-pulse.sh | LOW | fixture: "Depends on E-98a..c" with E-98b unmerged is blocked (red first) | released@2026-09-28T22:02Z | Source: E-91 Tech Lead review. Dispatched 21:31Z sonnet. Tech Lead REJECT 5f59bfed: numeric range uncapped (M-1..M-9999 expands to 9999 ids into the injected pulse); r2 caps at 50. r2 d99963e3 caps numeric spans at 50 (the Tech Lead blocker); merged; test-v10-pulse.sh 146/0. Released in v10.5.2 (merge ab909f95 is an ancestor of v10.5.2). |
448
+ | E-118 | Usage governor leftovers from G-01 review: a non-numeric used_percentage or a non-dict rate_limits in a live reading must be ignored, not crash; the "uncalibrated" label must not show when calibration exists but no engineers were active | scripts/usage-governor.py, tests/test-usage-governor.sh | LOW | fixtures for each case (red first); 30/30 existing still pass | merged@2026-09-28T22:08Z | Source: G-01 r2/r3 opus review non-blocking notes. Held 21:31Z: worktree cap (15). Dispatched 22:01Z. Built 7ef9183a (TypeError and AttributeError reproduced first); Tech Lead APPROVE (bad reading degrades to uncalibrated, never a healthy 0%; E-109 cache untouched); merged; 36/0. |
449
+ | E-119 | pre-push: the pushed-range .gitleaks.toml check (pre-push:319) swallows a git rev-list error with an or-true, which reads as "config unchanged" and restores the tip config; fail closed on a non-zero rc | .githooks/pre-push, tests/test-pre-push-gitleaks.sh | LOW | a stubbed git rev-list failure refuses the push (red first) | released@2026-09-28T22:26Z | Source: E-110 r2 opus review nit 4. Built 22bc9931 (case 35 red on the pre-fix hook: push succeeded rc=0); opus APPROVE (one code path changed; case 28 still refuses the corrupted range); merged; pre-push-gitleaks 54/0, pre-push-hook 13/0. Released in v10.5.3 (merge b6360142 is an ancestor of v10.5.3). |
450
+ | E-120 | Seal: carry implement.spec_conflict_reason into receipt.json and receipt.md so a SPEC_CONFLICT verdict states why | loki-ts/src/engine10/stages/seal.ts, loki-ts/tests/engine10/seal.test.ts | LOW | the E-116 documenting test flips to asserting the reason is present (red first); core stays under 5000 | released@2026-09-28T22:02Z | Source: E-116 engineer finding (seal.ts reads only implement.exit and tests_reverted). Dispatched 21:31Z sonnet. opus REJECT b0f0dce3: reason rendered raw into receipt.md (a newline plus heading forges VERIFIED); r2 46eeb56d neutralizes it; core 4982; opus re-review 21:42Z. opus APPROVE r2 46eeb56d (injection repro stays on one inline-code line; backticks neutralized; key omitted when absent); merged; seal+budget 23/0. Released in v10.5.2 (merge 4792e911 is an ancestor of v10.5.2). |
451
+ | E-121 | Pulse ID_RE and DEPENDS_ON_ID_RE reject ids with digits in the prefix (S41-01), so all 16 S41 rows are invisible to the building/ready counts and budgets; accept [A-Z]+[0-9]*-[0-9]+[a-z]? | scripts/v10-pulse.sh (id regexes only), tests/test-v10-pulse.sh | LOW | fixture: a building S41-01 row is counted and a "Depends on S41-06" is honored (red first) | released@2026-09-28T22:26Z | Source: 21:50Z pulse showed building=0 while S41-01, S41-02, S41-16 were building. Dispatched 21:51Z. Built f94ab0da (T52/T53 red first); Tech Lead APPROVE (full-match on cell 0 and Depends clause only); merged; test-v10-pulse.sh 149/0. Released in v10.5.3 (merge aecf6daa is an ancestor of v10.5.3). |
452
+ | E-122 | Scorecard headline pair (loki on sonnet vs raw opus) is green on cost only at 0.5x raw or less, per D41; add the rule and a test | eval/loki10/scorecard, eval/loki10/test-scorecard.sh | LOW | fixture at 0.6x raw cost is red on the headline pair, 0.5x is green (red first) | merged@2026-09-28T22:06Z | Source: S41-02 Tech Lead review note 5. Depends on S41-02. Dispatched 22:01Z. Built a4bc79b9 (0.6x headline red on the old script); Tech Lead APPROVE (label-matched pair, inclusive 0.5x, null stays red); merged; test-scorecard 27/0. |
453
+ | E-123 | tests/test-security-scan-coverage.sh runs only in local-ci.sh, never in CI, so its .gitleaksignore baseline drifted unnoticed (6358e0a6); register it in tests/run-all-tests.sh and shard-durations so CI Tests run it | tests/run-all-tests.sh, tests/shard-durations.tsv | LOW | test-shard-coverage.sh lists it; the suite passes on main (31/0) | merged@2026-09-28T22:06Z | Source: E-114 opus review item 4. Depends on E-114. Dispatched 22:01Z. Built fc3e17b1; Tech Lead APPROVE (self-contained text checks, rows match format); merged; scan-coverage 31/0, shard coverage 19/0. |
454
+ | E-124 | verifyPreSealedWall cross-checks the carried oracle_normalizers_sha256 against the current oracle seal (today only cases and coverage hashes are checked) | loki-ts/src/engine10/modernize/presealed_wall.ts, its test | LOW | a Wall sealed against one normalizer hash fails verify after the oracle normalizers change (red first) | merged@2026-09-28T22:21Z | Source: M-14 r3 opus review advisory. Dispatched 22:09Z. |
455
