loki-mode 10.5.6 → 10.5.8

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: Autonomous spec-driven build system with a built-in trust layer. It does not call work done until it is verified (RARV-C closure loop, 8 quality gates, completion council, verified-completion evidence gate). Triggers on "Loki Mode". Takes a spec (PRD, GitHub issue, OpenAPI doc, etc.) to deployed product with minimal human intervention. Provider-agnostic. Requires --dangerously-skip-permissions flag.
 ---
 
-# Loki Mode v10.5.6
+# Loki Mode v10.5.8
 
 **You are an autonomous agent. You make decisions. You do not ask questions. You do not stop.**
 
@@ -470,4 +470,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v10.5.6 | [Autonomi](https://www.autonomi.dev/) flagship product | ~410 lines core**
+**v10.5.8 | [Autonomi](https://www.autonomi.dev/) flagship product | ~410 lines core**

package/VERSION

@@ -1 +1 @@
-10.5.6
+10.5.8

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "10.5.6"
+__version__ = "10.5.8"
 
 # Expose the control app for easy import
 try:

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 The flagship product of [Autonomi](https://www.autonomi.dev/). Loki Mode is a spec-driven autonomous builder with a built-in trust layer that takes any spec to a deployed product and verifies completion with evidence (quality gates plus a completion council), not just a "done" claim. Complete installation instructions for all platforms and use cases.
 
