loki-mode 11.10.1 → 11.12.1

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: An autonomous software factory that knows what it is supposed to deliver, and proves it did. Use when the user says Loki Mode or asks to build, fix or verify software autonomously.
 ---
 
-# Loki Mode v11.10.1
+# Loki Mode v11.12.1
 
 **Current entry points (Loki 10 engine):** `loki "<task>"`, `loki owner/repo#N` and `loki quick "<task>"` run the Loki 10 engine and end with a signed receipt (`loki verify`). `loki backlog owner/repo --all` runs many issues in parallel. Guide: `docs/v10/GUIDE.md`. The skill instructions below, and `loki start`, describe the previous bash loop. PRD-file starts (`loki start ./prd.md`) and the opencode provider still run on it until FC38-SWEEP ports them; the legacy-engine command and the LOKI_ENGINE switch remain removed. Prefer `loki owner/repo#N` for issues.
 
@@ -200,7 +200,7 @@ This protocol governs **skill module** loading -- task-scoped instruction files
 <!-- generated:commands -->
 Commands (generated from `loki-ts/src/cli/registry.ts`; full reference in `docs/CLI-REFERENCE.md`):
 
-`version`, `status`, `doctor`, `provider`, `memory`, `rollback`, `proof`, `wiki`, `control`, `kpis`, `report`, `trust`, `crash`, `contract`, `start`, `slack`, `queue`, `issues`, `undo`, `verify-pr`, `answer`, `engine10`, `help`, `chat`, `edit`, `diff`, `models`, `setup`, `quick`, `quickstart`, `init`, `template`, `verify`, `keys`, `review`, `dashboard`, `config`, `mcp`, `acp`, `stop`, `pause`, `resume`, `why`, `next`, `logs`, `ship`, `deploy`, `import`, `github`, `issue`, `ci`, `modernize`, `share`, `assets`, `export`, `notify`, `tour`, `welcome`, `onboard`, `setup-skill`, `self-update`, `remote`, `cockpit`, `code`, `context`, `secrets`, `api`, `sandbox`, `docker`, `web`, `preview`, `telemetry`, `syslog`, `explain`, `docs`, `test`, `bench`, `voice`, `own`, `secure`, `compliance`, `enterprise`, `projects`, `audit`, `cost`, `metrics`, `sentrux`, `magic`
+`version`, `status`, `doctor`, `provider`, `memory`, `rollback`, `proof`, `wiki`, `control`, `intent`, `kpis`, `report`, `trust`, `crash`, `contract`, `start`, `slack`, `queue`, `issues`, `undo`, `verify-pr`, `answer`, `engine10`, `help`, `chat`, `edit`, `diff`, `models`, `setup`, `quick`, `quickstart`, `init`, `template`, `verify`, `keys`, `review`, `dashboard`, `config`, `mcp`, `acp`, `stop`, `pause`, `resume`, `why`, `next`, `logs`, `ship`, `deploy`, `import`, `github`, `issue`, `ci`, `modernize`, `share`, `assets`, `export`, `notify`, `tour`, `welcome`, `onboard`, `setup-skill`, `self-update`, `remote`, `cockpit`, `code`, `context`, `secrets`, `api`, `sandbox`, `docker`, `web`, `preview`, `telemetry`, `syslog`, `explain`, `docs`, `test`, `bench`, `voice`, `own`, `secure`, `compliance`, `enterprise`, `projects`, `audit`, `cost`, `metrics`, `sentrux`, `magic`
 <!-- /generated -->
 
 ---
@@ -483,4 +483,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v11.10.1 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**
+**v11.12.1 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**

package/VERSION

@@ -1 +1 @@
-11.10.1
+11.12.1

package/autonomy/loki

@@ -1905,6 +1905,7 @@ show_help_all() {
     echo "  loki memory list              # All learnings"
     echo "  loki memory search <query>    # Search across learnings"
     echo "  loki memory consolidate       # Run episodic-to-semantic pipeline"
+    echo "  loki memory learn --recent N  # Learn from the newest N merged PRs"
     echo ""
     echo "  # Config + dashboard"
     echo "  loki config set maxTier sonnet   # Cap model cost"

package/autonomy/quickstart.sh

@@ -181,6 +181,9 @@ _qs_score_templates() {
     # can tell a genuine match from simple-todo-app winning by default.
     local best_mode=false
     [ "${2:-}" = "--best" ] && best_mode=true
+    # --scores: print "name<TAB>score" for the top 3 (used by --explain-match).
+    local scores_mode=false
+    [ "${2:-}" = "--scores" ] && scores_mode=true
     local tdir; tdir="$(_qs_templates_dir)"
     local brief_lc; brief_lc=$(printf '%s' "$brief" | tr '[:upper:]' '[:lower:]')
 
@@ -263,6 +266,8 @@ _qs_score_templates() {
     ' | sort -t"$(printf '\t')" -k1,1nr -k2,2n -k3,3 | {
         if [ "$best_mode" = true ]; then
             head -1 | cut -f1 | awk '{ print ($1 == "" ? 0 : $1) }'
+        elif [ "$scores_mode" = true ]; then
+            head -3 | awk -F'\t' '{ printf "%s\t%s\n", $3, $1 }'
         else
             head -3 | cut -f3
         fi
@@ -276,6 +281,27 @@ _qs_match_strength() {
     _qs_score_templates "$1" --best
 }
 