+ | E-125 | Wall red classification: real pytest prints collection-time AttributeError/NameError frames as "path.py:N: in <module>", not "File ...", so wall.ts never classifies them red (always not_run, fail-safe but the D42 red class cannot fire); parse both frame shapes and replace the B3 test fixtures with real pytest output | loki-ts/src/engine10/stages/wall.ts, loki-ts/tests/engine10/wall.test.ts | MEDIUM | a real pytest run (captured fixture) with an in-repo AttributeError classifies red; third-party frame stays not_run; core stays under 5000 | ready@2026-09-28T22:48Z | Source: S41-16 r2 opus review (ran real pytest 9.0.2). WIND-DOWN 2026-09-28: opus r1 REJECT (B1 owner of missing attribute, B2 space in frame path, B3 captured-stdout injection, B4 chained exception) fixed at 845c9231 on slice-E-125: classifies on the pytest short-summary ERROR line, requires module '<name>' has no attribute with <name> under the repo; wall.test.ts 26/0, r3-B1 to B4 red on e6d2ddec then green. Core 4,998 (cap 4,999). Full engine10 suite not re-run after r3. NEXT: run tests/engine10 plus seal and budget, then opus r2 review, then merge. |
456
+ | E-126 | D41 item 3: repo memory, record the verified build and test command, flaky list and failure causes per repo, cold vs warm | loki-ts/src/e10ext/repomemory.ts, loki-ts/tests/e10ext/repomemory.test.ts | MEDIUM | cd loki-ts and bun test tests/e10ext/repomemory.test.ts | ready@2026-09-28T22:30Z | Source: D41 item 3, SCORECARD-PLAN section 7. Evidence: engine10/cache.ts:87 recordFlaky and :108 topFailures exist, the verified command is not captured. Data only per D42. |
457
+ | E-127 | D41 item 5 (backlog throughput): fetch N issues for a label or milestone as pure data | loki-ts/src/e10ext/issues.ts, loki-ts/tests/e10ext/issues.test.ts | MEDIUM | cd loki-ts and bun test tests/e10ext/issues.test.ts | ready@2026-09-28T22:30Z | Source: D41 item 5. Evidence: engine10/fetch_issue.ts:35 takes one ref only. |
458
+ | E-128 | BACKLOG 147: P7 scanner misses a useMemo factory that calls an already-registered fabricator instead of returning a literal | tests/moat/p7-no-fabricated-data.sh | HIGH | bash tests/moat/p7-no-fabricated-data.sh | ready@2026-09-28T22:30Z | Source: BACKLOG 147; the file's own comment at p7-no-fabricated-data.sh:987 names the gap. Same file as E-131: one engineer takes both. |
459
+ | E-129 | BACKLOG 117 remainder: WhatsNew.tsx hardcodes a stale CURRENT_VERSION (9.55.0) that drifts from the shipped release | web-app/src/components/WhatsNew.tsx, tests/test-whatsnew-version-sync.sh | LOW | bash tests/test-whatsnew-version-sync.sh | ready@2026-09-28T22:30Z | Source: BACKLOG 117. Evidence: WhatsNew.tsx:5 against VERSION 10.5.3. |
460
+ | E-130 | D41 item 4 (speed): cache dependency install by lockfile hash in the bash parallel-worktree bootstrap | autonomy/run.sh (create_worktree only), tests/test-worktree-install-cache.sh | MEDIUM | bash tests/test-worktree-install-cache.sh | ready@2026-09-28T22:30Z | Source: D41 item 4. Evidence: run.sh:6298-6304 installs unconditionally on every worktree. |
461
+ | E-131 | BACKLOG 146: P7 sink regex misses a computed or bracket-indexed sink name, for example window[sinkName](rows) | tests/moat/p7-no-fabricated-data.sh | HIGH | bash tests/moat/p7-no-fabricated-data.sh | ready@2026-09-28T22:30Z | Source: BACKLOG 146. Evidence: SETTER regex at p7-no-fabricated-data.sh:771 matches only literal names. Same engineer as E-128. |
462
+ | E-132 | Wall classifier: a missing test runner (python -m pytest exits 1 with No module named pytest) reads as red, not not_run; D42 red requires the runner to start and at least one test to fail, so require a pytest summary line with failed before red | loki-ts/src/engine10/stages/wall.ts, loki-ts/tests/engine10/wall.test.ts | HIGH | cd loki-ts and bun test tests/engine10/wall.test.ts with a pytest-less python first on PATH | ready@2026-09-28T22:47Z | Source: main red on 04d3ac9c and 708c2907 (CI Bun job had no pytest); reproduced locally with a pytest-less venv, tests (3b) and (4) read fail 1. Seal still refuses later (not_run), so no false VERIFIED, but the Wall mis-seals. Coordinate with E-125 (same classifier). Core budget binds. |
463
+ | E-133 | release.sh guard: refuse to commit dist maps that contain an absolute path (a node_modules symlink in a release worktree wrote 133 /Users paths into loki.js.map and one into cockpit.js.map at v10.5.4) | scripts/release.sh, tests/test-release-dist-guard.sh | MEDIUM | bash tests/test-release-dist-guard.sh | ready@2026-09-28T22:56Z | Source: v10.5.4 cut 2026-09-28, caught by hand before commit (paths rewritten to ../node_modules/). Guard: grep the dist maps for an absolute or home-directory path after the bump and exit nonzero. |
464
+ | S41-16 | P0: Wall red-on-base is vacuous without python (launch error counted as failed on base) | see docs/v10/SCORECARD-PLAN.md | HIGH | per SCORECARD-PLAN.md card | merged@2026-09-28T22:11Z | Source: D41, Architect plan 7f671f5c. Depends on D42. D42 (3) confirmed P0; merges before any wave-1 card touching wall, verify or Seal. Dispatched 21:42Z. r1 55e427ab opus REJECT: not_run never reaches seal (seal.ts:117 ignores not_run, so pass 1 fail 0 not_run 1 seals ALREADY_SATISFIED: a new false verdict); jest/vitest/bun non-zero exit without a parsed count read as red; AttributeError/NameError anywhere counted as repo red; system-interpreter results must be not_run. r2 dispatched 21:58Z. r2 d5bb05bd (seal refuses not_run; per-runner red rules; traceback path under repo; system interpreter not_run); core 4997; opus re-review 22:10Z. opus APPROVE r2 d5bb05bd (seal refuses not_run: real-seal test; receipts byte-stable when not_run 0; per-runner red rules; system interpreter not_run). Merged, dist rebuilt. Follow-up E-125. |