-**Version:** v10.5.6
+**Version:** v10.5.8
 
 ---
 

package/docs/v10/BOARD.md

@@ -410,7 +410,7 @@ set is declared to avoid overlap with those and with each other.
 | E-84 | Pulse TRAIN_LATE reads the last train push from the reflog of refs/remotes/origin/main (moves on every push and on fetches of others' pushes), then push-*.log, then UNKNOWN | scripts/v10-pulse.sh (last_train_push_epoch only), tests/test-v10-pulse.sh | MEDIUM | bash tests/test-v10-pulse.sh; fixture: temp repo plus bare remote, a real `git push` makes the check read under 1 min with no push-*.log present; no reflog and no logs reads UNKNOWN | released@2026-09-28T16:03Z | Source: founder 15:09Z; TRAIN_LATE read 681.9 min while trains were pushed at 14:42Z and later, because plain `git push` writes no push-*.log. TL APPROVE (sonnet) on eeace3f6: `bash tests/test-v10-pulse.sh` 109 passed 0 failed; against the old pulse 106 passed 3 failed; live pulse after merge reads "Minutes since last train push: 12.1". Released in v10.2.1 (npm publish 2026-09-28T16:03Z; every cited commit is an ancestor of the v10.2.1 tag; `git merge-base --is-ancestor`). |
 | E-85 | Security Audit: a narrowly scoped gitleaks allow rule for 40-hex commit pins in eval task.json (repo.ref, merge_sha) so pinned upstream SHAs stop tripping sourcegraph-access-token; CTO approval required (posture: no blanket suppressions) | .gitleaks.toml (or the workflow config), .github/workflows/security-audit.yml | HIGH | a fixture task.json with a 40-hex ref passes; the same string in any other file or key still fails | parked@2026-09-28T21:14Z | Source: v10.2.0 Release 36440534050 blocked by a pinned werkzeug SHA; EV-11b and EV-12A/B/C add more pins. Wave E27 (wf_bcacb1d1-e76). CTO-level opus review. Wave E27 stopped 18:37Z (founder: over budget, load 50). Build 1 commit on slice-E-85-gitleaks-pins, never reviewed. Parked 21:14Z: a regex allow rule for commit-pin shapes conflicts with the exact-fingerprint-only allowlist policy (security rule: no path or rule suppression). Pins are allowlisted per fingerprint with a reason, as done for werkzeug (82e39c29) and E-101 (6358e0a6). |
 | DEP-01 | Dependency inventory (D35): docs/v10/DEPS.md lists every manifest (all package.json incl. @anthropic-ai/sdk and claude-agent-sdk; every requirements*.txt and pyproject.toml; every uses: in .github/workflows and .github/actions; Node, Python, Bun matrices; Docker bases, Helm images, Terraform providers, Homebrew formula) with current and latest stable, patch/minor/MAJOR, and runtime EOL; no upgrades | docs/v10/DEPS.md, scripts/dep-inventory.py | LOW | python3 scripts/dep-inventory.py regenerates DEPS.md byte-identically on a second run (network results cached); every manifest found by `git ls-files` appears | released@2026-09-28T17:16Z | Source: founder directive 15:20Z (D35). DEP workstream: max 3 builders, never ahead of E/EV/M. Round 3 2794574b TL APPROVE (sonnet) after two REJECT rounds (bump column mismatch, Node 20 claim, 0.x class, Helm drift; then a missing helm/loki-mode chart and unverified floating tags); `bash tests/test-dep-inventory.sh` 5/5, `--self-test` 23/23. Released in v10.2.2 (npm gitHead 9a59750d). |
-| E-87 | Release dispatch path: required-ci also accepts a completed workflow_dispatch Security Audit run at the exact SHA (Tests and Bun Parity stay push-only), so a tree whose VERSION is already bumped can publish after an audit fix | .github/workflows/release.yml (required-ci only), a test that runs the extracted step against a fixture run list | HIGH | fixture: dispatched audit success at the SHA counts; a dispatched audit at another SHA does not; Tests via dispatch still does not | ready@2026-09-28T18:42Z | Source: v10.2.0 Release 36443541666 waited on an audit it could never count. CTO approval required (release gate). Wave E27 (wf_bcacb1d1-e76). CTO-level opus review. Wave E27 stopped 18:37Z (founder: over budget, load 50). REJECT (reproduced): tests pass with the completed-and-success condition removed from the dispatched-audit check. Branch kept. |
+| E-87 | Release dispatch path: required-ci also accepts a completed workflow_dispatch Security Audit run at the exact SHA (Tests and Bun Parity stay push-only), so a tree whose VERSION is already bumped can publish after an audit fix | .github/workflows/release.yml (required-ci only), a test that runs the extracted step against a fixture run list | HIGH | fixture: dispatched audit success at the SHA counts; a dispatched audit at another SHA does not; Tests via dispatch still does not | merged@2026-09-30T18:27Z | Source: v10.2.0 Release 36443541666 waited on an audit it could never count. CTO approval required (release gate). Wave E27 (wf_bcacb1d1-e76). CTO-level opus review. Wave E27 stopped 18:37Z (founder: over budget, load 50). REJECT (reproduced): tests pass with the completed-and-success condition removed from the dispatched-audit check. Branch kept. |
 | E-88 | Release notes fully written (D36): scripts/release-notes.sh extracts the CHANGELOG section literally (dated headings), fails on a missing, empty, heading-only or placeholder section; release.yml fails instead of falling back and checks the published body; pre-push refuses a VERSION bump without a full section | scripts/release-notes.sh, .github/workflows/release.yml (extract step), .githooks/pre-push, docs/dev/release-checklist.md, tests/test-release-notes.sh | HIGH | bash tests/test-release-notes.sh; failing first against the old awk pattern | released@2026-09-28T21:01Z | Source: founder directive 16:05Z; six releases published with "Release vX.Y.Z" bodies (backfilled). Founder 17:22Z: stopped at 70 min and re-sliced as E-88a (auto-carry removed, explicit --include only). Wave E27 (wf_bcacb1d1-e76). Wave E27 stopped 18:37Z (founder: over budget, load 50). E-88a opus APPROVE (branch slice-E-88a); merge conflicts with E-86 in .githooks/pre-push; rebase after E-99 lands (same file). E-88a rebased onto E-99 as slice-E-88a-r2 62774912; opus APPROVE (pre-push diff purely additive, E-99 gitleaks steps byte-identical, stdin read once, gate main-only and fail-closed, release.yml exits 1 instead of a placeholder); merged 60ce7620; release-notes 41/0, pre-push-hook 13/0, pre-push-gitleaks 43/0. Non-blocking: gate runs the working tree release-notes.sh; _cl_tmp not in the EXIT trap. Released in v10.5.0 (merge 60ce7620 is an ancestor of v10.5.0). |
 | E-89 | Pulse RELEASE_CADENCE (D37): violation when more than 25 minutes pass with main green (Tests and Bun Parity success at HEAD) and at least one merged-unreleased slice commit (not an ancestor of the latest published tag, docs-only commits excluded) | scripts/v10-pulse.sh (one check), tests/test-v10-pulse.sh | MEDIUM | bash tests/test-v10-pulse.sh; fixtures: green plus unreleased slice commit 26 min old fires; red main does not; docs-only commits do not; 24 min does not | released@2026-09-28T22:02Z | Source: founder directive 16:20Z. Founder 17:22Z: stopped at 58 min; salvaged commit cce8f48a re-sliced as its own slice plus UNDERSTAFFED. Wave E27 (wf_bcacb1d1-e76). Wave E27 stopped 18:37Z (founder: over budget, load 50). TL APPROVE (sonnet) on the salvaged cce8f48a plus UNDERSTAFFED; merged locally; `bash tests/test-v10-pulse.sh` 129 passed 0 failed. Released in v10.5.2 (merge bd7d75f7 is an ancestor of v10.5.2). |
 | E-90 | Release Manager marks BOARD rows released after publish: scripts/board-mark-released.sh <tag> flips every merged row whose merge commit is an ancestor of <tag> to released@ with the tag and the ancestry evidence; pulse MERGED_NOT_RELEASED_STALE when a merged row is already in a published tag | scripts/board-mark-released.sh, scripts/v10-pulse.sh (one check), tests/test-board-mark-released.sh | MEDIUM | bash tests/test-board-mark-released.sh; a merged row in the tag flips, one not in it stays; BOARD line count unchanged | released@2026-09-28T22:02Z | Source: 16:20Z the BOARD showed 20 merged slices that had all shipped in v10.1.0 to v10.2.1, which read as a 20-slice release backlog. Founder 17:22Z: stopped; salvaged commit 1d9dfae7 re-sliced after E-89. Wave E27 (wf_bcacb1d1-e76). Wave E27 stopped 18:37Z (founder: over budget, load 50). Build on slice-E-90-r2 (5 commits) never reviewed; re-review as its own slice. Dispatched 21:14Z sonnet (fresh; the E27 branch was never reviewed). Tech Lead APPROVE bd7d75f7 (anchored slice grep, ancestry-only flips, atomic write); merged 7b1f7e3d; run for v10.5.0 flipped 42 rows (c62f3cb0). Released in v10.5.2 (merge 7b1f7e3d is an ancestor of v10.5.2). |
@@ -420,7 +420,7 @@ set is declared to avoid overlap with those and with each other.
 | E-91 | Pulse UNEVIDENCED_CLAIM and every row parser accept any slice id prefix ([A-Z]+-\d+, e.g. DEP-02, GF-1, PF-3), not a hardcoded S/E/EV/M list | scripts/v10-pulse.sh (row-id regexes only), tests/test-v10-pulse.sh | LOW | bash tests/test-v10-pulse.sh; a DEP row with "green" only in its Wall cell is not flagged, its notes cell still is | released@2026-09-28T21:01Z | Source: pulse flagged DEP-03/DEP-04 Wall cells (df7dc134), the E-71 bug class again. Serialize after E-89/E-90 and E-79..81 (same file). Wave E27 (wf_bcacb1d1-e76). After E-90 (same file). Wave E27 stopped 18:37Z (founder: over budget, load 50). Not started. Tech Lead APPROVE e311b47e; merged 039f8af2; test-v10-pulse.sh 131/0. Revealed DEP-02..04 stale building rows (parked). Released in v10.5.0 (merge 039f8af2 is an ancestor of v10.5.0). |
 | E-92 | P0 fix-forward: dep-inventory --self-test reached the real gh floating-tag resolver (actions/setup-node@v4), so CI without gh auth read bump unknown (Tests red since df7dc134, run 36451439320) | scripts/dep-inventory.py (self-test fixture) | HIGH | `env -u GH_TOKEN -u GITHUB_TOKEN PATH=/usr/bin:/bin python3 scripts/dep-inventory.py --self-test` rc=0; rc=1 on the previous version | released@2026-09-28T17:16Z | TL APPROVE (sonnet) on 81cdba4d: stripped-env self-test 23/23 rc=0, origin/main rc=1, fixture mutation goes red, no second network path in self_test(); merged 4f7f1487. Guard: E-93. Released in v10.2.2 (npm gitHead 9a59750d, Release run 36455687013). |
 | E-93 | Guard (D37 same-class-never-twice): tests/test-dep-inventory.sh runs --self-test under a stripped environment (no GH_TOKEN/GITHUB_TOKEN, PATH=/usr/bin:/bin, empty HOME) so a network-dependent self-test fails locally, not only in CI; GUARDS.md entry | tests/test-dep-inventory.sh, docs/v10/GUARDS.md | LOW | a self-test that calls an unstubbed fetcher fails the leg locally | released@2026-09-28T21:01Z | Source: E-92 incident. Wave E25 (wf_46137a6b-367). TL APPROVE (sonnet); merged on main 18:00Z; `bash tests/test-dep-inventory.sh` 6 passed 0 failed. Released in v10.5.0 (merge 76086e8f is an ancestor of v10.5.0). |
-| EV-12E | Upstream-first hidden-test enforcement (D38 criteria 1, 3, 4, 7, 9): validate requires hidden.provenance, hidden.sha256 and requirements[] on lg-* tasks; measure-size excludes typing-examples/, examples/, docs/; a test-harness leg applies every tasks/lg-*/shortcuts/*.patch and asserts not completed, and RED at ref is not collection-only; run.sh rows gain hidden_subset | eval/loki10/harness.py (validate only), eval/loki10/measure-size.py, eval/loki10/test-harness.sh (new section) | HIGH | fixture with a wrong sha256 fails validate rc=1; a passing shortcut fixture fails the leg; an attrs-602-shaped fixture reads medium | ready@2026-09-28T18:42Z | Source: D38. Needs EV-12S merged first (measure-size). Wave E27 (wf_bcacb1d1-e76). Wave E27 stopped 18:37Z (founder: over budget, load 50). REJECT (reproduced): RED at ref must be by assertion (criterion 7) is untested. Branch slice-EV-12E kept (4 commits). |
+| EV-12E | Upstream-first hidden-test enforcement (D38 criteria 1, 3, 4, 7, 9): validate requires hidden.provenance, hidden.sha256 and requirements[] on lg-* tasks; measure-size excludes typing-examples/, examples/, docs/; a test-harness leg applies every tasks/lg-*/shortcuts/*.patch and asserts not completed, and RED at ref is not collection-only; run.sh rows gain hidden_subset | eval/loki10/harness.py (validate only), eval/loki10/measure-size.py, eval/loki10/test-harness.sh (new section) | HIGH | fixture with a wrong sha256 fails validate rc=1; a passing shortcut fixture fails the leg; an attrs-602-shaped fixture reads medium | building@2026-09-30T18:27Z | Source: D38. Needs EV-12S merged first (measure-size). Wave E27 (wf_bcacb1d1-e76). Wave E27 stopped 18:37Z (founder: over budget, load 50). REJECT (reproduced): RED at ref must be by assertion (criterion 7) is untested. Branch slice-EV-12E kept (4 commits). |
 | EV-12F | Retrofit lg-werkzeug-1513, 1680, 1769 and lg-httpx-1522 to D38 criteria 1-9 (requirements map, upstream-later tests first, authored public-API tests, sha256 freeze, saved shortcuts as must-fail fixtures from ~/loki-ci-logs/ev12-shortcuts/) | eval/loki10/tasks/lg-werkzeug-{1513,1680,1769}/, lg-httpx-1522/, their refdiffs | HIGH | per task: RED by assertion, GREEN at merge, every Ri-omission mutant fails, every shortcut fails, regression files pass, validate rc=0; independent opus 45-minute shortcut attempt passes nothing | ready@2026-09-28T18:00Z | Source: D38. Two engineers (task pairs). Wave E25 (wf_46137a6b-367). Two engineers (task pairs). Wave E25 opus REJECT on every retrofitted task (requirements not covering the sized refdiff, -k deselecting the only Ri test, deprecation requirements untested, shortcuts that omit stated requirements still passing). Deprioritized at 18:00Z behind EV-15 and E-98: the flip is blocked by the medium-tier result regardless of the large tier. |
 | EV-12G | Retrofit lg-httpx-1550, lg-httpx-3319, lg-attrs-660 to D38, then new upstream PRs (with later upstream tests first) until the large tier holds 10 | eval/loki10/tasks/lg-httpx-{1550,3319}/, lg-attrs-660/, new lg-* dirs, their refdiffs | HIGH | as EV-12F; at least 5 passing on main before the EV-14 large runs | ready@2026-09-28T18:00Z | Source: D38. Wave E25 (wf_46137a6b-367). Wave E25 opus REJECT on every retrofitted task (requirements not covering the sized refdiff, -k deselecting the only Ri test, deprecation requirements untested, shortcuts that omit stated requirements still passing). Deprioritized at 18:00Z behind EV-15 and E-98: the flip is blocked by the medium-tier result regardless of the large tier. |
 | E-94 | Guard for red main df7dc134 (a test passed locally only because gh was authenticated): local-ci fast tier re-runs every changed test file under a stripped environment (no GH_TOKEN, gh or network credentials) and fails on a difference | scripts/local-ci.sh (one check), tests/test-local-ci-hermetic.sh, docs/v10/GUARDS.md | MEDIUM | a fixture test that calls gh fails the check; the pre-E-92 dep-inventory.py is caught | released@2026-09-28T21:01Z | Source: founder 17:22Z (each red main becomes a pre-merge guard). Wave E27 (wf_bcacb1d1-e76). Wave E27 stopped 18:37Z (founder: over budget, load 50). TL APPROVE; merged locally; `bash tests/test-local-ci-hermetic.sh` 18 passed 0 failed. Released in v10.5.0 (merge 82c22684 is an ancestor of v10.5.0). |
@@ -442,7 +442,7 @@ set is declared to avoid overlap with those and with each other.
 | E-112 | v10-guard: refuse a path-wide `git checkout <ref> -- .` (or `git restore --source <ref> .`) when cwd is the main checkout, so a read-only reviewer cannot overwrite the shared tree; allowed inside .claude/worktrees/* | scripts/v10-guard.sh, tests/test-v10-guard.sh | LOW | fixture: the command in the main checkout is blocked, the same in a worktree is allowed, a single-file checkout is allowed (red first) | released@2026-09-28T21:01Z | Source: E-98e Tech Lead review 20:19Z ran `git checkout slice-E-98e -- .` then `git checkout main -- .` in the main checkout (tree restored clean, but it could have clobbered concurrent merges). Built f4515ec9 (6 new block cases red on the old guard); Tech Lead APPROVE (7 allow probes incl. single-file checkout, branch switch, heredoc text all exit 0); merged; test-v10-guard.sh 170/0. Released in v10.5.0 (merge 06c01b6c is an ancestor of v10.5.0). |
 | E-113 | P0 (main red at a4623675): tests/test-release-notes.sh T9l/T9n/--include fixtures build padding with yes piped to head under pipefail; on the Linux runner only the 34-byte header was written. Generate padding without a pipe | tests/test-release-notes.sh | LOW | passes locally and under the CI condition (SIGPIPE ignored); old version shown red there | released@2026-09-28T21:01Z | Source: Tests run on a4623675 shard 4/8: "[FAIL] T9n fixture is not in the intended size band ... 34 bytes". Passes 41/0 on macOS. Dispatched 20:39Z. Built 74ffd928 (pipe-free printf loops; macOS could not reproduce the Linux drop even under trap PIPE, so CI is the proof). Tech Lead APPROVE (bytes identical: T9l 132034, T9n 98034, T9o 224089). Merged; 41/0 locally. Released in v10.5.0 (merge f6c3add4 is an ancestor of v10.5.0). |
 | E-114 | CI Security Audit gitleaks must not trust a pushed .gitleaks.toml or new .gitleaksignore entries: scan with the default rules plus the config from the previous release tag (or refuse the job when the pushed range changes .gitleaks.toml), and report any .gitleaksignore line added in the range for review | .github/workflows/security-audit.yml, tests/test-security-audit-config.sh | HIGH | a workflow-level test (act or a script that runs the same step) shows a range that adds a zero-rule .gitleaks.toml plus a secret fails the job (red first) | released@2026-09-28T22:26Z | Source: E-110 opus review 21:09Z: the gitleaks step (security-audit.yml:276) loads the checkout own .gitleaks.toml, so the same zero-rule config trick that bypassed the pre-push scan works against CI (no --config at security-audit.yml:276). CTO-level change to a release gate. Dispatched 21:11Z sonnet; opus review before merge. opus REJECT r1 (event.before chain from an ungated push, repro "no leaks found"), REJECT r2 (no-tag fallback to origin/main~1 fails open), APPROVE r3 b30c2870 (base = last release tag; no tag: default rules and any tip .gitleaks.toml refused); also fixed the scan-coverage baseline shape broken by 6358e0a6. Merged; audit-config 15/0, scan-coverage 31/0. Released in v10.5.3 (merge 8b62cd2b is an ancestor of v10.5.3). |
-| E-115 | Verify: a passing lint on a system ruff adds its own not_proven line ("lint ran on the system ruff") instead of reusing "tests ran on the system interpreter" | loki-ts/src/engine10/stages/verify.ts, loki-ts/tests/engine10/verify.test.ts | LOW | unit test: system ruff pass gives the lint line, not the tests line (red first); core stays under 5000 | ready@2026-09-28T22:01Z | Source: E-98a r2 opus review (advisory). Held 21:31Z: worktree cap (15). Held 22:01Z: touches core verify.ts while S41-16 has core at 4997/5000. |
+| E-115 | Verify: a passing lint on a system ruff adds its own not_proven line ("lint ran on the system ruff") instead of reusing "tests ran on the system interpreter" | loki-ts/src/engine10/stages/verify.ts, loki-ts/tests/engine10/verify.test.ts | LOW | unit test: system ruff pass gives the lint line, not the tests line (red first); core stays under 5000 | building@2026-09-30T18:27Z | Source: E-98a r2 opus review (advisory). Held 21:31Z: worktree cap (15). Held 22:01Z: touches core verify.ts while S41-16 has core at 4997/5000. |
 | E-116 | seal.test.ts has no SPEC_CONFLICT case: add real-seal tests (not a copy of seal.ts:110) proving SPEC_CONFLICT survives verify pass, verify fail plus fix, and never upgrades to VERIFIED | loki-ts/tests/engine10/seal.test.ts | LOW | new cases red on a mutated seal.ts that drops the spec_conflict branch | released@2026-09-28T22:02Z | Source: E-98b opus review note 4. Built fbc79ac9 (4 real-seal tests; red when seal.ts:109 removed); Tech Lead review 21:30Z. Tech Lead APPROVE fbc79ac9 (imports the real sealStage; gap test honest); merged; seal.test.ts 18/0. Released in v10.5.2 (merge f4087942 is an ancestor of v10.5.2). |
 | E-117 | Pulse DEPENDS_ON parsing: expand range shorthand ("Depends on E-98a..e", "M-20..M-23") into each id so a dependency on b..e is not silently dropped | scripts/v10-pulse.sh (dependency parse only), tests/test-v10-pulse.sh | LOW | fixture: "Depends on E-98a..c" with E-98b unmerged is blocked (red first) | released@2026-09-28T22:02Z | Source: E-91 Tech Lead review. Dispatched 21:31Z sonnet. Tech Lead REJECT 5f59bfed: numeric range uncapped (M-1..M-9999 expands to 9999 ids into the injected pulse); r2 caps at 50. r2 d99963e3 caps numeric spans at 50 (the Tech Lead blocker); merged; test-v10-pulse.sh 146/0. Released in v10.5.2 (merge ab909f95 is an ancestor of v10.5.2). |
 | E-118 | Usage governor leftovers from G-01 review: a non-numeric used_percentage or a non-dict rate_limits in a live reading must be ignored, not crash; the "uncalibrated" label must not show when calibration exists but no engineers were active | scripts/usage-governor.py, tests/test-usage-governor.sh | LOW | fixtures for each case (red first); 30/30 existing still pass | released@2026-09-28T23:18Z | Source: G-01 r2/r3 opus review non-blocking notes. Held 21:31Z: worktree cap (15). Dispatched 22:01Z. Built 7ef9183a (TypeError and AttributeError reproduced first); Tech Lead APPROVE (bad reading degrades to uncalibrated, never a healthy 0%; E-109 cache untouched); merged; 36/0. Released in v10.5.5 (merge 66ef537d is an ancestor of v10.5.5). |
@@ -452,41 +452,52 @@ set is declared to avoid overlap with those and with each other.
 | E-122 | Scorecard headline pair (loki on sonnet vs raw opus) is green on cost only at 0.5x raw or less, per D41; add the rule and a test | eval/loki10/scorecard, eval/loki10/test-scorecard.sh | LOW | fixture at 0.6x raw cost is red on the headline pair, 0.5x is green (red first) | released@2026-09-28T23:18Z | Source: S41-02 Tech Lead review note 5. Depends on S41-02. Dispatched 22:01Z. Built a4bc79b9 (0.6x headline red on the old script); Tech Lead APPROVE (label-matched pair, inclusive 0.5x, null stays red); merged; test-scorecard 27/0. Released in v10.5.5 (merge 901466ef is an ancestor of v10.5.5). |
 | E-123 | tests/test-security-scan-coverage.sh runs only in local-ci.sh, never in CI, so its .gitleaksignore baseline drifted unnoticed (6358e0a6); register it in tests/run-all-tests.sh and shard-durations so CI Tests run it | tests/run-all-tests.sh, tests/shard-durations.tsv | LOW | test-shard-coverage.sh lists it; the suite passes on main (31/0) | released@2026-09-28T23:18Z | Source: E-114 opus review item 4. Depends on E-114. Dispatched 22:01Z. Built fc3e17b1; Tech Lead APPROVE (self-contained text checks, rows match format); merged; scan-coverage 31/0, shard coverage 19/0. Released in v10.5.5 (merge a553be40 is an ancestor of v10.5.5). |
 | E-124 | verifyPreSealedWall cross-checks the carried oracle_normalizers_sha256 against the current oracle seal (today only cases and coverage hashes are checked) | loki-ts/src/engine10/modernize/presealed_wall.ts, its test | LOW | a Wall sealed against one normalizer hash fails verify after the oracle normalizers change (red first) | released@2026-09-28T23:18Z | Source: M-14 r3 opus review advisory. Dispatched 22:09Z. Released in v10.5.5 (merge 8a99554c is an ancestor of v10.5.5). |
-| E-125 | Wall red classification: real pytest prints collection-time AttributeError/NameError frames as "path.py:N: in <module>", not "File ...", so wall.ts never classifies them red (always not_run, fail-safe but the D42 red class cannot fire); parse both frame shapes and replace the B3 test fixtures with real pytest output | loki-ts/src/engine10/stages/wall.ts, loki-ts/tests/engine10/wall.test.ts | MEDIUM | a real pytest run (captured fixture) with an in-repo AttributeError classifies red; third-party frame stays not_run; core stays under 5000 | review@2026-09-30T17:08Z | Source: S41-16 r2 opus review (ran real pytest 9.0.2).  WIND-DOWN 2026-09-28: opus r1 REJECT (B1 owner of missing attribute, B2 space in frame path, B3 captured-stdout injection, B4 chained exception) fixed at 845c9231 on slice-E-125: classifies on the pytest short-summary ERROR line, requires module '<name>' has no attribute with <name> under the repo; wall.test.ts 26/0, r3-B1 to B4 red on e6d2ddec then green. Core 4,998 (cap 4,999). Full engine10 suite not re-run after r3. NEXT: run tests/engine10 plus seal and budget, then opus r2 review, then merge. |
-| E-126 | D41 item 3: repo memory, record the verified build and test command, flaky list and failure causes per repo, cold vs warm | loki-ts/src/e10ext/repomemory.ts, loki-ts/tests/e10ext/repomemory.test.ts | MEDIUM | cd loki-ts and bun test tests/e10ext/repomemory.test.ts | ready@2026-09-28T22:30Z | Source: D41 item 3, SCORECARD-PLAN section 7. Evidence: engine10/cache.ts:87 recordFlaky and :108 topFailures exist, the verified command is not captured. Data only per D42. |
-| E-127 | D41 item 5 (backlog throughput): fetch N issues for a label or milestone as pure data | loki-ts/src/e10ext/issues.ts, loki-ts/tests/e10ext/issues.test.ts | MEDIUM | cd loki-ts and bun test tests/e10ext/issues.test.ts | ready@2026-09-28T22:30Z | Source: D41 item 5. Evidence: engine10/fetch_issue.ts:35 takes one ref only. |
-| E-128 | BACKLOG 147: P7 scanner misses a useMemo factory that calls an already-registered fabricator instead of returning a literal | tests/moat/p7-no-fabricated-data.sh | HIGH | bash tests/moat/p7-no-fabricated-data.sh | building@2026-09-30T17:29Z | Source: BACKLOG 147; the file's own comment at p7-no-fabricated-data.sh:987 names the gap. Same file as E-131: one engineer takes both. |
-| E-129 | BACKLOG 117 remainder: WhatsNew.tsx hardcodes a stale CURRENT_VERSION (9.55.0) that drifts from the shipped release | web-app/src/components/WhatsNew.tsx, tests/test-whatsnew-version-sync.sh | LOW | bash tests/test-whatsnew-version-sync.sh | building@2026-09-30T17:29Z | Source: BACKLOG 117. Evidence: WhatsNew.tsx:5 against VERSION 10.5.3. |
+| E-125 | Wall red classification: real pytest prints collection-time AttributeError/NameError frames as "path.py:N: in <module>", not "File ...", so wall.ts never classifies them red (always not_run, fail-safe but the D42 red class cannot fire); parse both frame shapes and replace the B3 test fixtures with real pytest output | loki-ts/src/engine10/stages/wall.ts, loki-ts/tests/engine10/wall.test.ts | MEDIUM | a real pytest run (captured fixture) with an in-repo AttributeError classifies red; third-party frame stays not_run; core stays under 5000 | review@2026-09-30T18:27Z | Source: S41-16 r2 opus review (ran real pytest 9.0.2).  WIND-DOWN 2026-09-28: opus r1 REJECT (B1 owner of missing attribute, B2 space in frame path, B3 captured-stdout injection, B4 chained exception) fixed at 845c9231 on slice-E-125: classifies on the pytest short-summary ERROR line, requires module '<name>' has no attribute with <name> under the repo; wall.test.ts 26/0, r3-B1 to B4 red on e6d2ddec then green. Core 4,998 (cap 4,999). Full engine10 suite not re-run after r3. NEXT: run tests/engine10 plus seal and budget, then opus r2 review, then merge. |
+| E-126 | D41 item 3: repo memory, record the verified build and test command, flaky list and failure causes per repo, cold vs warm | loki-ts/src/e10ext/repomemory.ts, loki-ts/tests/e10ext/repomemory.test.ts | MEDIUM | cd loki-ts and bun test tests/e10ext/repomemory.test.ts | merged@2026-09-30T18:11Z | Source: D41 item 3, SCORECARD-PLAN section 7. Evidence: engine10/cache.ts:87 recordFlaky and :108 topFailures exist, the verified command is not captured. Data only per D42. |
+| E-127 | D41 item 5 (backlog throughput): fetch N issues for a label or milestone as pure data | loki-ts/src/e10ext/issues.ts, loki-ts/tests/e10ext/issues.test.ts | MEDIUM | cd loki-ts and bun test tests/e10ext/issues.test.ts | merged@2026-09-30T18:11Z | Source: D41 item 5. Evidence: engine10/fetch_issue.ts:35 takes one ref only. |
+| E-128 | BACKLOG 147: P7 scanner misses a useMemo factory that calls an already-registered fabricator instead of returning a literal | tests/moat/p7-no-fabricated-data.sh | HIGH | bash tests/moat/p7-no-fabricated-data.sh | merged@2026-09-30T18:11Z | Source: BACKLOG 147; the file's own comment at p7-no-fabricated-data.sh:987 names the gap. Same file as E-131: one engineer takes both. |
+| E-129 | BACKLOG 117 remainder: WhatsNew.tsx hardcodes a stale CURRENT_VERSION (9.55.0) that drifts from the shipped release | web-app/src/components/WhatsNew.tsx, tests/test-whatsnew-version-sync.sh | LOW | bash tests/test-whatsnew-version-sync.sh | merged@2026-09-30T18:01Z | Source: BACKLOG 117. Evidence: WhatsNew.tsx:5 against VERSION 10.5.3. |
 | E-130 | D41 item 4 (speed): cache dependency install by lockfile hash in the bash parallel-worktree bootstrap | autonomy/run.sh (create_worktree only), tests/test-worktree-install-cache.sh | MEDIUM | bash tests/test-worktree-install-cache.sh | merged@2026-09-30T17:28Z | Source: D41 item 4. Evidence: run.sh:6298-6304 installs unconditionally on every worktree. |
-| E-131 | BACKLOG 146: P7 sink regex misses a computed or bracket-indexed sink name, for example window[sinkName](rows) | tests/moat/p7-no-fabricated-data.sh | HIGH | bash tests/moat/p7-no-fabricated-data.sh | building@2026-09-30T17:29Z | Source: BACKLOG 146. Evidence: SETTER regex at p7-no-fabricated-data.sh:771 matches only literal names. Same engineer as E-128. |
+| E-131 | BACKLOG 146: P7 sink regex misses a computed or bracket-indexed sink name, for example window[sinkName](rows) | tests/moat/p7-no-fabricated-data.sh | HIGH | bash tests/moat/p7-no-fabricated-data.sh | merged@2026-09-30T18:11Z | Source: BACKLOG 146. Evidence: SETTER regex at p7-no-fabricated-data.sh:771 matches only literal names. Same engineer as E-128. |
 | E-132 | Wall classifier: a missing test runner (python -m pytest exits 1 with No module named pytest) reads as red, not not_run; D42 red requires the runner to start and at least one test to fail, so require a pytest summary line with failed before red | loki-ts/src/engine10/stages/wall.ts, loki-ts/tests/engine10/wall.test.ts | HIGH | cd loki-ts and bun test tests/engine10/wall.test.ts with a pytest-less python first on PATH | ready@2026-09-28T22:47Z | Source: main red on 04d3ac9c and 708c2907 (CI Bun job had no pytest); reproduced locally with a pytest-less venv, tests (3b) and (4) read fail 1. Seal still refuses later (not_run), so no false VERIFIED, but the Wall mis-seals. Coordinate with E-125 (same classifier). Core budget binds. |
 | E-133 | release.sh guard: refuse to commit dist maps that contain an absolute path (a node_modules symlink in a release worktree wrote 133 /Users paths into loki.js.map and one into cockpit.js.map at v10.5.4) | scripts/release.sh, tests/test-release-dist-guard.sh | MEDIUM | bash tests/test-release-dist-guard.sh | merged@2026-09-30T17:08Z | Source: v10.5.4 cut 2026-09-28, caught by hand before commit (paths rewritten to ../node_modules/). Guard: grep the dist maps for an absolute or home-directory path after the bump and exit nonzero. |
-| E-134 | spawn_env_fsmonitor.test.ts positive control fails on Bun 1.4.2 (Nightly red 2026-09-29 and 09-30, both OSes): Bun no longer inherits the START env for a spawn with no env option, so the bare control call stops leaking the canary and the test proves nothing there. Keep the product assertions unconditional; add a control that passes the canary explicitly so the hook is proven to record env on any Bun; report which inheritance mode the running Bun has | loki-ts/tests/runner/spawn_env_fsmonitor.test.ts | HIGH | cd loki-ts and bun test tests/runner/spawn_env_fsmonitor.test.ts on Bun 1.3.13 and on latest | review@2026-09-30T17:08Z | Source: Nightly run 36719756873 job 109901555421 (bun-v1.4.2): control record held the withheld sentinel, not the canary. Product calls still did not leak. Security guard, opus review. |