+# _qs_explain_match <brief>: print the top 3 template scores and a confidence
+# label. Reuses the scorer; offline and read-only.
+_qs_explain_match() {
+    local brief="$1" strength rank=1 name score
+    strength="$(_qs_match_strength "$brief")"
+    case "$strength" in ''|*[!0-9]*) strength=0;; esac
+    printf '\n  Template match scores:\n'
+    while IFS=$'\t' read -r name score; do
+        [ -n "$name" ] || continue
+        printf '  %d. %s score %s\n' "$rank" "$name" "$score"
+        rank=$((rank + 1))
+    done < <(_qs_score_templates "$brief" --scores)
+    if [ "$strength" -ge 4 ]; then
+        printf '  Match confidence: high (strength %s)\n' "$strength"
+    elif [ "$strength" -ge 2 ]; then
+        printf '  Match confidence: medium (strength %s)\n' "$strength"
+    else
+        printf '  Match confidence: low (strength %s): no strong match, using a plain spec\n' "$strength"
+    fi
+}
+
 # _qs_template_summary <name>: a short one-line description for the picker.
 # Read from the template's first prose line would be fragile; use a small
 # curated table so the picker copy is stable and honest.
@@ -919,6 +945,7 @@ _qs_help() {
     printf '  --yes, -y     Auto-confirm the final build prompt (still shows the plan)\n'
     printf '  --dry-run     Preview the selected template and plan; write/start nothing\n'
     printf '  --json        Emit machine-readable output for a read-only command\n'
+    printf '  --explain-match  With --dry-run, show the top 3 template scores and match confidence\n'
     printf '  --from-preview F  Continue saved JSON from file F (or - for piped stdin); requires --yes\n'
     printf '  --verify-preview F  Verify saved JSON from file F (or - for piped stdin); executes nothing\n'
     printf '  --template N  Use the exact shipped template N for an IDEA\n'
@@ -986,6 +1013,7 @@ cmd_quickstart() {
     local template_flag_seen=false
     local list_templates=false
     local list_templates_flag_seen=false
+    local explain_match=false
     local from_preview=""
     local from_preview_flag_seen=false
     local verify_preview=""
@@ -1023,6 +1051,10 @@ cmd_quickstart() {
                 json_output=true
                 shift
                 ;;
+            --explain-match)
+                explain_match=true
+                shift
+                ;;
             --template)
                 if [ "$template_flag_seen" = true ]; then
                     printf '%s--template may be specified only once.%s\n' "$_QS_RED" "$_QS_NC" >&2
@@ -1168,6 +1200,11 @@ cmd_quickstart() {
         exit 2
     fi
 
+    if [ "$explain_match" = true ] && { [ "$dry_run" != true ] || [ "$json_output" = true ]; }; then
+        printf '%s--explain-match requires --dry-run and cannot be combined with --json.%s\n' "$_QS_RED" "$_QS_NC" >&2
+        exit 2
+    fi
+
     if [ "$json_output" = true ] && [ "$dry_run" != true ]; then
         printf '%s--json requires --dry-run.%s\n' "$_QS_RED" "$_QS_NC" >&2
         exit 2
@@ -1257,6 +1294,9 @@ cmd_quickstart() {
     printf '\n'
     if [ "$dry_run" = true ]; then
         printf '%sLoki Mode quickstart preview -- template and plan only.%s\n' "$_QS_BOLD" "$_QS_NC"
+        if [ "$explain_match" = true ]; then
+            _qs_explain_match "$positional"
+        fi
     else
         printf '%sLoki Mode quickstart -- four quick questions, then your build starts.%s\n' "$_QS_BOLD" "$_QS_NC"
     fi

package/completions/loki.bash

@@ -59,7 +59,7 @@ _loki_completion() {
         memory)
             local memory_cmds="list show search stats export clear dedupe index timeline consolidate economics retrieve lessons learn forget episode pattern skill vectors brief help"
             if [[ "$cur" == -* ]]; then
-                COMPREPLY=( $(compgen -W "--task --help" -- "$cur") )
+                COMPREPLY=( $(compgen -W "--task --recent --repo --help" -- "$cur") )
                 return 0
             fi
             COMPREPLY=( $(compgen -W "${memory_cmds}" -- "$cur") )
@@ -226,6 +226,13 @@ _loki_completion() {
             fi
             ;;
 
+        quickstart)
+            if [[ "$cur" == -* ]]; then
+                COMPREPLY=( $(compgen -W "--dry-run --explain-match --from-preview --verify-preview --json --list-templates --template --yes --help" -- "$cur") )
+                return 0
+            fi
+            ;;
+
         plan)
             if [[ "$cur" == -* ]]; then
                 COMPREPLY=( $(compgen -W "--json --verbose --spec --requirements --help" -- "$cur") )

package/dashboard/__init__.py

@@ -7,6 +7,6 @@ Modules:
     control: Session control helpers (status, atomic writes, origin check)
 """
 