465
+ | S41-01 | Harness: accept partial-stream cost, allowlist LOKI_E10_CASCADE, new row fields | see docs/v10/SCORECARD-PLAN.md | HIGH | per SCORECARD-PLAN.md card | ready@2026-09-28T22:50Z | Source: D41, Architect plan 7f671f5c. Depends on none. Dispatched 21:41Z. WIND-DOWN 2026-09-28: built at 68d1fc28 on slice-S41-01 (test-harness.sh 126/0; red vs its merge-base 0fe549a0 119/7, the 7 S41-01 legs; positive control provider_cost on e98f default-r1 pub-werkzeug-3121 gives 0.37101 with partial 0.0628). Sonnet TL APPROVE on content (af2109d7): partial-stream cost, never-silently-0, 7-knob allowlist, row fields, repriced files beside untouched originals. The 2 nocascade nulls are killed sessions with no partial-usage file and must stay null (E-98e engine gap). NOT MERGED: (1) rebase onto main conflicts in harness.py V10_ENGINE_ENV_ALLOWLIST (S41-09 and S41-11 added LOKI_E10_PREFIX and LOKI_E10_TRIM), keep one of each and rerun test-harness.sh; (2) SCORECARD-PLAN tags the card HIGH, so D12 needs an opus review before merge (this row said MEDIUM). WEDNESDAY STEP 1. |
466
+ | S41-02 | Scorecard tool: per-tier completion, cost per completed, p50, raw vs loki, into METRICS.md | see docs/v10/SCORECARD-PLAN.md | LOW | per SCORECARD-PLAN.md card | released@2026-09-28T22:26Z | Source: D41, Architect plan 7f671f5c. Depends on none. Dispatched 21:41Z. Built 42c0d88d (21/0; null-cost mutation flips n/a red to green, caught); replay reproduces E-98f exactly; EV-15 medium red on all 3 columns. Tech Lead review 21:51Z. Tech Lead APPROVE (definitions match section 2; replayed all 3 E-98f arms exactly). Merged. Released in v10.5.3 (merge a4cdb78f is an ancestor of v10.5.3). |
467
+ | S41-03 | Arm runner for raw sonnet, raw opus, loki on sonnet (LOKI_EVAL_MODEL) plus OAuth auth guard | see docs/v10/SCORECARD-PLAN.md | MEDIUM | per SCORECARD-PLAN.md card | merged@2026-09-28T22:04Z | Source: D41, Architect plan 7f671f5c. Depends on none. Dispatched 21:51Z. Built de741f04 (dry-run for 3 arms; red evidence only proved file existence); Tech Lead review 22:00Z checks the auth guard decision itself. Tech Lead APPROVE de741f04 (guard branches exercised with stubbed security/claude: near-expiry refresh, unreadable keychain, refresh failure; no token output; LOKI_EVAL_MODEL honored by both arms; mid-batch stop keeps prior results); merged; 7/7. |
468
+ | S41-04 | First-turn prefix measurement (tokens by type per stage) | see docs/v10/SCORECARD-PLAN.md | LOW | per SCORECARD-PLAN.md card | released@2026-09-28T22:26Z | Source: D41, Architect plan 7f671f5c. Depends on none. Dispatched 21:51Z. Built 71a0d28d; Tech Lead APPROVE (implement row re-derived from 58 impl.json files: mean 982,144, p50 654,959 cache_read, exact); merged. Implement is the re-reading hotspot (982K cache read per task vs 45-68K for intake, plan, Wall). Released in v10.5.3 (merge 926c0371 is an ancestor of v10.5.3). |
469
+ | S41-05 | Attempt-selection rule (pure function in e10ext/select.ts) | see docs/v10/SCORECARD-PLAN.md | HIGH | per SCORECARD-PLAN.md card | ready@2026-09-28T22:48Z | Source: D41, Architect plan 7f671f5c. Depends on D42. WIND-DOWN 2026-09-28: opus r2 REJECT (R1 Wall outside S uncounted, R2 key swaps 2-3 and 5-6 survived, R3 multi-line import passed fence) addressed at 34c44c99 on slice-S41-05 (50/0): R1 done red then green incl. M1'; R3, E3, require() done. LEFT: R2 pair tests 2-3, 4-5, 5-6, 6-7 are written and green but their mutation red-proof was not re-run. NEXT: run those 4 swap mutations, then opus r3 review. |
470
+ | S41-12 | Tree swap helper for parallel attempts | see docs/v10/SCORECARD-PLAN.md | HIGH | per SCORECARD-PLAN.md card | ready@2026-09-28T22:35Z | Source: D41, Architect plan 7f671f5c. Depends on D42. WIND-DOWN 2026-09-28: opus REJECT at 7a3fbe53, 5 blocking, all reproduced: B1 resetToBase deletes user untracked files on a successful swap (treeswap.ts:240-243); B2 symlinked attempts dir lets cleanup delete the primary (:301, :312-314); B3 type-changed path (T status) never reset (:228-229); B4 segment-anywhere excludes drop winner changes under src/venv (:109-113 vs :65); B5 base .gitignore restored before listing untracked deletes an ignored .env (:231, :240). Non-blocking N1 to N4 (index rewrite, undo not persisted, .git symlink, O_NOFOLLOW). Resume from branch slice-S41-12. |
461
471
  | S41-06 | Baseline scorecard (eval only) on small and medium, all arms | see docs/v10/SCORECARD-PLAN.md | HIGH | per SCORECARD-PLAN.md card | ready@2026-09-28T21:41Z | Source: D41, Architect plan 7f671f5c. Depends on S41-01, S41-02, S41-03, S41-04. |
462
472
  | S41-07 | Plan on the cheap model | see docs/v10/SCORECARD-PLAN.md | MEDIUM | per SCORECARD-PLAN.md card | ready@2026-09-28T21:41Z | Source: D41, Architect plan 7f671f5c. Depends on S41-06. |
463
473
  | S41-08 | Top model and deterministic-failure escalation | see docs/v10/SCORECARD-PLAN.md | HIGH | per SCORECARD-PLAN.md card | ready@2026-09-28T21:41Z | Source: D41, Architect plan 7f671f5c. Depends on S41-06. |
464
- | S41-09 | Lean stable prefix (flag) | see docs/v10/SCORECARD-PLAN.md | MEDIUM | per SCORECARD-PLAN.md card | building@2026-09-28T22:01Z | Source: D41, Architect plan 7f671f5c. Depends on S41-04. Dispatched 22:01Z. |
474