+| E-134 | spawn_env_fsmonitor.test.ts positive control fails on Bun 1.4.2 (Nightly red 2026-09-29 and 09-30, both OSes): Bun no longer inherits the START env for a spawn with no env option, so the bare control call stops leaking the canary and the test proves nothing there. Keep the product assertions unconditional; add a control that passes the canary explicitly so the hook is proven to record env on any Bun; report which inheritance mode the running Bun has | loki-ts/tests/runner/spawn_env_fsmonitor.test.ts | HIGH | cd loki-ts and bun test tests/runner/spawn_env_fsmonitor.test.ts on Bun 1.3.13 and on latest | merged@2026-09-30T18:11Z | Source: Nightly run 36719756873 job 109901555421 (bun-v1.4.2): control record held the withheld sentinel, not the canary. Product calls still did not leak. Security guard, opus review. |
 | E-135 | Post-Release Smoke PyPI install gives up after about 10.5 min (6 attempts, 30s steps) while the published version is still propagating; v10.5.5 failed this way though PyPI now has it. Add --no-cache-dir and widen the window | .github/workflows/post-release-smoke.yml | LOW | bash -n on the step script; a rerun of the smoke on the next release | merged@2026-09-30T17:08Z | Source: Post-Release Smoke run 36497082408 job 109179083720 (FATAL loki-mode-sdk==10.5.5 not installable after retries); PyPI shows 10.5.5 on 2026-09-30. Rerun of the failed jobs requested. |
-| E-136 | measure-size.py counts any touched non-test .py file, so a docstring-only or typing-only second file makes a one-file fix read as medium (click-3449 utils.py, marshmallow-2170, pluggy-442); count only files whose change alters code, not comments or docstrings | eval/loki10/measure-size.py, its test | MEDIUM | the measure-size self test plus a fixture diff with a docstring-only second file reading small | building@2026-09-30T17:29Z | Source: S41-20a opus review 2026-09-30 (criterion 7 cannot stand in for criterion 1). Use the Python ast module to compare function bodies with docstrings stripped. |
-| E-137 | S41-18 interrupt test (legA in eval/loki10/test-scorecard-run.sh) leaks an orphaned run.sh plus harness.py (tasks rt1,rt2) when the run is torn down: two groups found reparented to PID 1 after 18 and 32 min on 2026-09-30, from a removed worktree and a reviewer probe dir | eval/loki10/test-scorecard-run.sh | MEDIUM | bash eval/loki10/test-scorecard-run.sh twice, then no run.sh or harness.py with --tasks rt1,rt2 remains | ready@2026-09-30T17:45Z | Source: pulse Orphan worktree/run.sh processes 2 at 17:30Z; PIDs 56770/56781 and 96302/96310 stopped by literal PID after inspection (the python harness ignored SIGTERM). Fix: trap EXIT in the test that stops the recorded group, and assert no survivors. |
+| E-136 | measure-size.py counts any touched non-test .py file, so a docstring-only or typing-only second file makes a one-file fix read as medium (click-3449 utils.py, marshmallow-2170, pluggy-442); count only files whose change alters code, not comments or docstrings | eval/loki10/measure-size.py, its test | MEDIUM | the measure-size self test plus a fixture diff with a docstring-only second file reading small | merged@2026-09-30T18:01Z | Source: S41-20a opus review 2026-09-30 (criterion 7 cannot stand in for criterion 1). Use the Python ast module to compare function bodies with docstrings stripped. |
+| E-137 | S41-18 interrupt test (legA in eval/loki10/test-scorecard-run.sh) leaks an orphaned run.sh plus harness.py (tasks rt1,rt2) when the run is torn down: two groups found reparented to PID 1 after 18 and 32 min on 2026-09-30, from a removed worktree and a reviewer probe dir | eval/loki10/test-scorecard-run.sh | MEDIUM | bash eval/loki10/test-scorecard-run.sh twice, then no run.sh or harness.py with --tasks rt1,rt2 remains | merged@2026-09-30T18:27Z | Source: pulse Orphan worktree/run.sh processes 2 at 17:30Z; PIDs 56770/56781 and 96302/96310 stopped by literal PID after inspection (the python harness ignored SIGTERM). Fix: trap EXIT in the test that stops the recorded group, and assert no survivors. |
+| E-138 | P7 scanner misses optional-call sinks and one-hop aliasing: setRows?.([...]), window[k]?.(rows), const s = setRows; s(rows), and a memo or local that forwards a fabricator result; accept an optional ?. before the call in the three sink heads and follow one alias hop | tests/moat/p7-no-fabricated-data.sh | HIGH | bash tests/moat/p7-no-fabricated-data.sh with red and green fixtures per form | review@2026-09-30T18:27Z | Source: E-128/E-131 opus review 2026-09-30 (lines 776, 1067, 1172 use a (?=[(<]) or \s*\( lookahead); pre-existing at base, not opened by E-131. |
+| E-139 | spawn_env_fsmonitor.test.ts follow-ups from E-134 review: comments at lines 16-17 and 114 overstate Bun 1.4.2 (Bun.spawn and Bun.spawnSync with no env still inherit the START env; only node:child_process inherits current), name spawn_env_guard.test.ts as the guard for them; line 94 driver should run process.execPath, not the bun on PATH | loki-ts/tests/runner/spawn_env_fsmonitor.test.ts | LOW | cd loki-ts and bun test tests/runner/spawn_env_fsmonitor.test.ts | ready@2026-09-30T18:08Z | Source: E-134 opus review 2026-09-30 (probe: Bun.spawn on 1.4.2 printed START env). |
+| E-140 | Something deletes run-owned loki-run.* directories under TMPDIR while another agent is using them (an opus reviewer's dir and its Bun 1.4.2 binary vanished mid-review on 2026-09-30; unfamiliar dirs with e10ext subdirs appeared inside). Find the sweeper (a test cleanup, a trap, or a script removing loki-run.* by pattern) and make it remove only its own validated dir | the offending script or test (to locate), plus a guard test | HIGH | a guard that plants two run-owned dirs and runs the suspected cleanup, asserting the foreign one survives | merged@2026-09-30T18:27Z | Source: E-134 opus review cleanup note 2026-09-30. CLAUDE.md forbids sweeping TMPDIR by pattern. |
+| E-141 | treeswap passes an explicit env to its git spawns (spawn_env_guard, BACKLOG 149) | loki-ts/src/e10ext/treeswap.ts and its test | MEDIUM | bun test tests/e10ext | merged@2026-09-30T18:27Z | Merged c2305c99 via 0bf98fd0. S41-13 binding note records the scrubbed-env requirement. |
+| E-142 | D44-C follow-ups: structural-checks changed_chars diffs against the merge-base (committed dashes/emoji caught), typecheck prints SKIP without node_modules, register test-v10-ops.sh and fix the IGNORE comment (slow, not hanging) | scripts/structural-checks.sh, tests/test-structural-checks.sh, tests/test-registration-coverage.sh, tests/run-all-tests.sh, tests/shard-durations.tsv | LOW | bash tests/test-structural-checks.sh; each check under 10s | building@2026-09-30T18:27Z | Source: D44-C TL review (APPROVE with notes). |
+| E-143 | Follow-ups from E-87/E-140 reviews: pin audit_verdict created_at tie-to-failure with a test; test-no-tmp-sweep static scan also flags find -delete and find -exec rm shapes; move hardcoded /tmp fixtures (test-stop-process-group, test-audit-chain-cross-file, test-memory-cli, test-lsp-diagnostics-regression, test-watch-command, test-provider-source-cli, test-issue-providers) under loki_run_tmp_create | tests/test_release_required_ci.py, tests/test-no-tmp-sweep.sh, the listed tests | LOW | each named suite passes; a tie fixture expects rc 1 | ready@2026-09-30T18:27Z | Source: E-87 and E-140 TL reviews (both APPROVE). |
+| D44-A | Green main by construction: scripts/train-promote.sh fast-forwards main only to a train SHA with green Tests, Bun Parity and Coverage; pre-push refuses a push to main unless it is Tier B green, a VERSION-only bump on a green parent, or docs-only (LOKI_D44_EMERGENCY override logged) | scripts/train-promote.sh, .githooks/pre-push, tests/test-train-promote.sh, docs/v10/TRAINS.md | HIGH | bash tests/test-train-promote.sh | review@2026-09-30T18:27Z | Source: D44 item 1. |
+| D44-B | Pulse RELEASE_CADENCE (green unreleased main commit older than 20 min) and MAIN_RED_BY_MERGE; hourly releases per hour into METRICS.md | scripts/v10-pulse.sh, scripts/metrics-releases-append.py, pulse tests | MEDIUM | the pulse test file plus the metrics script self-test | building@2026-09-30T18:11Z | Source: D44 items 5 and 6. |
+| D44-C | Structural checks under 10 s each (shard rows, hardcoded paths, registration, doc drift, line budgets) as scripts/structural-checks.sh, run first in Tier A (also on train/** push) and in the local-ci fast tier | scripts/structural-checks.sh, .github/workflows/tier-a.yml, scripts/local-ci.sh, tests/test-structural-checks.sh | MEDIUM | bash tests/test-structural-checks.sh | merged@2026-09-30T18:27Z | Source: D44 item 3; four red mains on 2026-09-30. |
+| S41-20d | Medium tier growth batch d: 4 new tasks from unused repos under the 2026-09-30 opus criteria (2 behavioral files, not fixed at ref, wrong-fix rejected, solvable from issue, refdiff, provenance) | eval/loki10/tasks/pub-* (new), refdiff, INDEX.md | HIGH | measure-size rc 0 and validate rc 0 on the new tasks | building@2026-09-30T18:01Z | Source: D43 item 2 (medium at 12 of 20). |
+| S41-20e | Medium tier growth batch e: 4 more tasks, repos disjoint from S41-20d | eval/loki10/tasks/pub-* (new), refdiff, INDEX.md | HIGH | as S41-20d | review@2026-09-30T18:27Z | Source: D43 item 2. |
 | S41-16 | P0: Wall red-on-base is vacuous without python (launch error counted as failed on base) | see docs/v10/SCORECARD-PLAN.md | HIGH | per SCORECARD-PLAN.md card | released@2026-09-28T23:18Z | Source: D41, Architect plan 7f671f5c. Depends on D42. D42 (3) confirmed P0; merges before any wave-1 card touching wall, verify or Seal. Dispatched 21:42Z. r1 55e427ab opus REJECT: not_run never reaches seal (seal.ts:117 ignores not_run, so pass 1 fail 0 not_run 1 seals ALREADY_SATISFIED: a new false verdict); jest/vitest/bun non-zero exit without a parsed count read as red; AttributeError/NameError anywhere counted as repo red; system-interpreter results must be not_run. r2 dispatched 21:58Z. r2 d5bb05bd (seal refuses not_run; per-runner red rules; traceback path under repo; system interpreter not_run); core 4997; opus re-review 22:10Z. opus APPROVE r2 d5bb05bd (seal refuses not_run: real-seal test; receipts byte-stable when not_run 0; per-runner red rules; system interpreter not_run). Merged, dist rebuilt. Follow-up E-125. Released in v10.5.5 (merge 8788d54d is an ancestor of v10.5.5). |
-| S41-01 | Harness: accept partial-stream cost, allowlist LOKI_E10_CASCADE, new row fields | see docs/v10/SCORECARD-PLAN.md | HIGH | per SCORECARD-PLAN.md card | review@2026-09-30T17:28Z | Source: D41, Architect plan 7f671f5c. Depends on none. Dispatched 21:41Z.  WIND-DOWN 2026-09-28: built at 68d1fc28 on slice-S41-01 (test-harness.sh 126/0; red vs its merge-base 0fe549a0 119/7, the 7 S41-01 legs; positive control provider_cost on e98f default-r1 pub-werkzeug-3121 gives 0.37101 with partial 0.0628). Sonnet TL APPROVE on content (af2109d7): partial-stream cost, never-silently-0, 7-knob allowlist, row fields, repriced files beside untouched originals. The 2 nocascade nulls are killed sessions with no partial-usage file and must stay null (E-98e engine gap). NOT MERGED: (1) rebase onto main conflicts in harness.py V10_ENGINE_ENV_ALLOWLIST (S41-09 and S41-11 added LOKI_E10_PREFIX and LOKI_E10_TRIM), keep one of each and rerun test-harness.sh; (2) SCORECARD-PLAN tags the card HIGH, so D12 needs an opus review before merge (this row said MEDIUM). WEDNESDAY STEP 1. |
+| S41-01 | Harness: accept partial-stream cost, allowlist LOKI_E10_CASCADE, new row fields | see docs/v10/SCORECARD-PLAN.md | HIGH | per SCORECARD-PLAN.md card | merged@2026-09-30T18:01Z | Source: D41, Architect plan 7f671f5c. Depends on none. Dispatched 21:41Z.  WIND-DOWN 2026-09-28: built at 68d1fc28 on slice-S41-01 (test-harness.sh 126/0; red vs its merge-base 0fe549a0 119/7, the 7 S41-01 legs; positive control provider_cost on e98f default-r1 pub-werkzeug-3121 gives 0.37101 with partial 0.0628). Sonnet TL APPROVE on content (af2109d7): partial-stream cost, never-silently-0, 7-knob allowlist, row fields, repriced files beside untouched originals. The 2 nocascade nulls are killed sessions with no partial-usage file and must stay null (E-98e engine gap). NOT MERGED: (1) rebase onto main conflicts in harness.py V10_ENGINE_ENV_ALLOWLIST (S41-09 and S41-11 added LOKI_E10_PREFIX and LOKI_E10_TRIM), keep one of each and rerun test-harness.sh; (2) SCORECARD-PLAN tags the card HIGH, so D12 needs an opus review before merge (this row said MEDIUM). WEDNESDAY STEP 1. |
 | S41-02 | Scorecard tool: per-tier completion, cost per completed, p50, raw vs loki, into METRICS.md | see docs/v10/SCORECARD-PLAN.md | LOW | per SCORECARD-PLAN.md card | released@2026-09-28T22:26Z | Source: D41, Architect plan 7f671f5c. Depends on none. Dispatched 21:41Z. Built 42c0d88d (21/0; null-cost mutation flips n/a red to green, caught); replay reproduces E-98f exactly; EV-15 medium red on all 3 columns. Tech Lead review 21:51Z. Tech Lead APPROVE (definitions match section 2; replayed all 3 E-98f arms exactly). Merged. Released in v10.5.3 (merge a4cdb78f is an ancestor of v10.5.3). |
 | S41-03 | Arm runner for raw sonnet, raw opus, loki on sonnet (LOKI_EVAL_MODEL) plus OAuth auth guard | see docs/v10/SCORECARD-PLAN.md | MEDIUM | per SCORECARD-PLAN.md card | released@2026-09-28T23:18Z | Source: D41, Architect plan 7f671f5c. Depends on none. Dispatched 21:51Z. Built de741f04 (dry-run for 3 arms; red evidence only proved file existence); Tech Lead review 22:00Z checks the auth guard decision itself. Tech Lead APPROVE de741f04 (guard branches exercised with stubbed security/claude: near-expiry refresh, unreadable keychain, refresh failure; no token output; LOKI_EVAL_MODEL honored by both arms; mid-batch stop keeps prior results); merged; 7/7. Released in v10.5.5 (merge f76810ec is an ancestor of v10.5.5). |
 | S41-04 | First-turn prefix measurement (tokens by type per stage) | see docs/v10/SCORECARD-PLAN.md | LOW | per SCORECARD-PLAN.md card | released@2026-09-28T22:26Z | Source: D41, Architect plan 7f671f5c. Depends on none. Dispatched 21:51Z. Built 71a0d28d; Tech Lead APPROVE (implement row re-derived from 58 impl.json files: mean 982,144, p50 654,959 cache_read, exact); merged. Implement is the re-reading hotspot (982K cache read per task vs 45-68K for intake, plan, Wall). Released in v10.5.3 (merge 926c0371 is an ancestor of v10.5.3). |
-| S41-05 | Attempt-selection rule (pure function in e10ext/select.ts) | see docs/v10/SCORECARD-PLAN.md | HIGH | per SCORECARD-PLAN.md card | review@2026-09-30T17:29Z | Source: D41, Architect plan 7f671f5c. Depends on D42.   WIND-DOWN 2026-09-28: opus r2 REJECT (R1 Wall outside S uncounted, R2 key swaps 2-3 and 5-6 survived, R3 multi-line import passed fence) addressed at 34c44c99 on slice-S41-05 (50/0): R1 done red then green incl. M1'; R3, E3, require() done. LEFT: R2 pair tests 2-3, 4-5, 5-6, 6-7 are written and green but their mutation red-proof was not re-run. NEXT: run those 4 swap mutations, then opus r3 review. |
-| S41-12 | Tree swap helper for parallel attempts | see docs/v10/SCORECARD-PLAN.md | HIGH | per SCORECARD-PLAN.md card | review@2026-09-30T17:08Z | Source: D41, Architect plan 7f671f5c. Depends on D42.  WIND-DOWN 2026-09-28: opus REJECT at 7a3fbe53, 5 blocking, all reproduced: B1 resetToBase deletes user untracked files on a successful swap (treeswap.ts:240-243); B2 symlinked attempts dir lets cleanup delete the primary (:301, :312-314); B3 type-changed path (T status) never reset (:228-229); B4 segment-anywhere excludes drop winner changes under src/venv (:109-113 vs :65); B5 base .gitignore restored before listing untracked deletes an ignored .env (:231, :240). Non-blocking N1 to N4 (index rewrite, undo not persisted, .git symlink, O_NOFOLLOW). Resume from branch slice-S41-12. |
+| S41-05 | Attempt-selection rule (pure function in e10ext/select.ts) | see docs/v10/SCORECARD-PLAN.md | HIGH | per SCORECARD-PLAN.md card | merged@2026-09-30T18:01Z | Source: D41, Architect plan 7f671f5c. Depends on D42.   WIND-DOWN 2026-09-28: opus r2 REJECT (R1 Wall outside S uncounted, R2 key swaps 2-3 and 5-6 survived, R3 multi-line import passed fence) addressed at 34c44c99 on slice-S41-05 (50/0): R1 done red then green incl. M1'; R3, E3, require() done. LEFT: R2 pair tests 2-3, 4-5, 5-6, 6-7 are written and green but their mutation red-proof was not re-run. NEXT: run those 4 swap mutations, then opus r3 review. |
+| S41-12 | Tree swap helper for parallel attempts | see docs/v10/SCORECARD-PLAN.md | HIGH | per SCORECARD-PLAN.md card | merged@2026-09-30T18:11Z | Source: D41, Architect plan 7f671f5c. Depends on D42.  WIND-DOWN 2026-09-28: opus REJECT at 7a3fbe53, 5 blocking, all reproduced: B1 resetToBase deletes user untracked files on a successful swap (treeswap.ts:240-243); B2 symlinked attempts dir lets cleanup delete the primary (:301, :312-314); B3 type-changed path (T status) never reset (:228-229); B4 segment-anywhere excludes drop winner changes under src/venv (:109-113 vs :65); B5 base .gitignore restored before listing untracked deletes an ignored .env (:231, :240). Non-blocking N1 to N4 (index rewrite, undo not persisted, .git symlink, O_NOFOLLOW). Resume from branch slice-S41-12. |
 | S41-06 | Baseline scorecard (eval only) on small and medium, all arms | see docs/v10/SCORECARD-PLAN.md | HIGH | per SCORECARD-PLAN.md card | ready@2026-09-28T21:41Z | Source: D41, Architect plan 7f671f5c. Depends on S41-01, S41-02, S41-03, S41-04. |
 | S41-07 | Plan on the cheap model | see docs/v10/SCORECARD-PLAN.md | MEDIUM | per SCORECARD-PLAN.md card | ready@2026-09-28T21:41Z | Source: D41, Architect plan 7f671f5c. Depends on S41-06. |
 | S41-08 | Top model and deterministic-failure escalation | see docs/v10/SCORECARD-PLAN.md | HIGH | per SCORECARD-PLAN.md card | ready@2026-09-28T21:41Z | Source: D41, Architect plan 7f671f5c. Depends on S41-06. |
 | S41-09 | Lean stable prefix (flag) | see docs/v10/SCORECARD-PLAN.md | MEDIUM | per SCORECARD-PLAN.md card | released@2026-09-28T23:18Z | Source: D41, Architect plan 7f671f5c. Depends on S41-04. Dispatched 22:01Z. Released in v10.5.5 (merge ebb16a62 is an ancestor of v10.5.5). |
 | S41-14 | Wall in parallel with implement (item 4, target p50 not worse) | see docs/v10/SCORECARD-PLAN.md | HIGH | per SCORECARD-PLAN.md card | parked@2026-09-28T21:42Z | Source: D41, Architect plan 7f671f5c. Depends on D42, S41-16. D42 (2): deferred; E-98f shows no speed win (Wall-off p50 214s vs 209s) and it touches the moat. Reopen only if Wall is at least 15% of p50, with the Wall sealed and proven red on a clean base before any implement diff. |
-| S41-10 | Relevant context and a static-first brief | see docs/v10/SCORECARD-PLAN.md | MEDIUM | per SCORECARD-PLAN.md card | ready@2026-09-28T21:41Z | Source: D41, Architect plan 7f671f5c. Depends on S41-09. |
+| S41-10 | Relevant context and a static-first brief | see docs/v10/SCORECARD-PLAN.md | MEDIUM | per SCORECARD-PLAN.md card | building@2026-09-30T18:27Z | Source: D41, Architect plan 7f671f5c. Depends on S41-09. |
 | S41-11 | Rule-based trajectory trimming (flag) | see docs/v10/SCORECARD-PLAN.md | MEDIUM | per SCORECARD-PLAN.md card | merged@2026-09-30T17:08Z | Source: D41, Architect plan 7f671f5c. Depends on S41-09.  WIND-DOWN 2026-09-28: built at 8aafe341 on slice-S41-11 (trim.ts plus providers.ts wiring, 35/0; SDK exposes no Bash exit code to PostToolUse, sdk.d.ts:2677, so nonzero-exit uses a fail-safe heuristic). NEXT: TL review, then merge (rebase onto main: providers.ts and harness.py also changed). |
-| S41-13 | Two parallel attempts for medium and large (flag) | see docs/v10/SCORECARD-PLAN.md | HIGH | per SCORECARD-PLAN.md card | ready@2026-09-28T21:41Z | Source: D41, Architect plan 7f671f5c. Depends on S41-05, S41-12. |
+| S41-13 | Two parallel attempts for medium and large (flag) | see docs/v10/SCORECARD-PLAN.md | HIGH | per SCORECARD-PLAN.md card | ready@2026-09-28T21:41Z | Source: D41, Architect plan 7f671f5c. Depends on S41-05, S41-12. BINDING (E-141 opus review 2026-09-30): treeswap passes { ...process.env } to its git calls, so its caller must run where process.env is already scrubbed. engine10/supervisor.ts:200-201 scrubs only a workerEnv copy; if S41-13 calls treeswap from the supervisor it must pass the scrubbed env in as a parameter or run withholdGithubTokens on a copy inside treeswap, and its reviewer must check this. |
 | S41-15 | After-scorecard and defaults (flip only when green on small and medium) | see docs/v10/SCORECARD-PLAN.md | HIGH | per SCORECARD-PLAN.md card | ready@2026-09-28T21:41Z | Source: D41, Architect plan 7f671f5c. Depends on S41-13, S41-10, S41-11. |
-| S41-17 | Scorecard 95% intervals: bootstrap (seeded, 10000 resamples, per-task clustered over reps) CIs on completion, cost per completed and p50 for each arm and for the Loki minus raw difference; a mark is green or red only when the difference CI excludes 0, else inconclusive, and inconclusive blocks the tier verdict | eval/loki10/scorecard, eval/loki10/test-scorecard.sh | HIGH | bash eval/loki10/test-scorecard.sh | review@2026-09-30T17:28Z | Source: D43 item 2. Deterministic seed; a fixture where arms differ by noise only must read inconclusive, a clear gap must read green or red. Stdlib only.  WIND-DOWN 2026-09-28: built at f3f1d985 on slice-S41-17 (test-scorecard.sh 43/43; new cases a to e are 27 pass 16 fail on the old scorecard). Seeded (41) 10000-resample percentile bootstrap clustered by task; marks need the difference CI strictly outside 0; headline cost uses the ratio against 0.5; over 2.5 percent undefined replicates downgrades to inconclusive. Not benchmarked at real-eval scale. NEXT: opus review (HIGH, flip gate), then merge. |
+| S41-17 | Scorecard 95% intervals: bootstrap (seeded, 10000 resamples, per-task clustered over reps) CIs on completion, cost per completed and p50 for each arm and for the Loki minus raw difference; a mark is green or red only when the difference CI excludes 0, else inconclusive, and inconclusive blocks the tier verdict | eval/loki10/scorecard, eval/loki10/test-scorecard.sh | HIGH | bash eval/loki10/test-scorecard.sh | merged@2026-09-30T18:11Z | Source: D43 item 2. Deterministic seed; a fixture where arms differ by noise only must read inconclusive, a clear gap must read green or red. Stdlib only.  WIND-DOWN 2026-09-28: built at f3f1d985 on slice-S41-17 (test-scorecard.sh 43/43; new cases a to e are 27 pass 16 fail on the old scorecard). Seeded (41) 10000-resample percentile bootstrap clustered by task; marks need the difference CI strictly outside 0; headline cost uses the ratio against 0.5; over 2.5 percent undefined replicates downgrades to inconclusive. Not benchmarked at real-eval scale. NEXT: opus review (HIGH, flip gate), then merge. |
 | S41-18 | scorecard-run.sh resume: before each arm and rep, read that rep's --out file and pass the harness only tasks with no status ok row; a rerun after an interrupt or auth stop finishes the missing rows and never repeats done ones; auth_guard still runs before every rep | eval/loki10/scorecard-run.sh, eval/loki10/test-scorecard-run.sh | MEDIUM | bash eval/loki10/test-scorecard-run.sh | merged@2026-09-30T17:28Z | Source: D43 item 4. Do not change auth_guard logic or harness.py (S41-01 owns it). Test with the stub arm: kill mid-rep, rerun, assert each task row appears exactly once per rep.  WIND-DOWN 2026-09-28: built at 66cc1882 on slice-S41-18 (scorecard-run.sh resume; test-scorecard-run.sh 11/11, legs a to d red on the old script then green). LEFT: leg (a) seeds via a clean run, not a real SIGTERM mid-rep; no assertion for a capped (timeout) row; missing_tasks tier filter does not fail loud on an invalid tier; an empty tier now exits 0 instead of erroring. NEXT: close those 4, then TL review. |
 | S41-19 | Stage wall-clock profile: derive per-stage seconds (intake, plan, wall, implement, verify, fix, seal) per run from the preserved E-98f engine10 journals, publish a per-arm p50 and p90 table in METRICS.md and name the slowest stage | eval/loki10/stage-profile.py, docs/v10/METRICS.md | MEDIUM | python3 eval/loki10/stage-profile.py --self-test | merged@2026-09-30T17:08Z | Source: D43 item 3. Read only on run data. If the journals lack stage timestamps, say so with evidence and propose the minimal event field instead of guessing. The cut slice is cut from its result.  WIND-DOWN 2026-09-28: built at e06fa612 on slice-S41-19 (eval/loki10/stage-profile.py with --self-test, METRICS section over all 63 E-98f runs). Result: implement is 72.5 to 85.7 percent of wall-clock in every arm; wall is 23 to 29 percent and hits its own 90s timeout in 9/21 (default) and 11/21 (nocascade) runs, directly on the critical path, which clears D42 item 2's 15 percent revival bar for S41-14. NEXT: TL review and merge, then CTO call on reopening S41-14 (wall off the critical path) and an implement token/turn cut. |
-| S41-20a | Medium tier growth, batch a: add 5 new pub-* medium tasks from pallets repos (click, flask, jinja, itsdangerous, markupsafe) meeting the D30 medium criteria in INDEX.md | eval/loki10/tasks/pub-* (new dirs only) | HIGH | measure-size.py and validate rc=0 on the new tasks; RED at base and GREEN with the merged upstream fix for each | review@2026-09-30T17:28Z | Source: D43 item 2 (medium to 20). Return the INDEX.md lines in the report, do not edit INDEX.md (merge appends). No task whose issue is already present.  WIND-DOWN 2026-09-28: 2 of 5 tasks built and self-verified at d8d8d41e on slice-S41-20a: pub-flask-6093 (fix flask#6096) and pub-click-3449 (fix click#3533), RED rc=1, GREEN rc=0, deletion mutant red, no-op baseline not completed; INDEX lines in the engineer report (not yet in INDEX.md). Stopped mid-screen: flask#5736 (asserts span 2 test files), flask#5526, itsdangerous#151. Rejected: click#2836 (emoji in issue body). NEXT: opus review of the 2 tasks, append INDEX lines, then resume the 3 candidates. |
-| S41-20b | Medium tier growth, batch b: add 5 new pub-* medium tasks from attrs, more-itertools, packaging, humanize, faker meeting D30 | eval/loki10/tasks/pub-* (new dirs only) | HIGH | as S41-20a | review@2026-09-30T17:28Z | Source: D43 item 2. Same rules as S41-20a.  WIND-DOWN 2026-09-28: 3 of 5 tasks built at 881126a0 on slice-S41-20b: pub-attrs-1327 (fix attrs#1328), pub-packaging-1162 (fix packaging#1163, hidden test trimmed, pins pytest<9), pub-humanize-103 (fix humanize#110), each RED rc=1, GREEN rc=0, deletion mutant red; D30 no-op baseline NOT run for any. INDEX lines in the engineer report. Stopped: faker#2206 (fix #2211) venv installed, RED/GREEN not run. more-itertools has no 2-source-file fixes (rejected). NEXT: run the no-op baseline on the 3, opus review, append INDEX lines, then finish faker#2206. |
-| S41-20c | Medium tier growth, batch c: add 5 new pub-* medium tasks from werkzeug, jsonschema, and other pure-Python repos with pytest suites (for example marshmallow, httpx, pluggy) meeting D30 | eval/loki10/tasks/pub-* (new dirs only) | HIGH | as S41-20a | review@2026-09-30T17:28Z | Source: D43 item 2. Same rules as S41-20a.  WIND-DOWN 2026-09-28: 1 of 5 tasks built at f6ea1d02 on slice-S41-20c: pub-httpx-2536 (fix httpx#2543; hidden test trimmed to test_url_query_encoding), RED 1 failed, GREEN 1 passed, deletion mutant red; D30 no-op baseline NOT run. Stopped: marshmallow#2170 (fix #2792, 3 source files) cloned only. jsonschema, pluggy, most httpx fixes are single-file (rejected); httpx#1850 needs Python below 3.13 (cgi). NEXT: no-op baseline, opus review, INDEX line, then marshmallow#2170. Medium tier after 20a/b/c: 7 plus 6 candidates = 13, still short of 20. |
+| S41-20a | Medium tier growth, batch a: add 5 new pub-* medium tasks from pallets repos (click, flask, jinja, itsdangerous, markupsafe) meeting the D30 medium criteria in INDEX.md | eval/loki10/tasks/pub-* (new dirs only) | HIGH | measure-size.py and validate rc=0 on the new tasks; RED at base and GREEN with the merged upstream fix for each | merged@2026-09-30T18:27Z | Source: D43 item 2 (medium to 20). Return the INDEX.md lines in the report, do not edit INDEX.md (merge appends). No task whose issue is already present.  WIND-DOWN 2026-09-28: 2 of 5 tasks built and self-verified at d8d8d41e on slice-S41-20a: pub-flask-6093 (fix flask#6096) and pub-click-3449 (fix click#3533), RED rc=1, GREEN rc=0, deletion mutant red, no-op baseline not completed; INDEX lines in the engineer report (not yet in INDEX.md). Stopped mid-screen: flask#5736 (asserts span 2 test files), flask#5526, itsdangerous#151. Rejected: click#2836 (emoji in issue body). NEXT: opus review of the 2 tasks, append INDEX lines, then resume the 3 candidates. |
+| S41-20b | Medium tier growth, batch b: add 5 new pub-* medium tasks from attrs, more-itertools, packaging, humanize, faker meeting D30 | eval/loki10/tasks/pub-* (new dirs only) | HIGH | as S41-20a | building@2026-09-30T18:27Z | Source: D43 item 2. Same rules as S41-20a.  WIND-DOWN 2026-09-28: 3 of 5 tasks built at 881126a0 on slice-S41-20b: pub-attrs-1327 (fix attrs#1328), pub-packaging-1162 (fix packaging#1163, hidden test trimmed, pins pytest<9), pub-humanize-103 (fix humanize#110), each RED rc=1, GREEN rc=0, deletion mutant red; D30 no-op baseline NOT run for any. INDEX lines in the engineer report. Stopped: faker#2206 (fix #2211) venv installed, RED/GREEN not run. more-itertools has no 2-source-file fixes (rejected). NEXT: run the no-op baseline on the 3, opus review, append INDEX lines, then finish faker#2206. |
+| S41-20c | Medium tier growth, batch c: add 5 new pub-* medium tasks from werkzeug, jsonschema, and other pure-Python repos with pytest suites (for example marshmallow, httpx, pluggy) meeting D30 | eval/loki10/tasks/pub-* (new dirs only) | HIGH | as S41-20a | rejected@2026-09-30T18:27Z | Source: D43 item 2. Same rules as S41-20a.  WIND-DOWN 2026-09-28: 1 of 5 tasks built at f6ea1d02 on slice-S41-20c: pub-httpx-2536 (fix httpx#2543; hidden test trimmed to test_url_query_encoding), RED 1 failed, GREEN 1 passed, deletion mutant red; D30 no-op baseline NOT run. Stopped: marshmallow#2170 (fix #2792, 3 source files) cloned only. jsonschema, pluggy, most httpx fixes are single-file (rejected); httpx#1850 needs Python below 3.13 (cgi). NEXT: no-op baseline, opus review, INDEX line, then marshmallow#2170. Medium tier after 20a/b/c: 7 plus 6 candidates = 13, still short of 20. |
 | E-98b | a spec_conflict implement exit still runs verify and fix; receipt keeps SPEC_CONFLICT | loki-ts/src/engine10/machine.ts, loki-ts/tests/engine10/machine*.test.ts | HIGH | fake-stage test red on main; core +3 max | released@2026-09-28T21:01Z | Source: MEDIUM-ANALYSIS.md. Dispatched 19:40Z sonnet; opus review. opus APPROVE 214b8dd2 (seal stays SPEC_CONFLICT through verify and fix; empty diff fails verify, no false pass); merged 97b80ca4; machine+budget 26/0. Released in v10.5.0 (merge 97b80ca4 is an ancestor of v10.5.0). |
 | E-98c | existing test files append-only in the implement brief; impactedTests falls back to named files when relevant_files is empty | loki-ts/src/engine10/stages/implement.ts, its test | MEDIUM | unit test red then green; core +2 max | released@2026-09-28T21:01Z | Source: MEDIUM-ANALYSIS.md. Dispatched 19:40Z sonnet. Tech Lead APPROVE b24f4da2; merged f4606246; implement+machine+budget 37/0. Released in v10.5.0 (merge f4606246 is an ancestor of v10.5.0). |
 | E-98d | repo map extracts Python top-level def and class names | loki-ts/src/engine10/repomap.ts, loki-ts/tests/engine10/repomap*.test.ts | MEDIUM | unit test red then green; core +4 max | released@2026-09-28T21:01Z | Source: MEDIUM-ANALYSIS.md. Dispatched 19:40Z sonnet. Offline 7-repo check runs after merge. Tech Lead APPROVE ba31cca4 plus async def fix a1e8dc4b; merged 15859bef; 41/0 across repomap, implement, machine, budget. Offline 4/7 repos rank the upstream file in the top 8 (was 0/7; card bar 5/7, keyword-tie ceiling). Released in v10.5.0 (merge 15859bef is an ancestor of v10.5.0). |

