loki-mode 10.6.13 → 10.6.14

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: An autonomous software factory that knows what it is supposed to deliver, and proves it did. Use when the user says Loki Mode or asks to build, fix or verify software autonomously.
 ---
 
-# Loki Mode v10.6.13
+# Loki Mode v10.6.14
 
 **Current entry points (Loki 10 engine):** `loki "<task>"`, `loki owner/repo#N` and `loki quick "<task>"` run the Loki 10 engine and end with a signed receipt (`loki verify`). `loki backlog owner/repo --all` runs many issues in parallel. Guide: `docs/v10/GUIDE.md`. The skill instructions below, and `loki start`, describe the legacy engine, which still ships and is being removed (`loki start owner/repo#N` still routes to it; prefer `loki owner/repo#N`).
 
@@ -15,7 +15,7 @@ description: An autonomous software factory that knows what it is supposed to de
 
 **Provider-agnostic (stable since v5.0.0):** runs on Claude/Codex/Cline/Aider with abstract model tiers and degraded mode for non-Claude providers; no vendor lock-in. Gemini deprecated v7.5.18. See `skills/providers.md`. **Legacy track (v8.0.0):** the Anthropic Agent SDK route (see below), spec-mode expansion for OpenAPI/GraphQL/Postman contracts, the runtime-boot and secret-leak evidence axes, and `loki steer` / `loki why` for mid-run control. Earlier tracks: LSP grounding as a first-class agent tool (v7.7.x) and Phase 1 RARV-C closure (real provider judges, gate-failure flock, synthetic PRD e2e, status `--json`).
 
-**Runtime migration:** Bash-to-Bun migration. Read-only commands (`version`, `status`, `stats`, `doctor`, `provider show/list`, `memory list/index`) flow through Bun runtime via `bin/loki` since v7.3.0. Every other command remains on the Bash runtime (`autonomy/loki`). Rollback: `LOKI_LEGACY_BASH=1`. See `UPGRADING.md` and `docs/architecture/ADR-001-runtime-migration.md`.
+**Runtime migration:** Bash-to-Bun migration. `bin/loki` is the router: the commands in its Bun-route `case` (read-only ones such as `version`, `status`, `stats`, `doctor`, `provider`, `memory`, plus stateful ones such as `rollback`, `trust`, `proof`/`receipt`, `control`, `answer`) run through `loki-ts/src/cli.ts` on Bun; the rest, and some flag forms (for example `doctor --airgap`, `trust detail`), run on Bash (`autonomy/loki`). `start` is Bash by default and goes to Bun only for the SDK loop (`LOKI_SDK_LOOP=1`) or Loki 10 engine inputs (issue refs, multi-word tasks). Read `bin/loki` and `cli.ts` for the exact set rather than trusting a list here. Rollback: `LOKI_LEGACY_BASH=1`. See `UPGRADING.md` and `docs/architecture/ADR-001-runtime-migration.md`.
 
 **Anthropic Agent SDK route (v8.0.0, opt-in, default-off):** a claude-binary-free path where the RARV loop runs on `@anthropic-ai/claude-agent-sdk` `query()` and judges run on the raw `@anthropic-ai/sdk`. One operator switch `LOKI_SDK_MODE` (`off` default / `judges` / `full`), mirrored byte-for-byte in bash (`autonomy/lib/sdk-mode.sh`) and TypeScript (`loki-ts/src/runner/sdk_mode.ts`). Unset = byte-identical to the claude-CLI route. See `references/sdk-mode.md`.
 
@@ -473,4 +473,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v10.6.13 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**
+**v10.6.14 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**

package/VERSION

@@ -1 +1 @@
-10.6.13
+10.6.14

package/autonomy/completion-council.sh

@@ -3606,7 +3606,7 @@ print(1 if runner not in ('none', '', 'None') and p is True else 0)
         devils_advocate)
             # Check for TODO/FIXME
             local todo_count
-            todo_count=$(grep -rl "TODO\|FIXME\|HACK\|XXX" . --include="*.ts" --include="*.js" --include="*.py" --include="*.sh" 2>/dev/null | wc -l | tr -d ' ')
+            todo_count=$(grep -rlE "\b(TODO|FIXME|HACK|XXX)s?\b" --exclude-dir=node_modules --exclude-dir=.git --exclude-dir=.loki --exclude-dir=dist --exclude-dir=build --exclude-dir=vendor . --include="*.ts" --include="*.js" --include="*.py" --include="*.sh" 2>/dev/null | wc -l | tr -d ' ')
             if [ "$todo_count" -gt 5 ]; then
                 ((issues++))
             fi
@@ -3883,7 +3883,7 @@ print(len(d.get('tasks', d) if isinstance(d, dict) else d))" 2>/dev/null)
             # count is a hard "not done"; a missing/absent test base means no
             # positive evidence even when TODOs are low.
             local todo_count
-            todo_count=$(grep -rl "TODO\|FIXME\|HACK\|XXX" . --include="*.ts" --include="*.js" --include="*.py" --include="*.sh" 2>/dev/null | wc -l | tr -d ' ')
+            todo_count=$(grep -rlE "\b(TODO|FIXME|HACK|XXX)s?\b" --exclude-dir=node_modules --exclude-dir=.git --exclude-dir=.loki --exclude-dir=dist --exclude-dir=build --exclude-dir=vendor . --include="*.ts" --include="*.js" --include="*.py" --include="*.sh" 2>/dev/null | wc -l | tr -d ' ')
             if [ "$todo_count" -gt 5 ]; then
                 blocked="true"
                 reasons="${reasons}$todo_count files with TODO/FIXME markers; "
@@ -4149,7 +4149,7 @@ else:
 
     # Skeptical check 3: TODO/FIXME/HACK density
     local todo_count
-    todo_count=$(grep -rl "TODO\|FIXME\|HACK\|XXX" . --include="*.ts" --include="*.js" --include="*.py" --include="*.sh" 2>/dev/null | wc -l | tr -d ' ')
+    todo_count=$(grep -rlE "\b(TODO|FIXME|HACK|XXX)s?\b" --exclude-dir=node_modules --exclude-dir=.git --exclude-dir=.loki --exclude-dir=dist --exclude-dir=build --exclude-dir=vendor . --include="*.ts" --include="*.js" --include="*.py" --include="*.sh" 2>/dev/null | wc -l | tr -d ' ')
     if [ "$todo_count" -gt 3 ]; then
         ((issues_found++))
         issue_details="${issue_details}$todo_count files still contain TODO/FIXME markers; "

package/autonomy/issue-parser.sh

@@ -259,6 +259,7 @@ extract_type_from_labels() {
 # claim.
 _gp_criteria_lines() {
     printf '%s\n' "${1:-}" \
+        | grep -E '^[[:space:]]*([-*][[:space:]]+|[0-9]+[.)][[:space:]]+)' \
         | sed -E 's/^[[:space:]]*[-*][[:space:]]*\[[ xX]\][[:space:]]*//; s/^[[:space:]]*[-*][[:space:]]+//; s/^[[:space:]]*[0-9]+[.)][[:space:]]+//' \
         | grep -vE '^[[:space:]]*$' \
         | grep -vE '^[[:space:]]*-{3,}[[:space:]]*$'

package/autonomy/loki

@@ -1817,14 +1817,14 @@ show_help() {
     echo "  cost council crash dashboard demo deploy docker docs doctor dogfood"
     echo "  enterprise estimate explain export failover github grill heal help"
     echo "  import init intent"
-    echo "  issue kpis logs magic mcp memory metrics migrate modernize monitor"
+    echo "  issue keys kpis logs magic mcp memory metrics migrate modernize monitor"
     echo "  next notify onboard open optimize otel outcomes own (handoff) pause plan preview"
     echo "  projects proof (receipt) provider quick quickstart rc remote report reset"
     echo "  resume review rollback run sandbox secrets secure self-update sentrux"
     echo "  serve setup-skill share ship spec start state stats status steer stop"
     echo "  syslog telemetry template test tour trigger trust trust-metrics"
     echo "  ultracode update verify version voice watch watchdog web welcome why"
-    echo "  wiki worktree (wt)"
+    echo "  wiki workspace worktree (wt)"
     echo "  control"
     echo ""
     echo "Any command: loki <command> --help"
@@ -19270,7 +19270,7 @@ LANG_BY_EXT = {
 }
 
 TEST_HINT = re.compile(r'(^|[/_.-])(test|tests|spec|specs|__tests__)([/_.-]|s?$|\.)', re.I)
-TODO_RE = re.compile(r'\b(TODO|FIXME|HACK|XXX)\b')
+TODO_RE = re.compile(r'\b(TODO|FIXME|HACK|XXX)s?\b')
 
 # import/require line -> the referenced module basename(s). Deliberately cheap:
 # we only need a proxy for how many OTHER files reference a given file, to rank
@@ -19291,6 +19291,7 @@ total_files = 0
 todo_count = 0
 has_tests = False
 big_files = []      # (loc, relpath)
+max_loc = 0         # largest file by LOC, across every file
 # module reference tallies: how many files import a given basename (no-ext)
 ref_counts = {}
 file_records = {}   # relpath -> record
@@ -19340,6 +19341,8 @@ for dirpath, dirnames, filenames in os.walk(root):
         }
         files.append(rec)
         file_records[rel] = rec
+        if loc > max_loc:
+            max_loc = loc
         if loc >= 500:
             big_files.append((loc, rel))
         # tally inbound references toward the imported basenames
@@ -19352,7 +19355,7 @@ for rec in files:
 
 # --- Technical-debt / maintenance-risk signals (all deterministic) ---
 big_files.sort(reverse=True)
-largest_loc = big_files[0][0] if big_files else 0
+largest_loc = max_loc
 # dependency-manifest presence (a real, cheap signal; NOT a staleness figure).
 manifest_names = {
     'package.json', 'requirements.txt', 'Pipfile', 'pyproject.toml', 'go.mod',
@@ -24647,16 +24650,17 @@ if total_removed > 0:
             # Show or rebuild the memory index layer
             if [ "${2:-}" = "rebuild" ]; then
                 PYTHONPATH="${SKILL_DIR}${PYTHONPATH:+:$PYTHONPATH}" python3 -c "
+import sys
 try:
-    from memory.layers import IndexLayer
-    layer = IndexLayer('.loki/memory')
-    layer.update([])  # Will scan and rebuild
-    print('Index rebuilt')
-except ImportError:
-    print('Error: memory.layers module not found')
+    from memory.engine import MemoryEngine
+    engine = MemoryEngine(base_path='.loki/memory')
+    engine.rebuild_index()
+    total = (engine.get_index() or {}).get('total_memories', 0)
 except Exception as e:
-    print(f'Error: {e}')
-" 2>/dev/null
+    print(f'Error: index rebuild failed: {type(e).__name__}: {e}', file=sys.stderr)
+    sys.exit(1)
+print(f'Index rebuilt: {total} memories indexed')
+" || return 1
             else
                 cat .loki/memory/index.json 2>/dev/null | python3 -m json.tool 2>/dev/null || echo "No index found"
             fi

package/autonomy/quickstart.sh

@@ -152,6 +152,12 @@ landing:static-landing-page:3
 static:static-landing-page:3
 marketing:static-landing-page:3
 fullstack:full-stack-demo:3
+shortener:rest-api:3
+url:rest-api:2
+urls:rest-api:2
+stats:dashboard:3
+statistics:dashboard:3
+metrics:dashboard:3
 MAP
 }
 