+ | S41-09 | Lean stable prefix (flag) | see docs/v10/SCORECARD-PLAN.md | MEDIUM | per SCORECARD-PLAN.md card | merged@2026-09-28T22:28Z | Source: D41, Architect plan 7f671f5c. Depends on S41-04. Dispatched 22:01Z. |
465
475
  | S41-14 | Wall in parallel with implement (item 4, target p50 not worse) | see docs/v10/SCORECARD-PLAN.md | HIGH | per SCORECARD-PLAN.md card | parked@2026-09-28T21:42Z | Source: D41, Architect plan 7f671f5c. Depends on D42, S41-16. D42 (2): deferred; E-98f shows no speed win (Wall-off p50 214s vs 209s) and it touches the moat. Reopen only if Wall is at least 15% of p50, with the Wall sealed and proven red on a clean base before any implement diff. |
466
476
  | S41-10 | Relevant context and a static-first brief | see docs/v10/SCORECARD-PLAN.md | MEDIUM | per SCORECARD-PLAN.md card | ready@2026-09-28T21:41Z | Source: D41, Architect plan 7f671f5c. Depends on S41-09. |
467
- | S41-11 | Rule-based trajectory trimming (flag) | see docs/v10/SCORECARD-PLAN.md | MEDIUM | per SCORECARD-PLAN.md card | ready@2026-09-28T21:41Z | Source: D41, Architect plan 7f671f5c. Depends on S41-09. |
477
+ | S41-11 | Rule-based trajectory trimming (flag) | see docs/v10/SCORECARD-PLAN.md | MEDIUM | per SCORECARD-PLAN.md card | ready@2026-09-28T22:48Z | Source: D41, Architect plan 7f671f5c. Depends on S41-09. WIND-DOWN 2026-09-28: built at 8aafe341 on slice-S41-11 (trim.ts plus providers.ts wiring, 35/0; SDK exposes no Bash exit code to PostToolUse, sdk.d.ts:2677, so nonzero-exit uses a fail-safe heuristic). NEXT: TL review, then merge (rebase onto main: providers.ts and harness.py also changed). |
468
478
  | S41-13 | Two parallel attempts for medium and large (flag) | see docs/v10/SCORECARD-PLAN.md | HIGH | per SCORECARD-PLAN.md card | ready@2026-09-28T21:41Z | Source: D41, Architect plan 7f671f5c. Depends on S41-05, S41-12. |
469
479
  | S41-15 | After-scorecard and defaults (flip only when green on small and medium) | see docs/v10/SCORECARD-PLAN.md | HIGH | per SCORECARD-PLAN.md card | ready@2026-09-28T21:41Z | Source: D41, Architect plan 7f671f5c. Depends on S41-13, S41-10, S41-11. |
480
+ | S41-17 | Scorecard 95% intervals: bootstrap (seeded, 10000 resamples, per-task clustered over reps) CIs on completion, cost per completed and p50 for each arm and for the Loki minus raw difference; a mark is green or red only when the difference CI excludes 0, else inconclusive, and inconclusive blocks the tier verdict | eval/loki10/scorecard, eval/loki10/test-scorecard.sh | HIGH | bash eval/loki10/test-scorecard.sh | ready@2026-09-28T22:51Z | Source: D43 item 2. Deterministic seed; a fixture where arms differ by noise only must read inconclusive, a clear gap must read green or red. Stdlib only. WIND-DOWN 2026-09-28: built at f3f1d985 on slice-S41-17 (test-scorecard.sh 43/43; new cases a to e are 27 pass 16 fail on the old scorecard). Seeded (41) 10000-resample percentile bootstrap clustered by task; marks need the difference CI strictly outside 0; headline cost uses the ratio against 0.5; over 2.5 percent undefined replicates downgrades to inconclusive. Not benchmarked at real-eval scale. NEXT: opus review (HIGH, flip gate), then merge. |
481
+ | S41-18 | scorecard-run.sh resume: before each arm and rep, read that rep's --out file and pass the harness only tasks with no status ok row; a rerun after an interrupt or auth stop finishes the missing rows and never repeats done ones; auth_guard still runs before every rep | eval/loki10/scorecard-run.sh, eval/loki10/test-scorecard-run.sh | MEDIUM | bash eval/loki10/test-scorecard-run.sh | ready@2026-09-28T22:48Z | Source: D43 item 4. Do not change auth_guard logic or harness.py (S41-01 owns it). Test with the stub arm: kill mid-rep, rerun, assert each task row appears exactly once per rep. WIND-DOWN 2026-09-28: built at 66cc1882 on slice-S41-18 (scorecard-run.sh resume; test-scorecard-run.sh 11/11, legs a to d red on the old script then green). LEFT: leg (a) seeds via a clean run, not a real SIGTERM mid-rep; no assertion for a capped (timeout) row; missing_tasks tier filter does not fail loud on an invalid tier; an empty tier now exits 0 instead of erroring. NEXT: close those 4, then TL review. |
482
+ | S41-19 | Stage wall-clock profile: derive per-stage seconds (intake, plan, wall, implement, verify, fix, seal) per run from the preserved E-98f engine10 journals, publish a per-arm p50 and p90 table in METRICS.md and name the slowest stage | eval/loki10/stage-profile.py, docs/v10/METRICS.md | MEDIUM | python3 eval/loki10/stage-profile.py --self-test | ready@2026-09-28T22:48Z | Source: D43 item 3. Read only on run data. If the journals lack stage timestamps, say so with evidence and propose the minimal event field instead of guessing. The cut slice is cut from its result. WIND-DOWN 2026-09-28: built at e06fa612 on slice-S41-19 (eval/loki10/stage-profile.py with --self-test, METRICS section over all 63 E-98f runs). Result: implement is 72.5 to 85.7 percent of wall-clock in every arm; wall is 23 to 29 percent and hits its own 90s timeout in 9/21 (default) and 11/21 (nocascade) runs, directly on the critical path, which clears D42 item 2's 15 percent revival bar for S41-14. NEXT: TL review and merge, then CTO call on reopening S41-14 (wall off the critical path) and an implement token/turn cut. |
483