package/docs/v10/DECISIONS.md

@@ -341,3 +341,13 @@ Raw claude -p swung 85.7% to 71.4% between two runs on the same 7 medium tasks,
 2. The medium tier holds at least 20 tasks and every arm runs at least 3 reps. The scorecard reports 95% intervals; a mark is green or red only when the interval of the Loki minus raw difference excludes 0, otherwise it is inconclusive, and inconclusive never flips a default (S41-17, S41-20a to c).
 3. Speed is v10's worst medium axis (p50 138 to 214s against raw 56 to 70s): profile stage wall-clock per run and cut the slowest stage first (S41-19, then a cut slice named by its result).
 4. Auth is checked before every rep (S41-03 auth_guard) and an interrupted eval resumes from its out files, never re-runs from scratch (S41-18).
+
+## D44 (founder, 2026-09-30T17:51Z): green main by construction, releases on a 10-minute clock
+
+Main went red four times on 2026-09-30 from structural checks CI caught after a push. From now on:
+1. Trains. The Release Manager merges approved slices onto train/N and pushes it; Tier B (Tests, Bun Parity, Coverage) runs there. Main is fast-forwarded only to a train commit whose Tier B is green (scripts/train-promote.sh refuses otherwise). Unverified merges are never pushed to main. A red train drops or fixes the failing slice and re-runs; main stays releasable.
+2. Release clock at :00/:10/:20/:30/:40/:50: if main has a green commit newer than the last release, bump VERSION (verdict reuse through version-bump-only) and publish. Trains overlap. Target 3 or more releases per hour, stretch 6.
+3. Structural checks (shard-durations rows, hardcoded path scans, test registration, doc-drift, line budgets) run in Tier A and as a pre-merge check, each under 10 seconds. A slice is not approved while one fails.
+4. Staff 8 or more builders; clear waiting reviews with sonnet for LOW/MEDIUM; opus stays under 30 percent.
+5. Pulse gains RELEASE_CADENCE (a green unreleased commit on main older than 20 minutes) and MAIN_RED_BY_MERGE (a push to main failing Tier B). Releases per hour are reported in METRICS.md hourly.
+Bootstrap: train/1 is verified through a pull request to main (pull_request already triggers Tier B) and carries the train/** push triggers so later trains verify on push.

package/docs/v10/PROGRESS.md

@@ -1505,3 +1505,21 @@ The swarm is stopped: .loki/V10-STOP exists, the loop has no wake-ups, and the c
 - Merged: E-130 (worktree install cache, TL r2 APPROVE, 15/0; .loki copy 2.32s to 0.04s with a 71 MB cache) and S41-18 (resume, TL r3 APPROVE, 17/0). Pushed cad4615f with two red-main fix-forwards: 7f1dff57 (E-133 shard-durations row missing) and 010797b3 (E-133 fixture tripped test-no-hardcoded-paths, the real cause of Tests red on 53918a30). Local fast tier: 96 PASS, 0 FAIL before the 10 min cap. CI watcher armed; 10.5.6 on green.
 - S41-01 opus r1 REJECT (a killed session's cost silently dropped, understating loki); fixed at 5c539ee5 (129/0, 0 of 77 preserved rows change), opus r2 in flight. S41-17 opus r2 REJECT (floor counted rows not evaluated reps); fixed at 37fc78d2 (63/0), opus r3 in flight. S41-05 opus r4 REJECT (template-literal dynamic import bypasses the fence); engineer switching to Bun scanImports.
 - Medium tier: S41-20a flask-6093 reworked (click-3449 dropped); 20b/20c self-check kept attrs-1327, packaging-1162, faker-2206 (added an anti-alias test), httpx-2536 and dropped humanize-103, marshmallow-2170, pluggy-442. Medium would be 12 of the 20 D43 needs. The INDEX.md edits on the three branches will conflict at merge.
+
+## 2026-09-30T18:06Z (Chief of Staff / Release Manager, D44 in force)
+- D44 recorded (25c61932). Tier B now runs on train/** pushes (test.yml, bun-parity.yml, coverage.yml). Release clock cron b33e6870 every 10 min releases only a main commit with green Tier B at that exact SHA.
+- v10.5.6 cut from 005f7617 (Tests, Bun Parity, Coverage green) as 97faf361; Release run in progress. Carries S41-01, S41-05, S41-11, S41-18, S41-19, E-129, E-130, E-133, E-135 and the four red-main fixes.
+- Red main count today: 4 (53918a30 hardcoded path, cad4615f ShellCheck, 9e815035 duplicate TS function, plus the earlier drift row). Each was a structural check only CI ran; D44-C moves them into Tier A and pre-merge. Memory feedback-run-the-exact-gate-locally updated with the exact pre-push commands.
+- train/2 pushed at 2e22fde8 (v10.5.6 plus E-136, D44 triggers, E-126, E-128/E-131); Tier B running; main fast-forwards to it only when green, then the clock cuts 10.5.7. Local main has E-127 queued for train/3.
+- Builders (8): D44-A (promote script and pre-push), D44-C (structural checks), E-137 (orphan leak), S41-20d, S41-20e (medium tasks), plus reworks. D44-B done, TL review in flight (flag: its gh lookup is branch-scoped to main, which misses train runs).
+- Reviews: opus on E-125 r2, E-134, S41-12 r3; S41-17 r5 narrow re-check; opus share 28 percent.
+- Governor: docs/v10/usage-readings.tsv holds only its header; no calibration reading exists, so staffing stays at the operating-model floor of 8.
+
+## 2026-09-30T18:40Z (Chief of Staff and Release Manager)
+- train/3 (b984d18f) green on Tests, Bun Parity and Coverage (baseline) push runs at 18:29Z; main fast-forwarded 97faf361..b984d18f; v10.5.7 released at 5a00409f (VERSION-only bump on the green parent). Watcher armed for the Release run, npm latest and gitHead, and the release body.
+- train/3 was blocked locally first by `tests/run-shellcheck.sh` rc=1 (SC2046 in eval/loki10/test-scorecard.sh:430-431); fixed with a scoped directive, rerun rc=0 before the push.
+- train/4 staging on local main: E-137, D44-C (15c2a870), S41-20a (flask-6093), E-140 (no TMPDIR glob sweeps), E-87 (dispatch Security Audit accepted by required-ci), S41-20e (pendulum-768, isort-2646). Local gate: shellcheck rc=0, structural-checks all passed, test-structural-checks 5/5, harness 130/0, scorecard 67/0, required-ci pytest 37 passed.
+- Medium tier: 10 on local main. Rejected with reproduced one-file fixes: attrs-1327, httpx-2536, pyjwt-1147, isort-1913; S41-20b-r2 (faker-2206 fixed, packaging-1162 borderline) and S41-20d in review; S41-20f and S41-20g building 4 each with a mandatory self-written one-file-fix probe.
+- Opus reviews (share 22.6 percent at dispatch): D44-A r2, E-125 r4 (absorbs E-132), M-15 r3. E-138 held for opus capacity.
+- Sonnet: reviews of S41-20d, S41-20b-r2, E-115 plus E-142, S41-10; builders EV-12E, S41-20f, S41-20g, E-143.
+- Founder: a reviewer's failed cd left an empty pip-only venv at the repo-root .venv (gitignored); v10-guard RULE4 blocks its removal from a session. Remove with `rm -rf .venv` when convenient.

