loki-mode 10.5.30 → 10.5.32

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: An autonomous software factory that knows what it is supposed to deliver, and proves it did. Use when the user says Loki Mode or asks to build, fix or verify software autonomously.
 ---
 
-# Loki Mode v10.5.30
+# Loki Mode v10.5.32
 
 **You are an autonomous agent. You make decisions. You do not ask questions. You do not stop.**
 
@@ -470,4 +470,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v10.5.30 | [Autonomi](https://www.autonomi.dev/) flagship product | ~410 lines core**
+**v10.5.32 | [Autonomi](https://www.autonomi.dev/) flagship product | ~410 lines core**

package/VERSION

@@ -1 +1 @@
-10.5.30
+10.5.32

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "10.5.30"
+__version__ = "10.5.32"
 
 # Expose the control app for easy import
 try:

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 The flagship product of [Autonomi](https://www.autonomi.dev/). Loki Mode is a spec-driven autonomous builder with a built-in trust layer that takes any spec to a deployed product and verifies completion with evidence (quality gates plus a completion council), not just a "done" claim. Complete installation instructions for all platforms and use cases.
 
-**Version:** v10.5.30
+**Version:** v10.5.32
 
 ---
 

package/docs/v10/BOARD.md

@@ -613,8 +613,35 @@ Source: ~/git/autonomi-dev/research/2026-09-30-adoption/SWARM-PROMPT-ADOPTION.md
 | A-104 | Commit only the fix (items 1 and 2, v10) | see plan A-104 | HIGH | first-run-gate assertion per plan card | released@2026-09-30T21:23Z | Wave per plan section 5; one writer per file. Released in v10.5.11 (merge d86a5817 is an ancestor of v10.5.11). |
 | A-104b | A-104 opus follow-ups: run the unstage reset as `git --literal-pathspecs reset` and check its rc (a path starting with `:(top)` was read as a pathspec and committed); match "manifest changed" per directory in monorepos (a stray lockfile in packages/b rode along with a packages/a manifest change); judge new lockfiles and Wall files against the run base, not HEAD, so files the agent commits during implement are also excluded | loki-ts/src/engine10/stages/seal.ts, loki-ts/tests/engine10/seal.test.ts | HIGH | fixtures for each case red first; seal-then-verify still matches | merged@2026-10-01T09:45Z | Source: A-104 opus review (APPROVE with notes). seal.ts writer order: after A-121. |
 | A-104c | A-104b r2 opus follow-up (code reading, not reproduced): a FAILED run now reaches backstopCommit in supervisor.ts (around lines 93-98 and 229), which runs git add -A with hooks off, so a run whose commit stage failed could still commit Wall files, stray lockfiles and the user's pre-run dirty files, and hasDiff could push them as a draft PR (E-67 behaviour). Reproduce first; then make the backstop honor the same exclusions as the commit stage, or skip it when the commit stage itself failed | loki-ts/src/engine10/supervisor.ts, its test | failed-commit run leaves no new commit with Wall files, lockfiles or pre-run dirty files, and opens no PR | HIGH | merged@2026-10-01T10:03Z | none |
-| D50-F1 | D50 lift fix 1 (aiq-52, expected no_change_needed): v10 printed ALREADY_SATISFIED but left source changes from implement (harness no_source_diff=false), so it scored not completed; raw sonnet checked first and changed nothing. On ALREADY_SATISFIED, restore source to base before commit, PR or seal; fail closed to FAILED if the restore fails | loki-ts/src/engine10 (outcome path), its tests, dist | fixture with implement edits plus ALREADY_SATISFIED ends with an empty diff, no commit, no PR; VERIFIED runs keep changes | HIGH | building@2026-10-01T10:27Z | none |
-| D50-F2 | D50 lift fix 2 (humanize-174): the task changes behaviour that existing tests encode; raw sonnet fixed code and updated the assertions (2/3), v10 BLOCKED as spec conflict or hit the iteration cap (0/3). Needs a design that permits spec-required assertion changes, recorded in the receipt, without opening a test-weakening loophole. Opus architect first | engine10 intake, plan, wall, verify, seal (per design) | humanize-174-shaped fixture completes with the assertion changes listed in NOT PROVEN; a weakening attack still fails | HIGH | building@2026-10-01T10:31Z | opus architect design in progress |
+| D50-F1 | D50 lift fix 1 (aiq-52, expected no_change_needed): v10 printed ALREADY_SATISFIED but left source changes from implement (harness no_source_diff=false), so it scored not completed; raw sonnet checked first and changed nothing. On ALREADY_SATISFIED, restore source to base before commit, PR or seal; fail closed to FAILED if the restore fails | loki-ts/src/engine10 (outcome path), its tests, dist | fixture with implement edits plus ALREADY_SATISFIED ends with an empty diff, no commit, no PR; VERIFIED runs keep changes | HIGH | merged@2026-10-01T11:45Z f391ba33f (r5, opus approved, train/56) | none |