@@ -171,6 +177,10 @@ _qs_is_stopword() {
 # plus the curated keyword weights. No network, no provider, no LLM.
 _qs_score_templates() {
     local brief="$1"
+    # --best: print only the strongest real score (baseline excluded) so callers
+    # can tell a genuine match from simple-todo-app winning by default.
+    local best_mode=false
+    [ "${2:-}" = "--best" ] && best_mode=true
     local tdir; tdir="$(_qs_templates_dir)"
     local brief_lc; brief_lc=$(printf '%s' "$brief" | tr '[:upper:]' '[:lower:]')
 
@@ -198,7 +208,7 @@ _qs_score_templates() {
 
     # No templates resolvable: fall back to the guaranteed default only.
     if [ -z "$scores" ]; then
-        printf 'simple-todo-app\n'
+        if [ "$best_mode" = true ]; then printf '0\n'; else printf 'simple-todo-app\n'; fi
         return 0
     fi
 
@@ -230,7 +240,7 @@ _qs_score_templates() {
     done
 
     # Guaranteed default baseline: simple-todo-app gets +1 and wins exact ties.
-    deltas="${deltas}simple-todo-app\t1\n"
+    [ "$best_mode" = true ] || deltas="${deltas}simple-todo-app\t1\n"
 
     # Fold: keep only names that are REAL templates (a keyword map entry naming
     # a template that does not exist must not invent one), sum the deltas, then
@@ -250,7 +260,20 @@ _qs_score_templates() {
                 printf "%d\t%d\t%s\n", sum[n], prio, n
             }
         }
-    ' | sort -t"$(printf '\t')" -k1,1nr -k2,2n -k3,3 | head -3 | cut -f3
+    ' | sort -t"$(printf '\t')" -k1,1nr -k2,2n -k3,3 | {
+        if [ "$best_mode" = true ]; then
+            head -1 | cut -f1 | awk '{ print ($1 == "" ? 0 : $1) }'
+        else
+            head -3 | cut -f3
+        fi
+    }
+}
+
+# _qs_match_strength <brief>: the best real (non-baseline) template score. 0
+# means no template matched the brief at all; >= 2 is a real match (one
+# filename token or one curated keyword).
+_qs_match_strength() {
+    _qs_score_templates "$1" --best
 }
 
 # _qs_template_summary <name>: a short one-line description for the picker.
@@ -1363,6 +1386,10 @@ cmd_quickstart() {
             [ -n "$line" ] && top3+=("$line")
         done < <(_qs_score_templates "$brief")
 
+        local match_strength=0
+        match_strength="$(_qs_match_strength "$brief")"
+        case "$match_strength" in ''|*[!0-9]*) match_strength=0;; esac
+
         # Defensive: guarantee a default if scoring produced nothing.
         if [ "${#top3[@]}" -eq 0 ]; then
             top3=("simple-todo-app")
@@ -1388,6 +1415,9 @@ cmd_quickstart() {
                 printf '    %d) %-18s %s%s\n' "$i" "$t" "$(_qs_template_summary "$t")" "$suffix"
                 i=$((i + 1))
             done
+            if [ "$match_strength" -lt 2 ] && [ -n "$brief" ]; then
+                printf '  No strong match (score %s); these are weak guesses. Type "none" to build from your description.\n' "$match_strength"
+            fi
             printf '  Choose 1-%d, or press Enter for 1.\n' "${#top3[@]}"
             printf '> '
             read -r pick 2>/dev/null || pick=""
@@ -1400,7 +1430,17 @@ cmd_quickstart() {
             # non-interactive choice is exactly the one an operator pressing
             # Enter would get. No picker, no prompt, no second code path.
             printf '%sStep 3 of 4: Template%s\n' "$_QS_BOLD" "$_QS_NC"
-            printf '  Selected %s (top match) for "%s".\n\n' "${top3[0]}" "$brief"
+            if [ "$match_strength" -ge 2 ]; then
+                printf '  Selected %s (top match, score %s) for "%s".\n\n' "${top3[0]}" "$match_strength" "$brief"
+            elif [ -n "$brief" ]; then
+                # No template matched: building a todo app for an unrelated
+                # brief is wrong (issue #217). Use the brief as the spec.
+                pick="none"
+                printf '  No strong template match for "%s" (score %s).\n' "$brief" "$match_strength"
+                printf '  Falling back to a plain-spec build from your description.\n\n'
+            else
+                printf '  Selected %s (default) for the sample Todo app.\n\n' "${top3[0]}"
+            fi
         fi
 
         # An explicit rejection is honored, never converted into a selection.

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "10.6.13"
+__version__ = "10.6.14"
 
 # Expose the control app for easy import
 try:

package/docs/COMPETITOR-DEPLOYMENT-MODELS.md

@@ -213,10 +213,10 @@ verbatim:
 MCP server, https://docs.replit.com/platforms/mcp-server (accessed 2026-08-08).
 This is the programmatic trigger. Documented tools:
 
-- `create_app_from_prompt` — "Create a new Replit App from a natural language
+- `create_app_from_prompt` - "Create a new Replit App from a natural language
   description. Replit Agent immediately starts building the app."
-- `update_app_using_prompt` — "Make changes to an existing Replit App."
-- `ask_question` — "Ask Replit Agent about the current app."
+- `update_app_using_prompt` - "Make changes to an existing Replit App."
+- `ask_question` - "Ask Replit Agent about the current app."
 
 An Enterprise Admin API exists
 (https://docs.replit.com/teams/admin-api) but is scoped to account usage,

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 The flagship product of [Autonomi](https://www.autonomi.dev/). Loki Mode is a spec-driven autonomous builder with a built-in trust layer that takes any spec to a deployed product and verifies completion with evidence (quality gates plus a completion council), not just a "done" claim. Complete installation instructions for all platforms and use cases.
 
-**Version:** v10.6.13
+**Version:** v10.6.14
 
 **Engine note:** `loki "<task>"`, `loki owner/repo#N` and `loki quick` run the Loki 10 engine. `loki start` still routes to the legacy engine, which is being removed (planned work resumes 2026-10-07); prefer `loki owner/repo#N`. See [docs/v10/GUIDE.md](v10/GUIDE.md).
 

package/docs/architecture/ADR-001-runtime-migration.md

@@ -81,9 +81,9 @@ User constraint: "people use npm, I want to keep it the same way."
 | **Bash** (today) | `package.json` `bin` field points to shell script | Trivial; current state |
 | **Bun runtime** | `npm install -g loki-mode` ships TS, requires Bun installed via `npm install -g bun` (peer) OR Bun standalone in postinstall | Medium; peer dependency convention |
 | **Bun compiled binary** | `bun build --compile` → 60 MB binary per platform; npm postinstall downloads correct binary (esbuild model) | Medium; per-platform binaries |
-| **Go binary** | Same model as Bun compiled — npm postinstall downloads platform binary (esbuild, biome, vite-rust, swc all use this) | Medium; mature pattern |
-| **Python** | npm postinstall would shell out to `pip install` or bundle Python — fragile, two package managers | High; do not recommend |
-| **Node.js** | Native — no postinstall needed | Trivial; but Node is 10x slower than bash on cold start |
+| **Go binary** | Same model as Bun compiled - npm postinstall downloads platform binary (esbuild, biome, vite-rust, swc all use this) | Medium; mature pattern |
+| **Python** | npm postinstall would shell out to `pip install` or bundle Python - fragile, two package managers | High; do not recommend |
+| **Node.js** | Native - no postinstall needed | Trivial; but Node is 10x slower than bash on cold start |
 
 All three viable options (Bun runtime, Bun compiled, Go binary) keep the `npm install -g loki-mode` UX. Users see no change.
 
@@ -104,17 +104,17 @@ All three viable options (Bun runtime, Bun compiled, Go binary) keep the `npm in
 - Rewriting 33,000+ lines of bash to idiomatic Go is a 3-6 month effort.
 - Goroutines/channels are different mental model than bash + Python orchestration.
 
-**Distribution via npm:** Same pattern as esbuild — npm postinstall downloads the right platform binary. Mature, ~5 MB compressed per arch.
+**Distribution via npm:** Same pattern as esbuild - npm postinstall downloads the right platform binary. Mature, ~5 MB compressed per arch.
 
 ### Option B: Bun runtime + TypeScript
 
 **Pro:**
 - **Anthropic owns Bun.** Strategic alignment with the company that owns the model we depend on.
-- Native shell built in (`Bun.$\`echo hello\``) — minimal friction porting bash idioms.
-- Bun's `npm install` is 20-40x faster than npm — every CI run faster.
+- Native shell built in (`Bun.$\`echo hello\``) - minimal friction porting bash idioms.
+- Bun's `npm install` is 20-40x faster than npm - every CI run faster.
 - TypeScript: types catch bugs bash can't.
 - Anthropic-funded development means Bun improvements specifically target AI agent workloads.
-- 98% Node.js compatibility — npm packages work directly.
+- 98% Node.js compatibility - npm packages work directly.
 
 **Con:**
 - **1.7x SLOWER than bash on trivial cold-start** (7.6 ms vs 4.5 ms). The user explicitly said "no speed compromise". This is a genuine compromise, even if 3 ms is humanly invisible.
@@ -127,20 +127,20 @@ All three viable options (Bun runtime, Bun compiled, Go binary) keep the `npm in
 
 **Pro:**
 - Keep tiny scripts in bash (where it wins by 3 ms): `loki version`, `loki status`, anything <100 LOC.
-- Migrate the 11k-line orchestrator (`run.sh`) and 22k-line CLI (`autonomy/loki`) to Bun TypeScript — where compiled+typed wins.
-- Keep `memory/`, `providers/`, `mcp/` in Python — they're already mature, no reason to rewrite.
+- Migrate the 11k-line orchestrator (`run.sh`) and 22k-line CLI (`autonomy/loki`) to Bun TypeScript - where compiled+typed wins.
+- Keep `memory/`, `providers/`, `mcp/` in Python - they're already mature, no reason to rewrite.
 - Anthropic alignment via Bun for the parts that matter.
 - No speed regression for trivial commands; large gains for orchestrator.
 
 **Con:**
-- Three runtimes in the codebase (bash + Bun + Python) — operational complexity.
+- Three runtimes in the codebase (bash + Bun + Python) - operational complexity.
 - Cross-runtime debugging harder than monorepo.
 
 **Distribution:** Bun shipped via npm postinstall as compiled binary; bash remains as-is; Python unchanged.
 
 ## Recommendation
 
-**Option B (Bun runtime + TypeScript) — full migration, not hybrid.**
+**Option B (Bun runtime + TypeScript) - full migration, not hybrid.**
 
 Reasons:
 
@@ -148,7 +148,7 @@ Reasons:
 2. **Anthropic strategic alignment.** Anthropic owns Bun. Loki uses Claude. Aligning runtime and model owner reduces dependency-versioning friction over time.
 3. **TypeScript pays the maintainability dividend** that 33k lines of bash will never deliver. Type checking catches whole classes of bugs (the kind we hit in v6.81-v7.2 cycles).
 4. **Hybrid is now harder to justify.** When bash loses by 8.6x on the actual workload, keeping it for 3 ms theoretical wins on hello-world is bad engineering.
-5. **Go would still be 2-4x faster than Bun** in absolute cold-start, but: zero existing Go in the codebase, no Anthropic alignment, larger rewrite cost, no JS ecosystem reuse. Unless Loki specifically targets the sub-millisecond CLI category (which it doesn't — every command runs in a multi-second/minute autonomous loop), the absolute speed delta doesn't justify the strategic cost.
+5. **Go would still be 2-4x faster than Bun** in absolute cold-start, but: zero existing Go in the codebase, no Anthropic alignment, larger rewrite cost, no JS ecosystem reuse. Unless Loki specifically targets the sub-millisecond CLI category (which it doesn't - every command runs in a multi-second/minute autonomous loop), the absolute speed delta doesn't justify the strategic cost.
 