+ | S41-20a | Medium tier growth, batch a: add 5 new pub-* medium tasks from pallets repos (click, flask, jinja, itsdangerous, markupsafe) meeting the D30 medium criteria in INDEX.md | eval/loki10/tasks/pub-* (new dirs only) | HIGH | measure-size.py and validate rc=0 on the new tasks; RED at base and GREEN with the merged upstream fix for each | ready@2026-09-28T22:48Z | Source: D43 item 2 (medium to 20). Return the INDEX.md lines in the report, do not edit INDEX.md (merge appends). No task whose issue is already present. WIND-DOWN 2026-09-28: 2 of 5 tasks built and self-verified at d8d8d41e on slice-S41-20a: pub-flask-6093 (fix flask#6096) and pub-click-3449 (fix click#3533), RED rc=1, GREEN rc=0, deletion mutant red, no-op baseline not completed; INDEX lines in the engineer report (not yet in INDEX.md). Stopped mid-screen: flask#5736 (asserts span 2 test files), flask#5526, itsdangerous#151. Rejected: click#2836 (emoji in issue body). NEXT: opus review of the 2 tasks, append INDEX lines, then resume the 3 candidates. |
484
+ | S41-20b | Medium tier growth, batch b: add 5 new pub-* medium tasks from attrs, more-itertools, packaging, humanize, faker meeting D30 | eval/loki10/tasks/pub-* (new dirs only) | HIGH | as S41-20a | ready@2026-09-28T22:48Z | Source: D43 item 2. Same rules as S41-20a. WIND-DOWN 2026-09-28: 3 of 5 tasks built at 881126a0 on slice-S41-20b: pub-attrs-1327 (fix attrs#1328), pub-packaging-1162 (fix packaging#1163, hidden test trimmed, pins pytest<9), pub-humanize-103 (fix humanize#110), each RED rc=1, GREEN rc=0, deletion mutant red; D30 no-op baseline NOT run for any. INDEX lines in the engineer report. Stopped: faker#2206 (fix #2211) venv installed, RED/GREEN not run. more-itertools has no 2-source-file fixes (rejected). NEXT: run the no-op baseline on the 3, opus review, append INDEX lines, then finish faker#2206. |
485
+ | S41-20c | Medium tier growth, batch c: add 5 new pub-* medium tasks from werkzeug, jsonschema, and other pure-Python repos with pytest suites (for example marshmallow, httpx, pluggy) meeting D30 | eval/loki10/tasks/pub-* (new dirs only) | HIGH | as S41-20a | ready@2026-09-28T22:48Z | Source: D43 item 2. Same rules as S41-20a. WIND-DOWN 2026-09-28: 1 of 5 tasks built at f6ea1d02 on slice-S41-20c: pub-httpx-2536 (fix httpx#2543; hidden test trimmed to test_url_query_encoding), RED 1 failed, GREEN 1 passed, deletion mutant red; D30 no-op baseline NOT run. Stopped: marshmallow#2170 (fix #2792, 3 source files) cloned only. jsonschema, pluggy, most httpx fixes are single-file (rejected); httpx#1850 needs Python below 3.13 (cgi). NEXT: no-op baseline, opus review, INDEX line, then marshmallow#2170. Medium tier after 20a/b/c: 7 plus 6 candidates = 13, still short of 20. |
470
486
  | E-98b | a spec_conflict implement exit still runs verify and fix; receipt keeps SPEC_CONFLICT | loki-ts/src/engine10/machine.ts, loki-ts/tests/engine10/machine*.test.ts | HIGH | fake-stage test red on main; core +3 max | released@2026-09-28T21:01Z | Source: MEDIUM-ANALYSIS.md. Dispatched 19:40Z sonnet; opus review. opus APPROVE 214b8dd2 (seal stays SPEC_CONFLICT through verify and fix; empty diff fails verify, no false pass); merged 97b80ca4; machine+budget 26/0. Released in v10.5.0 (merge 97b80ca4 is an ancestor of v10.5.0). |
471
487
  | E-98c | existing test files append-only in the implement brief; impactedTests falls back to named files when relevant_files is empty | loki-ts/src/engine10/stages/implement.ts, its test | MEDIUM | unit test red then green; core +2 max | released@2026-09-28T21:01Z | Source: MEDIUM-ANALYSIS.md. Dispatched 19:40Z sonnet. Tech Lead APPROVE b24f4da2; merged f4606246; implement+machine+budget 37/0. Released in v10.5.0 (merge f4606246 is an ancestor of v10.5.0). |
472
488
  | E-98d | repo map extracts Python top-level def and class names | loki-ts/src/engine10/repomap.ts, loki-ts/tests/engine10/repomap*.test.ts | MEDIUM | unit test red then green; core +4 max | released@2026-09-28T21:01Z | Source: MEDIUM-ANALYSIS.md. Dispatched 19:40Z sonnet. Offline 7-repo check runs after merge. Tech Lead APPROVE ba31cca4 plus async def fix a1e8dc4b; merged 15859bef; 41/0 across repomap, implement, machine, budget. Offline 4/7 repos rank the upstream file in the top 8 (was 0/7; card bar 5/7, keyword-tie ceiling). Released in v10.5.0 (merge 15859bef is an ancestor of v10.5.0). |
473
489
  | E-98e | a session killed at its stage limit writes a partial-stream cost record, never cost_usd null | loki-ts/src/engine10/session.ts, loki-ts/src/engine10/cost.ts, a test | MEDIUM | fake killed stream test red then green; core +10 max | released@2026-09-28T21:01Z | Source: MEDIUM-ANALYSIS.md. Dispatched 19:40Z sonnet. r1 blocked honestly (no per-message usage persisted before result; a fixture-only test would not be wired to a real killed session). Re-sized: sdk_stream_parser.ts running usage file plus session.ts pricing via calculateCostFromRecords; r2 dispatched 19:50Z. r2 86d7eea4: logic moved to runner/budget.ts, core -12; full bun test failure sets byte-identical to main (55 fail, 13 errors both, zero new). Tech Lead APPROVE (max-per-id dedupe test, result file wins, partial-usage- matches no result-cost- consumer, opus/sonnet priced by family). Merged 8b41ad40; 153/0 across cost, session, parser, budget, seal, verify; budget.test.ts passes again. Process note: the reviewer ran git checkout in the main checkout (read-only breach, tree restored clean). Released in v10.5.0 (merge 8b41ad40 is an ancestor of v10.5.0). |