+| D50-F2 | D50 lift fix 2 (humanize-174): the task changes behaviour that existing tests encode; raw sonnet fixed code and updated the assertions (2/3), v10 BLOCKED as spec conflict or hit the iteration cap (0/3). Needs a design that permits spec-required assertion changes, recorded in the receipt, without opening a test-weakening loophole. Opus architect first | engine10 intake, plan, wall, verify, seal (per design) | humanize-174-shaped fixture completes with the assertion changes listed in NOT PROVEN; a weakening attack still fails | HIGH | rejected@2026-10-01T12:40Z: S1+S2 (71997e6c, a2941555) opus REJECT. Moat holds (any existing-test edit seals PARTIAL). Blocking: the per-spec label fires on any literal swap whose test calls a task word (if True to False, range(10) to range(0), tolerance 1e-3 to 1e3) and drops the weakened-test flag, a false Seal claim. No lift: context.ts:23 still makes tests append-only, so humanize-174 still ends SPEC_CONFLICT. Rework D50-F2r (honest label) building; lift fix D50-F2-S3 needs a CTO call | none |
+| D50-F2r | D50-F2 rework, honest label only: label a test value change only on the expected side of an assert comparison or a parametrize expected value, only when the old or new value appears in the task text; wording 'assertion value changed (not shown to be required by the task): file:line old -> new' and keep the 'weakened test' line beside it; exclude control flow, range, tolerances, approx kwargs, decorators | loki-ts/src/e10ext classifier, engine10 verify and seal wiring, tests, dist | probes C D E F G H K from the F2 review all keep 'weakened test'; A labelled only when 5 appears in the task; verdict PARTIAL in every case | HIGH | building@2026-10-01T13:15Z r2 (r1 6368111d REJECTED: python3 -c in repo cwd lets a planted copy.py forge receipt text; old-or-new and substring task match; inTask hard-coded; counts defaulted) | none |
+| D50-F2-S3 | humanize-174 lift: let the implement brief edit an existing assertion only when the task text states the new expected value; verdict stays PARTIAL, never VERIFIED (moat). CTO call needed first: does a PARTIAL spec-required test edit count as the right outcome, and does the brief license weaken the append-only rule (context.ts:23) | loki-ts/src/e10ext/context.ts, verify and wall policy, eval fixture through implement | humanize-174 fixture through implement ends with code fixed and the spec value assertion changed, PARTIAL with an honest note | HIGH | ready (D53 ruled 12:39Z: VERIFIED allowed when the new literal is verbatim in the issue, the edit changes only that literal in an existing assert, and Wall plus other tests pass; PARTIAL never scores completed; red bypass tests for tolerance, if True to False, deleted assert, literal not in issue) | needs D50-F2r |
+| D50-F4 | aiq-52 diagnosis: on FAILED, backstopCommit runs git add -A and re-stages the commit stage's exclusions (pre-existing dirt, Wall files, stray lockfiles), so a PR with only setup dirt is pushed. Backstop applies the same exclusions; nothing left means no commit and no PR | loki-ts/src/engine10/supervisor.ts, e10ext helper, tests, dist | preexisting-dirty fixture with FAILED: HEAD equals base and no PR; with a run edit the backstop commit holds only that edit; Wall and stray lockfile never committed | HIGH | building@2026-10-01T13:25Z r2 (r1 2f183c4e REJECTED: backstop hash-object ran with the supervisor env, so an agent clean filter could read the unwithheld GH_TOKEN; also hasDiff not net) | none |
+| D50-F5 | aiq-52 lift: already_done.ts findEvidence misses compound task keywords (searchbar vs search-command); add deterministic compound-token matching and a same-stem source plus referencing-test category pair; confirmation still must cite a real hit | loki-ts/src/e10ext/already_done.ts, tests, dist | aiq-52-shaped fixture yields a candidate; unrelated keyword, source without referencing test and short prefix yield none | HIGH | building@2026-10-01T13:25Z r2 (r1 94bc5172 REJECTED: plain single-part equality made user, api and notification tasks candidates; comment-only stem and vendor dirs counted) | none |
+| D50-W1 | CTO call (aiq-52 diagnosis): Wall runs in an empty temp cwd (wall.ts:156-169) with a 90s cap, so on brownfield tasks it writes blind tests and was killed twice; options are read-only repo access for Wall, or a longer cap, each weighed against Wall's from-spec independence (moat) | loki-ts/src/engine10/stages/wall.ts | decision recorded in DECISIONS | HIGH | blocked@2026-10-01T13:00Z CTO call | none |
+| P0-backstop-refused | A run refused at intake (dirty tracked tree) still runs backstopCommit (git add -A plus commit) on the user's own branch, landing their dirty and untracked files on main; found by the D50-F1b opus review on base 151aa563 | loki-ts/src/engine10/supervisor.ts, its tests, dist | dirty-README fixture: refusal exit, no new commit on main, README still dirty byte-identical, notes.txt untracked | HIGH | merged@2026-10-01T12:25Z 3c46a2b6 (a70f0980; red 22/1, green 953/0; train/57) | none |