 **If user explicitly wants the absolute fastest:** Go (Option A) is 2.5x faster than Bun. But for orchestrator-heavy work where most time is spent waiting on Claude API calls, the difference is invisible.
 
@@ -214,7 +214,7 @@ Reasons:
 2. Port `cmd_version` to `loki-ts/src/commands/version.ts` (proof of concept)
 3. Add `bun-test.yml` GitHub workflow alongside existing `test.yml`
 4. Set acceptance criteria: every Phase 2+ command must benchmark within 2x of bash cold-start AND be type-checked via `bun typecheck`
-5. Ship Phase 1 as v8.0.0-alpha.1 (pre-release, opt-in) — does not affect default users
+5. Ship Phase 1 as v8.0.0-alpha.1 (pre-release, opt-in) - does not affect default users
 
 ---
 

package/docs/dev/architecture-reference.md

@@ -25,10 +25,10 @@ model explicitly rather than inherit the session model.
 - **Inspired by**: Amazon AGI Lab's "How Agentic AI Helps Heal Systems We Can't Replace"
 - **CLI**: `loki heal <path> [--phase archaeology|stabilize|isolate|modernize|validate]` (`autonomy/loki` `cmd_heal`)
 - **Principles**: Friction-as-semantics, failure-first learning, universal adapters, incremental healing, institutional knowledge preservation
-- **Artifacts**: `.loki/healing/` (friction-map.json, failure-modes.json, institutional-knowledge.md)
+- **Artifacts**: `.loki/healing/` (friction-map.json, failure-modes.json, institutional-knowledge.md). `loki heal` seeds failure-modes.json as `{"modes":[]}` and the prompt asks the agent to fill it; no code appends to it (NOT WIRED, issue #200)
 - **Review**: `legacy-healing-auditor` specialist added to code review pool (gated)
 - **Gate**: backward-compatibility / legacy-healing auditor (healing mode; not one of the 8 numbered gates) blocks removal of unclassified friction
-- **Hooks**: `hook_pre_healing_modify()` (`autonomy/hooks/migration-hooks.sh:283`), `hook_post_healing_modify()` (`:328`), `hook_healing_phase_gate()` (`:386`)
+- **Hooks**: `hook_pre_healing_modify()` (`autonomy/hooks/migration-hooks.sh:348`), `hook_post_healing_modify()` (`:576`), `hook_healing_phase_gate()`. NOT WIRED (issue #200): the pre/post modify hooks are defined and unit-tested but have no production caller, so the snapshot/revert pairing contract and the failure-modes.json append inside them are not enforced in a real heal run
 - **Memory**: `FrictionPoint` and `FailureMode` schemas for healing-specific memory entries
 - **Skill**: `skills/healing.md` | **Reference**: `references/legacy-healing-patterns.md`
 

package/docs/v10/BOARD.md

@@ -32,7 +32,7 @@ merge (all touch trust-core or security-relevant surfaces), oldest first.
 