-__version__ = "11.10.1"
+__version__ = "11.12.1"
 
 __all__ = ["__version__"]

package/docs/CLI-REFERENCE.md

@@ -1,6 +1,6 @@
 # CLI reference
 
-Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.10.1. Do not edit by hand.
+Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.12.1. Do not edit by hand.
 Hidden and legacy-only commands are omitted; see `docs/v10/CLI-MODERN.md` for the full inventory.
 
 | Command | Description |
@@ -44,6 +44,8 @@ Hidden and legacy-only commands are omitted; see `docs/v10/CLI-MODERN.md` for th
 | `loki control backfill` | Ship DIR/.loki/runs to the control plane |
 | `loki control prune` | Delete matching runs |
 | `loki control status` | Show control plane reachability |
+| `loki intent` | Show a past run's intent card |
+| `loki intent show` | Print the intent card and answer |
 | `loki kpis` | KPI snapshot (alias of report kpis) |
 | `loki report` | Reporting: kpis, session, metrics, cost, export, share, dogfood |
 | `loki report kpis` | Canonical KPI snapshot |

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 Loki Mode, by [Autonomi](https://www.autonomi.dev/), turns a spec or an issue into a verified pull request with a receipt you can check. This page covers installing it, a first run, and the options around it.
 
-**Version:** v11.10.1
+**Version:** v11.12.1
 
 **Engine note:** `loki start` is the primary command. `loki start`, `loki "<task>"`, `loki owner/repo#N` and `loki quick` all run the Loki 10 engine, whatever the flag order or input form (PRD file, issue ref, task or one-word brief). The previous loop runs only on `--engine legacy`, `LOKI_ENGINE=legacy`, or for one call when a flag Loki 10 cannot honor is present. See the [user guide](v10/GUIDE.md) and the [5-minute quickstart](QUICKSTART.md).
 