+| D50-F1c | Re-decision 12:35Z: D50-F1 stays in place (r5, released 10.5.30); B (worktree per run, D50-F1b) stays parked until a dependency strategy exists, because a worktree without node_modules or .venv lost a VERIFIED fixture. This slice fixes the in-place gap the F1b review reproduced: SIGINT or SIGTERM leaves the user's checkout on the loki/e10 run branch and can orphan the worker | loki-ts/src/engine10 supervisor (signal path), e10ext helper if needed, tests, dist | SIGINT and SIGTERM mid-run: original branch checked out, worker PID gone, run branch kept; never reset or discard user files | MEDIUM | merged@2026-10-01T12:55Z 027be0eb (e3773291; signal tests red then green, clean-tree guard added on lead review, engine10 956/0; train/58) | none |
+| D51-B01 | D51 Phase B B01 (flag LOKI_WORKSPACES, docs/v10/D51-PHASE-B.md): Test harness: register `tests/test-workspace.sh`, which sources `tests/workspace/*.sh` parts (each later slice adds only its own part) | tests/test-workspace.sh, tests/run-all-tests.sh, scripts/local-ci.sh, tests/workspace/00-smoke.sh | runner lists the suite; an empty part dir passes 1/0; shellcheck clean | LOW | merged@2026-10-01T12:46Z 12c4a6d3 (28566052, haiku; workspace, registration, shard, drift, v10-ops, shellcheck all rc 0) | none |
+| D51-B02 | D51 Phase B B02 (flag LOKI_WORKSPACES, docs/v10/D51-PHASE-B.md): Schema plus validator for `workspaces` (repos, path, setup, after, integration, integration_files); `after` cycle and unknown-repo rejection | schemas/loki-yaml.schema.json, autonomy/lib/loki_yaml.py, tests/workspace/10-schema.sh | a valid sample passes; a cycle, an unknown `after` and a non-ignored integration file are each rejected with a named error | MEDIUM | ready | needs B01 |
+| D51-B03 | D51 Phase B B03 (flag LOKI_WORKSPACES, docs/v10/D51-PHASE-B.md): worktree_prep core: start ref, per-base lock, left-out-edits line, stamped dirs, never delete a kept tree | autonomy/lib/worktree_prep.py, tests/workspace/20-prep.sh | a dirty source fixture yields a worktree tree equal to base; 4 parallel preps on one base all succeed; a relaunch keeps the old dir | HIGH | ready | needs B01 |
+| D51-B04 | D51 Phase B B04 (flag LOKI_WORKSPACES, docs/v10/D51-PHASE-B.md): Dependency strategy: setup, CoW copy, ignore check, escape detection | autonomy/lib/worktree_deps.py, tests/workspace/30-deps.sh | editable-install venv fixture: copy refused, setup path imports worktree code; absolute-symlink node_modules refused; a non-ignored dir is never copied | HIGH | ready | needs B02/B03 |
+| D51-B05 | D51 Phase B B05 (flag LOKI_WORKSPACES, docs/v10/D51-PHASE-B.md): Adopt worktree_prep in backlog.py behind the flag (also closes A3b relaunch) | autonomy/lib/backlog.py, tests/test-backlog.sh | flag off: backlog 47/0 unchanged; flag on: a JS fixture issue reaches VERIFIED with node_modules present | MEDIUM | ready | needs B04 |
+| D51-B06 | D51 Phase B B06 (flag LOKI_WORKSPACES, docs/v10/D51-PHASE-B.md): Adopt worktree_prep in api_start._prepare_workdir behind the flag | dashboard/api_start.py, tests/dashboard/test_api_start_prep.py | flag on: the UI path uses the same lock and deps; flag off: byte-identical behavior | MEDIUM | ready | needs B04 |
+| D51-B07 | D51 Phase B B07 (flag LOKI_WORKSPACES, docs/v10/D51-PHASE-B.md): group.json store: atomic write, single writer, reader API | autonomy/lib/workspace_state.py, tests/workspace/40-state.sh | a killed writer never leaves a partial file; a second writer pid is refused | MEDIUM | ready | needs B01 |
+| D51-B08 | D51 Phase B B08 (flag LOKI_WORKSPACES, docs/v10/D51-PHASE-B.md): Runner: fan-out per repo, `after` ordering, SKIPPED on predecessor failure, killpg on SIGTERM, exit codes | autonomy/lib/workspace.py, tests/workspace/50-run.sh | stub launcher: parallel repos overlap, the dependent starts after the predecessor, a failing predecessor marks the dependent SKIPPED, SIGTERM leaves no child alive | HIGH | ready | needs B07/B03/B04 |
+| D51-B09 | D51 Phase B B09 (flag LOKI_WORKSPACES, docs/v10/D51-PHASE-B.md): Per-repo task text: section split, preamble, `LOKI_E10_TASK_TEXT` only (no issue.json in the run) | autonomy/lib/workspace_task.py, tests/workspace/60-task.sh | a 2-section issue gives each repo only its section; no issue.json exists in either run dir; untrusted text is never placed in argv | HIGH | ready | needs B08 |
+| D51-B10 | D51 Phase B B10 (flag LOKI_WORKSPACES, docs/v10/D51-PHASE-B.md): Integration runner plus evidence.json (not a Seal) | autonomy/lib/workspace_integration.py, tests/workspace/70-integration.sh | a passing compose stub gives exit 0 and matching SHAs; a timeout is FAILED, never passed; integration_files absent from every engine worktree | HIGH | ready | needs B08 |
+| D51-B11 | D51 Phase B B11 (flag LOKI_WORKSPACES, docs/v10/D51-PHASE-B.md): PR comment with the integration result, via the existing gh token path (no LLM in the step) | autonomy/lib/workspace_comment.py, tests/workspace/80-comment.sh | stub gh receives one comment per PR; the token appears in no log or argv | MEDIUM | ready | needs B09/B10 |