 | ID | Owner | Branch @ SHA | File set (summary) | Tier | Status | Notes |
 |---|---|---|---|---|---|---|
-| GF-1 | cycle-4 (main) | main @ 779c50e5 (v9.54.1) | cycle 4 + verdict fix + XSS fix + pkill-scoping fix (D15/D16/D17, RELEASED) + D8-D17 | HIGH | blocked@2026-09-27T01:33Z | PF-2 (P7 scanner gap fix) finished at ecfd9578, ready for review. Full council re-run required once merged (D12). PF-1 shipped separately as v9.54.1, ahead of GF-1. |
+| GF-1 | cycle-4 (main) | main @ 779c50e5 (v9.54.1) | cycle 4 + verdict fix + XSS fix + pkill-scoping fix (D15/D16/D17, RELEASED) + D8-D17 | HIGH | parked@2026-10-03T12:01Z | PF-2 (P7 scanner gap fix) finished at ecfd9578, ready for review. Full council re-run required once merged (D12). PF-1 shipped separately as v9.54.1, ahead of GF-1. Drift audit 12:01Z: no live owner for 5+ days; parked per D68 drop-red. |
 | GF-2 | P5 slice | main @ c7b2d8b4 | providers/loader.sh, autonomy/loki, bin/loki, docs/air-gapped.md, docs/enterprise/*, README.md, tests/moat/p5-*.sh, tests/test-doctor-json-sentrux.sh | HIGH | released@2026-09-27T15:00Z | Rebased onto current main (past S-11), 4 conflicts resolved (cloud-tag detection + OLLAMA_HOST override are complementary, merged with cloud-tag checked first). HIGH review APPROVE. P5 PROVEN (9/9), pushed. Moat is now 3 of 9 (P5, P6, P7). CORRECTION: the `.loki/state/provider` issue found during verification was NOT a local-only false alarm -- it is a real CI-breaking cross-test contamination bug (test-iteration-grace.sh writes it, poisoning every later test in the same CI shard's shared checkout, including test-airgap-ollama-host.sh); it genuinely broke `Tests` (shard 3/4) on `ba6610dc`. See BACKLOG 126 for the corrected root cause and the fix (shipped, see PROGRESS.md/BACKLOG 126). Shipped in v9.56.0 (merged before the 14:16:24Z release push of b651b98d; on npm 15:00:06Z). |
 | GF-3 | P9 slice | main @ 4c15ef5b | .github/workflows/*.yml, .github/actions/issue-to-pr, autonomy/run.sh (github_token wrap), loki-ts/src/runner/github_token.ts, autonomy/lib/proof-check.sh, action.yml, docs/environment-variables.md, tests/moat/p9-rule-of-two.sh, tests/test-issue-to-pr-action.sh, loki-ts/tests/runner/github_token_withheld.test.ts, loki-ts/dist/loki.js | HIGH | released@2026-09-27T15:00Z | Rebased cleanly (0 conflicts) onto current main; 4/4 P9 moat cases re-verified fresh at every step, never trusted from a stale note. Full 4-reviewer HIGH-tier quorum, effectively unanimous: 2/4 clean APPROVE, 1/4 APPROVE-with-precondition (found and live-reproduced a real TOCTOU gap via a planted git hook, correctly bucket-(b) per D21, filed BACKLOG 138/139), 1/4 CONCERN citing the same dist-staleness gap independently via commit-timestamp comparison. Fixed by rebuilding loki-ts/dist (confirmed new env-var literals present in the built artifact) and re-verifying: P9 genuinely PROVEN, 4 of 9 moat properties overall (a clean superset of main, zero regressions once `npm ci` corrected an environment gap in review worktrees), 6/6 Bun tests, clean tsc. BACKLOG 140/141 filed for two more non-blocking follow-ups. Per D22, ships alone (release.yml touched: 3 no-cache additions, verified minimal through every review round) -- pushed, its own triggered CI run being watched to green before anything else merges. S-18 and S-37 (duplicate) now unblocked to re-cut once this CI run is confirmed green. Shipped in v9.56.0 (merged before the 14:16:24Z release push of b651b98d; on npm 15:00:06Z). |
 | GF-4 | P4 slice | main @ 0f214c3f | providers/model_catalog.json, loki-ts/src/commands/start.ts, loki-ts/src/runner/providers.ts, tests/moat/pending.txt | MEDIUM | released@2026-09-27T15:00Z | Both reviewers landed APPROVE (reviewer 2 conditional on the commit-message fix, already applied at cd07adb2; reviewer 1 independently traced bash/Bun parity end to end and found the same commit-message defect). Re-rebased onto main post-S-41, re-verified moat clean (P4.catalog-has-top-model promoted, P7 PROVEN, 4/9) on the real checkout with deps installed. Merged. Correction: this row was left at `review@` after the actual merge -- caught by the pulse's REVIEW_STALE violation, a repeat of the same status-tracking-lag class as S-30/S-32. Shipped in v9.56.0 (merged before the 14:16:24Z release push of b651b98d; on npm 15:00:06Z). |
@@ -433,7 +433,7 @@ set is declared to avoid overlap with those and with each other.
 | G-01 | Usage governor (D39): scripts/usage-governor.py sums usage (output, input, cache read, cache write) from ~/.claude/projects/**/*.jsonl per model, role (from workflow labels and agent types where recorded) and hour; stores founder plan-percentage readings (docs/v10/usage-readings.tsv) and fits tokens-per-percent as a labelled estimate; projects 5-hour window and weekly usage; outputs max engineers for the next hour; checks and records whether Claude Code exposes plan usage directly (statusline input rate-limit fields, /usage) and uses it when it does | scripts/usage-governor.py, docs/v10/usage-readings.tsv, tests/test-usage-governor.sh | HIGH | fixture jsonl plus readings gives a stated projection and max-engineer number; missing readings reads "uncalibrated", never a number presented as fact | released@2026-09-28T21:01Z | Source: founder 17:44Z. First in the queue; everything obeys it. r2 de8e1f76 opus REJECT: weekly reset 1h off across DST; fixes 2 and 4 unguarded. r3 dispatched 19:00Z. r3 fa279532 opus APPROVE (DST reset fixed; fixes 2 and 4 mutation-guarded by T14/T15); merged c2ae4347; governor 25/0, logger 16/0, run-shellcheck.sh passes, shard coverage 19/0, drift 6/0. Open non-blocking: weekly tokens counted from computed Wednesday not live resets_at-7d; no test for live-reset preference; "uncalibrated" label when idle. Released in v10.5.0 (merge c2ae4347 is an ancestor of v10.5.0). |
 | G-02 | Pulse BUDGET_BURN and OPUS_SHARE violations plus an hourly METRICS.md usage section (tokens per role and model, cost per merged slice, window and weekly projections, max engineers, releases per hour, merged slices per hour and per million tokens), all from G-01 | scripts/v10-pulse.sh (two checks), tests/test-v10-pulse.sh, docs/v10/METRICS.md (section header only) | MEDIUM | fixtures: opus 31% fires OPUS_SHARE; a projection of 86% fires BUDGET_BURN; uncalibrated reads UNKNOWN | released@2026-09-28T21:01Z | Source: founder 17:44Z. Depends on G-01. Serialize after E-89..E-91 (same file). Dispatched 19:09Z, sonnet engineer (G-01 merged; goes before E-90/E-91, which rebase after). Built f172b9b6 (rebased onto E-91), test-v10-pulse.sh 138/0, 7 T48 subtests red on unmodified pulse first; 46 min vs 30 budget (large pulse file). Tech Lead review 19:55Z. Tech Lead APPROVE (pulse 0.61s wall, governor keys match usage-governor.py:562-591, null max is UNKNOWN); merged. Released in v10.5.0 (merge 8f93cb9f is an ancestor of v10.5.0). |
 | G-03 | docs/v10/SCALE.md: what the Max 20x plan sustains around the clock (from G-01 measurements and calibration), what 50 parallel engineers need (API pay-as-you-go with a rate-limit tier, or Team/Enterprise), cost per day estimates labelled as estimates, and the ramp gates (governor allows, merged slices per hour rising, merged work per token not falling) | docs/v10/SCALE.md | HIGH | every number cites a measurement or is labelled an estimate with its basis | released@2026-09-28T21:01Z | Source: founder 17:44Z. CTO (opus) authors. Billing is the founder decision. Merged as 4708cee1 (row status was stale). Released in v10.5.0 (merge 62b495a5 is an ancestor of v10.5.0). |
-| G-04 | Cloud fan-out (HIGH, CTO-owned): dispatch ready slices with no file overlap with in-flight work as Claude Code cloud sessions that open PRs from their own branches; the Release Manager merges PRs whose checks concluded success with gh pr merge; every dispatch recorded in BOARD.md with its cloud session id; ramp 25 to 50 only when the governor allows and merged slices per hour rose | scripts/cloud-dispatch.sh, docs/v10/SWARM.md (one section), tests/test-cloud-dispatch.sh | HIGH | dry-run dispatch prints the exact command and the BOARD row it would write; refuses when the governor max is reached or file sets overlap | ready@2026-09-28T17:50Z | Source: founder 17:44Z. Depends on G-01 (governor) and G-03 (plan ceiling). Verify the real cloud-session CLI syntax before building. |
+| G-04 | Cloud fan-out (HIGH, CTO-owned): dispatch ready slices with no file overlap with in-flight work as Claude Code cloud sessions that open PRs from their own branches; the Release Manager merges PRs whose checks concluded success with gh pr merge; every dispatch recorded in BOARD.md with its cloud session id; ramp 25 to 50 only when the governor allows and merged slices per hour rose | scripts/cloud-dispatch.sh, docs/v10/SWARM.md (one section), tests/test-cloud-dispatch.sh | HIGH | dry-run dispatch prints the exact command and the BOARD row it would write; refuses when the governor max is reached or file sets overlap | building@2026-10-03T13:21Z | Built 0a90538a8: dry-run default, --live needs verified `claude --cloud` (no cloud subcommand in 2.1.288), refusals 10/11/12; test 25/0, overlap mutation 3 red. Governor uncalibrated so every dispatch refuses (fail safe). Opus HIGH review running. First real --live is a founder probe. r2 building (F1-F6 + A1/A6/A7/A8). |
 | G-05 | The same fan-out as loki modernize remote-worker mode (POST /jobs kind unit, Helm worker.engine v10): align G-04 with M-23 | (design note in docs/v10/MODERNIZE.md, one section) | MEDIUM | the note maps G-04 dispatch fields to the M-23 job schema | ready@2026-09-28T17:50Z | Source: founder 17:44Z. Depends on G-04 and M-17. |
 | EV-15 | Re-run the medium tier (7 tasks, raw and v10, 2 runs each, same model) with every result file written under ~/loki-ci-logs/eval/ev15-<arm>-r<n>/ (outside any worktree) and a per-task table of which runs failed and why (hidden-test failure, timeout, no PR, cost) | eval/loki10 results (outside the repo), docs/v10/METRICS.md (one section) | HIGH | 28 rows, 0 arm_unavailable; per-task failure reasons cited from the result files | merged@2026-09-28T19:40Z | Source: EV-14 evidence lost (17:36Z incident) and v10 lost on all three medium axes. Governor-gated (paid run). D40 priority 1: running (wf_4af22d00-9fb), results under ~/loki-ci-logs/eval. Done 19:19Z: raw 10/14 $0.5085 p50 56s; v10 9/14, cost at least $0.788 (E-98 correction) p50 128s. Files durable under ~/loki-ci-logs/eval/ev15-*. |
 | E-98 | Diagnose why v10 loses to raw on medium (EV-15 per-task failures): for each task v10 failed and raw completed, read the v10 run log and name the stage and cause (plan, Wall, implement, verify, fix rounds, cap), then cut fix slices | docs/v10/ENGINE.md (findings section) | HIGH | each finding cites a result file path and a log line | released@2026-09-28T21:01Z | Source: EV-14. Depends on EV-15. CTO (opus) analysis. D40 priority 1: CTO analysis runs after EV-15 in the same workflow. docs/v10/MEDIUM-ANALYSIS.md merged d496db89. Top cause: verify hard-codes python, so 27/27 pytest checks were not_run and no fix round ever fired. Cards E-98a..f below. Released in v10.5.0 (merge 8b41ad40 is an ancestor of v10.5.0). |
@@ -501,7 +501,7 @@ set is declared to avoid overlap with those and with each other.