474
- | E-98f | A/B eval of Wall and cascade on medium (default, WALL=0, CASCADE=0, n=3 each), then a sizing default only if a knob wins on completions without losing on cost | eval run; loki-ts/src/engine10/sizing.ts | HIGH | chosen default at or above raw 71.4% and below $0.5085 per completed; after table published in MEDIUM-ANALYSIS.md | merged@2026-09-28T21:30Z | Source: MEDIUM-ANALYSIS.md. Depends on E-98a..e merged. One combined re-run replaces the per-card re-runs (D40 cost). Dispatched 20:20Z (sonnet eval runner): E-98a..e merged locally; default, WALL=0, CASCADE=0 arms at n=3 on the 7 medium tasks, raw baseline from EV-15. d3c906fa merged eca3e8ef. n=3 x 21: default 15/21 (71.4%) p50 209s; WALL=0 16/21 (76.2%) p50 214s; CASCADE=0 15/21 p50 138s. No arm has a clean cost (null rows 10/2/11: harness provider_cost rejects partial-stream). pytest not_run 0 in all arms; jinja-1413 9/9. No flip (bar 85.7% and $0.5085). Results ~/loki-ci-logs/eval/e98f-*. |
490
+ | E-98f | A/B eval of Wall and cascade on medium (default, WALL=0, CASCADE=0, n=3 each), then a sizing default only if a knob wins on completions without losing on cost | eval run; loki-ts/src/engine10/sizing.ts | HIGH | chosen default at or above raw 71.4% and below $0.5085 per completed; after table published in MEDIUM-ANALYSIS.md | released@2026-09-28T22:02Z | Source: MEDIUM-ANALYSIS.md. Depends on E-98a..e merged. One combined re-run replaces the per-card re-runs (D40 cost). Dispatched 20:20Z (sonnet eval runner): E-98a..e merged locally; default, WALL=0, CASCADE=0 arms at n=3 on the 7 medium tasks, raw baseline from EV-15. d3c906fa merged eca3e8ef. n=3 x 21: default 15/21 (71.4%) p50 209s; WALL=0 16/21 (76.2%) p50 214s; CASCADE=0 15/21 p50 138s. No arm has a clean cost (null rows 10/2/11: harness provider_cost rejects partial-stream). pytest not_run 0 in all arms; jinja-1413 9/9. No flip (bar 85.7% and $0.5085). Results ~/loki-ci-logs/eval/e98f-*. Released in v10.5.2 (merge eca3e8ef is an ancestor of v10.5.2). |
475
491
  | E-99 | E-86 follow-ups (opus non-blocking): scan every pushed commit with the pushed tip's .gitleaksignore (what CI does) so a self-suppressing line added and removed in one push is refused; unset GITLEAKS_CONFIG and GITLEAKS_CONFIG_TOML in the hook; refuse a .gitleaks.toml change in any push (not only eval-touching ones) without LOKI_ALLOW_GITLEAKS_CONFIG_CHANGE=1; pin the installed binary sha256 in the hook | .githooks/pre-push, tests/test-pre-push-gitleaks.sh | MEDIUM | real-push fixtures for each case, failing first | released@2026-09-28T21:01Z | Source: E-86 round-4 review C1-C3 and the forged-sidecar boundary. Opus APPROVE; merged 5ee5a630 (conflict with E-100 case 20 resolved: guard kept, E-99 message taken; gitleaks test 43/0 with binary, 19/0/24 skipped without; pre-push hook 13/0). Released in v10.5.0 (merge 5ee5a630 is an ancestor of v10.5.0). |
476
492
  | E-100 | P0: main Tests red on cc4992ed (run 36465466283): tests/test-pre-push-gitleaks.sh case 20 asserted a pass without the pinned gitleaks binary, which the CI runner does not have | tests/test-pre-push-gitleaks.sh | HIGH | `HOME=<empty> bash tests/test-pre-push-gitleaks.sh` 18 passed 0 failed 22 skipped; with the binary 40 passed | released@2026-09-28T21:01Z | Built 91a47f52; the class is guarded by E-94 (changed tests re-run with an empty HOME). Released in v10.5.0 (merge 0716ec41 is an ancestor of v10.5.0). |
477
493
  | E-101 | Eval results durable (D40 priority 4): run.sh and harness.py write results.jsonl to ~/loki-ci-logs/eval/<run> and a redacted copy to eval/loki10/archive/; scripts/prune-worktrees.sh never removes a worktree with a live process, a commit in the last 30 minutes, or un-archived eval results | eval/loki10/run.sh, eval/loki10/harness.py, scripts/prune-worktrees.sh, tests/test-eval-archive.sh, tests/test-prune-worktrees.sh | HIGH | fixtures: live-process and un-archived worktrees kept; a planted token never reaches the in-repo archive | released@2026-09-28T21:01Z | Source: EV-14 results lost 17:36Z. Supersedes E-96. Reviewer APPROVE bbe83c7a (mutation-checked all 3 prune checks and redact_row); merged 21df7d4a; prune-worktrees 26/0, eval-archive 5/0. Used at 19:40Z to prune 6 finished worktrees. Released in v10.5.0 (merge 21df7d4a is an ancestor of v10.5.0). |
@@ -333,3 +333,11 @@ One entry per decision: context, choice, why, how to reverse. Newest last.
333
333
  - (2) S41-14 is DEFERRED, not run in wave 2. E-98f shows no speed win (Wall-off p50 214s vs default 209s; opus implement 138s), and it touches the moat for nothing measurable; speed work goes to implement (item 1, S41-06) and lockfile-cached installs. It may be revived only on new evidence that Wall is 15% or more of p50 wall-clock, and then only under this invariant: the Wall files are sha256-sealed and proven red on the base tree BEFORE the implement diff exists anywhere the Wall author or runner can read it (Wall reads base only, in its temp dir); red-on-base runs on a pristine base checkout, never by resetting the implement worktree; implement never sees Wall files. A post-implement red check is rejected.