package/docs/v10/BOARD.md

@@ -366,9 +366,9 @@ set is declared to avoid overlap with those and with each other.
 | M-12 | Oracle seal, held-out split, 80% floor, up-front NOT PROVEN | loki-ts/src/engine10/modernize/oracle/seal.ts, loki-ts/tests/engine10/modernize/oracle_seal.test.ts | HIGH | cd loki-ts && bun test tests/engine10/modernize/oracle_seal.test.ts | released@2026-09-28T21:01Z | Source: MODERNIZE.md (D30). Depends on M-09. Opus REJECT (reproduced): delete-and-reseal defeats tamper evidence (hashes stored beside the data). Next: rework. r2 d9026ec6 Opus APPROVE (reseal refused via the append-only log); merged dc827b80 (on top of v10.2.2): full `cd loki-ts && bun test` 2277 pass 0 fail, `bash tests/test-engine10-dist.sh` 18 passed, `bash tests/test-v10-pulse.sh` 117 passed. Released in v10.5.0 (merge b71d80fa is an ancestor of v10.5.0). |
 | M-13 | Equivalence checker with sealed normalizers and contract output | loki-ts/src/engine10/modernize/equiv.ts, loki-ts/tests/engine10/modernize/equiv.test.ts, loki-ts/tests/engine10/modernize/fixtures/equiv/ | HIGH | cd loki-ts && bun test tests/engine10/modernize/equiv.test.ts | released@2026-09-28T22:26Z | Source: MODERNIZE.md (D30). Depends on M-12. Wave E27 (wf_bcacb1d1-e76). Wave E27 stopped 18:37Z (founder: over budget, load 50). REJECT (reproduced): a unit whose oracle seal is NOT_PROVEN still gets a clean equivalence pass. Branch slice-M-13-equiv kept. Dispatched 21:18Z sonnet (founder 17:10 staffing directive). r2 b379c171 REJECT (3 blockers), r3 89ea40ae REJECT on B3 (normalizers still caller-supplied: tolerance 1e9 after the new tree gives PROVEN). D42 (4): only fix (a), sealOracle hashes the normalizers; M-13 may edit the M-12 seal file for this only. r4 dispatched 21:42Z. r4 fe3cae28 opus APPROVE (normalizer hash in the oracle seal; tolerance 1e9 after seal gives NOT_PROVEN; hand-edited sealed.json refused; canonical hash over all 3 fields). Merged. Released in v10.5.3 (merge cb1ef386 is an ancestor of v10.5.3). |
 | M-14 | Wall pre-sealed mode: oracle plus conformance, green base is an error | loki-ts/src/engine10/stages/wall.ts (pre-sealed branch only), loki-ts/tests/engine10/modernize/wall_presealed.test.ts | HIGH | cd loki-ts && bun test tests/engine10/modernize/wall_presealed.test.ts | released@2026-09-28T23:18Z | Source: MODERNIZE.md (D30). Depends on M-12, E-54. D33: states its net core line delta; core must stay under 5,000 (92 lines of headroom shared by E-67, E-66, E-61, M-14, merge order E-67, E-66, E-61); offset any excess by deleting dead core code. Wave E27 (wf_bcacb1d1-e76). Wave E27 stopped 18:37Z (founder: over budget, load 50). REJECT: branch empty (no commits). Dispatched 21:51Z. r1 867cffab opus REJECT: crash/OOM/signal exits read as red; bare ImportError enum reads a missing third-party package as red; no file sha256 or verify; no binding to the oracle seal. r2 dispatched 21:57Z. r2 86d078eb (crash/signal exits not_run; inRepo on collection errors; file sha256 plus verify; oracle seal required; base_sha recorded); presealed 26/26, modernize 222/0; opus re-review 22:04Z. r2 86d078eb opus: B1, B3, B4 fixed; B2 still open (inRepo is a caller-supplied flag: name six with inRepo true gives red). r3 derives it from the repo tree. r3 ef4fa166 opus APPROVE (inRepo derived from the real tree via realpath; symlinks and .. names give not_run; verify re-runs verifySeal). Merged; modernize suite green. Released in v10.5.5 (merge c8f9a7d0 is an ancestor of v10.5.5). |
-| M-15 | Unit runner: card to v10 run with oracle Wall and equiv check | loki-ts/src/engine10/modernize/unit.ts, loki-ts/tests/engine10/modernize/unit.test.ts | HIGH | cd loki-ts && bun test tests/engine10/modernize/unit.test.ts | parked@2026-09-30T20:04Z | Source: MODERNIZE.md (D30). Depends on M-13, M-14. Requirement from the M-13 review: call sealOracle with the card normalizers before implement, and test that ordering. From the M-14 review: derive the failing module from the traceback file path under the target runtime (site-packages can shadow a repo name); resolve the module part of an AttributeError so real reds are sealable; call verifyPreSealedWall and verifySeal before trusting a Wall. Dispatched 22:09Z (M-13, M-14 merged).  WIND-DOWN 2026-09-28: opus r1 REJECT (B1 importer frame made a missing third-party package red; B2 PROVEN without conformance re-run or ablation) fixed at 03b35a69 on slice-M-15 (modernize plus budget 250/0, both red then green on real pytest 9.0.2). NEXT: opus r2 review of 03b35a69, then merge. Opus r3 REJECT (18:40Z): B1 added pytest.toml/.pytest.ini or test file bypasses conformance to PROVEN with u.py unmodernized; r4 widens drift rules, adds throwing-stub ablation test, re-syncs the collection rule to E-125 6fc6e950. M-17 must build the production runStub. PARKED 20:05Z by the adoption directive (docs/v10/PROGRESS.md 20:05Z); resumes after Tier 0 is green. |