 | S41-14 | Wall in parallel with implement (item 4, target p50 not worse) | see docs/v10/SCORECARD-PLAN.md | HIGH | per SCORECARD-PLAN.md card | parked@2026-09-28T21:42Z | Source: D41, Architect plan 7f671f5c. Depends on D42, S41-16. D42 (2): deferred; E-98f shows no speed win (Wall-off p50 214s vs 209s) and it touches the moat. Reopen only if Wall is at least 15% of p50, with the Wall sealed and proven red on a clean base before any implement diff. |
 | S41-10 | Relevant context and a static-first brief | see docs/v10/SCORECARD-PLAN.md | MEDIUM | per SCORECARD-PLAN.md card | released@2026-09-30T19:46Z | Source: D41, Architect plan 7f671f5c. Depends on S41-09. TL r1 REJECT: empty brief when plan has no relevant_files and selection matches nothing; rework adds a capped head fallback, drops absolute or .. plan paths, quotes test paths. Released in v10.5.9 (merge 635f5488 is an ancestor of v10.5.9). |
 | S41-11 | Rule-based trajectory trimming (flag) | see docs/v10/SCORECARD-PLAN.md | MEDIUM | per SCORECARD-PLAN.md card | released@2026-09-30T18:50Z | Source: D41, Architect plan 7f671f5c. Depends on S41-09.  WIND-DOWN 2026-09-28: built at 8aafe341 on slice-S41-11 (trim.ts plus providers.ts wiring, 35/0; SDK exposes no Bash exit code to PostToolUse, sdk.d.ts:2677, so nonzero-exit uses a fail-safe heuristic). NEXT: TL review, then merge (rebase onto main: providers.ts and harness.py also changed). Released in v10.5.7 (merge 5e8c0eb2 is an ancestor of v10.5.7). |
-| S41-13 | Two parallel attempts for medium and large (flag) | see docs/v10/SCORECARD-PLAN.md | HIGH | per SCORECARD-PLAN.md card | ready@2026-09-28T21:41Z | Source: D41, Architect plan 7f671f5c. Depends on S41-05, S41-12. BINDING (E-141 opus review 2026-09-30): treeswap passes { ...process.env } to its git calls, so its caller must run where process.env is already scrubbed. engine10/supervisor.ts:200-201 scrubs only a workerEnv copy; if S41-13 calls treeswap from the supervisor it must pass the scrubbed env in as a parameter or run withholdGithubTokens on a copy inside treeswap, and its reviewer must check this. |
+| S41-13 | Two parallel attempts for medium and large (flag) | see docs/v10/SCORECARD-PLAN.md | HIGH | per SCORECARD-PLAN.md card | ready@2026-09-28T21:41Z | Source: D41, Architect plan 7f671f5c. Depends on S41-05, S41-12. BINDING (E-141 opus review 2026-09-30): treeswap passes { ...process.env } to its git calls, so its caller must run where process.env is already scrubbed. engine10/supervisor.ts:200-201 scrubs only a workerEnv copy; if S41-13 calls treeswap from the supervisor it must pass the scrubbed env in as a parameter or run withholdGithubTokens on a copy inside treeswap, and its reviewer must check this. Drift audit 13:12Z: the card also depends on S41-08 (needs S41-06, eval-only, real-model leg parked) and S41-10; not dispatchable. |
 | S41-15 | After-scorecard and defaults (flip only when green on small and medium) | see docs/v10/SCORECARD-PLAN.md | HIGH | per SCORECARD-PLAN.md card | ready@2026-09-28T21:41Z | Source: D41, Architect plan 7f671f5c. Depends on S41-13, S41-10, S41-11. |
 | S41-17 | Scorecard 95% intervals: bootstrap (seeded, 10000 resamples, per-task clustered over reps) CIs on completion, cost per completed and p50 for each arm and for the Loki minus raw difference; a mark is green or red only when the difference CI excludes 0, else inconclusive, and inconclusive blocks the tier verdict | eval/loki10/scorecard, eval/loki10/test-scorecard.sh | HIGH | bash eval/loki10/test-scorecard.sh | released@2026-09-30T18:50Z | Source: D43 item 2. Deterministic seed; a fixture where arms differ by noise only must read inconclusive, a clear gap must read green or red. Stdlib only.  WIND-DOWN 2026-09-28: built at f3f1d985 on slice-S41-17 (test-scorecard.sh 43/43; new cases a to e are 27 pass 16 fail on the old scorecard). Seeded (41) 10000-resample percentile bootstrap clustered by task; marks need the difference CI strictly outside 0; headline cost uses the ratio against 0.5; over 2.5 percent undefined replicates downgrades to inconclusive. Not benchmarked at real-eval scale. NEXT: opus review (HIGH, flip gate), then merge. Released in v10.5.7 (merge 446a1c7f is an ancestor of v10.5.7). |
 | S41-18 | scorecard-run.sh resume: before each arm and rep, read that rep's --out file and pass the harness only tasks with no status ok row; a rerun after an interrupt or auth stop finishes the missing rows and never repeats done ones; auth_guard still runs before every rep | eval/loki10/scorecard-run.sh, eval/loki10/test-scorecard-run.sh | MEDIUM | bash eval/loki10/test-scorecard-run.sh | released@2026-09-30T18:50Z | Source: D43 item 4. Do not change auth_guard logic or harness.py (S41-01 owns it). Test with the stub arm: kill mid-rep, rerun, assert each task row appears exactly once per rep.  WIND-DOWN 2026-09-28: built at 66cc1882 on slice-S41-18 (scorecard-run.sh resume; test-scorecard-run.sh 11/11, legs a to d red on the old script then green). LEFT: leg (a) seeds via a clean run, not a real SIGTERM mid-rep; no assertion for a capped (timeout) row; missing_tasks tier filter does not fail loud on an invalid tier; an empty tier now exits 0 instead of erroring. NEXT: close those 4, then TL review. Released in v10.5.7 (merge cad4615f is an ancestor of v10.5.7). |
@@ -536,7 +536,7 @@ set is declared to avoid overlap with those and with each other.
 | E-49 | loki dashboard reachable through the real entry: serves a run folded from a fixture event log | loki-ts/tests/engine10/dashboard_entry.test.ts | LOW | cd loki-ts && bun test tests/engine10/dashboard_entry.test.ts | released@2026-09-28T02:38Z | E-24 exists; this proves the cli route reaches it. Depends on E-42. Dispatched. Merged 3ab2a8fa (train E14, rebased on main): engine10 404 pass 0 fail (402 pass 0 fail with claude removed from PATH), tsc exit 0, test-harness 86/0, test-local-ci-gitleaks 6/0, test-engine10-dist 18/0. Released v9.81.0 (npm view loki-mode time: 2026-09-28T02:38:54Z). |
 | E-50 | Receipt model field and summary token count match the provider report on a real SDK session (fixture replay of a recorded result-cost file) | loki-ts/tests/engine10/model_report.test.ts, loki-ts/tests/engine10/fixtures/model-report/ | MEDIUM | cd loki-ts && bun test tests/engine10/model_report.test.ts | released@2026-09-28T02:38Z | Found by E-14 (model "default", 1k tokens shown for 372k used). Depends on E-42, E-44. Staffed in engine10-tests-e42, based on the E-42 branch. Built 716618d4, TL APPROVE: 2 tests red for real bugs (cost.ts writes caller model not provider model; events.ts fold drops cache tokens, 1004 vs 373164). Held; merges with E-59. Merged 3ab2a8fa (train E14, rebased on main): engine10 404 pass 0 fail (402 pass 0 fail with claude removed from PATH), tsc exit 0, test-harness 86/0, test-local-ci-gitleaks 6/0, test-engine10-dist 18/0. Merged with E-59. Released v9.81.0 (npm view loki-mode time: 2026-09-28T02:38:54Z). |
 | E-51 | v10 run passes the pinned origin and the task through to a local-origin PR in the eval harness (regression test of the E-41 plus E-42 path) | loki-ts/tests/engine10/eval_pr_path.test.ts | HIGH | cd loki-ts && bun test tests/engine10/eval_pr_path.test.ts (bare local origin receives the branch; pr.opened url is local://) | released@2026-09-28T01:11Z | Guards the path that lets v10 score in the gate. Depends on E-41, E-42. Staffed in engine10-tests-e42, based on the E-42 branch. Merged (cherry-pick of 018fbcd4 onto main): bun test tests/engine10/eval_pr_path.test.ts 1 pass 0 fail; TL APPROVE with mutation (env scrub removed -> canary leak caught). Released v9.80.1 (npm view loki-mode time: 2026-09-28T01:11:53Z). |
-| E-31 | Default flip to v10 with LOKI_ENGINE=legacy override and the loki legacy alias (merge held until the gate marker reads met) | bin/loki, loki-ts/src/engine10/cli.ts (USAGE only), tests/test-engine10-default.sh, tests/test-engine10-dispatch.sh, tests/test-engine10-legacy-contract.sh, README.md and docs/v10/GUIDE.md (marked opt-in line only, after E-34) | HIGH | bash tests/test-engine10-default.sh && bash tests/test-engine10-legacy-contract.sh && bash tests/test-engine10-dispatch.sh (0 failed; legacy contract 0 skipped) | approved@2026-09-28T01:16Z | Source: ENGINE.md 23:00Z cut. Held at approved until the METRICS.md loki10-gate marker reads met; parked if not met by 03:00Z. Depends on E-30, E-32, E-33, E-34, E-35, E-38, EV-6. Staffed in engine10-gate-push (wf_1d47133f-7c7). Built 2caf70e5 (branch e31-default-flip), opus APPROVE. Held: merges only if the gate marker reads met at 03:00Z. |
+| E-31 | Default flip to v10 with LOKI_ENGINE=legacy override and the loki legacy alias (merge held until the gate marker reads met) | bin/loki, loki-ts/src/engine10/cli.ts (USAGE only), tests/test-engine10-default.sh, tests/test-engine10-dispatch.sh, tests/test-engine10-legacy-contract.sh, README.md and docs/v10/GUIDE.md (marked opt-in line only, after E-34) | HIGH | bash tests/test-engine10-default.sh && bash tests/test-engine10-legacy-contract.sh && bash tests/test-engine10-dispatch.sh (0 failed; legacy contract 0 skipped) | parked@2026-10-03T12:01Z | Source: ENGINE.md 23:00Z cut. Held at approved until the METRICS.md loki10-gate marker reads met; parked if not met by 03:00Z. Depends on E-30, E-32, E-33, E-34, E-35, E-38, EV-6. Staffed in engine10-gate-push (wf_1d47133f-7c7). Built 2caf70e5 (branch e31-default-flip), opus APPROVE. Held: merges only if the gate marker reads met at 03:00Z. Drift audit 12:01Z: no live owner for 5+ days; parked per D68 drop-red. |
 | E-32 | Packaging: engine runs from dist and the npm package (static registry, session child via cli route, REPO_ROOT paths) | loki-ts/src/engine10/registry.ts, loki-ts/src/cli.ts (engine10 arm only), loki-ts/src/engine10/machine.ts, loki-ts/src/engine10/session.ts, loki-ts/src/engine10/output.ts, loki-ts/src/engine10/fetch_issue.ts, loki-ts/src/engine10/stages/pr.ts, loki-ts/tests/engine10/registry.test.ts, tests/test-engine10-dist.sh | HIGH | bash tests/test-engine10-dist.sh && (cd loki-ts && bun test tests/engine10/registry.test.ts) | released@2026-09-28T02:38Z | Source: ENGINE.md 23:00Z cut. Later engine slices add one registry line at merge. Depends on E-14, E-TG. Staffed in engine10-gate-push (wf_1d47133f-7c7). Built f44797bf+0b859361, APPROVE; conflicts with E-42 in session.ts. Rebase dispatched. Merged 646a6cd7 (train E13): engine10 388 pass 0 fail, tsc exit 0, test-engine10-dist 18/0, test-engine10-docs 26 passed, test-harness 82/0. APPROVE (e00cbcd1); squashed with E-58. Released v9.81.0 (npm view loki-mode time: 2026-09-28T02:38:54Z). |
 | E-33 | Gate report generator: METRICS.md and CHANGELOG blocks with every gate number, misses and the loki10-gate marker | eval/loki10/gate_report.py, eval/loki10/test-gate-report.sh, eval/loki10/fixtures/gate/ | HIGH | bash eval/loki10/test-gate-report.sh | released@2026-09-28T01:11Z | Source: ENGINE.md 23:00Z cut. EV-6 runs it on real results and commits METRICS.md. Depends on EV-1. Building in a private clone (worktrees full). Built 06c457b8; review CONCERN (one-model check not covered by a test); fix in engine10-gate-push. Merged 23b20e6f (train E12): shard coverage 19/0, drift 6/0, engine10 349 pass 0 fail, tsc exit 0. Fix 4eb826b2 APPROVE; test-gate-report 34/0. Released v9.80.1 (npm view loki-mode time: 2026-09-28T01:11:53Z). |