+| D51-B12 | D51 Phase B B12 (flag LOKI_WORKSPACES, docs/v10/D51-PHASE-B.md): CLI `loki workspace` subcommand (list, show, run, status, clean) | autonomy/loki, tests/workspace/90-cli.sh | flag off: the command says it is disabled; `clean` never removes a worktree whose branch has an open PR | MEDIUM | ready | needs B08 |
+| D51-B13 | D51 Phase B B13 (flag LOKI_WORKSPACES, docs/v10/D51-PHASE-B.md): Dashboard endpoints reading group.json; run launches a detached runner | dashboard/api_workspaces.py, dashboard/server.py, tests/dashboard/test_api_workspaces.py | the group survives an app restart; non-loopback Host gets 403; control scope required for run | HIGH | ready | needs B07/B08 |
+| D51-B14 | D51 Phase B B14 (flag LOKI_WORKSPACES, docs/v10/D51-PHASE-B.md): Dashboard group card (per-repo rows, integration row, stale-evidence badge) | dashboard/static/start.html | Playwright: a fixture group renders 2 repo rows plus integration; a mismatched head SHA shows stale | LOW | ready | needs B13 |
+| D51-B15 | D51 Phase B B15 (flag LOKI_WORKSPACES, docs/v10/D51-PHASE-B.md): 10x metric: PRs per wall-clock hour and per attention minute from group.json timestamps | autonomy/lib/workspace_metrics.py, tests/workspace/95-metrics.sh | a fixture group gives the hand-computed rate; unmeasured runs are reported, not counted as zero | LOW | ready | needs B07 |
+| D51-B16 | D51 Phase B B16 (flag LOKI_WORKSPACES, docs/v10/D51-PHASE-B.md): Docs plus flag flip after the whole-feature Wall: a 2-repo fixture (lib and app) ends with 2 PRs and integration passed | docs/WORKSPACES.md, tests/workspace/99-e2e.sh | the e2e part passes on CI with the stub provider; one real run is recorded in METRICS.md | MEDIUM | ready | needs all |
+| INTEL-1 | Standards-based receipts (competitive intel 2026-10-01): emit the Seal as an in-toto Statement in a DSSE envelope, verifiable by stock tools (in-toto verify, cosign verify-blob) as well as loki verify; V10-VISION names this stack | loki-ts/src/engine10 seal and receipt export, loki keys, tests, dist | a stock tool verifies a real receipt in a test; a tampered envelope fails both the stock tool and loki verify | HIGH | ready@2026-10-01T12:46Z | none |
+| INTEL-2 | Visible hard cost cap by default: the v10 start line shows the per-run cap; BUDGET_STOP (exit 3) enforces it; loki.yaml budgets.per_run or --max-cost sets it; conservative default with rationale in DECISIONS. Check what already exists first (BUDGET_STOP, LOKI_E10_CAP_S) | engine10 start line and budget path, loki.yaml schema, docs, tests | a run over the cap stops with exit 3 and BUDGET_STOP; the start line names the cap; the default is recorded in DECISIONS | MEDIUM | ready@2026-10-01T12:46Z | none |
+| INTEL-3 | Reviewer-first PR body: delivery contract, each acceptance criterion mapped to changed files and the proving check, then NOT PROVEN, readable in 60 seconds | engine10 pr body rendering, tests | a fixture PR body lists every Wall criterion with its file and check; NOT PROVEN last; under a fixed line budget | MEDIUM | ready@2026-10-01T12:46Z | none |
+| D50-F1b | D50-F1 structural follow-up (CTO call B): run engine10 in a worktree on base per run instead of the user checkout, copying uncommitted user edits in via git stash create; run files stay under the user .loki; PR pushes from the worktree branch; removes the restore and pre-existing-dirty class by construction | loki-ts/src/engine10 supervisor, worker, intake, seal/discard, pr, their tests, dist | user checkout byte-identical after any outcome; dirty user edits visible to the run; ALREADY_SATISFIED leaves no diff; VERIFIED opens the PR from the worktree branch | HIGH | parked@2026-10-01T12:20Z: e69eeec2 REJECTED by opus. Blocking: dirty user edits snapshotted into the pushed branch and receipt base; ignored deps (node_modules, .venv, .env) absent in the worktree, VERIFIED fixture STALLED. Rework needs refuse-dirty in main(), start from HEAD, a dependency strategy (CoW clone or install step) and kill cleanup; CTO call | D50-F1 |
 | A-120 | One signing key, auto-generated (item 3) | see plan A-120 | HIGH | first-run-gate assertion per plan card | released@2026-10-01T00:52Z | Wave per plan section 5; one writer per file. Released in v10.5.13 (merge 1e1417b9 is an ancestor of v10.5.13). |
 | A-132 | Legacy: no HANDOFF.md, USAGE.md or lockfile in a fix commit (item 2) | see plan A-132 | MEDIUM | first-run-gate assertion per plan card | released@2026-10-01T00:52Z | Wave per plan section 5; one writer per file. Released in v10.5.13 (merge 297c2d1f is an ancestor of v10.5.13). |
 | A-133 | Legacy: skip Council evidence probes on a trivial diff (item 2) | see plan A-133 | HIGH | first-run-gate assertion per plan card | merged@2026-09-30T21:08Z | Wave per plan section 5; one writer per file. |