+| M-15 | Unit runner: card to v10 run with oracle Wall and equiv check | loki-ts/src/engine10/modernize/unit.ts, loki-ts/tests/engine10/modernize/unit.test.ts | HIGH | cd loki-ts && bun test tests/engine10/modernize/unit.test.ts | merged@2026-10-15T23:40Z | Source: MODERNIZE.md (D30). Depends on M-13, M-14. Requirement from the M-13 review: call sealOracle with the card normalizers before implement, and test that ordering. From the M-14 review: derive the failing module from the traceback file path under the target runtime (site-packages can shadow a repo name); resolve the module part of an AttributeError so real reds are sealable; call verifyPreSealedWall and verifySeal before trusting a Wall. Dispatched 22:09Z (M-13, M-14 merged).  WIND-DOWN 2026-09-28: opus r1 REJECT (B1 importer frame made a missing third-party package red; B2 PROVEN without conformance re-run or ablation) fixed at 03b35a69 on slice-M-15 (modernize plus budget 250/0, both red then green on real pytest 9.0.2). NEXT: opus r2 review of 03b35a69, then merge. Opus r3 REJECT (18:40Z): B1 added pytest.toml/.pytest.ini or test file bypasses conformance to PROVEN with u.py unmodernized; r4 widens drift rules, adds throwing-stub ablation test, re-syncs the collection rule to E-125 6fc6e950. M-17 must build the production runStub. PARKED 20:05Z by the adoption directive (docs/v10/PROGRESS.md 20:05Z); resumes after Tier 0 is green. |
 | M-16 | Deterministic codemods first (futurize, OpenRewrite) or skipped | loki-ts/src/engine10/modernize/codemod.ts, loki-ts/tests/engine10/modernize/codemod.test.ts | MEDIUM | cd loki-ts && bun test tests/engine10/modernize/codemod.test.ts | released@2026-09-28T16:03Z | Source: MODERNIZE.md (D30). Depends on M-02. Built 0a8bbe6c (branch slice-M-16-codemods); TL review died on the 04:48Z access outage. Wave E21 (wf_39ab3f7d-8f3). TL review. TL APPROVE of 0a8bbe6c; merged into train E22 (9042e964): `bun test tests/engine10/` 547 pass 0 fail, tsc 0, `bash tests/test-v10-pulse.sh` 107 passed, `bash eval/loki10/test-harness.sh` 108 passed. Released in v10.2.1 (npm publish 2026-09-28T16:03Z; every cited commit is an ancestor of the v10.2.1 tag; `git merge-base --is-ancestor`). |
-| M-17 | Scheduler: N workers, worktrees, cascade, best-of-2, budget stop | loki-ts/src/engine10/modernize/scheduler.ts, loki-ts/tests/engine10/modernize/scheduler.test.ts | HIGH | cd loki-ts && bun test tests/engine10/modernize/scheduler.test.ts | ready@2026-09-28T02:45Z | Source: MODERNIZE.md (D30). Depends on M-15. |
+| M-17 | Scheduler: N workers, worktrees, cascade, best-of-2, budget stop | loki-ts/src/engine10/modernize/scheduler.ts, loki-ts/tests/engine10/modernize/scheduler.test.ts | HIGH | cd loki-ts && bun test tests/engine10/modernize/scheduler.test.ts | merged@2026-10-16T00:00Z | Source: MODERNIZE.md (D30). Depends on M-15. |
 | M-18 | Re-slice non-equivalent units to depth 2, then NOT PROVEN | loki-ts/src/engine10/modernize/reslice.ts, loki-ts/tests/engine10/modernize/reslice.test.ts | MEDIUM | cd loki-ts && bun test tests/engine10/modernize/reslice.test.ts | released@2026-09-28T23:18Z | Source: MODERNIZE.md (D30). Depends on M-05, M-13.  Merged 20c51512 after TL r2 APPROVE (f41e7e70; reslice 13/0, modernize 241/0 on main). Released in v10.5.5 (merge 20c51512 is an ancestor of v10.5.5). |
 | M-19 | Strangler targets and routes.json (py2/dual/py3, per-module release) | loki-ts/src/engine10/modernize/routes.ts, loki-ts/src/engine10/modernize/targets/python3.ts, loki-ts/src/engine10/modernize/targets/java21.ts, loki-ts/tests/engine10/modernize/routes.test.ts | MEDIUM | cd loki-ts && bun test tests/engine10/modernize/routes.test.ts | released@2026-09-28T16:03Z | Source: MODERNIZE.md (D30). Depends on M-05. Built 3299d359 (branch slice-M-19-routes); TL review died on the 04:48Z access outage. Wave E21 (wf_39ab3f7d-8f3). TL review. TL APPROVE of 3299d359; merged into train E22 (9042e964): `bun test tests/engine10/` 547 pass 0 fail, tsc 0, `bash tests/test-v10-pulse.sh` 107 passed, `bash eval/loki10/test-harness.sh` 108 passed. Released in v10.2.1 (npm publish 2026-09-28T16:03Z; every cited commit is an ancestor of the v10.2.1 tag; `git merge-base --is-ancestor`). |
 | M-20 | Wave verify: full build, integration and original suite | loki-ts/src/engine10/modernize/wave.ts, loki-ts/tests/engine10/modernize/wave.test.ts | MEDIUM | cd loki-ts && bun test tests/engine10/modernize/wave.test.ts | ready@2026-09-28T02:45Z | Source: MODERNIZE.md (D30). Depends on M-17, M-19. |
@@ -870,13 +870,68 @@ Source: ~/git/autonomi-dev/research/2026-09-30-adoption/SWARM-PROMPT-ADOPTION.md
 | CP-UI-SHELL | Control Plane shell, brand, import, loopback-only start endpoint | packages/control-plane ui and server | HIGH | opus APPROVE r2, suite 68/0 | merged@15:33Z f88c18a6b | D82 10.7.0 big train |
 | D82-WALL0 | Empty Wall seal is NOT PROVEN; nested Wall files collected | loki-ts engine10 wall and seal | HIGH | opus APPROVE r2, wall+seal 101/0 | merged@15:33Z 9b87e50c8 | D82 10.7.0 big train |
 | D83-CPE | Enterprise Control Plane UI rebuild, slices CPE-01..26 per docs/v10/CP-ENTERPRISE-UI.md, integrating on branch cpe-base | packages/control-plane, loki-ts engine10 run_pid | HIGH | per-slice Wall checks, opus on 04/07/09/14 | building@15:33Z (01,03,05,21 on cpe-base; 04,07 in opus review; 02,09 building) | D83 10.8.0 |
-| FC-09r | FC-09 rework f4eccfeac BLOCKED by rv-trust3 (reproduced): package.json pretest/posttest/test:* edits return no runner-config note; compare the whole scripts object, and have verify compare base vs head runner sections; add go.mod replace, Cargo.toml [patch], package.json overrides/imports, tsconfig paths | loki-ts/src/features/runner_config.ts plus its tests | HIGH | bun repro: a pretest-only edit caps the verdict; runner_config tests green | ready@2026-10-03T19:35Z | Do not merge f4eccfeac as is. Opus reviewer. |