 | E-34 | v10 user docs: README quickstart and docs/v10/GUIDE.md (5-line summary, NOT PROVEN, receipts), opt-in until the flip | README.md, docs/v10/GUIDE.md, tests/test-engine10-docs.sh | LOW | bash tests/test-engine10-docs.sh | released@2026-09-28T02:38Z | Source: ENGINE.md 23:00Z cut. Depends on E-13, E-22. Building in a private clone (worktrees full). Stopped over budget (CEO 23:31Z); built 9716677f; re-sliced to a 15-minute review in engine10-gate-push. Re-review APPROVE, but README says the run does not execute a build yet, false since E-42 (9db2a4ed). Refresh dispatched. Merged 646a6cd7 (train E13): engine10 388 pass 0 fail, tsc exit 0, test-engine10-dist 18/0, test-engine10-docs 26 passed, test-harness 82/0. APPROVE (7dcae83d). Released v9.81.0 (npm view loki-mode time: 2026-09-28T02:38:54Z). |
@@ -624,8 +624,10 @@ Source: ~/git/autonomi-dev/research/2026-09-30-adoption/SWARM-PROMPT-ADOPTION.md
 | D50-F5 | aiq-52 lift: already_done.ts findEvidence misses compound task keywords (searchbar vs search-command); add deterministic compound-token matching and a same-stem source plus referencing-test category pair; confirmation still must cite a real hit | loki-ts/src/e10ext/already_done.ts, tests, dist | aiq-52-shaped fixture yields a candidate; unrelated keyword, source without referencing test and short prefix yield none | HIGH | parked@2026-10-03T09:21Z | drift audit 09:22Z: r2 rejected, no live builder since 2026-10-01; parked per D68 drop-red |
 | D50-W1 | CTO call (aiq-52 diagnosis): Wall runs in an empty temp cwd (wall.ts:156-169) with a 90s cap, so on brownfield tasks it writes blind tests and was killed twice; options are read-only repo access for Wall, or a longer cap, each weighed against Wall's from-spec independence (moat) | loki-ts/src/engine10/stages/wall.ts | decision recorded in DECISIONS | HIGH | merged@2026-10-03T08:52Z (decided: D77) | none |
 | W1-S1 | D77 manifest builder: pure buildWallManifest returning signatures-only text from the base tree | loki-ts/src/engine10/wall_manifest.ts (new), loki-ts/tests/engine10/wall_manifest.test.ts | TS and Python fixtures: every exported signature present, body canary absent; style example never imports a named module; output 400 lines or fewer; byte-identical for the same tree | HIGH | merged@2026-10-03T10:50Z | d7285daa3..9da5c123f on main (opus APPROVE r7, 51/0, tsc 0); library only, flag not wired; advisory: invalid-TS keyword after decorator leaks, fold into W1-S2 |
-| W1-S2 | D77 wire manifest into Wall cwd and brief; manifest_sha256 on wall.sealed | loki-ts/src/engine10/stages/wall.ts, loki-ts/tests/engine10/wall.test.ts | cwd holds only task.md, repomap.txt, wall_manifest.txt; body and implement-diff canaries never reach cwd or brief; E-54 and D42(3) tests green | HIGH | building@2026-10-03T11:50Z | r7 1c416912f opus BLOCK R7-B1 r7 narrowing reopened in-dir index imports, R7-B2 relative . and .. imports, R7-B3 absolute path drops sigs; r8 resolves relative specifiers plus location backstop |
-| W1-S3 | D77 size-tied Wall cap: 90s small, 180s normal, env override clamped to 300s | loki-ts/src/engine10/sizing.ts, loki-ts/src/engine10/stages/wall.ts, loki-ts/tests/engine10/sizing.test.ts | small 90, normal 180, 999 clamps to 300, garbage falls back; killed session copies no file; timeout never already_satisfied | MEDIUM | ready@2026-10-03T08:52Z | Source: D77. Shares wall.ts with W1-S2: build after W1-S2 merges. |
+| W1-S2 | D77 wire manifest into Wall cwd and brief; manifest_sha256 on wall.sealed | loki-ts/src/engine10/stages/wall.ts, loki-ts/tests/engine10/wall.test.ts | cwd holds only task.md, repomap.txt, wall_manifest.txt; body and implement-diff canaries never reach cwd or brief; E-54 and D42(3) tests green | HIGH | merged@2026-10-03T12:58Z | r1-r15 cherry-picked (6acdb8476..f9dc7d67b), opus HIGH r15 APPROVE (211/0, tsc 0). Combined with D61-11 it breaks the e10ext/features size budgets; P0-SIZE-BUDGET trim in flight, train held. Advisory: add a johab cookie test row. |
+| P0-SIZE-BUDGET | Trim e10ext (1505/1500) and features (3041/3000) under budget with no behaviour change after D61-11 + W1-S2 merged | loki-ts/src/engine10/stages/wall.ts, loki-ts/tests/engine10/wall.test.ts | cwd holds only task.md, repomap.txt, wall_manifest.txt; body and implement-diff canaries never reach cwd or brief; E-54 and D42(3) tests green | HIGH | merged@2026-10-03T13:05Z | Merged 87f256642: e10ext 1433/1500, features 2931/3000; budget.test.ts 27/0, dist guard 13/0. Whitespace/comment only. |
+| P0-T99-ROUTING | train/99 Tests red on shards 3/4/7 twice (run 37124003039 + full rerun): test-issue-to-pr acceptance import includes heading lines, test_start_run_unified URL start says no provider CLI, test-start-repo-directory (PO4) fails in 1s; all pass locally with provider CLIs | tests/cli/test-issue-to-pr.sh, tests/cli/test_start_run_unified.sh, tests/cli/test-start-repo-directory.sh, cause TBD | MEDIUM | three suites green under a CI-like PATH with no provider CLI, red before the fix | merged@2026-10-03T13:21Z | Root cause: train/99 af6b616fa+2db6d1358 registered 4 orphan tests/cli suites; GNU sed range in issue-parser.sh extract_acceptance_criteria keeps heading lines (BSD falls back, so green on macOS); 2 suites silently needed a claude CLI. Fix 060a5794c red/green under env -i and ubuntu:24.04. Tier corrected HIGH->MEDIUM (parser, not moat). TL review running. TL APPROVE (5 suites green macOS+ubuntu docker). Merged ec5cc3398. Advisory carded: switch sed \s to [[:space:]] at the root. |
+| W1-S3 | D77 size-tied Wall cap: 90s small, 180s normal, env override clamped to 300s | loki-ts/src/engine10/sizing.ts, loki-ts/src/engine10/stages/wall.ts, loki-ts/tests/engine10/sizing.test.ts | small 90, normal 180, 999 clamps to 300, garbage falls back; killed session copies no file; timeout never already_satisfied | MEDIUM | merged@2026-10-03T13:21Z | TL MEDIUM BLOCK: wiring test uses a small task so limitS 90 equals old value; wall.ts:168 mutation survived. r2 test-only fix requested (normal task -> 180, env 240 reaches session). Code itself passed: 300 stage ceiling safe, env parse ok. Merged 916f2d99d..615fd4745 + dist f0ece075d; engine10 1199/0, tsc 0, dist guard 13/0. |
 | W1-S4 | D77 lift row: manifest off versus on | docs/v10/METRICS.md | augmentiq#52 plus 2 brownfield tasks, both arms; Wall timeouts, red-on-base count, completion, cost; logs under ~/loki-ci-logs | MEDIUM | ready@2026-10-03T08:52Z | Source: D77. Depends on W1-S2, W1-S3. Real-model leg: parked until Loki confirms key use. |
 | P0-backstop-refused | A run refused at intake (dirty tracked tree) still runs backstopCommit (git add -A plus commit) on the user's own branch, landing their dirty and untracked files on main; found by the D50-F1b opus review on base 151aa563 | loki-ts/src/engine10/supervisor.ts, its tests, dist | dirty-README fixture: refusal exit, no new commit on main, README still dirty byte-identical, notes.txt untracked | HIGH | merged@2026-10-01T12:25Z 3c46a2b6 (a70f0980; red 22/1, green 953/0; train/57) | none |
 | D50-F1c | Re-decision 12:35Z: D50-F1 stays in place (r5, released 10.5.30); B (worktree per run, D50-F1b) stays parked until a dependency strategy exists, because a worktree without node_modules or .venv lost a VERIFIED fixture. This slice fixes the in-place gap the F1b review reproduced: SIGINT or SIGTERM leaves the user's checkout on the loki/e10 run branch and can orphan the worker | loki-ts/src/engine10 supervisor (signal path), e10ext helper if needed, tests, dist | SIGINT and SIGTERM mid-run: original branch checked out, worker PID gone, run branch kept; never reset or discard user files | MEDIUM | merged@2026-10-01T12:55Z 027be0eb (e3773291; signal tests red then green, clean-tree guard added on lead review, engine10 956/0; train/58) | none |
@@ -735,7 +737,8 @@ Source: ~/git/autonomi-dev/research/2026-09-30-adoption/SWARM-PROMPT-ADOPTION.md
 | D61-09 | D61 slice 9, decomposability check with strict-schema confirm | features/speed/decompose_check.ts, tests engine10/decompose_check.test.ts | MEDIUM | merged@2026-10-03T03:13Z | TL APPROVE; 0393c5a6b in train/83 1a63ad156. |
 | D61-15 | D61 slice 15, live unit grid (dashboard /g/<group>, Control Plane group_id) | features/speed/group_grid.ts, engine10/dashboard, packages/control-plane runs and drizzle 0001 | MEDIUM | merged@2026-10-03T03:14Z | TL APPROVE plus should-fix (400 on bad encoding); 024a4d16b, 79eac0297 on main for train/84. Add a drizzle 0001 snapshot before the next schema change. |
 | D61-10 | D61 slice 10, unit runner (backlog.py --dag) | autonomy/lib/backlog.py, tests/test-backlog-units.sh | MEDIUM | merged@2026-10-03T03:15Z | TL APPROVE; ad4f4b926. Follow-up D61-10-F1 1e844e066 TL APPROVE (30/0), approved@2026-10-03T03:33Z. |
-| D61-11 | D61 slice 11, unit run mode (write-set fence, pack-only brief, unit cost cap) | features/speed/unit_mode.ts, e10ext/scope.ts, e10ext/context.ts | HIGH | building@2026-10-03T04:24Z | Round 2 opus BLOCK: f in pre matches Object.prototype keys (constructor/toString escape fence); round 3 fix (Object.hasOwn) dispatched |
+| D61-11 | D61 slice 11, unit run mode (write-set fence, pack-only brief, unit cost cap) | features/speed/unit_mode.ts, e10ext/scope.ts, e10ext/context.ts | HIGH | merged@2026-10-03T12:52Z | 48006fdbe..a56978deb, opus HIGH r3 APPROVE (169/0, tsc 0). Fence and pack-only brief only: unitCapEnv has no caller, so no unit cost cap is enforced yet (see D61-11b). |
+| D61-11b | Wire the unit cost cap (unitCapEnv) into the real unit spawn path, fail closed with a NOT PROVEN note on a bad unit spec, read the spec at intake from outside the worktree, and state in slice 12 that FAILED units are never merged (backstopCommit runs add -A unfenced) | features/speed/unit_mode.ts, e10ext/scope.ts, e10ext/context.ts | HIGH | merged@2026-10-03T13:16Z | Merged f6dea72bd+5e6b5e9c3, dist 095f17e79. r2 opus APPROVE (18 containment cases, revert-red 22/1, supervisor rc=2 probe). Main: budget+unit_mode+features+supervisor 320/0, tsc 0, dist guard 13/0. Advisories carded: gate maybeRunGroup on !u; supervisor main() rc=2 test; win32 sep. |
 | P1-DISCARD-PROTO | discardIfSatisfied uses `f in pre` (e10ext/discard.ts:36): prototype-named files (constructor, toString) survive the ALREADY_SATISFIED discard, so the run reports completed with a source diff (breaks D50-F1). Use Object.hasOwn plus a real-git test | loki-ts/src/e10ext/discard.ts, loki-ts/tests/e10ext/discard*.test.ts | HIGH | merged@2026-10-03T05:10Z | opus APPROVE (real-git probe: 8 prototype names incl __proto__ and a/constructor all discarded; parent code discarded 1); cherry-picked 6e6a74680, e10ext 92/0. Sibling scope.ts:20-21 hole covered by D61-11 r3 |
 | D61-12 | D61 slice 12, integrator (ordered merges, fix units, 2-round cap) | features/speed/integrate.ts, tests features/speed/integrate.test.ts | HIGH | parked@2026-10-03T04:47Z | Round 7 opus BLOCK 5b788e895: exemption launders drops (B1,B2), context false positive (B3); round 8 is final: three-way containment, no exemption, else drop 04:47Z: round 8 opus BLOCK on 35a7b0c32 (C1-C4, S3: a dropped unit change reported merged and ready; E6 mode-only false fail). Final round spent: dropped from this window per D73; integrator design rework next window. |