package/loki-ts/dist/loki.js

@@ -1,5 +1,5 @@
 // @bun
-var Js=Object.create;var{getPrototypeOf:Ks,defineProperty:EG,getOwnPropertyNames:Ys}=Object;var Vs=Object.prototype.hasOwnProperty;function zs($){return this[$]}var Ws,qs,Gs=($,Z,Q)=>{var X=$!=null&&typeof $==="object";if(X){var J=Z?Ws??=new WeakMap:qs??=new WeakMap,K=J.get($);if(K)return K}Q=$!=null?Js(Ks($)):{};let Y=Z||!$||!$.__esModule?EG(Q,"default",{value:$,enumerable:!0}):Q;for(let V of Ys($))if(!Vs.call(Y,V))EG(Y,V,{get:zs.bind($,V),enumerable:!0});if(X)J.set($,Y);return Y};var zK=($,Z)=>()=>(Z||$((Z={exports:{}}).exports,Z),Z.exports);var Hs=($)=>$;function Bs($,Z){this[$]=Hs.bind(null,Z)}var R0=($,Z)=>{for(var Q in Z)EG($,Q,{get:Z[Q],enumerable:!0,configurable:!0,set:Bs.bind(Z,Q)})};var v=($,Z)=>()=>($&&(Z=$($=0)),Z);var R7=import.meta.require;var HT={};R0(HT,{lokiDir:()=>F0,homeLokiDir:()=>b4,findRepoRootForVersion:()=>xG,REPO_ROOT:()=>d0});import{resolve as P7,dirname as kG}from"path";import{fileURLToPath as Us}from"url";import{existsSync as WK}from"fs";import{homedir as Os}from"os";function Ns(){let $=GT;for(let Z=0;Z<6;Z++){if(WK(P7($,"VERSION"))&&WK(P7($,"autonomy/run.sh")))return $;let Q=kG($);if(Q===$)break;$=Q}return P7(GT,"..","..","..")}function xG($){let Z=$;for(let Q=0;Q<6;Q++){if(WK(P7(Z,"VERSION"))&&WK(P7(Z,"autonomy/run.sh")))return Z;let X=kG(Z);if(X===Z)break;Z=X}return P7($,"..","..","..")}function F0(){return process.env.LOKI_DIR??P7(process.cwd(),".loki")}function b4(){return P7(Os(),".loki")}var GT,d0;var Z8=v(()=>{GT=kG(Us(import.meta.url));d0=Ns()});import{readFileSync as Ms}from"fs";import{resolve as js,dirname as Ls}from"path";import{fileURLToPath as As}from"url";function E7(){if(y4!==null)return y4;let $="10.5.6";if(typeof $==="string"&&$.length>0)return y4=$,y4;try{let Z=Ls(As(import.meta.url)),Q=xG(Z);y4=Ms(js(Q,"VERSION"),"utf-8").trim()}catch{y4="unknown"}return y4}var y4=null;var y$=v(()=>{Z8()});var LT={};R0(LT,{runOrThrow:()=>fs,run:()=>T0,readStreamCapped:()=>qK,commandVersion:()=>hs,commandExists:()=>K9,ShellError:()=>bG,MAX_STDOUT_BYTES:()=>jT});async function qK($,Z=jT){let Q=$.getReader(),X=new TextDecoder,J="",K=0;try{while(K<Z){let{done:Y,value:V}=await Q.read();if(Y)break;if(!V)continue;if(K+=V.byteLength,K>Z){let z=V.byteLength-(K-Z);J+=X.decode(V.subarray(0,z),{stream:!0});break}J+=X.decode(V,{stream:!0})}J+=X.decode()}finally{try{await Q.cancel()}catch{}Q.releaseLock()}return J}async function T0($,Z={}){let Q=Bun.spawn({cmd:[...$],stdout:"pipe",stderr:"pipe",env:Z.env?{...process.env,...Z.env}:process.env,cwd:Z.cwd}),X,J;if(Z.timeoutMs&&Z.timeoutMs>0)X=setTimeout(()=>{try{Q.kill("SIGTERM")}catch{}J=setTimeout(()=>{try{Q.kill("SIGKILL")}catch{}},2000)},Z.timeoutMs);try{let[K,Y,V]=await Promise.all([qK(Q.stdout),new Response(Q.stderr).text(),Q.exited]);return{stdout:K,stderr:Y,exitCode:V}}finally{if(X)clearTimeout(X);if(J)clearTimeout(J)}}async function fs($,Z={}){let Q=await T0($,Z);if(Q.exitCode!==0)throw new bG(`command failed (${Q.exitCode}): ${$.join(" ")}`,Q.exitCode,Q.stdout,Q.stderr);return Q}async function K9($){let Z=vs($),Q=await T0(["sh","-c",`command -v ${Z}`],{timeoutMs:5000});if(Q.exitCode===0)return Q.stdout.trim()||null;return null}function vs($){if(!/^[A-Za-z0-9._/-]+$/.test($))throw Error(`refused to shell-escape suspect token: ${$}`);return $}async function hs($,Z="--version"){if(!await K9($))return null;let X=await T0([$,Z],{timeoutMs:5000});if(X.exitCode!==0)return null;return((X.stdout||X.stderr).split(/\r?\n/)[0]?.trim()??"")||null}var jT=16777216,bG;var s8=v(()=>{bG=class bG extends Error{message;exitCode;stdout;stderr;constructor($,Z,Q,X){super($);this.message=$;this.exitCode=Z;this.stdout=Q;this.stderr=X;this.name="ShellError"}}});function k7($){return gs?"":$}var gs,k0,P8,c0,P18,J8,L8,Y9,d;var n5=v(()=>{gs=(process.env.NO_COLOR??"").length>0;k0=k7("\x1B[0;31m"),P8=k7("\x1B[0;32m"),c0=k7("\x1B[1;33m"),P18=k7("\x1B[0;34m"),J8=k7("\x1B[0;36m"),L8=k7("\x1B[1m"),Y9=k7("\x1B[2m"),d=k7("\x1B[0m")});import{accessSync as ns,constants as ss,existsSync as rs,statSync as ts}from"fs";async function s5(){if(_$!==void 0)return _$;let $="/opt/homebrew/bin/python3.12";if(rs($))return _$=$,$;let Z=await K9("python3.12");if(Z)return _$=Z,Z;let Q=await K9("python3");return _$=Q,Q}async function T6($,Z={}){let Q=await s5();if(!Q)return{stdout:"",stderr:"python3 not found",exitCode:127};return T0([Q,"-c",$],Z)}async function x7(){let $=(process.env.PATH??"").split(":").filter((Z)=>Z.startsWith("/"));for(let Z of[...$r,...$.map((Q)=>`${Q}/python3`)])try{if(!ts(Z).isFile())continue;if(ns(Z,ss.X_OK),(await T0([Z,"-I","-S","-c",""],{timeoutMs:1e4})).exitCode===0)return Z}catch{}return null}var _$,es,$r;var J5=v(()=>{s8();es=["/usr/bin/python3","/bin/python3"],$r=es});var gT={};R0(gT,{runStatus:()=>Ir});import{existsSync as V9,readFileSync as Y2,readdirSync as xT,statSync as ST}from"fs";import{resolve as u8,basename as Nr}from"path";import{homedir as Mr}from"os";function bT($){let Z=Math.trunc($);if(Z>=1e6)return`${(Math.trunc(Z/1e6*10)/10).toFixed(1)}M`;if(Z>=1000)return`${(Math.trunc(Z/1000*10)/10).toFixed(1)}K`;return String(Z)}function yT($,Z,Q){if(Z===0)return null;let X=Math.trunc($*100/Z),J=Math.trunc($*HK/Z);if(J>HK)J=HK;let K=HK-J,Y=P8;if(X>=80)Y=k0;else if(X>=50)Y=c0;let V="=".repeat(Math.max(0,J))+" ".repeat(Math.max(0,K)),z=bT($),W=bT(Z);return`  ${L8}${Q}${d} ${Y}[${V}]${d} ${X}% (${z} / ${W})`}async function Lr(){if(await K9("jq"))return!0;return process.stdout.write(`${k0}Error: jq is required but not installed.${d}
+var Js=Object.create;var{getPrototypeOf:Ks,defineProperty:EG,getOwnPropertyNames:Ys}=Object;var Vs=Object.prototype.hasOwnProperty;function zs($){return this[$]}var Ws,qs,Gs=($,Z,Q)=>{var X=$!=null&&typeof $==="object";if(X){var J=Z?Ws??=new WeakMap:qs??=new WeakMap,K=J.get($);if(K)return K}Q=$!=null?Js(Ks($)):{};let Y=Z||!$||!$.__esModule?EG(Q,"default",{value:$,enumerable:!0}):Q;for(let V of Ys($))if(!Vs.call(Y,V))EG(Y,V,{get:zs.bind($,V),enumerable:!0});if(X)J.set($,Y);return Y};var zK=($,Z)=>()=>(Z||$((Z={exports:{}}).exports,Z),Z.exports);var Hs=($)=>$;function Bs($,Z){this[$]=Hs.bind(null,Z)}var R0=($,Z)=>{for(var Q in Z)EG($,Q,{get:Z[Q],enumerable:!0,configurable:!0,set:Bs.bind(Z,Q)})};var v=($,Z)=>()=>($&&(Z=$($=0)),Z);var R7=import.meta.require;var HT={};R0(HT,{lokiDir:()=>F0,homeLokiDir:()=>b4,findRepoRootForVersion:()=>xG,REPO_ROOT:()=>d0});import{resolve as P7,dirname as kG}from"path";import{fileURLToPath as Us}from"url";import{existsSync as WK}from"fs";import{homedir as Os}from"os";function Ns(){let $=GT;for(let Z=0;Z<6;Z++){if(WK(P7($,"VERSION"))&&WK(P7($,"autonomy/run.sh")))return $;let Q=kG($);if(Q===$)break;$=Q}return P7(GT,"..","..","..")}function xG($){let Z=$;for(let Q=0;Q<6;Q++){if(WK(P7(Z,"VERSION"))&&WK(P7(Z,"autonomy/run.sh")))return Z;let X=kG(Z);if(X===Z)break;Z=X}return P7($,"..","..","..")}function F0(){return process.env.LOKI_DIR??P7(process.cwd(),".loki")}function b4(){return P7(Os(),".loki")}var GT,d0;var Z8=v(()=>{GT=kG(Us(import.meta.url));d0=Ns()});import{readFileSync as Ms}from"fs";import{resolve as js,dirname as Ls}from"path";import{fileURLToPath as As}from"url";function E7(){if(y4!==null)return y4;let $="10.5.8";if(typeof $==="string"&&$.length>0)return y4=$,y4;try{let Z=Ls(As(import.meta.url)),Q=xG(Z);y4=Ms(js(Q,"VERSION"),"utf-8").trim()}catch{y4="unknown"}return y4}var y4=null;var y$=v(()=>{Z8()});var LT={};R0(LT,{runOrThrow:()=>fs,run:()=>T0,readStreamCapped:()=>qK,commandVersion:()=>hs,commandExists:()=>K9,ShellError:()=>bG,MAX_STDOUT_BYTES:()=>jT});async function qK($,Z=jT){let Q=$.getReader(),X=new TextDecoder,J="",K=0;try{while(K<Z){let{done:Y,value:V}=await Q.read();if(Y)break;if(!V)continue;if(K+=V.byteLength,K>Z){let z=V.byteLength-(K-Z);J+=X.decode(V.subarray(0,z),{stream:!0});break}J+=X.decode(V,{stream:!0})}J+=X.decode()}finally{try{await Q.cancel()}catch{}Q.releaseLock()}return J}async function T0($,Z={}){let Q=Bun.spawn({cmd:[...$],stdout:"pipe",stderr:"pipe",env:Z.env?{...process.env,...Z.env}:process.env,cwd:Z.cwd}),X,J;if(Z.timeoutMs&&Z.timeoutMs>0)X=setTimeout(()=>{try{Q.kill("SIGTERM")}catch{}J=setTimeout(()=>{try{Q.kill("SIGKILL")}catch{}},2000)},Z.timeoutMs);try{let[K,Y,V]=await Promise.all([qK(Q.stdout),new Response(Q.stderr).text(),Q.exited]);return{stdout:K,stderr:Y,exitCode:V}}finally{if(X)clearTimeout(X);if(J)clearTimeout(J)}}async function fs($,Z={}){let Q=await T0($,Z);if(Q.exitCode!==0)throw new bG(`command failed (${Q.exitCode}): ${$.join(" ")}`,Q.exitCode,Q.stdout,Q.stderr);return Q}async function K9($){let Z=vs($),Q=await T0(["sh","-c",`command -v ${Z}`],{timeoutMs:5000});if(Q.exitCode===0)return Q.stdout.trim()||null;return null}function vs($){if(!/^[A-Za-z0-9._/-]+$/.test($))throw Error(`refused to shell-escape suspect token: ${$}`);return $}async function hs($,Z="--version"){if(!await K9($))return null;let X=await T0([$,Z],{timeoutMs:5000});if(X.exitCode!==0)return null;return((X.stdout||X.stderr).split(/\r?\n/)[0]?.trim()??"")||null}var jT=16777216,bG;var s8=v(()=>{bG=class bG extends Error{message;exitCode;stdout;stderr;constructor($,Z,Q,X){super($);this.message=$;this.exitCode=Z;this.stdout=Q;this.stderr=X;this.name="ShellError"}}});function k7($){return gs?"":$}var gs,k0,P8,c0,P18,J8,L8,Y9,d;var n5=v(()=>{gs=(process.env.NO_COLOR??"").length>0;k0=k7("\x1B[0;31m"),P8=k7("\x1B[0;32m"),c0=k7("\x1B[1;33m"),P18=k7("\x1B[0;34m"),J8=k7("\x1B[0;36m"),L8=k7("\x1B[1m"),Y9=k7("\x1B[2m"),d=k7("\x1B[0m")});import{accessSync as ns,constants as ss,existsSync as rs,statSync as ts}from"fs";async function s5(){if(_$!==void 0)return _$;let $="/opt/homebrew/bin/python3.12";if(rs($))return _$=$,$;let Z=await K9("python3.12");if(Z)return _$=Z,Z;let Q=await K9("python3");return _$=Q,Q}async function T6($,Z={}){let Q=await s5();if(!Q)return{stdout:"",stderr:"python3 not found",exitCode:127};return T0([Q,"-c",$],Z)}async function x7(){let $=(process.env.PATH??"").split(":").filter((Z)=>Z.startsWith("/"));for(let Z of[...$r,...$.map((Q)=>`${Q}/python3`)])try{if(!ts(Z).isFile())continue;if(ns(Z,ss.X_OK),(await T0([Z,"-I","-S","-c",""],{timeoutMs:1e4})).exitCode===0)return Z}catch{}return null}var _$,es,$r;var J5=v(()=>{s8();es=["/usr/bin/python3","/bin/python3"],$r=es});var gT={};R0(gT,{runStatus:()=>Ir});import{existsSync as V9,readFileSync as Y2,readdirSync as xT,statSync as ST}from"fs";import{resolve as u8,basename as Nr}from"path";import{homedir as Mr}from"os";function bT($){let Z=Math.trunc($);if(Z>=1e6)return`${(Math.trunc(Z/1e6*10)/10).toFixed(1)}M`;if(Z>=1000)return`${(Math.trunc(Z/1000*10)/10).toFixed(1)}K`;return String(Z)}function yT($,Z,Q){if(Z===0)return null;let X=Math.trunc($*100/Z),J=Math.trunc($*HK/Z);if(J>HK)J=HK;let K=HK-J,Y=P8;if(X>=80)Y=k0;else if(X>=50)Y=c0;let V="=".repeat(Math.max(0,J))+" ".repeat(Math.max(0,K)),z=bT($),W=bT(Z);return`  ${L8}${Q}${d} ${Y}[${V}]${d} ${X}% (${z} / ${W})`}async function Lr(){if(await K9("jq"))return!0;return process.stdout.write(`${k0}Error: jq is required but not installed.${d}
 `),process.stdout.write(`Install with:
 `),process.stdout.write(`  brew install jq    (macOS)
 `),process.stdout.write(`  apt install jq     (Debian/Ubuntu)
@@ -1516,4 +1516,4 @@ Set LOKI_LEGACY_BASH=1 to force the bash CLI for every command.
 `),2}case"start":{let{runStart:X}=await Promise.resolve().then(() => (Pi(),Ri));return X(Q)}case"engine10":{let{runEngine10:X}=await Promise.resolve().then(() => (xi(),ki)),{registryLoader:J}=await Promise.resolve().then(() => (uq(),nn));return X(Q,J)}default:return process.stderr.write(`Unknown command: ${Z}
 `),process.stderr.write(sn),2}}ET();process.on("SIGINT",()=>process.exit(130));process.on("SIGTERM",()=>process.exit(143));var q18=await W18(Bun.argv.slice(2));process.exit(q18);
 
-//# debugId=CC6A6DF8D0E4F63424261F46CE4DA827
+//# debugId=774762068E6C7976D964A88E6A23A354

package/mcp/__init__.py

@@ -75,4 +75,4 @@ try:
 except ImportError:
     __all__ = ['mcp']
 
-__version__ = '10.5.6'
+__version__ = '10.5.8'

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "loki-mode",
   "mcpName": "io.github.asklokesh/loki-mode",
-  "version": "10.5.6",
+  "version": "10.5.8",
   "description": "Loki Mode by Autonomi. Autonomous spec-to-product system: takes a PRD, GitHub issue, OpenAPI/JSON/YAML, or one-line brief to a deployed app via the RARV-C closure loop with 8 quality gates. Provider-agnostic (Claude Code, OpenAI Codex, Cline, Aider, opencode).",
   "keywords": [
     "agent",

package/plugins/loki-mode/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "loki-mode",
   "displayName": "Loki Mode",
-  "version": "10.5.6",
+  "version": "10.5.8",
   "description": "Autonomous spec-to-product build system with a built-in trust layer (RARV-C closure loop, 8 quality gates, completion council). Ships Loki's spec-hardening, drift-detection, and deterministic PR verification commands plus the Loki MCP server.",
   "author": {
     "name": "Autonomi",

package/web-app/dist/assets/{AdminPage-TrFw5uq4.js → AdminPage-BAivfGJA.js}

@@ -1,4 +1,4 @@
-import{c as L,r as x,j as e,w as re,Z as ne,m as le,h as ie,p as P,F as ye,U as I,X as ce,L as de,x as oe,M as Ae,T as Z,S as we,l as xe,k as me,y as Ce,E as Fe,a0 as Se,a as U,a2 as he}from"./index-CCMAsJAW.js";import{B as C}from"./Button-uD8DtV8A.js";import{T as $e}from"./trending-up-DFl5twW_.js";import{C as z}from"./clock-CG9o0zgK.js";import{A as Be,U as ue,M as De}from"./Avatar-BQTp4bqf.js";import{A as J}from"./activity-CjPTVzFk.js";import{R as pe}from"./refresh-cw-BT2CvLmV.js";import{G as ze}from"./globe-Bgw8ae_Q.js";import{C as Le}from"./chevron-left-DAMVo_FN.js";import{C as je}from"./check-zzTEyu5C.js";import{D as Y}from"./dollar-sign-i_pmA6g5.js";import{U as Te}from"./user-DKle9QPo.js";import{D as Me}from"./database-CX-u55m-.js";import{L as Ue}from"./lock-CjWeWASl.js";import{S as Re}from"./scroll-text-Byp_Qui_.js";import{S as Ie}from"./shield-alert-Cfq3M6Sq.js";/**
+import{c as L,r as x,j as e,w as re,Z as ne,m as le,h as ie,p as P,F as ye,U as I,X as ce,L as de,x as oe,M as Ae,T as Z,S as we,l as xe,k as me,y as Ce,E as Fe,a0 as Se,a as U,a2 as he}from"./index-Cyw0iehe.js";import{B as C}from"./Button-DqFijh1t.js";import{T as $e}from"./trending-up-CklD7DnW.js";import{C as z}from"./clock-DPelcqof.js";import{A as Be,U as ue,M as De}from"./Avatar-BA71k1Ek.js";import{A as J}from"./activity-CBTzzRu1.js";import{R as pe}from"./refresh-cw-D2tureNn.js";import{G as ze}from"./globe-BXA2crAj.js";import{C as Le}from"./chevron-left-DvsvMWo4.js";import{C as je}from"./check-DL4Pmd0G.js";import{D as Y}from"./dollar-sign-CDTMWNIm.js";import{U as Te}from"./user-DnZKgBa-.js";import{D as Me}from"./database-S54KUl1N.js";import{L as Ue}from"./lock-C8el6Nma.js";import{S as Re}from"./scroll-text-CcVCuiPk.js";import{S as Ie}from"./shield-alert-OZCHTW9G.js";/**
  * @license lucide-react v0.577.0 - ISC
  *
  * This source code is licensed under the ISC license.

package/web-app/dist/assets/{Avatar-BQTp4bqf.js → Avatar-BA71k1Ek.js}

@@ -1,4 +1,4 @@
-import{c as l,j as s}from"./index-CCMAsJAW.js";/**
+import{c as l,j as s}from"./index-Cyw0iehe.js";/**
  * @license lucide-react v0.577.0 - ISC
  *
  * This source code is licensed under the ISC license.