package/docs/v10/D51-PHASE-B.md

@@ -0,0 +1,118 @@
+# D51 Phase B: workspaces, cross-repo runs, combined integration evidence
+
+Architect design, 2026-10-01, base ee67eaf16. Design only; nothing here is built. Flag: `LOKI_WORKSPACES=1` (off by default).
+
+## Goal (user-visible)
+1. Name a group of repos once in loki.yaml (`workspaces.shop: [acme/api, acme/web]`) and run one issue across all of them: `loki workspace run shop acme/api#12`.
+2. Each repo gets its own isolated worktree with working dependencies, its own engine run, its own Seal and its own PR; the user's checkouts are never touched.
+3. One integration command runs against all the run branches together; its evidence (head SHAs, exit code, log hash) is attached to every PR and shown in the dashboard.
+
+## What exists today (evidence)
+- Two duplicate worktree paths. Headless: `autonomy/lib/backlog.py:232-241` (`worktree add -B loki/backlog-N <top>-backlog/issue-N HEAD`). UI: `dashboard/api_start.py:159-184` (clone to ~/.loki/repos/<slug>, fetch, `worktree add` off origin/HEAD under ~/.loki/worktrees). Neither copies or installs dependencies, and neither locks the shared base repo against concurrent fetch or worktree add.
+- Missing dependencies are a live problem. `loki-ts/src/engine10/stages/verify.ts:39` resolves `.venv/bin/<bin>` inside repoDir, and `testmap.ts:45` does the same for the interpreter. A fresh worktree has no node_modules or .venv, and the D50-F1b opus review hit exactly this: its VERIFIED fixture stalled (BOARD.md row D50-F1b).
+- Relaunch destroys evidence. `backlog.py:234-235` force-removes an existing issue worktree before relaunching, which is the open D51-A3b follow-up.
+- The engine is single-repo and runs in its cwd. Intake refuses a dirty tracked tree (`intake.ts:65-67`); text tasks enter through `LOKI_E10_TASK_TEXT` (`intake.ts:74`), but only when no issue.json exists (`intake.ts:80`). The backstop stages with `git add -A` (`supervisor.ts:95`), so anything in the worktree that is not ignored gets committed.
+- Run state in the UI is in memory only (`api_start.py:13`). `knowledge_sources` is parsed but nothing reads it (schema description). `loki.yaml` sets `additionalProperties: false` (`schemas/loki-yaml.schema.json:7`).
+- D33 amendment (1): e10ext never runs tests or computes pass or fail. Integration checks therefore cannot live in loki-ts; they belong in autonomy/lib (Python), outside the Seal.
+- Precedent for partial failure: `tests/test-multi-repo-orchestrates.sh` uses continue-and-report with a non-zero aggregate exit.
+
+## Design
+Principle: engine10 core is untouched. A workspace run calls the existing launcher once per repo, in a prepared worktree, exactly the way backlog.py does today. Phase B therefore adds no TypeScript, has no dist overlap and puts nothing new into the 5,000-line cap.
+
+Config (loki.yaml, the only place workspaces are defined; everything else keeps working without a config file):
+```
+workspaces:
+  shop:
+    repos:
+      - {repo: acme/api, path: ~/src/api, setup: "npm ci"}   # path optional, else clone; setup optional
+      - {repo: acme/web, after: [acme/api]}                   # after: runs once api finishes
+    integration: {command: "docker compose up --abort-on-container-exit", timeout_s: 900}
+    integration_files: [.env]   # opt-in, integration step only, never the engine worktree
+```
+The schema accepts the `workspaces` key unconditionally, so a config written for a newer version does not fail validation on an older one; the flag gates only runtime behavior.
+
+Worktree substrate (`autonomy/lib/worktree_prep.py`, one helper used by backlog, the UI and workspaces):
+- Start point: fetch, then `origin/HEAD`, falling back to HEAD. Uncommitted user edits are never carried, never stashed and never snapshotted. The base SHA is recorded, and one line reports how many uncommitted changes in the source checkout were left out.
+- Concurrency: an fcntl lock per base repo (`~/.loki/repos/<slug>.lock`) held around fetch and worktree add.
+- Dependencies, in priority order:
+  1. A declared `setup` command, run in the worktree.
+  2. A copy-on-write copy (`cp -c` on APFS, `cp --reflink=auto` on Linux) of ignored top-level dependency directories: node_modules, .venv, venv, vendor.
+  3. None, recorded as `deps: none`.
+- Before a copied directory is accepted, it must pass two checks, or the copy is refused and the run ends FAILED with "deps: copy unsafe, declare setup":
+  - `git check-ignore` at the start ref, so `add -A` can never commit it;
+  - no escape into the source checkout: no absolute symlink, no editable `.pth` or `__editable__` finder, and no shebang pointing at the source path.
+- Never symlink dependencies.
+- Secrets: .env and similar files are never placed in an engine worktree, because issue text is untrusted and moat 9 forbids secrets in that step.
+- A relaunch never deletes a kept worktree. It creates a new stamped one, and old ones are removed only by `clean`.
+
+Group state lives on disk with one writer: `~/.loki/workspaces/<ws>/<group-id>/group.json`, written atomically by the runner process only. It holds:
+- the workspace and the issue ref;
+- per repo: base SHA, branch, worktree, run_id, outcome, pr_url, deps mode, and started and ended timestamps;
+- integration: status, evidence path.
+
+The CLI and the dashboard both read this file, so state survives a dashboard restart. The timestamps feed the D51 item 3 PRs-per-hour metric.
+
+Cross-repo run (`autonomy/lib/workspace.py`):
+- The issue is fetched once.
+- Per-repo task text goes to each run through `LOKI_E10_TASK_TEXT` (no issue.json is written into those runs). By default it is the issue's `## repo: owner/name` section when present, otherwise the full issue. The text also carries a fixed preamble naming the sibling worktree paths as read-only context.
+- Repos with no `after` run in parallel up to `concurrency`. A repo with `after` starts when its predecessors finish, with their worktrees at their final state.
+- A repo that needs nothing ends ALREADY_SATISFIED with no PR, which is existing engine behavior.
+
+Integration (`autonomy/lib/workspace_integration.py`):
+- Runs after every repo run has finished, in `<group>/integration/`: worktrees of each repo at its run branch head, or at base if there was no change, plus deps through the same substrate, plus the opt-in integration_files.
+- The command runs with a timeout and a killpg on timeout.
+- It writes evidence.json: command, exit code, duration, the sha256 of the log, per-repo head SHAs, and the literal statement `"seal": false, "note": "integration evidence is not part of the Seal"`.
+- One PR comment per PR links the group and states the result. If any head SHA no longer matches the PR head, the dashboard shows the evidence as stale.
+
+Surface:
+- CLI: `loki workspace list | show <ws> | run <ws> <ref> [--repos a,b] [--dry-run] | status [<group>] | clean <group>`.
+- Dashboard: endpoints `GET /api/workspaces`, `POST /api/workspaces/{ws}/run`, `GET /api/workspaces/groups/{id}`, and a group card in start.html (per-repo row with outcome and PR link, plus an integration row).