334
334
  - (3) S41-16 is P0, confirmed: wall.ts:48-51 counts any throw as fail, and `/bin/sh -c 'python -m pytest ...'` exits 127 here (command -v python rc=1), so every pytest red-first check today is vacuous and already_satisfied cannot fire. It merges before any other wave-1 card that touches wall.ts, verify or Seal, and before any eval run counts Wall seals. Classification: red = the runner started and reported at least one failed test (pytest exit 1; jest/vitest/bun non-zero with a parsed failed-test count above 0). A collection error (pytest exit 2) is red only when its error is ImportError, AttributeError or NameError on a name inside the repo under test (the feature does not exist yet); otherwise it is not_run. Exit 126/127, tool not found, pytest exit 3, 4 or 5, a timeout, or no parsed count is not_run, which refuses the seal (NOT PROVEN) and never counts as red. The mutation test must include a launch failure that goes red today.
335
335
  - (4) M-13: fix (a) is the only allowed fix; (b) is rejected because event order is not a binding. M-12's sealOracle takes the card's normalizers (default: tolerance 0, empty skip_fields), writes their sha256 into sealed.json and the oracle.captured event, and equiv refuses PROVEN when the normalizers it uses do not hash-match, or when the seal has no hash. The separate sealNormalizers call is deleted. M-13 may edit the M-12 seal file under modernize/ for this sealing change only, as the single writer while no other slice holds it.
336
+
337
+ ## D43 (founder, 2026-09-28T22:25Z): the scorecard decides only outside its noise
338
+
339
+ Raw claude -p swung 85.7% to 71.4% between two runs on the same 7 medium tasks, so the sample is smaller than the effects being measured. Before any flip decision:
340
+ 1. Cost capture first (S41-01): no scorecard counts while any evaluated cost row is null (already n/a = red in SCORECARD-PLAN section 2).
341
+ 2. The medium tier holds at least 20 tasks and every arm runs at least 3 reps. The scorecard reports 95% intervals; a mark is green or red only when the interval of the Loki minus raw difference excludes 0, otherwise it is inconclusive, and inconclusive never flips a default (S41-17, S41-20a to c).
342
+ 3. Speed is v10's worst medium axis (p50 138 to 214s against raw 56 to 70s): profile stage wall-clock per run and cut the slowest stage first (S41-19, then a cut slice named by its result).
343
+ 4. Auth is checked before every rep (S41-03 auth_guard) and an interrupted eval resumes from its out files, never re-runs from scratch (S41-18).
@@ -126,6 +126,14 @@ critical path and reviewed immediately.
126
126
 
127
127
  ## Usage (hourly, from scripts/usage-governor.py)
128
128
 
129
+ ### 2026-09-28T22:19Z
130
+ - 5h window: uncalibrated, 5,229,182 output tokens since 2026-09-28T17:19Z (uncalibrated)
131
+ - Weekly: uncalibrated, 48,901,928 output tokens, 42.7h to reset (uncalibrated)
132
+ - Last hour: 1,436,250 output tokens; 45 active engineers; 29,189 per engineer; Chief of Staff 124,829
133
+ - Max engineers next hour: uncalibrated (no plan reading on file)
134
+ - Output tokens by model (all scanned transcripts): claude-sonnet-5 31,903,763 (43.0%), claude-opus-5-5 16,991,251 (22.9%), claude-opus-4-8 14,720,953 (19.8%), claude-opus-4-7 4,678,300 (6.3%), claude-opus-5 4,489,139 (6.0%), claude-fable-5 1,254,167 (1.7%), claude-opus-4-6 203,492 (0.3%), claude-haiku-4-5-20251001 6,565 (0.0%)
135
+ - Output tokens by role (all scanned transcripts): workflow-agent 44,503,521, chief-of-staff 29,712,444, subagent 31,665
136
+
129
137
  ### 2026-09-28T21:15Z
130
138
  - 5h window: uncalibrated, 5,183,443 output tokens since 2026-09-28T16:15Z (uncalibrated)
131
139
  - Weekly: uncalibrated, 47,364,676 output tokens, 43.7h to reset (uncalibrated)
@@ -1441,3 +1441,50 @@ sample.
1441
1441
  - P0 augmentiq #52 rework: E-68, E-69, EV-13 APPROVE; E-66 CONCERN; E-67 REJECT. E-64 (lean small path plus opus on failure) APPROVE on rework.
1442
1442
  - Part 2: 0 slices merged. M-01, M-02, M-05, M-06 built (CONCERN: recursive SCC); M-09 built (REJECT: unsupported types recorded as equal).
1443
1443
  - Top blocker: the 2 red Tests shards on 898fa081 block the v10.0.0 release.
1444
+
1445
+ ## 2026-09-28T22:21Z (Chief of Staff)
1446
+ - E-124 merged (8a99554c): opus r3 APPROVE at 2a3f992b; a missing normalizer hash on either side now fails verify, and a pre-D42 oracle is refused at seal (presealed_wall.ts:249, 355-356). modernize 229/0; dist loki.js unchanged (cockpit.js debugId-only noise discarded).
1447
+ - Staffed M-18 and E-125 (sonnet, worktrees); S41-05 and S41-12 corrected to building (29529670). Pruned 3 finished, merged, clean worktrees by agent state (lsof positive control read 0 on a live worktree, so lsof is not a liveness signal here).
1448
+ - S41-09 done (e5468d2c, flag-gated lean prefix, core unchanged at 4,982); sonnet TL review in flight. PO cutting 6 ready slices for LOW_READY.
1449
+ - v10.5.3 Release 36490908332 in progress (required-ci and gate success); watcher re-armed after a network error. Hourly usage snapshot 9522ae5e: governor still uncalibrated.
1450
+ - S41-01 at 37 min against a 30 min budget: stop and re-slice at 45 min if it has not committed.
1451
+
1452
+ ## 2026-09-28T22:27Z (Chief of Staff)
1453
+ - Founder directive recorded as D43 (a9f74496): medium tier to 20+ tasks, 3+ reps, 95% CIs, decide only outside them; profile stage wall-clock; auth check per rep plus resume. Cards S41-17 (CIs), S41-18 (resume), S41-19 (stage profile), S41-20a/b/c (15 medium candidates) staffed on sonnet. Auth check per rep already exists (scorecard-run.sh:174 auth_guard per arm and rep).
1454
+ - S41-01 (D43 item 1, P0) done at 68d1fc28: test-harness.sh 126/0, red vs main 119/7 (all 7 the S41-01 checks); E-98f repriced: default $1.1328/completed, nowall $0.9148, nocascade n/a (2 killed-session rows with zero usage stay null). Sonnet TL review in flight.