package/web-app/dist/assets/{Badge-k23hiC44.js → Badge-CSMDzfyx.js}

@@ -1 +1 @@
-import{j as e}from"./index-CCMAsJAW.js";import{C as r}from"./clock-CG9o0zgK.js";import{C as a}from"./circle-alert-CDXwnHdj.js";import{C as l}from"./check-zzTEyu5C.js";const i={completed:"bg-[#1FC5A8]/10 text-[#1FC5A8]",running:"bg-[#553DE9]/10 text-[#553DE9]",failed:"bg-[#C45B5B]/10 text-[#C45B5B]",started:"bg-[#D4A03C]/10 text-[#D4A03C]",empty:"bg-[#F8F4F0] text-[#6B6960]",version:"bg-[#553DE9]/10 text-[#553DE9]"};function o({status:t}){switch(t){case"completed":return e.jsx(l,{size:12});case"running":return e.jsxs("span",{className:"relative flex h-2 w-2",children:[e.jsx("span",{className:"animate-ping motion-reduce:animate-none absolute inline-flex h-full w-full rounded-full bg-current opacity-75"}),e.jsx("span",{className:"relative inline-flex rounded-full h-2 w-2 bg-current"})]});case"failed":return e.jsx(a,{size:12});case"started":return e.jsx(r,{size:12});default:return null}}function f({status:t,children:n,className:s=""}){return e.jsxs("span",{className:["inline-flex items-center gap-1 rounded-btn px-2.5 py-0.5 text-xs font-semibold",i[t],s].filter(Boolean).join(" "),children:[e.jsx(o,{status:t}),n]})}export{f as B};
+import{j as e}from"./index-Cyw0iehe.js";import{C as r}from"./clock-DPelcqof.js";import{C as a}from"./circle-alert-t3qnFaLA.js";import{C as l}from"./check-DL4Pmd0G.js";const i={completed:"bg-[#1FC5A8]/10 text-[#1FC5A8]",running:"bg-[#553DE9]/10 text-[#553DE9]",failed:"bg-[#C45B5B]/10 text-[#C45B5B]",started:"bg-[#D4A03C]/10 text-[#D4A03C]",empty:"bg-[#F8F4F0] text-[#6B6960]",version:"bg-[#553DE9]/10 text-[#553DE9]"};function o({status:t}){switch(t){case"completed":return e.jsx(l,{size:12});case"running":return e.jsxs("span",{className:"relative flex h-2 w-2",children:[e.jsx("span",{className:"animate-ping motion-reduce:animate-none absolute inline-flex h-full w-full rounded-full bg-current opacity-75"}),e.jsx("span",{className:"relative inline-flex rounded-full h-2 w-2 bg-current"})]});case"failed":return e.jsx(a,{size:12});case"started":return e.jsx(r,{size:12});default:return null}}function f({status:t,children:n,className:s=""}){return e.jsxs("span",{className:["inline-flex items-center gap-1 rounded-btn px-2.5 py-0.5 text-xs font-semibold",i[t],s].filter(Boolean).join(" "),children:[e.jsx(o,{status:t}),n]})}export{f as B};

package/web-app/dist/assets/{Button-uD8DtV8A.js → Button-DqFijh1t.js}

@@ -1 +1 @@
-import{r as p,j as t}from"./index-CCMAsJAW.js";const m={primary:"bg-[#553DE9] text-white hover:bg-[#4432c4] shadow-button rounded-btn",secondary:"border border-[#553DE9] text-[#553DE9] hover:bg-[#E8E4FD] bg-transparent rounded-btn",ghost:"text-[#36342E] hover:bg-[#F8F4F0] rounded-btn",danger:"bg-[#C45B5B]/10 text-[#C45B5B] border border-[#C45B5B]/20 hover:bg-[#C45B5B]/20 rounded-btn"},b={sm:"px-3 py-1.5 text-xs",md:"px-4 py-2 text-sm",lg:"px-6 py-3 text-base"},u={sm:14,md:16,lg:18};function h({size:e}){return t.jsxs("svg",{className:"animate-spin",width:e,height:e,viewBox:"0 0 24 24",fill:"none",children:[t.jsx("circle",{className:"opacity-25",cx:"12",cy:"12",r:"10",stroke:"currentColor",strokeWidth:"4"}),t.jsx("path",{className:"opacity-75",fill:"currentColor",d:"M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4z"})]})}const B=p.forwardRef(({variant:e="primary",size:o="md",icon:n,iconRight:i,loading:r=!1,disabled:a,className:c="",children:l,...x},d)=>{const s=u[o];return t.jsxs("button",{ref:d,disabled:a||r,className:["inline-flex items-center justify-center gap-2 font-medium transition-colors",m[e],b[o],(a||r)&&"opacity-60 cursor-not-allowed",c].filter(Boolean).join(" "),...x,children:[r?t.jsx(h,{size:s}):n?t.jsx(n,{size:s}):null,l,i&&!r&&t.jsx(i,{size:s})]})});B.displayName="Button";export{B};
+import{r as p,j as t}from"./index-Cyw0iehe.js";const m={primary:"bg-[#553DE9] text-white hover:bg-[#4432c4] shadow-button rounded-btn",secondary:"border border-[#553DE9] text-[#553DE9] hover:bg-[#E8E4FD] bg-transparent rounded-btn",ghost:"text-[#36342E] hover:bg-[#F8F4F0] rounded-btn",danger:"bg-[#C45B5B]/10 text-[#C45B5B] border border-[#C45B5B]/20 hover:bg-[#C45B5B]/20 rounded-btn"},b={sm:"px-3 py-1.5 text-xs",md:"px-4 py-2 text-sm",lg:"px-6 py-3 text-base"},u={sm:14,md:16,lg:18};function h({size:e}){return t.jsxs("svg",{className:"animate-spin",width:e,height:e,viewBox:"0 0 24 24",fill:"none",children:[t.jsx("circle",{className:"opacity-25",cx:"12",cy:"12",r:"10",stroke:"currentColor",strokeWidth:"4"}),t.jsx("path",{className:"opacity-75",fill:"currentColor",d:"M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4z"})]})}const B=p.forwardRef(({variant:e="primary",size:o="md",icon:n,iconRight:i,loading:r=!1,disabled:a,className:c="",children:l,...x},d)=>{const s=u[o];return t.jsxs("button",{ref:d,disabled:a||r,className:["inline-flex items-center justify-center gap-2 font-medium transition-colors",m[e],b[o],(a||r)&&"opacity-60 cursor-not-allowed",c].filter(Boolean).join(" "),...x,children:[r?t.jsx(h,{size:s}):n?t.jsx(n,{size:s}):null,l,i&&!r&&t.jsx(i,{size:s})]})});B.displayName="Button";export{B};

package/web-app/dist/assets/{CockpitPage-CAPci7PQ.js → CockpitPage-D8IaSpQ4.js}

@@ -1,4 +1,4 @@
-import{c as $,r as l,j as e,G as we,Q as Se,F as Ce,h as Re,T as U,Z as Ee,a as S,V as Me,S as $e,Y as Te,X as Pe,P as ie,i as Ae,g as ze,C as Ie,l as Le,N as I,J as _e,K as De,O as Fe,u as Oe}from"./index-CCMAsJAW.js";import{P as K,S as He,E as Be}from"./ErrorBoundary-BxiLU-gm.js";import{C as qe,F as Ge,M as Ue,H as Ke,a as We,G as Ve,T as Qe}from"./thumbs-up-Bf9EPha1.js";import{C as oe}from"./check-zzTEyu5C.js";import{C as Ye}from"./clock-CG9o0zgK.js";import{D as Xe}from"./dollar-sign-i_pmA6g5.js";import{U as Ze}from"./upload-Ba2_IFPe.js";import{L as V}from"./loader-circle-D3XG86Eb.js";/**
+import{c as $,r as l,j as e,G as we,Q as Se,F as Ce,h as Re,T as U,Z as Ee,a as S,V as Me,S as $e,Y as Te,X as Pe,P as ie,i as Ae,g as ze,C as Ie,l as Le,N as I,J as _e,K as De,O as Fe,u as Oe}from"./index-Cyw0iehe.js";import{P as K,S as He,E as Be}from"./ErrorBoundary-KJ1WCGVK.js";import{C as qe,F as Ge,M as Ue,H as Ke,a as We,G as Ve,T as Qe}from"./thumbs-up-Cwg2QohI.js";import{C as oe}from"./check-DL4Pmd0G.js";import{C as Ye}from"./clock-DPelcqof.js";import{D as Xe}from"./dollar-sign-CDTMWNIm.js";import{U as Ze}from"./upload-QqL7JN5e.js";import{L as V}from"./loader-circle-fz1m_qyG.js";/**
  * @license lucide-react v0.577.0 - ISC
  *
  * This source code is licensed under the ISC license.