-| CPE24-P2a | Checkpoint rollback restores only an allowlist (session.json, dashboard-state.json, CONTINUITY.md, autonomy-state.json, state, queue) and refuses nested symlinks | packages/control-plane/src/server/routes/checkpoints.ts plus test | MEDIUM | planted audit/ in a checkpoint does not overwrite .loki/audit | ready@2026-10-03T19:35Z | rv-trust3 advisory on P2. |
-| CPE24-P4a | Legacy /api/control/* callers require ctx.local (or isLoopbackHost) like /v1 | packages/control-plane/src/server/legacy/routes-control.ts plus test | MEDIUM | non-loopback Host refused on legacy control | ready@2026-10-03T19:35Z | rv-trust3 advisory on P4. |
-| CP-NITS1 | CP run page nits from the 10.10.2 smoke: Wall row describes the Wall ("Wrote acceptance checks (n files)" or "skipped: no checks written"); local repo with no remote shows the folder name, not REPO UNMEASURED; receipt text read from receipt.json on disk like the derived diff; diffstat failures cached (F1); leading-dash sha fixture | packages/control-plane/src/server plus ui run page plus tests | MEDIUM | CP suite green; a signed receipt on disk renders its text; a no-remote repo shows its folder name | ready@2026-10-03T21:31Z | Peer smoke 21:27Z plus CP follow-up review F1. |
-| FC-01b | Monorepo visual-evidence skip reason: with backend/ and frontend/ package.json and no root manifest, say "no dev, preview or start script in backend/ or frontend/", not "no package.json" | visual evidence path in loki-ts/src plus test | LOW | monorepo fixture prints the per-package reason | ready@2026-10-03T21:31Z | FC-01 sibling (Engine Law L5). |
-| FC-19b | Spec-conflict resume near the stage limit: skip the resume when under about 60s of the implement window remains, or keep the first conflict when the resume is aborted, so the run ends BLOCKED with its question instead of a limit failure | loki-ts/src/util/conflict_resume.ts plus machine.ts plus test | MEDIUM | a fake first session that uses the window then conflicts ends BLOCKED with its question | ready@2026-10-03T21:56Z | review-fc19 non-blocking follow-up, from reading machine.ts runStage. |
-| CP-START | FC-20 (LATER list): root-cause the CP home Start "HTTP 404" (route mismatch, stale CP process serving a newer UI, or the loopback guard) and fix it at the shared layer (UI and server version match; a stale CP restarts or refuses a newer UI); never show a bare HTTP status, show a sentence with the next step; repo chip lists registered repos by name plus Browse; choosing a smaller model shows one muted line ("haiku: fastest, may be less accurate") and never blocks. The composer itself is redefined by CP-ASK (founder 22:03Z): greenfield-from-composer is dropped | packages/control-plane server and ui plus tests | MEDIUM | a forced 404 renders a sentence, a version-skewed UI gets the restart sentence | ready@2026-10-03T22:05Z | Founder bug via steering 22:01Z, rescoped by founder 22:03Z. Do not displace FC-15 or FC-16. |
+| FC-09r | FC-09 rework f4eccfeac BLOCKED by rv-trust3 (reproduced): package.json pretest/posttest/test:* edits return no runner-config note; compare the whole scripts object, and have verify compare base vs head runner sections; add go.mod replace, Cargo.toml [patch], package.json overrides/imports, tsconfig paths | loki-ts/src/features/runner_config.ts plus its tests | HIGH | bun repro: a pretest-only edit caps the verdict; runner_config tests green | released@2026-10-15T23:55Z | Do not merge f4eccfeac as is. Opus reviewer. |
+| FC-09s | FC-09 sibling sweep from the FC-09r opus review (bun probe reproduced): runner_config misses (1) Cargo.toml top-level dotted keys such as patch.crates-io.serde = { path = "fake" } before [package]; (2) go.work replace directives (go.work is not in RUNNER_CONFIGS); (3) babel.config.*, .babelrc, .pnpmfile.cjs, Cargo [[test]] harness=false and Cargo [dev-dependencies] path=; also add one verify-stage case where a package.json pretest edit caps the verdict | loki-ts/src/features/runner_config.ts, loki-ts/tests/engine10/runner_config.test.ts, loki-ts/tests/engine10/verify_weak.test.ts | HIGH | each probe above caps the verdict to NOT PROVEN; a plain version bump still does not cap | merged@2026-10-16T00:00Z | FC-09 sibling (L5). No core engine10 lines (4998 of 5000). |
+| FC-09t | FC-09s opus review follow-ups (all reproduced as pre-existing misses): P1 Cargo section headers with a trailing comment or inner spaces ([patch.crates-io] # local, [ patch.crates-io ], [dev-dependencies] # t) are not seen, so path= under them does not cap; Cargo [dependencies] and [workspace.dependencies] path= (parity with npm depGuard); dev-dependency git =; [[test]] path = and [lib] test = false; go.work use ./x lines and a new go.work with only use lines; .pnpmfile.mjs | loki-ts/src/features/runner_config.ts, loki-ts/tests/engine10/runner_config.test.ts | HIGH | each probe caps; plain version bumps do not cap | review@2026-10-16T00:27Z | r4 5f4e626bb on branch fc09t-wip in Opus round-4 review (r2 9e00d7c21 and r3 064cb191b were Opus-BLOCKED). FC-09 sibling (L5). No core engine10 lines. |