+- Exit codes: 0 when all repos are ok and integration passed; 3 for budget stops only; 1 otherwise. This is continue-and-report.
+
+Failure modes:
+- Clone or fetch fails: that repo is FAILED, and the others continue.
+- Lock contention: wait with a bound of 120s, then FAILED.
+- Setup fails: FAILED with the last stderr line.
+- Unsafe copy: FAILED, with the reason given.
+- A predecessor fails: dependents become SKIPPED (predecessor failed) and are not run.
+- SIGTERM: killpg every child, mark the group interrupted, and keep the worktrees.
+- Integration timeout: FAILED (timeout), never passed.
+- Integration not configured: status `not_configured`, which never reads as passed.
+- Dashboard restarts mid-group: the runner is a detached process; the UI re-reads group.json.
+
+## Slices (all behind LOKI_WORKSPACES; test parts register through one runner entry owned by B01)
+| ID | Goal | File set | Wall check | Tier |
+|---|---|---|---|---|
+| B01 | Test harness: register `tests/test-workspace.sh`, which sources `tests/workspace/*.sh` parts (each later slice adds only its own part) | tests/test-workspace.sh, tests/run-all-tests.sh, scripts/local-ci.sh, tests/workspace/00-smoke.sh | runner lists the suite; an empty part dir passes 1/0; shellcheck clean | LOW |
+| B02 | Schema plus validator for `workspaces` (repos, path, setup, after, integration, integration_files); `after` cycle and unknown-repo rejection | schemas/loki-yaml.schema.json, autonomy/lib/loki_yaml.py, tests/workspace/10-schema.sh | a valid sample passes; a cycle, an unknown `after` and a non-ignored integration file are each rejected with a named error | MEDIUM |
+| B03 | worktree_prep core: start ref, per-base lock, left-out-edits line, stamped dirs, never delete a kept tree | autonomy/lib/worktree_prep.py, tests/workspace/20-prep.sh | a dirty source fixture yields a worktree tree equal to base; 4 parallel preps on one base all succeed; a relaunch keeps the old dir | HIGH |
+| B04 | Dependency strategy: setup, CoW copy, ignore check, escape detection | autonomy/lib/worktree_deps.py, tests/workspace/30-deps.sh | editable-install venv fixture: copy refused, setup path imports worktree code; absolute-symlink node_modules refused; a non-ignored dir is never copied | HIGH |
+| B05 | Adopt worktree_prep in backlog.py behind the flag (also closes A3b relaunch) | autonomy/lib/backlog.py, tests/test-backlog.sh | flag off: backlog 47/0 unchanged; flag on: a JS fixture issue reaches VERIFIED with node_modules present | MEDIUM |
+| B06 | Adopt worktree_prep in api_start._prepare_workdir behind the flag | dashboard/api_start.py, tests/dashboard/test_api_start_prep.py | flag on: the UI path uses the same lock and deps; flag off: byte-identical behavior | MEDIUM |
+| B07 | group.json store: atomic write, single writer, reader API | autonomy/lib/workspace_state.py, tests/workspace/40-state.sh | a killed writer never leaves a partial file; a second writer pid is refused | MEDIUM |
+| B08 | Runner: fan-out per repo, `after` ordering, SKIPPED on predecessor failure, killpg on SIGTERM, exit codes | autonomy/lib/workspace.py, tests/workspace/50-run.sh | stub launcher: parallel repos overlap, the dependent starts after the predecessor, a failing predecessor marks the dependent SKIPPED, SIGTERM leaves no child alive | HIGH |
+| B09 | Per-repo task text: section split, preamble, `LOKI_E10_TASK_TEXT` only (no issue.json in the run) | autonomy/lib/workspace_task.py, tests/workspace/60-task.sh | a 2-section issue gives each repo only its section; no issue.json exists in either run dir; untrusted text is never placed in argv | HIGH |
+| B10 | Integration runner plus evidence.json (not a Seal) | autonomy/lib/workspace_integration.py, tests/workspace/70-integration.sh | a passing compose stub gives exit 0 and matching SHAs; a timeout is FAILED, never passed; integration_files absent from every engine worktree | HIGH |
+| B11 | PR comment with the integration result, via the existing gh token path (no LLM in the step) | autonomy/lib/workspace_comment.py, tests/workspace/80-comment.sh | stub gh receives one comment per PR; the token appears in no log or argv | MEDIUM |
+| B12 | CLI `loki workspace` subcommand (list, show, run, status, clean) | autonomy/loki, tests/workspace/90-cli.sh | flag off: the command says it is disabled; `clean` never removes a worktree whose branch has an open PR | MEDIUM |
+| B13 | Dashboard endpoints reading group.json; run launches a detached runner | dashboard/api_workspaces.py, dashboard/server.py, tests/dashboard/test_api_workspaces.py | the group survives an app restart; non-loopback Host gets 403; control scope required for run | HIGH |
+| B14 | Dashboard group card (per-repo rows, integration row, stale-evidence badge) | dashboard/static/start.html | Playwright: a fixture group renders 2 repo rows plus integration; a mismatched head SHA shows stale | LOW |
+| B15 | 10x metric: PRs per wall-clock hour and per attention minute from group.json timestamps | autonomy/lib/workspace_metrics.py, tests/workspace/95-metrics.sh | a fixture group gives the hand-computed rate; unmeasured runs are reported, not counted as zero | LOW |
+| B16 | Docs plus flag flip after the whole-feature Wall: a 2-repo fixture (lib and app) ends with 2 PRs and integration passed | docs/WORKSPACES.md, tests/workspace/99-e2e.sh | the e2e part passes on CI with the stub provider; one real run is recorded in METRICS.md | MEDIUM |
+
+Dependencies:
+- B01 comes before every slice that adds a test part.
+- Parallel chains:
+  - B02 and B03, then B04, then B05 and B06.
+  - B07, then B08 (which also needs B03 and B04), then B09 and B10, then B11.
+- B12 needs B08. B13 needs B07 and B08, then B14. B15 needs B07.
+- B16 needs everything.
+- File sets do not overlap. `autonomy/loki` belongs to B12 only, `api_start.py` to B06 only, `start.html` to B14 only, and the runner files to B01 only.
+
+## Open questions (CTO or founder)
+1. CTO: should integration evidence ever join the Seal or be signed with the Seal key? The default here is no: it is labelled as not part of the Seal.
+2. Founder: may opt-in integration_files such as .env be carried even into the model-free integration step, or is the declared `setup` the only path? The engine worktree is a hard no either way (moat 9).
+3. CTO: where does per-repo task text come from? Options: the issue's `## repo:` sections (the default here), user edits in the UI, or a planner model call. A full multi-repo requirement in every repo makes the Wall write checks that no single repo can pass.
+4. CTO: can a provider CLI session read sibling worktrees outside its cwd? If sandboxing blocks it, `after` ordering only orders work and gives no context, and `knowledge_sources` (no consumer today) should become that channel.
+5. CTO: what size ceiling applies to a non-CoW full copy on Linux without reflink? The proposal is to refuse above 2 GB and require `setup`.
+6. Founder: should a failed integration convert the group's PRs to draft? Doing so needs a credentialed write outside engine10-push.sh, which bears on the Rule of Two.