package/web-app/dist/assets/{ComparePage-BUn6AE0j.js → ComparePage-e9HSyfV0.js}

@@ -1 +1 @@
-import{r as o,j as e}from"./index-CCMAsJAW.js";function f({value:r,prefix:t="",suffix:s=""}){const[u,n]=o.useState(0),c=o.useRef(0);return o.useEffect(()=>{const a=c.current,h=r-a;if(h===0)return;const i=600,d=performance.now();function l(b){const v=b-d,m=Math.min(v/i,1),N=1-Math.pow(1-m,3),p=Math.round(a+h*N);n(p),c.current=p,m<1&&requestAnimationFrame(l)}requestAnimationFrame(l)},[r]),e.jsxs("span",{className:"tabular-nums",children:[t,u.toLocaleString(),s]})}function g(){const[r,t]=o.useState(5),[s,u]=o.useState(30),[n,c]=o.useState(75),a=.4,i=Math.round(r*s*a*4.33),d=Math.round(i*n);return e.jsxs("div",{className:"bg-white border border-[#ECEAE3] rounded-xl p-6 shadow-sm",children:[e.jsx("h3",{className:"text-lg font-bold text-[#36342E] mb-1",children:"ROI Calculator"}),e.jsx("p",{className:"text-sm text-[#6B6960] mb-6",children:"Estimate how much your team could save with autonomous development."}),e.jsxs("div",{className:"space-y-5",children:[e.jsxs("div",{children:[e.jsxs("div",{className:"flex items-center justify-between mb-2",children:[e.jsx("label",{className:"text-sm font-medium text-[#36342E]",children:"Team size"}),e.jsxs("span",{className:"text-sm font-semibold text-[#553DE9] tabular-nums",children:[r," developers"]})]}),e.jsx("input",{type:"range",min:1,max:50,value:r,onChange:l=>t(Number(l.target.value)),className:"w-full h-2 bg-[#ECEAE3] rounded-full appearance-none cursor-pointer accent-[#553DE9]"}),e.jsxs("div",{className:"flex justify-between text-xs text-[#939084] mt-1",children:[e.jsx("span",{children:"1"}),e.jsx("span",{children:"50"})]})]}),e.jsxs("div",{children:[e.jsxs("div",{className:"flex items-center justify-between mb-2",children:[e.jsx("label",{className:"text-sm font-medium text-[#36342E]",children:"Hours coding per week"}),e.jsxs("span",{className:"text-sm font-semibold text-[#553DE9] tabular-nums",children:[s,"h"]})]}),e.jsx("input",{type:"range",min:5,max:60,value:s,onChange:l=>u(Number(l.target.value)),className:"w-full h-2 bg-[#ECEAE3] rounded-full appearance-none cursor-pointer accent-[#553DE9]"}),e.jsxs("div",{className:"flex justify-between text-xs text-[#939084] mt-1",children:[e.jsx("span",{children:"5h"}),e.jsx("span",{children:"60h"})]})]}),e.jsxs("div",{children:[e.jsxs("div",{className:"flex items-center justify-between mb-2",children:[e.jsx("label",{className:"text-sm font-medium text-[#36342E]",children:"Average hourly rate"}),e.jsxs("span",{className:"text-sm font-semibold text-[#553DE9] tabular-nums",children:["$",n,"/hr"]})]}),e.jsx("input",{type:"range",min:25,max:250,step:5,value:n,onChange:l=>c(Number(l.target.value)),className:"w-full h-2 bg-[#ECEAE3] rounded-full appearance-none cursor-pointer accent-[#553DE9]"}),e.jsxs("div",{className:"flex justify-between text-xs text-[#939084] mt-1",children:[e.jsx("span",{children:"$25"}),e.jsx("span",{children:"$250"})]})]})]}),e.jsxs("div",{className:"mt-6 pt-6 border-t border-[#ECEAE3]",children:[e.jsxs("div",{className:"grid grid-cols-2 gap-4 text-center",children:[e.jsxs("div",{children:[e.jsx("div",{className:"text-2xl font-bold text-[#553DE9]",children:e.jsx(f,{value:i,suffix:"h"})}),e.jsx("div",{className:"text-xs text-[#6B6960] mt-1",children:"Est. hours saved / month"})]}),e.jsxs("div",{children:[e.jsx("div",{className:"text-2xl font-bold text-[#1FC5A8]",children:e.jsx(f,{value:d,prefix:"$"})}),e.jsx("div",{className:"text-xs text-[#6B6960] mt-1",children:"Est. cost saved / month"})]})]}),e.jsxs("div",{className:"mt-4 p-3 rounded-lg bg-[#553DE9]/5 border border-[#553DE9]/10",children:[e.jsxs("p",{className:"text-sm text-[#36342E] text-center",children:["If Loki Mode saved ",Math.round(a*100),"% of coding time, your team could save"," ",e.jsxs("span",{className:"font-bold text-[#553DE9]",children:[i.toLocaleString()," hours"]})," ","and"," ",e.jsxs("span",{className:"font-bold text-[#1FC5A8]",children:["$",d.toLocaleString()]})," ","per month."]}),e.jsxs("p",{className:"mt-2 text-xs text-[#6B6960] text-center",children:["The ",Math.round(a*100),"% is an assumption, not a measurement. Model and API spend is not included."]})]})]})]})}const j=[{feature:"Claude (Opus/Sonnet/Haiku)",category:"AI Models",lokiMode:!0,boltNew:!1,replit:!1,lovable:!0},{feature:"GPT-4o / Codex",category:"AI Models",lokiMode:!0,boltNew:!0,replit:!0,lovable:!1},{feature:"5-provider auto-failover",category:"AI Models",lokiMode:!0,boltNew:!1,replit:!1,lovable:!1},{feature:"8 automated quality gates",category:"Quality",lokiMode:!0,boltNew:!1,replit:!1,lovable:!1},{feature:"Blind 3-reviewer code review",category:"Quality",lokiMode:!0,boltNew:!1,replit:!1,lovable:!1},{feature:"Anti-sycophancy checks",category:"Quality",lokiMode:!0,boltNew:!1,replit:!1,lovable:!1},{feature:"Automated test generation",category:"Quality",lokiMode:!0,boltNew:!1,replit:"Partial",lovable:!1},{feature:"Docker container generation",category:"Deployment",lokiMode:!0,boltNew:!1,replit:!0,lovable:!1},{feature:"CI/CD pipeline generation",category:"Deployment",lokiMode:!0,boltNew:!1,replit:!1,lovable:!1},{feature:"One-click cloud deploy",category:"Deployment",lokiMode:"Planned",boltNew:!0,replit:!0,lovable:!0},{feature:"Self-hosted (your keys)",category:"Cost",lokiMode:!0,boltNew:!1,replit:!1,lovable:!1},{feature:"Free tier available",category:"Cost",lokiMode:"Source-available (BUSL-1.1)",boltNew:!0,replit:!0,lovable:!0},{feature:"No vendor lock-in",category:"Cost",lokiMode:!0,boltNew:!1,replit:!1,lovable:!1},{feature:"SSO / OIDC authentication",category:"Enterprise",lokiMode:!0,boltNew:!1,replit:!0,lovable:!1},{feature:"RBAC access control",category:"Enterprise",lokiMode:!0,boltNew:!1,replit:!0,lovable:!1},{feature:"Audit logging",category:"Enterprise",lokiMode:!0,boltNew:!1,replit:!0,lovable:!1},{feature:"Air-gapped deployment",category:"Enterprise",lokiMode:!0,boltNew:!1,replit:!1,lovable:!1}];function y(){return e.jsx("svg",{width:"18",height:"18",viewBox:"0 0 24 24",fill:"none",className:"text-[#1FC5A8]",children:e.jsx("path",{d:"M20 6L9 17l-5-5",stroke:"currentColor",strokeWidth:"2.5",strokeLinecap:"round",strokeLinejoin:"round"})})}function w(){return e.jsx("svg",{width:"18",height:"18",viewBox:"0 0 24 24",fill:"none",className:"text-[#C45B5B]/40",children:e.jsx("path",{d:"M18 6L6 18M6 6l12 12",stroke:"currentColor",strokeWidth:"2",strokeLinecap:"round",strokeLinejoin:"round"})})}function x({value:r}){return typeof r=="string"?e.jsx("span",{className:"text-xs text-[#6B6960] font-medium",children:r}):r?e.jsx(y,{}):e.jsx(w,{})}const k=[{title:"Full Autonomy",description:"Describe what you want. Loki Mode handles planning, coding, testing, and verification automatically.",icon:e.jsx("svg",{width:"24",height:"24",viewBox:"0 0 24 24",fill:"none",className:"text-[#553DE9]",children:e.jsx("path",{d:"M13 2L3 14h9l-1 8 10-12h-9l1-8z",stroke:"currentColor",strokeWidth:"2",strokeLinecap:"round",strokeLinejoin:"round"})})},{title:"Production Quality",description:"8 quality gates, blind code review, and anti-sycophancy checks ensure code that actually works.",icon:e.jsx("svg",{width:"24",height:"24",viewBox:"0 0 24 24",fill:"none",className:"text-[#1FC5A8]",children:e.jsx("path",{d:"M12 22s8-4 8-10V5l-8-3-8 3v7c0 6 8 10 8 10z",stroke:"currentColor",strokeWidth:"2",strokeLinecap:"round",strokeLinejoin:"round"})})},{title:"Your Infrastructure",description:"Self-hosted, source-available (BUSL-1.1), no data leaves your network. Use your own API keys across 5 providers.",icon:e.jsxs("svg",{width:"24",height:"24",viewBox:"0 0 24 24",fill:"none",className:"text-[#2F71E3]",children:[e.jsx("rect",{x:"2",y:"2",width:"20",height:"8",rx:"2",stroke:"currentColor",strokeWidth:"2"}),e.jsx("rect",{x:"2",y:"14",width:"20",height:"8",rx:"2",stroke:"currentColor",strokeWidth:"2"}),e.jsx("circle",{cx:"6",cy:"6",r:"1",fill:"currentColor"}),e.jsx("circle",{cx:"6",cy:"18",r:"1",fill:"currentColor"})]})},{title:"Built for Teams",description:"Enterprise auth, RBAC, audit logs, and parallel workflows for teams of any size.",icon:e.jsxs("svg",{width:"24",height:"24",viewBox:"0 0 24 24",fill:"none",className:"text-[#E93D82]",children:[e.jsx("path",{d:"M17 21v-2a4 4 0 00-4-4H5a4 4 0 00-4 4v2",stroke:"currentColor",strokeWidth:"2",strokeLinecap:"round",strokeLinejoin:"round"}),e.jsx("circle",{cx:"9",cy:"7",r:"4",stroke:"currentColor",strokeWidth:"2"}),e.jsx("path",{d:"M23 21v-2a4 4 0 00-3-3.87M16 3.13a4 4 0 010 7.75",stroke:"currentColor",strokeWidth:"2",strokeLinecap:"round",strokeLinejoin:"round"})]})}];function C(){const r=[...new Set(j.map(t=>t.category))];return e.jsx("div",{className:"min-h-screen bg-[#FAF9F6]",children:e.jsxs("div",{className:"max-w-6xl mx-auto px-6 py-8",children:[e.jsxs("div",{className:"mb-8",children:[e.jsx("h1",{className:"text-2xl font-bold text-[#36342E]",children:"Compare"}),e.jsx("p",{className:"text-[#6B6960] mt-1",children:"See how Loki Mode stacks up against other AI development platforms."})]}),e.jsx("div",{className:"bg-white border border-[#ECEAE3] rounded-xl overflow-hidden shadow-sm",children:e.jsx("div",{className:"overflow-x-auto",children:e.jsxs("table",{className:"w-full text-sm",children:[e.jsx("thead",{children:e.jsxs("tr",{className:"border-b border-[#ECEAE3]",children:[e.jsx("th",{className:"text-left px-4 py-3 font-medium text-[#6B6960] w-[240px]",children:"Feature"}),e.jsx("th",{className:"text-center px-4 py-3 font-bold text-[#553DE9] bg-[#553DE9]/5 w-[130px]",children:"Loki Mode"}),e.jsx("th",{className:"text-center px-4 py-3 font-medium text-[#6B6960] w-[130px]",children:"bolt.new"}),e.jsx("th",{className:"text-center px-4 py-3 font-medium text-[#6B6960] w-[130px]",children:"Replit"}),e.jsx("th",{className:"text-center px-4 py-3 font-medium text-[#6B6960] w-[130px]",children:"Lovable"})]})}),e.jsx("tbody",{children:r.map(t=>e.jsxs(e.Fragment,{children:[e.jsx("tr",{className:"bg-[#FAF9F6]",children:e.jsx("td",{colSpan:5,className:"px-4 py-2 text-xs font-bold text-[#939084] uppercase tracking-wider",children:t})},`cat-${t}`),j.filter(s=>s.category===t).map(s=>e.jsxs("tr",{className:"border-b border-[#ECEAE3] last:border-b-0",children:[e.jsx("td",{className:"px-4 py-2.5 text-[#36342E]",children:s.feature}),e.jsx("td",{className:"px-4 py-2.5 text-center bg-[#553DE9]/5",children:e.jsx("div",{className:"flex justify-center",children:e.jsx(x,{value:s.lokiMode})})}),e.jsx("td",{className:"px-4 py-2.5 text-center",children:e.jsx("div",{className:"flex justify-center",children:e.jsx(x,{value:s.boltNew})})}),e.jsx("td",{className:"px-4 py-2.5 text-center",children:e.jsx("div",{className:"flex justify-center",children:e.jsx(x,{value:s.replit})})}),e.jsx("td",{className:"px-4 py-2.5 text-center",children:e.jsx("div",{className:"flex justify-center",children:e.jsx(x,{value:s.lovable})})})]},s.feature))]}))})]})})}),e.jsxs("div",{className:"mt-12",children:[e.jsx("h2",{className:"text-xl font-bold text-[#36342E] mb-6",children:"Why developers choose Loki Mode"}),e.jsx("div",{className:"grid grid-cols-1 md:grid-cols-2 gap-5",children:k.map(t=>e.jsxs("div",{className:"bg-white border border-[#ECEAE3] rounded-xl p-5 shadow-sm hover:shadow-md transition-shadow",children:[e.jsx("div",{className:"mb-3",children:t.icon}),e.jsx("h3",{className:"text-base font-bold text-[#36342E] mb-1",children:t.title}),e.jsx("p",{className:"text-sm text-[#6B6960]",children:t.description})]},t.title))})]}),e.jsx("div",{className:"mt-12 max-w-xl mx-auto",children:e.jsx(g,{})})]})})}export{C as default};
+import{r as o,j as e}from"./index-Cyw0iehe.js";function f({value:r,prefix:t="",suffix:s=""}){const[u,n]=o.useState(0),c=o.useRef(0);return o.useEffect(()=>{const a=c.current,h=r-a;if(h===0)return;const i=600,d=performance.now();function l(b){const v=b-d,m=Math.min(v/i,1),N=1-Math.pow(1-m,3),p=Math.round(a+h*N);n(p),c.current=p,m<1&&requestAnimationFrame(l)}requestAnimationFrame(l)},[r]),e.jsxs("span",{className:"tabular-nums",children:[t,u.toLocaleString(),s]})}function g(){const[r,t]=o.useState(5),[s,u]=o.useState(30),[n,c]=o.useState(75),a=.4,i=Math.round(r*s*a*4.33),d=Math.round(i*n);return e.jsxs("div",{className:"bg-white border border-[#ECEAE3] rounded-xl p-6 shadow-sm",children:[e.jsx("h3",{className:"text-lg font-bold text-[#36342E] mb-1",children:"ROI Calculator"}),e.jsx("p",{className:"text-sm text-[#6B6960] mb-6",children:"Estimate how much your team could save with autonomous development."}),e.jsxs("div",{className:"space-y-5",children:[e.jsxs("div",{children:[e.jsxs("div",{className:"flex items-center justify-between mb-2",children:[e.jsx("label",{className:"text-sm font-medium text-[#36342E]",children:"Team size"}),e.jsxs("span",{className:"text-sm font-semibold text-[#553DE9] tabular-nums",children:[r," developers"]})]}),e.jsx("input",{type:"range",min:1,max:50,value:r,onChange:l=>t(Number(l.target.value)),className:"w-full h-2 bg-[#ECEAE3] rounded-full appearance-none cursor-pointer accent-[#553DE9]"}),e.jsxs("div",{className:"flex justify-between text-xs text-[#939084] mt-1",children:[e.jsx("span",{children:"1"}),e.jsx("span",{children:"50"})]})]}),e.jsxs("div",{children:[e.jsxs("div",{className:"flex items-center justify-between mb-2",children:[e.jsx("label",{className:"text-sm font-medium text-[#36342E]",children:"Hours coding per week"}),e.jsxs("span",{className:"text-sm font-semibold text-[#553DE9] tabular-nums",children:[s,"h"]})]}),e.jsx("input",{type:"range",min:5,max:60,value:s,onChange:l=>u(Number(l.target.value)),className:"w-full h-2 bg-[#ECEAE3] rounded-full appearance-none cursor-pointer accent-[#553DE9]"}),e.jsxs("div",{className:"flex justify-between text-xs text-[#939084] mt-1",children:[e.jsx("span",{children:"5h"}),e.jsx("span",{children:"60h"})]})]}),e.jsxs("div",{children:[e.jsxs("div",{className:"flex items-center justify-between mb-2",children:[e.jsx("label",{className:"text-sm font-medium text-[#36342E]",children:"Average hourly rate"}),e.jsxs("span",{className:"text-sm font-semibold text-[#553DE9] tabular-nums",children:["$",n,"/hr"]})]}),e.jsx("input",{type:"range",min:25,max:250,step:5,value:n,onChange:l=>c(Number(l.target.value)),className:"w-full h-2 bg-[#ECEAE3] rounded-full appearance-none cursor-pointer accent-[#553DE9]"}),e.jsxs("div",{className:"flex justify-between text-xs text-[#939084] mt-1",children:[e.jsx("span",{children:"$25"}),e.jsx("span",{children:"$250"})]})]})]}),e.jsxs("div",{className:"mt-6 pt-6 border-t border-[#ECEAE3]",children:[e.jsxs("div",{className:"grid grid-cols-2 gap-4 text-center",children:[e.jsxs("div",{children:[e.jsx("div",{className:"text-2xl font-bold text-[#553DE9]",children:e.jsx(f,{value:i,suffix:"h"})}),e.jsx("div",{className:"text-xs text-[#6B6960] mt-1",children:"Est. hours saved / month"})]}),e.jsxs("div",{children:[e.jsx("div",{className:"text-2xl font-bold text-[#1FC5A8]",children:e.jsx(f,{value:d,prefix:"$"})}),e.jsx("div",{className:"text-xs text-[#6B6960] mt-1",children:"Est. cost saved / month"})]})]}),e.jsxs("div",{className:"mt-4 p-3 rounded-lg bg-[#553DE9]/5 border border-[#553DE9]/10",children:[e.jsxs("p",{className:"text-sm text-[#36342E] text-center",children:["If Loki Mode saved ",Math.round(a*100),"% of coding time, your team could save"," ",e.jsxs("span",{className:"font-bold text-[#553DE9]",children:[i.toLocaleString()," hours"]})," ","and"," ",e.jsxs("span",{className:"font-bold text-[#1FC5A8]",children:["$",d.toLocaleString()]})," ","per month."]}),e.jsxs("p",{className:"mt-2 text-xs text-[#6B6960] text-center",children:["The ",Math.round(a*100),"% is an assumption, not a measurement. Model and API spend is not included."]})]})]})]})}const j=[{feature:"Claude (Opus/Sonnet/Haiku)",category:"AI Models",lokiMode:!0,boltNew:!1,replit:!1,lovable:!0},{feature:"GPT-4o / Codex",category:"AI Models",lokiMode:!0,boltNew:!0,replit:!0,lovable:!1},{feature:"5-provider auto-failover",category:"AI Models",lokiMode:!0,boltNew:!1,replit:!1,lovable:!1},{feature:"8 automated quality gates",category:"Quality",lokiMode:!0,boltNew:!1,replit:!1,lovable:!1},{feature:"Blind 3-reviewer code review",category:"Quality",lokiMode:!0,boltNew:!1,replit:!1,lovable:!1},{feature:"Anti-sycophancy checks",category:"Quality",lokiMode:!0,boltNew:!1,replit:!1,lovable:!1},{feature:"Automated test generation",category:"Quality",lokiMode:!0,boltNew:!1,replit:"Partial",lovable:!1},{feature:"Docker container generation",category:"Deployment",lokiMode:!0,boltNew:!1,replit:!0,lovable:!1},{feature:"CI/CD pipeline generation",category:"Deployment",lokiMode:!0,boltNew:!1,replit:!1,lovable:!1},{feature:"One-click cloud deploy",category:"Deployment",lokiMode:"Planned",boltNew:!0,replit:!0,lovable:!0},{feature:"Self-hosted (your keys)",category:"Cost",lokiMode:!0,boltNew:!1,replit:!1,lovable:!1},{feature:"Free tier available",category:"Cost",lokiMode:"Source-available (BUSL-1.1)",boltNew:!0,replit:!0,lovable:!0},{feature:"No vendor lock-in",category:"Cost",lokiMode:!0,boltNew:!1,replit:!1,lovable:!1},{feature:"SSO / OIDC authentication",category:"Enterprise",lokiMode:!0,boltNew:!1,replit:!0,lovable:!1},{feature:"RBAC access control",category:"Enterprise",lokiMode:!0,boltNew:!1,replit:!0,lovable:!1},{feature:"Audit logging",category:"Enterprise",lokiMode:!0,boltNew:!1,replit:!0,lovable:!1},{feature:"Air-gapped deployment",category:"Enterprise",lokiMode:!0,boltNew:!1,replit:!1,lovable:!1}];function y(){return e.jsx("svg",{width:"18",height:"18",viewBox:"0 0 24 24",fill:"none",className:"text-[#1FC5A8]",children:e.jsx("path",{d:"M20 6L9 17l-5-5",stroke:"currentColor",strokeWidth:"2.5",strokeLinecap:"round",strokeLinejoin:"round"})})}function w(){return e.jsx("svg",{width:"18",height:"18",viewBox:"0 0 24 24",fill:"none",className:"text-[#C45B5B]/40",children:e.jsx("path",{d:"M18 6L6 18M6 6l12 12",stroke:"currentColor",strokeWidth:"2",strokeLinecap:"round",strokeLinejoin:"round"})})}function x({value:r}){return typeof r=="string"?e.jsx("span",{className:"text-xs text-[#6B6960] font-medium",children:r}):r?e.jsx(y,{}):e.jsx(w,{})}const k=[{title:"Full Autonomy",description:"Describe what you want. Loki Mode handles planning, coding, testing, and verification automatically.",icon:e.jsx("svg",{width:"24",height:"24",viewBox:"0 0 24 24",fill:"none",className:"text-[#553DE9]",children:e.jsx("path",{d:"M13 2L3 14h9l-1 8 10-12h-9l1-8z",stroke:"currentColor",strokeWidth:"2",strokeLinecap:"round",strokeLinejoin:"round"})})},{title:"Production Quality",description:"8 quality gates, blind code review, and anti-sycophancy checks ensure code that actually works.",icon:e.jsx("svg",{width:"24",height:"24",viewBox:"0 0 24 24",fill:"none",className:"text-[#1FC5A8]",children:e.jsx("path",{d:"M12 22s8-4 8-10V5l-8-3-8 3v7c0 6 8 10 8 10z",stroke:"currentColor",strokeWidth:"2",strokeLinecap:"round",strokeLinejoin:"round"})})},{title:"Your Infrastructure",description:"Self-hosted, source-available (BUSL-1.1), no data leaves your network. Use your own API keys across 5 providers.",icon:e.jsxs("svg",{width:"24",height:"24",viewBox:"0 0 24 24",fill:"none",className:"text-[#2F71E3]",children:[e.jsx("rect",{x:"2",y:"2",width:"20",height:"8",rx:"2",stroke:"currentColor",strokeWidth:"2"}),e.jsx("rect",{x:"2",y:"14",width:"20",height:"8",rx:"2",stroke:"currentColor",strokeWidth:"2"}),e.jsx("circle",{cx:"6",cy:"6",r:"1",fill:"currentColor"}),e.jsx("circle",{cx:"6",cy:"18",r:"1",fill:"currentColor"})]})},{title:"Built for Teams",description:"Enterprise auth, RBAC, audit logs, and parallel workflows for teams of any size.",icon:e.jsxs("svg",{width:"24",height:"24",viewBox:"0 0 24 24",fill:"none",className:"text-[#E93D82]",children:[e.jsx("path",{d:"M17 21v-2a4 4 0 00-4-4H5a4 4 0 00-4 4v2",stroke:"currentColor",strokeWidth:"2",strokeLinecap:"round",strokeLinejoin:"round"}),e.jsx("circle",{cx:"9",cy:"7",r:"4",stroke:"currentColor",strokeWidth:"2"}),e.jsx("path",{d:"M23 21v-2a4 4 0 00-3-3.87M16 3.13a4 4 0 010 7.75",stroke:"currentColor",strokeWidth:"2",strokeLinecap:"round",strokeLinejoin:"round"})]})}];function C(){const r=[...new Set(j.map(t=>t.category))];return e.jsx("div",{className:"min-h-screen bg-[#FAF9F6]",children:e.jsxs("div",{className:"max-w-6xl mx-auto px-6 py-8",children:[e.jsxs("div",{className:"mb-8",children:[e.jsx("h1",{className:"text-2xl font-bold text-[#36342E]",children:"Compare"}),e.jsx("p",{className:"text-[#6B6960] mt-1",children:"See how Loki Mode stacks up against other AI development platforms."})]}),e.jsx("div",{className:"bg-white border border-[#ECEAE3] rounded-xl overflow-hidden shadow-sm",children:e.jsx("div",{className:"overflow-x-auto",children:e.jsxs("table",{className:"w-full text-sm",children:[e.jsx("thead",{children:e.jsxs("tr",{className:"border-b border-[#ECEAE3]",children:[e.jsx("th",{className:"text-left px-4 py-3 font-medium text-[#6B6960] w-[240px]",children:"Feature"}),e.jsx("th",{className:"text-center px-4 py-3 font-bold text-[#553DE9] bg-[#553DE9]/5 w-[130px]",children:"Loki Mode"}),e.jsx("th",{className:"text-center px-4 py-3 font-medium text-[#6B6960] w-[130px]",children:"bolt.new"}),e.jsx("th",{className:"text-center px-4 py-3 font-medium text-[#6B6960] w-[130px]",children:"Replit"}),e.jsx("th",{className:"text-center px-4 py-3 font-medium text-[#6B6960] w-[130px]",children:"Lovable"})]})}),e.jsx("tbody",{children:r.map(t=>e.jsxs(e.Fragment,{children:[e.jsx("tr",{className:"bg-[#FAF9F6]",children:e.jsx("td",{colSpan:5,className:"px-4 py-2 text-xs font-bold text-[#939084] uppercase tracking-wider",children:t})},`cat-${t}`),j.filter(s=>s.category===t).map(s=>e.jsxs("tr",{className:"border-b border-[#ECEAE3] last:border-b-0",children:[e.jsx("td",{className:"px-4 py-2.5 text-[#36342E]",children:s.feature}),e.jsx("td",{className:"px-4 py-2.5 text-center bg-[#553DE9]/5",children:e.jsx("div",{className:"flex justify-center",children:e.jsx(x,{value:s.lokiMode})})}),e.jsx("td",{className:"px-4 py-2.5 text-center",children:e.jsx("div",{className:"flex justify-center",children:e.jsx(x,{value:s.boltNew})})}),e.jsx("td",{className:"px-4 py-2.5 text-center",children:e.jsx("div",{className:"flex justify-center",children:e.jsx(x,{value:s.replit})})}),e.jsx("td",{className:"px-4 py-2.5 text-center",children:e.jsx("div",{className:"flex justify-center",children:e.jsx(x,{value:s.lovable})})})]},s.feature))]}))})]})})}),e.jsxs("div",{className:"mt-12",children:[e.jsx("h2",{className:"text-xl font-bold text-[#36342E] mb-6",children:"Why developers choose Loki Mode"}),e.jsx("div",{className:"grid grid-cols-1 md:grid-cols-2 gap-5",children:k.map(t=>e.jsxs("div",{className:"bg-white border border-[#ECEAE3] rounded-xl p-5 shadow-sm hover:shadow-md transition-shadow",children:[e.jsx("div",{className:"mb-3",children:t.icon}),e.jsx("h3",{className:"text-base font-bold text-[#36342E] mb-1",children:t.title}),e.jsx("p",{className:"text-sm text-[#6B6960]",children:t.description})]},t.title))})]}),e.jsx("div",{className:"mt-12 max-w-xl mx-auto",children:e.jsx(g,{})})]})})}export{C as default};

package/web-app/dist/assets/{ErrorBoundary-BxiLU-gm.js → ErrorBoundary-KJ1WCGVK.js}

@@ -1,4 +1,4 @@
-import{c as o,r as a,j as e,T as n,h as i,p as c}from"./index-CCMAsJAW.js";/**
+import{c as o,r as a,j as e,T as n,h as i,p as c}from"./index-Cyw0iehe.js";/**
  * @license lucide-react v0.577.0 - ISC
  *
  * This source code is licensed under the ISC license.

package/web-app/dist/assets/{EvidenceReceiptPanel-BKpHqQTX.js → EvidenceReceiptPanel-8TG9VopB.js}