 | D61-14 | D61 slice 14, group events plus terminal unit table | features/speed/group_output.ts, engine10/events.ts | MEDIUM | merged@2026-10-03T03:22Z | TL APPROVE; 61c598412. Should-fix: unref() the default repaint timer (fold into D61-16 caller slice). |
@@ -769,7 +772,7 @@ Source: ~/git/autonomi-dev/research/2026-09-30-adoption/SWARM-PROMPT-ADOPTION.md
 | D65-BUG7 | E2E leg 7: installed `loki workspace run` exits 1 with 0 receipts after BUG-5 (integration.json now written); expected one run per repo and rc 0 | engineer-determined (autonomy/lib workspace path, tests) | MEDIUM | merged | main b5a0085a0 (cherry-pick of 18ca83dd8); TL APPROVE 07:59Z (mutation red 15/1, restored 16/0); dist guard 13/0; e2e-d65 legs=9 fails=0 |
 | D63-C6 | SLACK: two-way Slack on by default | features/slack_inbound.ts, docs/slack.md, README | HIGH | merged@2026-10-03T04:15Z | Opus round 2 APPROVE; cherry-picked 1acd2a9a2,4b2c242bd,f02609175, dist fc10b503c |
 | D63-C6-F | SLACK follow-up: sender allowlist, 64 KB task cap, no local paths in replies, strict --port | features/slack_inbound.ts, docs/slack.md | MEDIUM | merged@2026-10-03T04:25Z | TL APPROVE e8837ffa4 (3 mutations red); cherry-picked 2a404421a, dist 7ad4a44e9 |
-| P0-CORE-BUDGET | Core engine10 at 5001 lines after D61-13 (budget.test.ts needs < 5000); remove dead core code | loki-ts/src/engine10 | MEDIUM | merged@2026-10-03T10:50Z | 77d879908 cherry-picked c0dee1301; second TL (sonnet) BLOCKED only on stale test pins (test-engine10-dist greps intakeStage/prStage; already_done.test imports intakeStage), CoS repinned c9c377563; engine10 bun 1189/0, budget 27/0, tsc 0, engine10-dist 18/0, dist 500d77e24, guard 13/0 |
+| P0-CORE-BUDGET | Core engine10 at 5001 lines after D61-13 (budget.test.ts needs < 5000); remove dead core code | loki-ts/src/engine10 | MEDIUM | merged@2026-10-03T10:50Z | 77d879908 cherry-picked c0dee1301; second TL (sonnet) BLOCKED only on stale test pins (test-engine10-dist greps intakeStage/prStage; already_done.test imports intakeStage), CoS repinned c9c377563; engine10 bun 1189/0, budget 27/0, tsc 0, engine10-dist 18/0, dist 500d77e24, guard 13/0; TL r2 dist-test BLOCK not reproduced (test-engine10-dist.sh 18/0 on main, no intakeStage refs) |
 | P0-CONTROL-LINUX | train/85 ubuntu red: control_default timed out because a repo-root node_modules disables bun auto-install (hono missing) | loki-ts/src/commands/control.ts, loki-ts/tests/commands/control_default.test.ts, CHANGELOG.md | HIGH | merged@2026-10-03T04:56Z | opus APPROVE (reproduced in oven/bun:1.3.13; npm tarball uses bundled dist/server.js so no runtime fetch); cherry-picked 2d6e4a77d, dist 377871c88, dist guard 13/0. Follow-up: frozen-lockfile install of packages/control-plane in CI |
 | D63-C7 | TRACKERS: Jira and Linear intake polish | features/tracker_intake.ts, docs/trackers.md, README | MEDIUM | merged@2026-10-03T03:55Z | TL APPROVE 5c002ae69; cherry-picked 6fd472e1a into train 85. Advisory: suffix/userinfo/port negative tests. |
 | P0-D66-FENCE | Fix-forward: lean_select value-imported stages/plan (train 83 Coverage red, run 37092508809) | engine10/relevant_files.ts, stages/plan.ts, features/speed/lean_select.ts | MEDIUM | merged@2026-10-03T03:21Z | TL APPROVE; 53182ff94; budget.test 27/0, typecheck rc 0. |
@@ -805,7 +808,7 @@ Source: ~/git/autonomi-dev/research/2026-09-30-adoption/SWARM-PROMPT-ADOPTION.md
 | PO-TEST-2 | Tests for scripts/check-inline-scripts.js | tests/test-check-inline-scripts.sh (new), runner and shard registration | valid exits 0, broken fixture exits 1, structural guards | LOW | merged@2026-10-03T09:01Z | merged 8b3fa5af4 (TL APPROVE; suite + shard/registration guards green)|
 | PO-TEST-3 | Tests for scripts/clean-test-branches.sh safety rules | tests/test-clean-test-branches.sh (new), runner and shard registration | refusals proven in a throwaway repo; mutation dropping main refusal goes red; structural guards | MEDIUM | merged@2026-10-03T09:01Z | merged 75953c210 (TL APPROVE; suite + shard/registration guards green)|
 | P7-SCALAR-PIN | Pin the P7 SCALAR_READ exclusion with honest fixtures, so a regression that flags `.length`, `[0]` or `.find(` reaching a sink (or a widening that lets a fabricated array through) goes red. | tests/moat/p7-no-fabricated-data.sh only | Add honest fixtures `const n = getRows(d).length; setCount(n);`, `setFirst(getRows(d)[0])`, `setHit(getRows(d).find(x=>x.ok))` with expected 0 findings. RED: temporarily change `if not SCALAR_READ.match(tail): return True` (line ~1243) to `return True` and run `bash tests/moat/p7-no-fabricated-data.sh` -> the new fixtures fail. GREEN: revert -> `bash tests/moat/p7-no-fabricated-data.sh` exit 0, and every existing fixture keeps its expected count. Also `bash tests/moat/run.sh` shows the P7 verdict unchanged. Do NOT touch pending.txt. No CHANGELOG line (test-only). | HIGH | merged@2026-10-03T11:25Z | d668a9cbc opus APPROVE (13 mutations, 11 caught by new fixtures); advisories: realistic ternary shape, Index/Find honest-label debate, .search gap |
-| SEAL-FORGED-LINES | loki-seal refuses VERIFIED when the parsed passing lines disagree with the runner's own summary counts, so a test that prints forged `ok N - name` or `--- PASS:` lines cannot fake delivery. | packages/loki-seal/bin/contract.js (passing() and its caller), packages/loki-seal/test/seal.test.js, packages/loki-seal/README.md (Known limits ~44), CHANGELOG.md | RED: new seal.test.js cases: (a) TAP output with `ok 1 - x` printed by the test body plus summary `# pass 0` / `# fail 1`; (b) pytest output with `test_x PASSED` plus `1 failed, 0 passed`; (c) an id that appears both passed and failed. Each expects NOT VERIFIED with reason "runner output inconsistent". `bash packages/loki-seal/test/run.sh` fails on the new cases before the change (baseline 72/0). GREEN: after the change, `bash packages/loki-seal/test/run.sh` passes all cases (75+/0) and the existing 72 stay green. When no summary line exists, current behavior is unchanged (document this in Known limits). CHANGELOG: "loki-seal: forged runner pass lines that contradict the runner summary now give NOT VERIFIED." | HIGH | review@2026-10-03T11:50Z | r5 f02531df5 spec path fails closed on ambiguity (NOT VERIFIED, TAP named), counts() last block only; opus re-review running |
+| SEAL-FORGED-LINES | loki-seal refuses VERIFIED when the parsed passing lines disagree with the runner's own summary counts, so a test that prints forged `ok N - name` or `--- PASS:` lines cannot fake delivery. | packages/loki-seal/bin/contract.js (passing() and its caller), packages/loki-seal/test/seal.test.js, packages/loki-seal/README.md (Known limits ~44), CHANGELOG.md | RED: new seal.test.js cases: (a) TAP output with `ok 1 - x` printed by the test body plus summary `# pass 0` / `# fail 1`; (b) pytest output with `test_x PASSED` plus `1 failed, 0 passed`; (c) an id that appears both passed and failed. Each expects NOT VERIFIED with reason "runner output inconsistent". `bash packages/loki-seal/test/run.sh` fails on the new cases before the change (baseline 72/0). GREEN: after the change, `bash packages/loki-seal/test/run.sh` passes all cases (75+/0) and the existing 72 stay green. When no summary line exists, current behavior is unchanged (document this in Known limits). CHANGELOG: "loki-seal: forged runner pass lines that contradict the runner summary now give NOT VERIFIED." | HIGH | building@2026-10-03T12:30Z | r7 opus BLOCK: F1 unterminated write hides real summary, F2 64MB cap drops summary; r8 builder dispatched |
 | HONEST-READ-2 | /api runs never claim "recorded no run_id" or "no per-iteration records" when the events or iteration files were unreadable or corrupt; they say unreadable, with the errno. | dashboard/api_runs.py, tests/dashboard/test_api_runs_unreadable.py (new), tests/run-all-tests.sh (run_test line), tests/shard-durations.tsv (row), CHANGELOG.md | RED: new pytest: (a) events file chmod 000 -> list_runs reason must contain "unreadable", not "no run id found"; (b) iteration dir with only corrupt JSON -> reason "unreadable or corrupt", not "no per-iteration records"; (c) missing file (ENOENT) keeps today's "no ..." wording. Skip (a) when running as root. `python3 -m pytest -q tests/dashboard/test_api_runs_unreadable.py` red before. GREEN: same command passes; `python3 -m pytest -q tests/dashboard` stays green. Register `run_test "Dashboard api_runs unreadable reads (HONEST-READ-2)" "timeout -k 10 120 python3 -m pytest -q $SCRIPT_DIR/dashboard/test_api_runs_unreadable.py"` plus the shard row `Dashboard api_runs unreadable reads (HONEST-READ-2)<TAB>5`, then run the structural guards for new test files. CHANGELOG: "Dashboard runs view reports unreadable or corrupt run records instead of claiming none were recorded." | MEDIUM | merged@2026-10-03T10:50Z | b8b30f271 on main (MEDIUM TL APPROVE) |
 | BACKLOG-LEDGER-FAILCLOSED | `loki backlog` daily budget cap fails closed: a corrupt or unreadable spend ledger stops new units with BUDGET_STOP "ledger unreadable" instead of reading $0 spent, and add_spend never overwrites a corrupt ledger (move it aside to .corrupt-<ts>). | autonomy/lib/backlog.py (spent_today, add_spend, cap check ~383), tests/test-backlog.sh, CHANGELOG.md | RED: add a case to tests/test-backlog.sh with HOME pointing at a run-owned temp dir, `~/.loki/backlog-spend.json` containing `{not json`, a daily cap of $1, and a stub loki. Expect status "BUDGET_STOP: ... ledger unreadable" and no unit started; today the cap reads 0.0 and units run. A second case checks that after add_spend the corrupt bytes survive in backlog-spend.json.corrupt-*. `bash tests/test-backlog.sh` red before. GREEN: same passes; `bash tests/test-backlog-units.sh` stays green; a missing ledger (ENOENT) still means $0 spent. No cap configured means no behavior change. CHANGELOG: "loki backlog: a corrupt spend ledger now stops new units when a daily budget is set, instead of reading as $0 spent." | MEDIUM | merged@2026-10-03T10:50Z | 4dd5faf62 on main (MEDIUM TL APPROVE) |
 | MCP-RUN-EXIT | MCP v10_run reports an early loki crash (exit code plus the last 20 log lines) instead of returning run_id None with no error. | mcp/v10_tools.py, mcp/tests/test_v10_tools.py | RED: new test: monkeypatch the loki binary to a stub that exits 2 immediately and writes "boom" to the log. Expect a result with `error` containing "exited 2" and "boom"; today it is `{"run_id": None, "pid":..., "log_path":...}`. `python3 -m pytest -q mcp/tests/test_v10_tools.py` red before. GREEN: same passes and `bash tests/test-mcp-server.sh` (test 13 at :204) stays green. A still-running process with no run id yet keeps today's shape. CHANGELOG: "MCP loki run now returns the exit code and log tail when loki exits before a run starts." | LOW | merged@2026-10-03T10:46Z | 01c8c0e6c cherry-picked (TL APPROVE; pytest 18/0, red 2 on revert, test-mcp-server 13/0) |
@@ -816,3 +819,29 @@ Source: ~/git/autonomi-dev/research/2026-09-30-adoption/SWARM-PROMPT-ADOPTION.md