+| FV-evidence-sha-1 | Bind integration status and exit code into the composite: In composeComposite and verifyComposite (seal_group.ts), read integration.json status/exit_code. Seal throws unless status is passed or not_configured. Verify returns TAMPERED when status is failed/interrupted or exit_code is nonzero. Add integration {status, exit_code, log_sha256, heads} to Composi | loki-ts/src/features/speed/seal_group.ts | HIGH | Extend loki-ts/tests/engine10/seal_group.test.ts: writeWs fixture (line ~341) with status:failed. Red: current code seals VERIFIED then verify passes; green: se | building@2026-10-16T00:12Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
+| FV-evidence-sha-2 | Bind integration.log hash and require non-null heads: In composeComposite refuse null/missing heads[repo] and, when log_sha256 is non-null, recompute sha256 of <run>/integration.log and throw on mismatch/missing. In verifyComposite do the same (TAMPERED on log mismatch) and make integrated-head mismatch TAMPERED rather than UNCHECKED (matches seal). Ke | loki-ts/src/features/speed/seal_group.ts | HIGH | Extend seal_group.test.ts tests at ~458 (null head) and ~406 (head edit): add log swap case; update null-head expectation to seal-refuse, add legacy-case UNCHEC | building@2026-10-16T00:12Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
+| FV-evidence-sha-3 | Show SHAs and integration status in verify output and fix stale note: Make `loki verify <run-dir>/composite.json` and the --seal-composite output print per-repo head_sha, integration status and log hash (verify_cmd.ts:132 and the composite verify branch near :111-122). Delete the stale `seal: False` and 'only when the run seals one' note in workspace.py run_integratio | loki-ts/src/engine10/verify_cmd.ts, autonomy/lib/workspace.py | MEDIUM | Extend loki-ts/tests/engine10/verify_cmd.test.ts (composite output contains each 40-hex head and 'integration: passed') and the existing workspace python test f | building@2026-10-16T00:12Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
+| FV-evidence-sha-4 | Correct workspace guide on what the Seal covers, reachable from chat: Update docs/WORKSPACES.md lines 39, 55-59: state integration.json, integration status, log hash and every head SHA are inside the signed composite; list the new TAMPERED conditions (failed status, log swap, head mismatch); state explicitly that deployed-SHA binding is not implemented. Remove the now | docs/WORKSPACES.md | LOW | Extend the existing docs/claims guard test if present (grep tests for WORKSPACES.md); otherwise a grep assertion in seal_group.test.ts is not needed: manual che | building@2026-10-16T00:12Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
+| FV-readiness-env-1 | Readiness score + findings in loki doctor --repo: Add pure function repoReadiness(profile, reqs) in repo_profile.ts returning {score 0-100, grade, findings[{id,severity,message,fix}]}. Rules from existing profile fields: no test cmd (-30), baseline not run/timed out/not attributable (-15), baseline red with N failing ids (-20, fix: 'loki start will | loki-ts/src/runner/repo_profile.ts, loki-ts/src/commands/doctor.ts | LOW | Extend loki-ts/tests/runner/harness_intelligence.test.ts REPOMEM block (near :764 and :634): red = assert readiness absent/undefined fails for profiles with no  | building@2026-10-16T00:12Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
+| FV-readiness-env-2 | doctor --repo builds the profile on demand (--fix applies safe repo repair): When profile is absent, `loki doctor --repo` calls the existing ensureProfile(process.cwd()) (honours LOKI_REPO_BASELINE=0, never throws) instead of printing 'none yet'; keep read-only printing when a fresh profile exists. Allow --repo --fix to mean 'build/refresh profile' (replace the exit-64 rejec | loki-ts/src/commands/doctor.ts, loki-ts/src/runner/repo_profile.ts | MEDIUM | Extend harness_intelligence.test.ts :764 test: red = absent profile in a temp git repo with package.json test script prints 'none yet'; green = doctor --repo cr | building@2026-10-16T00:12Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
+| FV-readiness-env-3 | Reach readiness from loki start and loki chat: Add /doctor (alias /ready) slash to loki chat delegating via _chat_do "$loki" doctor --repo (plus --json passthrough), listed in _chat_help. In loki start's existing first-run/summary output, print the one-line 'Readiness: NN/100' from the same repoReadiness helper after intake builds the profile (i | autonomy/lib/chat.sh, loki-ts/src/engine10/stages/intake.ts | LOW | Extend an existing chat test if present (grep tests/ for chat help assertions, e.g. tests/test-first-run-funnel-coverage.sh) to assert /doctor appears in /help  | building@2026-10-16T00:12Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
+| FV-readiness-env-4 | Docs reconcile + remove dead doctor-fix.py: Update docs/CLI-REFERENCE.md and docs/cli-reference.md (merge into one if one is a duplicate, delete the other and fix links) doctor row to list --json --fix --requirements --repo and readiness score; add a short Readiness section. Verify then delete autonomy/lib/doctor-fix.py and tests/test_doctor_ | docs/CLI-REFERENCE.md, docs/cli-reference.md, autonomy/lib/doctor-fix.py, tests/test_doctor_fix_plan.py | LOW | Existing docs-vs-help guard (grep tests/ for CLI-REFERENCE checks) must stay green; after deletion run tests/run-all-tests.sh doctor subset (test-doctor-ux.sh,  | building@2026-10-16T00:12Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