@@ -1 +1 @@
-import{r as l,a as x,j as e}from"./index-CCMAsJAW.js";const N={verified:{badge:"bg-success/10 text-success border-success/20",dot:"bg-success",label:"Verified",proven:"The server recomputed the integrity hash and it matches, and the gpg signature verified against its keyring.",notProven:"That the code is correct, or that the recorded diff still matches your repo. A receipt records which checks ran, not that the result is right."},unsigned:{badge:"bg-warning/10 text-warning border-warning/20",dot:"bg-warning",label:"Unsigned",proven:"The server recomputed the integrity hash and it matches these receipt bytes.",notProven:"Who produced it. An unsigned receipt is forgeable: whoever controls the builder can rewrite the facts and recompute the hash."},unchecked:{badge:"bg-warning/10 text-warning border-warning/20",dot:"bg-warning",label:"Not checked",proven:"The server recomputed the integrity hash and it matches.",notProven:"Provenance. A signature is present but was not evaluated here, which is not the same as a bad signature."},tampered:{badge:"bg-danger/10 text-danger border-danger/20",dot:"bg-danger",label:"Tampered",proven:"Nothing. The server recomputed the integrity hash and it does not match the contents.",notProven:"Anything at all. This receipt was edited after it was written. Do not trust this build."},failed:{badge:"bg-danger/10 text-danger border-danger/20",dot:"bg-danger",label:"Failed verification",proven:"Nothing. A verification check ran on the server and said no.",notProven:"Anything the receipt claims. Read the reason below."},not_verified:{badge:"border-muted/20 text-muted",dot:"bg-muted/40",label:"Not verified here",proven:"Nothing. No verification result was computed for this receipt here.",notProven:"Integrity or provenance. Run the command below to check it yourself."}};function w(t){const n=t==null?void 0:t.integrity_check,r=t==null?void 0:t.verification;return n?n.status==="tampered"?"tampered":n.status==="failed"?"failed":n.status!=="verified"?"not_verified":n.gpg_ok===!0?"verified":r!=null&&r.attestation||r!=null&&r.gpg_signature?"unchecked":"unsigned":"not_verified"}const v=[{key:"verified",label:"Verified",bar:"bg-success",text:"text-success"},{key:"with_gaps",label:"With gaps",bar:"bg-warning",text:"text-warning"},{key:"not_verified",label:"Not verified",bar:"bg-danger",text:"text-danger"},{key:"unknown",label:"Unknown",bar:"bg-muted/40",text:"text-muted"}];function y({summary:t}){const n=t.total_receipts;return n?e.jsxs("div",{className:"space-y-2",children:[e.jsx("div",{className:"flex h-1.5 rounded-full overflow-hidden bg-muted/10",children:v.map(({key:r,bar:s})=>{const i=t[r];return i?e.jsx("div",{className:s,style:{width:`${i/n*100}%`},title:`${i} ${r}`},r):null})}),e.jsx("div",{className:"flex flex-wrap gap-x-4 gap-y-1 text-xs",children:v.map(({key:r,label:s,text:i})=>{const c=t[r];return c?e.jsxs("span",{className:i,children:[e.jsx("span",{className:"font-semibold",children:c})," ",s.toLowerCase()]},r):null})}),e.jsxs("p",{className:"text-muted text-xs",children:["Recorded verdicts across ",n," receipt",n===1?"":"s",", not re-verified here."]})]}):null}function u({label:t,value:n}){return e.jsxs("div",{className:"flex items-baseline gap-2 text-xs",children:[e.jsx("span",{className:"text-muted w-28 flex-shrink-0",children:t}),e.jsx("span",{className:"font-mono truncate",title:n,children:n})]})}function k({proof:t}){var m,p,g,f,b;const[n,r]=l.useState(!1),[s,i]=l.useState(null),[c,d]=l.useState(null);l.useEffect(()=>{if(!n||s||c)return;let o=!1;return x.getProof(t.run_id).then(h=>{o||i(h)}).catch(h=>{o||d((h==null?void 0:h.message)||"could not load this receipt")}),()=>{o=!0}},[n,t.run_id,s,c]);const a=N[w(s)],j=t.generated_at?new Date(t.generated_at).toLocaleString():"unknown";return e.jsxs("div",{className:`border rounded-card overflow-hidden ${s?a.badge:"border-muted/20"}`,children:[e.jsxs("button",{type:"button",className:"w-full flex items-center gap-3 px-3 py-2.5 text-left",onClick:()=>r(!n),"aria-expanded":n,children:[e.jsx("span",{className:`w-2 h-2 rounded-full flex-shrink-0 ${s?a.dot:"bg-muted/40"}`}),e.jsx("span",{className:"text-sm font-medium flex-1 truncate",children:t.headline?`Recorded: ${t.headline}`:t.run_id}),t.final_verdict&&e.jsxs("span",{className:"text-xs font-mono uppercase tracking-wider flex-shrink-0 text-muted",children:["council ",t.final_verdict]}),e.jsx("span",{className:"text-muted text-xs flex-shrink-0",children:n?"−":"+"})]}),n&&e.jsxs("div",{className:"px-3 pb-3 space-y-3 border-t border-current/10 pt-3",children:[c&&e.jsxs("p",{className:"text-xs text-danger",children:["Could not load this receipt: ",c]}),!c&&!s&&e.jsx("p",{className:"text-xs text-muted",children:"Loading receipt…"}),s&&e.jsxs(e.Fragment,{children:[e.jsxs("div",{className:"space-y-1",children:[e.jsx(u,{label:"Run",value:s.run_id}),e.jsx(u,{label:"Generated",value:j}),e.jsx(u,{label:"Loki version",value:s.loki_version||"unknown"}),e.jsx(u,{label:"Cost",value:typeof((m=s.cost)==null?void 0:m.usd)=="number"?`$${s.cost.usd.toFixed(2)}`:"unknown"}),e.jsx(u,{label:"Files changed",value:typeof((p=s.files_changed)==null?void 0:p.count)=="number"?String(s.files_changed.count):"unknown"}),((g=s.verification)==null?void 0:g.hash)&&e.jsx(u,{label:"Recorded hash",value:s.verification.hash})]}),e.jsxs("div",{className:`rounded-card border px-3 py-2 ${a.badge}`,children:[e.jsx("p",{className:"text-xs font-semibold uppercase tracking-wider mb-1",children:a.label}),e.jsxs("p",{className:"text-xs mb-1",children:[e.jsx("span",{className:"font-semibold",children:"Proven: "}),a.proven]}),e.jsxs("p",{className:"text-xs opacity-80",children:[e.jsx("span",{className:"font-semibold",children:"Not proven: "}),a.notProven]}),(((f=s.integrity_check)==null?void 0:f.reasons)||[]).slice(0,2).map(o=>e.jsx("p",{className:"text-xs opacity-80 mt-1",children:o},o))]}),e.jsxs("p",{className:"text-xs text-muted",children:["Verify it yourself (also re-derives the diff against your repo):"," ",e.jsxs("code",{className:"font-mono",children:["loki proof verify ",s.run_id,(b=s.verification)!=null&&b.attestation?" --jwks <url|file>":""]})]}),t.pr_url&&e.jsx("a",{href:t.pr_url,target:"_blank",rel:"noreferrer noopener",className:"text-xs text-primary underline",children:"View the pull request"})]})]})]})}function P(){const[t,n]=l.useState(null),[r,s]=l.useState(null),[i,c]=l.useState(null);return l.useEffect(()=>{let d=!1;return x.listProofs().then(a=>{d||n(a.proofs||[])}).catch(a=>{d||c((a==null?void 0:a.message)||"could not load receipts")}),x.proofsSummary().then(a=>{d||s(a)}).catch(()=>{}),()=>{d=!0}},[]),e.jsxs("section",{className:"space-y-3",children:[e.jsxs("div",{children:[e.jsx("h2",{className:"text-sm font-semibold",children:"Evidence Receipts"}),e.jsx("p",{className:"text-muted text-xs mt-1",children:"What each build actually checked, recorded so you can verify it yourself."})]}),i&&e.jsxs("p",{className:"text-xs text-danger",children:["Could not load receipts: ",i]}),!i&&t===null&&e.jsx("p",{className:"text-xs text-muted",children:"Loading…"}),r&&e.jsx(y,{summary:r}),t!==null&&t.length===0&&e.jsxs("p",{className:"text-xs text-muted",children:["No receipts yet. One is written at the end of each run (set ",e.jsx("code",{className:"font-mono",children:"LOKI_PROOF=0"})," to opt out)."]}),e.jsx("div",{className:"space-y-2",children:t==null?void 0:t.map(d=>e.jsx(k,{proof:d},d.run_id))})]})}export{P as E};
+import{r as l,a as x,j as e}from"./index-Cyw0iehe.js";const N={verified:{badge:"bg-success/10 text-success border-success/20",dot:"bg-success",label:"Verified",proven:"The server recomputed the integrity hash and it matches, and the gpg signature verified against its keyring.",notProven:"That the code is correct, or that the recorded diff still matches your repo. A receipt records which checks ran, not that the result is right."},unsigned:{badge:"bg-warning/10 text-warning border-warning/20",dot:"bg-warning",label:"Unsigned",proven:"The server recomputed the integrity hash and it matches these receipt bytes.",notProven:"Who produced it. An unsigned receipt is forgeable: whoever controls the builder can rewrite the facts and recompute the hash."},unchecked:{badge:"bg-warning/10 text-warning border-warning/20",dot:"bg-warning",label:"Not checked",proven:"The server recomputed the integrity hash and it matches.",notProven:"Provenance. A signature is present but was not evaluated here, which is not the same as a bad signature."},tampered:{badge:"bg-danger/10 text-danger border-danger/20",dot:"bg-danger",label:"Tampered",proven:"Nothing. The server recomputed the integrity hash and it does not match the contents.",notProven:"Anything at all. This receipt was edited after it was written. Do not trust this build."},failed:{badge:"bg-danger/10 text-danger border-danger/20",dot:"bg-danger",label:"Failed verification",proven:"Nothing. A verification check ran on the server and said no.",notProven:"Anything the receipt claims. Read the reason below."},not_verified:{badge:"border-muted/20 text-muted",dot:"bg-muted/40",label:"Not verified here",proven:"Nothing. No verification result was computed for this receipt here.",notProven:"Integrity or provenance. Run the command below to check it yourself."}};function w(t){const n=t==null?void 0:t.integrity_check,r=t==null?void 0:t.verification;return n?n.status==="tampered"?"tampered":n.status==="failed"?"failed":n.status!=="verified"?"not_verified":n.gpg_ok===!0?"verified":r!=null&&r.attestation||r!=null&&r.gpg_signature?"unchecked":"unsigned":"not_verified"}const v=[{key:"verified",label:"Verified",bar:"bg-success",text:"text-success"},{key:"with_gaps",label:"With gaps",bar:"bg-warning",text:"text-warning"},{key:"not_verified",label:"Not verified",bar:"bg-danger",text:"text-danger"},{key:"unknown",label:"Unknown",bar:"bg-muted/40",text:"text-muted"}];function y({summary:t}){const n=t.total_receipts;return n?e.jsxs("div",{className:"space-y-2",children:[e.jsx("div",{className:"flex h-1.5 rounded-full overflow-hidden bg-muted/10",children:v.map(({key:r,bar:s})=>{const i=t[r];return i?e.jsx("div",{className:s,style:{width:`${i/n*100}%`},title:`${i} ${r}`},r):null})}),e.jsx("div",{className:"flex flex-wrap gap-x-4 gap-y-1 text-xs",children:v.map(({key:r,label:s,text:i})=>{const c=t[r];return c?e.jsxs("span",{className:i,children:[e.jsx("span",{className:"font-semibold",children:c})," ",s.toLowerCase()]},r):null})}),e.jsxs("p",{className:"text-muted text-xs",children:["Recorded verdicts across ",n," receipt",n===1?"":"s",", not re-verified here."]})]}):null}function u({label:t,value:n}){return e.jsxs("div",{className:"flex items-baseline gap-2 text-xs",children:[e.jsx("span",{className:"text-muted w-28 flex-shrink-0",children:t}),e.jsx("span",{className:"font-mono truncate",title:n,children:n})]})}function k({proof:t}){var m,p,g,f,b;const[n,r]=l.useState(!1),[s,i]=l.useState(null),[c,d]=l.useState(null);l.useEffect(()=>{if(!n||s||c)return;let o=!1;return x.getProof(t.run_id).then(h=>{o||i(h)}).catch(h=>{o||d((h==null?void 0:h.message)||"could not load this receipt")}),()=>{o=!0}},[n,t.run_id,s,c]);const a=N[w(s)],j=t.generated_at?new Date(t.generated_at).toLocaleString():"unknown";return e.jsxs("div",{className:`border rounded-card overflow-hidden ${s?a.badge:"border-muted/20"}`,children:[e.jsxs("button",{type:"button",className:"w-full flex items-center gap-3 px-3 py-2.5 text-left",onClick:()=>r(!n),"aria-expanded":n,children:[e.jsx("span",{className:`w-2 h-2 rounded-full flex-shrink-0 ${s?a.dot:"bg-muted/40"}`}),e.jsx("span",{className:"text-sm font-medium flex-1 truncate",children:t.headline?`Recorded: ${t.headline}`:t.run_id}),t.final_verdict&&e.jsxs("span",{className:"text-xs font-mono uppercase tracking-wider flex-shrink-0 text-muted",children:["council ",t.final_verdict]}),e.jsx("span",{className:"text-muted text-xs flex-shrink-0",children:n?"−":"+"})]}),n&&e.jsxs("div",{className:"px-3 pb-3 space-y-3 border-t border-current/10 pt-3",children:[c&&e.jsxs("p",{className:"text-xs text-danger",children:["Could not load this receipt: ",c]}),!c&&!s&&e.jsx("p",{className:"text-xs text-muted",children:"Loading receipt…"}),s&&e.jsxs(e.Fragment,{children:[e.jsxs("div",{className:"space-y-1",children:[e.jsx(u,{label:"Run",value:s.run_id}),e.jsx(u,{label:"Generated",value:j}),e.jsx(u,{label:"Loki version",value:s.loki_version||"unknown"}),e.jsx(u,{label:"Cost",value:typeof((m=s.cost)==null?void 0:m.usd)=="number"?`$${s.cost.usd.toFixed(2)}`:"unknown"}),e.jsx(u,{label:"Files changed",value:typeof((p=s.files_changed)==null?void 0:p.count)=="number"?String(s.files_changed.count):"unknown"}),((g=s.verification)==null?void 0:g.hash)&&e.jsx(u,{label:"Recorded hash",value:s.verification.hash})]}),e.jsxs("div",{className:`rounded-card border px-3 py-2 ${a.badge}`,children:[e.jsx("p",{className:"text-xs font-semibold uppercase tracking-wider mb-1",children:a.label}),e.jsxs("p",{className:"text-xs mb-1",children:[e.jsx("span",{className:"font-semibold",children:"Proven: "}),a.proven]}),e.jsxs("p",{className:"text-xs opacity-80",children:[e.jsx("span",{className:"font-semibold",children:"Not proven: "}),a.notProven]}),(((f=s.integrity_check)==null?void 0:f.reasons)||[]).slice(0,2).map(o=>e.jsx("p",{className:"text-xs opacity-80 mt-1",children:o},o))]}),e.jsxs("p",{className:"text-xs text-muted",children:["Verify it yourself (also re-derives the diff against your repo):"," ",e.jsxs("code",{className:"font-mono",children:["loki proof verify ",s.run_id,(b=s.verification)!=null&&b.attestation?" --jwks <url|file>":""]})]}),t.pr_url&&e.jsx("a",{href:t.pr_url,target:"_blank",rel:"noreferrer noopener",className:"text-xs text-primary underline",children:"View the pull request"})]})]})]})}function P(){const[t,n]=l.useState(null),[r,s]=l.useState(null),[i,c]=l.useState(null);return l.useEffect(()=>{let d=!1;return x.listProofs().then(a=>{d||n(a.proofs||[])}).catch(a=>{d||c((a==null?void 0:a.message)||"could not load receipts")}),x.proofsSummary().then(a=>{d||s(a)}).catch(()=>{}),()=>{d=!0}},[]),e.jsxs("section",{className:"space-y-3",children:[e.jsxs("div",{children:[e.jsx("h2",{className:"text-sm font-semibold",children:"Evidence Receipts"}),e.jsx("p",{className:"text-muted text-xs mt-1",children:"What each build actually checked, recorded so you can verify it yourself."})]}),i&&e.jsxs("p",{className:"text-xs text-danger",children:["Could not load receipts: ",i]}),!i&&t===null&&e.jsx("p",{className:"text-xs text-muted",children:"Loading…"}),r&&e.jsx(y,{summary:r}),t!==null&&t.length===0&&e.jsxs("p",{className:"text-xs text-muted",children:["No receipts yet. One is written at the end of each run (set ",e.jsx("code",{className:"font-mono",children:"LOKI_PROOF=0"})," to opt out)."]}),e.jsx("div",{className:"space-y-2",children:t==null?void 0:t.map(d=>e.jsx(k,{proof:d},d.run_id))})]})}export{P as E};

package/web-app/dist/assets/{GitHubIssuesPanel-DCBAGBey.js → GitHubIssuesPanel-BnbS5gQg.js}

@@ -1,4 +1,4 @@
-import{c as _,r as o,a as k,j as e,m as B,J as v,N as h,a5 as H,M as L,l as q}from"./index-CCMAsJAW.js";import{B as N}from"./Button-uD8DtV8A.js";import{C as y}from"./thumbs-up-Bf9EPha1.js";import{R as S}from"./refresh-cw-BT2CvLmV.js";import{C as z}from"./circle-alert-CDXwnHdj.js";import{U as D}from"./user-DKle9QPo.js";import{L as G}from"./loader-circle-D3XG86Eb.js";import{R as T}from"./rotate-ccw-DFEEIWSI.js";/**
+import{c as _,r as o,a as k,j as e,m as B,J as v,N as h,a5 as H,M as L,l as q}from"./index-Cyw0iehe.js";import{B as N}from"./Button-DqFijh1t.js";import{C as y}from"./thumbs-up-Cwg2QohI.js";import{R as S}from"./refresh-cw-D2tureNn.js";import{C as z}from"./circle-alert-t3qnFaLA.js";import{U as D}from"./user-DnZKgBa-.js";import{L as G}from"./loader-circle-fz1m_qyG.js";import{R as T}from"./rotate-ccw-CO9asUB3.js";/**
  * @license lucide-react v0.577.0 - ISC
  *
  * This source code is licensed under the ISC license.

package/web-app/dist/assets/{GitHubPRsPanel-BbuTShuc.js → GitHubPRsPanel-QsViwYBT.js}

@@ -1,4 +1,4 @@
-import{c as I,r as c,a as b,j as e,G as me,A as ue,S as Z,k as ee,m as pe,h as he,p as fe,X as te,M as be}from"./index-CCMAsJAW.js";import{B as y}from"./Button-uD8DtV8A.js";import{C as ge}from"./chevron-left-DAMVo_FN.js";import{G as P}from"./thumbs-up-Bf9EPha1.js";import{R as $}from"./refresh-cw-BT2CvLmV.js";import{C as Ne}from"./circle-alert-CDXwnHdj.js";import{L as Q,S as je}from"./ProjectPage-DwpdTqRm.js";import{S as se}from"./shield-alert-Cfq3M6Sq.js";import{F as ye}from"./file-code-corner-BhT9HDbd.js";import{C as V}from"./clock-CG9o0zgK.js";import{C as re}from"./check-zzTEyu5C.js";import"./ErrorBoundary-BxiLU-gm.js";import"./TerminalOutput-D-NqghAv.js";import"./lock-CjWeWASl.js";import"./package-WugiQ9wc.js";import"./file-plus-DZLJn576.js";import"./activity-CjPTVzFk.js";import"./scroll-text-Byp_Qui_.js";import"./bot-B1Mc6ViV.js";import"./loader-circle-D3XG86Eb.js";import"./hammer-D2XXuXr_.js";import"./dollar-sign-i_pmA6g5.js";import"./globe-Bgw8ae_Q.js";import"./trash-2-Cd0gDTru.js";import"./upload-Ba2_IFPe.js";import"./plus-BnP7v-Ox.js";import"./rotate-ccw-DFEEIWSI.js";import"./code-xml-BQfcp-ky.js";import"./trending-up-DFl5twW_.js";import"./layers-DNhvlI4K.js";import"./trending-down--Pztmpkh.js";import"./server-AmNijQ29.js";/**
+import{c as I,r as c,a as b,j as e,G as me,A as ue,S as Z,k as ee,m as pe,h as he,p as fe,X as te,M as be}from"./index-Cyw0iehe.js";import{B as y}from"./Button-DqFijh1t.js";import{C as ge}from"./chevron-left-DvsvMWo4.js";import{G as P}from"./thumbs-up-Cwg2QohI.js";import{R as $}from"./refresh-cw-D2tureNn.js";import{C as Ne}from"./circle-alert-t3qnFaLA.js";import{L as Q,S as je}from"./ProjectPage-DnEnuZL8.js";import{S as se}from"./shield-alert-OZCHTW9G.js";import{F as ye}from"./file-code-corner-Ch9htpS3.js";import{C as V}from"./clock-DPelcqof.js";import{C as re}from"./check-DL4Pmd0G.js";import"./ErrorBoundary-KJ1WCGVK.js";import"./TerminalOutput-C1TOba5Z.js";import"./lock-C8el6Nma.js";import"./package-BwVcYrn4.js";import"./file-plus-QlZOWwR2.js";import"./activity-CBTzzRu1.js";import"./scroll-text-CcVCuiPk.js";import"./bot-BPcsYYVi.js";import"./loader-circle-fz1m_qyG.js";import"./hammer-zIyoDfnl.js";import"./dollar-sign-CDTMWNIm.js";import"./globe-BXA2crAj.js";import"./trash-2-N2pjfN_R.js";import"./upload-QqL7JN5e.js";import"./plus-Dhk0Lmnm.js";import"./rotate-ccw-CO9asUB3.js";import"./code-xml-C7SwLtD6.js";import"./trending-up-CklD7DnW.js";import"./layers-BVOciYK7.js";import"./trending-down-CSPOiXdQ.js";import"./server-JrM9ZY4N.js";/**
  * @license lucide-react v0.577.0 - ISC
  *
  * This source code is licensed under the ISC license.