 | SPEED-TIMER-UNREF | The group-output spinner interval no longer keeps the process alive when stop() is never called. | loki-ts/src/features/speed/group_output.ts, loki-ts/tests/features/speed/group_output.test.ts | RED: test spawns `bun -e` with isTTY forced true that calls start() and never stop(), with a 5 s timeout -> today it hangs (killed by the timeout, assert exit). `cd loki-ts && bun test tests/features/speed/group_output.test.ts` red before. GREEN: `.unref?.()` on the interval; the child exits within 2 s; existing tests stay green; `bun run build` plus the dist guard pass. Must not touch features/speed/unit_mode.ts (D61-11). CHANGELOG: "Grouped speed output no longer keeps the process alive after a command finishes." | LOW | merged@2026-10-03T10:50Z | 06ac495c0 on main (TL APPROVE), dist 63c6fd667 |
 | SC-LOKI-RATCHET | Warning-level shellcheck coverage for autonomy/loki as a count ratchet (at most 89 today, may only shrink), without editing autonomy/loki. | tests/run-shellcheck.sh, tests/shellcheck-baselines.tsv (new data file, not a test script) | RED: add the ratchet, then in a scratch copy append a line producing SC2086 to autonomy/loki -> `bash tests/run-shellcheck.sh` fails "autonomy/loki warnings 90 > baseline 89". GREEN: on the real tree `bash tests/run-shellcheck.sh` passes and prints "autonomy/loki warnings 89 (baseline 89)". Lowering the file count below the baseline prints a hint to lower the baseline. Run it with `timeout -k 10 120` and record the wall time (today about 19 s for this file) in the PR, and schedule the large file first so total wall time does not grow. Not a new tests/*.sh, so no runner or shard row. No CHANGELOG. | LOW | merged@2026-10-03T10:50Z | 785423377 on main (TL APPROVE) |
 | TRACKER-SITE-1 | Jira intake refuses when JIRA_BASE_URL and the browse URL's origin differ, instead of fetching the same key from the wrong site and building the wrong issue. It also refuses suffix, userinfo and port tricks. | loki-ts/src/features/tracker_intake.ts, loki-ts/tests/engine10/tracker_intake.test.ts, CHANGELOG.md | RED: new tests: (1) JIRA_BASE_URL=https://acme.atlassian.net plus URL https://other.atlassian.net/browse/X-1 -> expect an error naming both origins (today it resolves to acme); (2) `https://acme.atlassian.net.evil.com/browse/X-1`; (3) `https://user@acme.atlassian.net/browse/X-1`; (4) `https://acme.atlassian.net:8443/browse/X-1` -> each refused. `cd loki-ts && bun test tests/engine10/tracker_intake.test.ts` red before. GREEN: same command passes, plus `cd loki-ts && bun run build` and `bash tests/test-release-dist-guard.sh` (dist rebuilt in main checkout per memory). Matching origins still work. CHANGELOG: "Jira intake: a browse URL whose site differs from JIRA_BASE_URL is refused instead of silently fetched from the configured site." | MEDIUM | merged@2026-10-03T10:50Z | 5b595ba3b on main (MEDIUM TL APPROVE) |
+| PO3-QS-MATCH | quickstart picks simple-todo-app for briefs that match no template (#217): keywords + no-match fallback | autonomy/quickstart.sh, tests/test-quickstart-bash32.sh | MEDIUM | bash tests/test-quickstart-bash32.sh (red: URL-shortener brief ranks simple-todo-app first) | merged@2026-10-03T12:48Z | ca50d28d8 TL APPROVE |
+| PO3-PAUSED-TTY | Bun PAUSED.md says Press Enter off a TTY and cites wrong run.sh lines (#212) | loki-ts/src/runner/intervention.ts, loki-ts/tests/runner/intervention.test.ts | LOW | cd loki-ts && bun test tests/runner/intervention.test.ts (red: non-TTY text still says Press Enter) | merged@2026-10-03T12:12Z | TL APPROVE (27/0, 8/0, 85/0, byte parity cmp identical 411B); merged 1ba95e986+b31cf61a7, dist rebuilt |
+| PO3-MEM-INDEX | loki memory index rebuild wipes the index and prints success on failure (#204) | autonomy/loki (24647-24662 only), tests/test-memory-cli.sh | MEDIUM | bash tests/test-memory-cli.sh (red: 2-episode fixture ends with total_memories 0 or no index.json) | merged@2026-10-03T12:12Z | TL APPROVE (test-memory-cli 25/0, 11b red on parent); merged b7b9c74bb |
+| PO3-COUNCIL-TODO | council TODO/FIXME count scans node_modules/.git/.loki and can set blocked=true (3 greps) | autonomy/completion-council.sh (3609, 3886, 4152), tests/test-council-todo-scope.sh (new) | HIGH | bash tests/test-council-todo-scope.sh (red: 6 TODO files under node_modules block the council) | merged@2026-10-03T12:12Z | opus APPROVE (32 council suites rc 0, BSD+GNU grep, red 7/9); merged d5ac03e1a; advisories A1-A3 logged |
+| PO3-HEAL-DOC | healing docs claim failure-modes.json and an enforced pairing contract that never run in production (#200) | skills/healing.md, docs/dev/architecture-reference.md, tests/test-heal-docs-honesty.sh (new) | LOW | bash tests/test-heal-docs-honesty.sh (red: docs assert the artifact is written; zero production callers) | merged@2026-10-03T12:12Z | TL APPROVE (3/0, red on parent, mutation red, structural guards green); merged a9388e9a7 |
+| PO3-SKILL-RUNTIME-DOC | SKILL.md says only read-only commands run on Bun; cli.ts now routes start, proof, report, engine10 and more | SKILL.md (line 18), tests/test-skill-md-runtime-claim.sh (new) | LOW | bash tests/test-skill-md-runtime-claim.sh (red: cli.ts case labels absent from the claim) | merged@2026-10-03T12:12Z | TL APPROVE (claims verified vs bin/loki:570, new guard 7/0, red 4/3 on parent); merged 10aab744d |
+| PO3-HELP-ALLCMDS | loki help All commands omits keys and workspace; discoverability test passes on any prose mention | autonomy/loki (help block ~1814), tests/test-help-discoverability.sh | LOW | bash tests/test-help-discoverability.sh (red after tightening the matcher to the All commands block) | merged@2026-10-03T12:12Z | TL APPROVE (4/0, 15/0, 9/0, mutation red); merged d82bf2779 |
+| PO4-COUNCIL-TEST-TMP | council TODO scope test uses raw mktemp; switch to loki_run_tmp helper | tests/test-council-todo-scope.sh | LOW | bash tests/test-council-todo-scope.sh (red: file has mktemp, no loki_run_tmp_create) | merged@2026-10-03T12:25Z | TL APPROVE (17/0, mutation red, run dir cleaned); merged 8a1b49075 |
+| PO4-ANCHOR-PRECHECK | probe-free stale-anchor precheck for trust-core probe_case strings (#214 opt 3) | tests/test-trust-core-tests-detect.sh, scripts/local-ci.sh | MEDIUM | TRUST_CORE_PROBE_MODE=anchors bash tests/test-trust-core-tests-detect.sh (red: fixture stale anchor exits 0) | merged@2026-10-03T12:30Z | TL APPROVE (semantics match probe, red real, 94 anchors 0.14s, hermetic 18/0); merged fe8456b1b |
+| PO4-HEAL-GUARD-SCOPE | heal-docs honesty guard scans only 3 dirs; widen to all tracked files | tests/test-heal-docs-honesty.sh | LOW | bash tests/test-heal-docs-honesty.sh (red: dashboard/ caller fixture counts 0) | merged@2026-10-03T12:25Z | TL APPROVE (4/0, revert-to-old-scan mutation red); merged fed6dfe2c |
+| PO4-CLI-TS-HELP | cli.ts header says 8 commands and HELP omits dispatched commands | loki-ts/src/cli.ts, loki-ts/tests/commands/cli_help_routes.test.ts, loki-ts/dist | LOW | cd loki-ts && bun test tests/commands/cli_help_routes.test.ts (red: kpis/report/trust missing from HELP) | merged@2026-10-03T12:25Z | TL APPROVE + wording fix (8/0, dist guard 13/0); merged db0ae9eea+458237fb6, dist 8fd495579 |
+| PO4-DASH-SWEEP | remove em/en dashes from 7 tracked text files incl proof-passport output | tools/proof-passport.py, 6 docs files, tests/test_proof_passport.py | LOW | python3 -m pytest tests/test_proof_passport.py (red: rendered passport contains U+2014) | merged@2026-10-03T12:25Z | TL APPROVE (passport pytest 12/0, no dashes in diff); merged 43ca907a4 |
+| PO4-START-REPO-DIR-FIX | tests/cli/test-start-repo-directory.sh fails today; diagnose and fix | tests/cli/test-start-repo-directory.sh | MEDIUM | bash tests/cli/test-start-repo-directory.sh (red: exits 1 stubbed dispatch) | merged@2026-10-03T12:25Z | TL APPROVE (root cause /var symlink confirmed, injection check intact); merged |
+| PO4-CLI-SUITES-REG | 4 tests/cli suites unregistered; guard scans only tests/test-*.sh (after START-REPO-DIR-FIX) | tests/run-all-tests.sh, tests/test-registration-coverage.sh, tests/shard-durations.tsv | MEDIUM | bash tests/test-registration-coverage.sh (red: guard extended to tests/*/ names 4 files) | merged@2026-10-03T12:33Z | TL APPROVE (mutation red, same-name masking refuted, shellcheck unchanged vs parent); merged af6b616fa |
+| PO4-TRUST-CMD-TEST | Bun runTrust has no exit-code/flag contract test | loki-ts/tests/commands/trust.test.ts | LOW | cd loki-ts && bun test tests/commands/trust.test.ts (red vs stub; mutation return 1->0) | merged@2026-10-03T12:25Z | TL APPROVE (14/0, json-branch mutation 3 red); merged |
+| PO4-TODO-PLURAL | council TODO counter misses TODOs/FIXMEs plurals (after COUNCIL-TEST-TMP) | autonomy/completion-council.sh (3 patterns), tests/test-council-todo-scope.sh | HIGH | bash tests/test-council-todo-scope.sh (red: six TODOs-only files do not trip count) | merged@2026-10-03T12:34Z | opus APPROVE (BSD and GNU grep identical on 16 cases, 3 site mutations red, 30 council suites green); merged 4c88ff15e |
+| PO5-ASSESS-HONEST | modernize heal --assess counts plural TODOs and reports the real largest file | autonomy/loki (PYASSESS heredoc only), tests/test-assess-runtime-detection.sh | LOW | bash tests/test-assess-runtime-detection.sh | merged@2026-10-03T12:48Z | 48968d0a5 |
+| PO5-REG-EXACT | registration coverage matches suites exactly, not by substring | tests/test-registration-coverage.sh | LOW | bash tests/test-registration-coverage.sh | merged@2026-10-03T12:48Z | 135dc6368 |
+| PO5-ANCHOR-EQ | trust-core anchors pre-check rejects find == repl cases | tests/test-trust-core-tests-detect.sh | LOW | TRUST_CORE_PROBE_MODE=anchors bash tests/test-trust-core-tests-detect.sh | merged@2026-10-03T12:48Z | 752e3c684 |
+| PO5-DOGFOOD-HONEST | dogfood-stats --help and labels the keyword heuristic | scripts/dogfood-stats.sh, tests/test-dogfood-stats.sh | LOW | bash tests/test-dogfood-stats.sh | merged@2026-10-03T12:48Z | 65c9232b1 |
+| PO5-ORPHAN-SUITES | register 4 orphaned non-test-*.sh suites, guard their naming | tests/test-registration-nonstandard.sh, tests/integration/run_integration_suite.sh | LOW | bash tests/test-registration-nonstandard.sh | merged@2026-10-03T12:48Z | 2db6d1358 |
+| PO5-DASH-BENCH | remove dashes from benchmarks/magic-ab/README.md, whole-tree dash guard | benchmarks/magic-ab/README.md, tests/test-no-dashes-tree.sh | LOW | bash tests/test-no-dashes-tree.sh | merged@2026-10-03T12:48Z | 6e26b46fd |
+| PO5-HELP-READONLY | measure-run.sh and guard-changed.sh treat --help as help | scripts/measure-run.sh, scripts/guard-changed.sh, tests/test-help-readonly-scripts.sh | LOW | bash tests/test-help-readonly-scripts.sh | merged@2026-10-03T12:50Z | 4eba90e3f (from de07c36a6), TL APPROVE 17/0, mutation red 6 |
+| PO5-HELP-NOTES-BRANCHES | release-notes.sh and clean-test-branches.sh real --help | scripts/release-notes.sh, scripts/clean-test-branches.sh, tests/test-release-notes.sh, tests/test-clean-test-branches.sh | LOW | bash tests/test-release-notes.sh; bash tests/test-clean-test-branches.sh | merged@2026-10-03T12:48Z | 53d295093 |
+| PO5-WORKSPACE-VACUOUS | test-workspace.sh fails when no assertions ran | tests/test-workspace.sh | LOW | bash tests/test-workspace.sh | merged@2026-10-03T12:48Z | 43e805cef |
+| PO5-HELP-INSTALL-HOOKS | install-hooks.sh --help never rewrites git config | scripts/install-hooks.sh, tests/test-install-hooks.sh | LOW | bash tests/test-install-hooks.sh | merged@2026-10-03T12:48Z | fce165e70 |