1455
+ - S41-05 opus REJECT (3 blocking: key-order mutations M1 to M4 survive 19/0, no early-accept predicate, import fence misses 4 forms); back to its engineer. M-15 done at a6d584fb (246/0), opus review in flight.
1456
+ - Worktree drift: removed 4 stale worktrees (E-106, E-98a, old M-14 wf, EV-12F-b) after saving their diffs and untracked files to the session scratchpad (wt-salvage/).
1457
+ - UNEVIDENCED_CLAIM on a9f74496 is the S41-17 card text defining marks ("green or red"), a spec, not a claim.
1458
+
1459
+ ## 2026-09-28T22:33Z (Chief of Staff / Release Manager)
1460
+ - v10.5.3 verified: Release 36490908332 all jobs success; npm latest 10.5.3, gitHead 2e13fca3; body 12 lines. npm 404'd the version for about 7 min after publish-npm logged "+ loki-mode@10.5.3" (22:19:55Z); propagation, not a failed publish. 6 rows flipped released.
1461
+ - Train pushed 2e13fca3..04d3ac9c (41 commits: S41-16, M-14, E-118, E-122, E-123, E-124, S41-09, dist); Tests and Bun Parity watcher armed; 10.5.4 cut on green.
1462
+ - S41-09 merged (ebb16a62, TL APPROVE, 26/0). M-15 opus REJECT (B1 missing third-party package classified red; B2 PROVEN without conformance re-run or no-op ablation), back to engineer. M-18 done (a01c6fdb, 206/0 modernize), TL review. PO cut E-126 to E-131; staffing waits on worktree slots (15/15).
1463
+
1464
+ ## 2026-09-28T22:55Z HAND-OFF: PAUSED UNTIL WEDNESDAY 2026-09-30 13:00 ET (founder: weekly usage at 77%)
1465
+
1466
+ The swarm is stopped: .loki/V10-STOP exists, the loop has no wake-ups, and the cadence, usage-snapshot and loop-resume crons are deleted. Nothing is building or in review. Do not restart before the weekly reset.
1467
+
1468
+ ### Shipped today (tail)
1469
+ - v10.5.3 (2e13fca3): npm latest 10.5.3, gitHead 2e13fca3, body 12 lines. Carried E-114, E-119, M-13, S41-02, S41-04, E-121.
1470
+ - v10.5.4 (8ee273f6): Wall classifies a runner that never started as not_run and Seal refuses not_run above 0 (S41-16); pre-sealed Wall in modernize (M-14) with the normalizer-hash check (E-124); strict-narrowing re-slice to depth 2 (M-18); LOKI_E10_PREFIX=lean flag (S41-09); governor fix (E-118); headline cost rule (E-122); arm runner and auth guard (S41-03); CI registration (E-123). npm and body verification recorded in the next entry.
1471
+ - Red main fixed forward twice: dc392119 (S41-09 moved the SDK systemPrompt, a source-reading test followed it; 948/0) and 32c66596 (the Bun and coverage CI jobs had no pytest; reproduced locally with a pytest-less venv, 18/2 then 20/0). CI green at 7f341027 (Tests, Bun Parity, Coverage).
1472
+ - Release note: release.sh in a worktree with a node_modules symlink writes absolute /Users paths into the dist maps (133 in loki.js.map, plus cockpit.js.map). For 10.5.4 they were rewritten to ../node_modules/ and cockpit maps restored from HEAD before commit. Guard slice needed (see E-102/E-103 history).
1473
+
1474
+ ### Ready, with work on a branch (each BOARD row carries where it stopped)
1475
+ - S41-01 cost capture, 68d1fc28: TL APPROVE on content; needs rebase (harness.py allowlist conflict with S41-09 and S41-11) and an opus review (card is HIGH).
1476
+ - S41-17 scorecard 95% CIs, f3f1d985: 43/43, red-first proven; needs opus review.
1477
+ - S41-18 scorecard resume, 66cc1882: 11/11; 4 gaps listed in the row; needs TL review.
1478
+ - S41-19 stage profile, e06fa612: implement is 72 to 86% of medium wall-clock; the Wall is 23 to 29% and times out at 90s in 9 to 11 of 21 runs, clearing D42's 15% bar to reopen S41-14; needs TL review.
1479
+ - S41-11 trim flag, 8aafe341: 35/0; needs TL review and a rebase.
1480
+ - S41-20a/b/c medium tasks: 6 built (flask-6093, click-3449, attrs-1327, packaging-1162, humanize-103, httpx-2536), none reviewed; the no-op baseline is missing on the 4 from b and c. Medium tier would be 13 of the 20 D43 requires.
1481
+ - E-126 to E-131 (PO cut, unstaffed), E-132 (missing pytest reads red at Wall, found fixing red main).
1482
+
1483
+ ### In rework (fix committed, needs a re-review)
1484
+ - M-15 03b35a69 (opus r2), E-125 845c9231 (opus r2, core 4,998 of 4,999; run full engine10 first), S41-05 34c44c99 (4 key-swap mutation proofs left, then opus r3), S41-12 7a3fbe53 (opus REJECT, 5 data-loss findings, not yet reworked).
1485
+
1486
+ ### Wednesday, exact next step
1487
+ 1. Remove .loki/V10-STOP, run scripts/v10-pulse.sh, and confirm main CI is green.
1488
+ 2. S41-01: rebase slice-S41-01 onto main, keep one LOKI_E10_PREFIX and one LOKI_E10_TRIM in V10_ENGINE_ENV_ALLOWLIST, rerun bash eval/loki10/test-harness.sh to 0 failures, send it to an opus reviewer, and merge on APPROVE. No scorecard counts until this is merged (D43 item 1).
1489
+ 3. Then merge the eval prerequisites (S41-17 CIs, S41-18 resume) and bring the medium tier to 20 tasks (review S41-20a/b/c, run their no-op baselines, append their INDEX lines, and cut 7 more).
1490
+ 4. Then run the medium-tier eval per D43: raw sonnet, raw opus and loki on sonnet, at least 3 reps each, back to back, with auth checked before every rep and resume on interrupt; decide only on differences whose 95% interval excludes 0.