package/docs/v10/DECISIONS.md

@@ -419,3 +419,10 @@ Loki's definition: "autonomous software factory that runs with the knowledge of
 ## D52 (founder, relayed 03:25Z) and overnight mandate (03:40Z): least tokens, fastest release
 1. Target about 10x less plan usage per merged slice and per release, measured from `claude -p "/usage"`. Haiku for mechanical work, sonnet to build, opus only for moat or latest-moving reviews; `model:` set explicitly on every agent; small briefs with file paths; read line ranges, not whole files; agent returns of 10 lines or fewer; fresh agent per slice; the lead session hands off at about 120k context.
 2. Overnight until about 11:00Z: sprint to 04:35Z, then pace (D39 amendment). Priority: release flow, D48 rows plus the 04:35Z report, D51 Phase A ready to test (LOKI MORNING TEST in PROGRESS), D50 lift baseline then harness slices, docs, then D51 Phase B/C as budget allows. docs/v10/MORNING-BRIEF.md (60 lines or fewer) at 10:30Z, honest about what is not done.
+
+## D53 (founder delegation "do what's best, don't ask me anything", ruled by autonomi-dev-dc, relayed 12:39Z; reversible): spec-required test updates
+1. An existing assertion may be changed, and the run may be VERIFIED, only when all of these hold, each checked deterministically (never by model judgement): (a) the new expected value appears verbatim as a string or number literal in the task, issue or spec text; (b) the edit changes only that literal in an existing assertion, with no assertion removed, no skip, xfail or .only added, no tolerance or comparator loosened and no other line changed (the D50-F2r classifier decides; any doubt means weakened); (c) the Wall checks, written without the implementation, and the project's other tests pass.
+2. When all three hold, the receipt discloses "spec-required test update: file:line old -> new (source: issue text)". When any one fails, the verdict is PARTIAL with the weakened-test flag, as before.
+3. Scoring: PARTIAL never counts as completed in the harness or eval scoring. Lift comes from honest VERIFIED outcomes only.
+4. The append-only test rule (loki-ts/src/e10ext/context.ts:23) is relaxed only for case 1, using the same check; everything else stays append-only. It ships with red tests for: a loosened tolerance, if True changed to if False, a deleted assertion, and a literal not present in the issue.
+5. Rationale: no model opinion produces a pass, and the checks really ran, so the moat holds. It matches what users expect when an issue says "should return X instead of Y". Raw agents edit tests freely; Loki allows only the edit the spec literally demands. Implementation is HIGH tier (opus review), built after D50-F2r merges (D50-F2-S3).

package/docs/v10/PROGRESS.md

@@ -1846,3 +1846,16 @@ The swarm is stopped: .loki/V10-STOP exists, the loop has no wake-ups, and the c
 - v10.5.28 76af09dc (A-104b Seal fail-closed): latest via both gate legs at 10:17Z (promote 36848247075). v10.5.29 ee3e4c1f (A-104c no backstop commit or PR after a failed commit stage): npm gitHead ee3e4c1fd606 matches; promote 36850763292 at 10:42Z success; latest=next=10.5.29.
 - D50-F1 (restore to base on ALREADY_SATISFIED) REJECTED by opus: intake ignores untracked files (intake.ts:31 --untracked-files=no), the commit stage stages them, and the discard git rm -f deletes them (repro: untracked notes.md removed, including with intake.already_satisfied and no agent session). Also a pre-existing dirty lockfile edited by the run is restored to base, losing the user's edits. Other checks held (base..HEAD empty after an implement commit, only ALREADY_SATISFIED discards, .loki/ kept). r2 records untracked paths at intake and restores pre-existing files to their intake content.
 - D50-F2: S1 classifier built (71997e6c, 10/10, mutation red); S2 verify and seal wiring building.
+
+## 2026-10-01T12:10Z v10.5.30 cut (D50-F1 r5 + D48 row 5 schemas); D50-F1b in HIGH review
+- train/56 f391ba33 (D50-F1 r5, D48-r5 schemas, E-170 docs): Tests, Bun Parity, Coverage, Security Audit, Tier A, First-run gate all success at 11:54Z; main fast-forwarded. Release commit 18827347 (v10.5.30, full CHANGELOG, maps sources bad=0, dist guard 13/0, check-clean 0); Release run in progress at 12:02Z.
+- D50-F1 r5 approved by opus (6 symlinked-parent attacks, outside files byte-identical; old raw write reinstated turns both tests red). CTO call: B (run in a worktree) as the structural fix, row D50-F1b.
+- D50-F1b e69eeec2 built: engine10 runs in a git worktree, discard.ts deleted; engine10 941 pass 0 fail after bun install (the builder's 1 fail was a missing tsc), the five branch and legacy shell suites rc 0. Open question for the opus review: uncommitted user edits are snapshotted into the run branch and so could reach a PR (old behaviour refused a dirty checkout). Dist maps need a main rebuild on merge.
+- No new seats: unblocked ready rows are HIGH, CTO or large eval; weekly projection 114%.
+
+## 2026-10-01T12:55Z v10.5.30 latest, v10.5.31 in Release; D50 lift row and rulings
+- v10.5.30: the first Release run failed only on the moat flake P6.untracked-not-swept (legacy receipt files_changed), which passed 3 of 3 locally at 18827347 and on a CI rerun; a full Release rerun published it (npm gitHead 18827347), and it auto-promoted to latest. v10.5.31 (1e8ba278, P0-backstop-refused) pushed; its Release run is in progress.
+- D50-F1b REJECTED by opus: dirty edits pushed, ignored deps missing in the worktree. D50-F1 re-decided: r5 in place stays. D50-F1c (signal path) merged, train/58.
+- D50-F2 S1+S2 REJECTED by opus (a dishonest per-spec label, no lift). D53 ruled (relayed, reversible): a spec-required test update may be VERIFIED under three deterministic conditions; PARTIAL never scores completed. D50-F2r built (6368111d, 979/0, probes red on S2), in opus review. S3 waits on it.
+- D50 lift row (INTERNAL, sonnet, e9d8042c): aiq-52 v10 0/3 again (baseline v10 0/3, raw 2/3). F1 worked (no_source_diff true in all 3 reps), but every rep ended FAILED ("no tests to run" once, "limit" twice) and opened a PR. A new root cause is in diagnosis. The eval harness crashes on a missing eval/loki10/archive in a fresh worktree (EVAL-archive slice, haiku).
+- D51 Phase B design merged (docs/v10/D51-PHASE-B.md, 16 slices behind LOKI_WORKSPACES); B01 merged. INTEL-1 to 3 queued behind D50.