+| FV-docs-pin-1 | Fix `loki answer` wording everywhere: Change 'Resume a BLOCKED run' to 'Start a follow-up run from a BLOCKED run with your answer' in the single registry string and help text; run generate-stale-zero.sh so CLI-REFERENCE regenerates; fix README.md:105 and autonomy/loki:1685 help; add one line to docs/slack.md that CLI `loki answer` has t | loki-ts/src/cli/registry.ts, loki-ts/src/cli.ts, README.md, autonomy/loki, docs/slack.md, docs/CLI-REFERENCE.md | LOW | Extend loki-ts/tests registry/help snapshot test (or tests/test-docs-cli-drift.sh): red = grep 'Resume a BLOCKED' returns hits in registry.ts/README/cli.ts; gre | building@2026-10-16T00:12Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
+| FV-docs-pin-2 | Correct wiki/Providers.md capability table from provider files: Edit existing table (wiki/Providers.md:11-18) to match providers/*.sh: context windows, codex parallel (max 2, degraded), cline MCP yes; add Degraded column; add a one-line 'source: providers/*.sh PROVIDER_* vars' note. Mirror the same facts in README.md:116 only if it disagrees. No new doc. | wiki/Providers.md, README.md | LOW | Extend tests/test-no-stale-facts.sh (or test-docs-cli-drift.sh) with a check that for each provider the doc row's Parallel/MCP/context value equals the provider | building@2026-10-16T00:12Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
+| FV-docs-pin-3 | Reconcile Node floor and install claims: Make README.md:142 and docs/INSTALLATION.md:60 say Node 20+ (matches package.json engines >=20.0.0 and wiki/Installation.md:11); verify against bin/loki runtime check for the Node guard and keep the stricter source of truth. | README.md, docs/INSTALLATION.md, wiki/Installation.md | LOW | Extend tests/test-no-stale-facts.sh: red = grep 'Node.js 18' README/INSTALLATION; add assertion that min-Node string in docs equals package.json engines.node; g | building@2026-10-16T00:12Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
+| FV-docs-pin-4 | Stamp wiki pages to current VERSION and fix legacy-engine banner: Replace the 13 stale 10.6.6 version stamps with 11.11.0 (pin to 11.12.0 at release via generate-stale-zero.sh by adding wiki/*.md line-3 stamp to its targets), delete the 'legacy engine, being removed' banner in wiki/CLI-Reference.md:3 and drop or mark rows for commands not in registry (compound, cp | scripts/generate-stale-zero.sh, wiki/CLI-Reference.md, wiki/Architecture.md, wiki/Dashboard.md, wiki/Home.md, tests/test-no-stale-facts.sh | MEDIUM | Extend tests/test-no-stale-facts.sh to scan wiki/*.md version stamps against VERSION (and tests/lib/scan-doc-cli-drift.py to cover wiki/): red = 13 pages flagge | building@2026-10-16T00:12Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
+| FV-deploy-observe-1 | Re-check health after auto-rollback and record it: After a rollback exits 0, re-probe health_url with _deploy_probe_health; add post_rollback_health (healthy/FAILED_HEALTH/unchecked) and health_http_code to the loki.deploy/1 record; replace the 'NOT re-checked' message. Return distinct exit if rollback also unhealthy. | autonomy/loki, docs/SIGNED-RECEIPTS.md | MEDIUM | Extend tests/test-deploy-receipt-gate.sh section 14-18 (line ~740): stub vercel/curl, red = record lacks post_rollback_health and message still says NOT re-chec | building@2026-10-16T00:12Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
+| FV-deploy-observe-2 | Acceptance beyond 2xx: --health-match and artifact evidence: Add `--health-match STR` to loki deploy (and pass-through on start --deploy): probe body must contain STR (e.g. HEAD sha or version) else FAILED_HEALTH; record health_match, health_http_code, tree_sha (git rev-parse HEAD^{tree}) in loki.deploy/1. | autonomy/loki, loki-ts/src/commands/start.ts, loki-ts/src/util/receipt_signer.ts | MEDIUM | Extend tests/test-deploy-receipt-gate.sh (stub curl body): red = mismatching body still reports healthy; green = FAILED_HEALTH exit 4. Extend start-flags allowl | building@2026-10-16T00:12Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
+| FV-deploy-observe-3 | Surface last deploy in `loki status` / `loki chat` context: Read newest .loki/deploys/*.json and show target, head_sha, health_status, rollback, signed/VERIFIED via existing verify path in `loki status` (and the chat context that status feeds). Gives 'observing' state without a new command. | loki-ts/src/commands/status.ts, loki-ts/src/util/receipt_signer.ts, loki-ts/tests/commands | LOW | Extend the existing status command test: fixture .loki/deploys/x.json with FAILED_HEALTH; red = status prints nothing about deploy; green = prints line and flag | building@2026-10-16T00:12Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
+| FV-deploy-observe-4 | Sentry brief correlates alert with latest deploy and culprit owner: In build_sentry_brief/handle_sentry_event, append release/environment from payload and, from the project's .loki/deploys newest record, 'last deploy <sha7> <finished_at> health=<status>' plus git log -1 author/commit for the culprit file when resolvable. Still PR-only, brief stays one sanitized line | autonomy/trigger-server.py, autonomy/issue-providers.sh, docs/sentry-intake.md | HIGH | Extend tests/test_trigger_server_hardening.py (sentry fixture ~line 749): red = brief lacks deploy context with a seeded deploy record; green = present, control | building@2026-10-16T00:12Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
+| FV-outcome-metrics-1 | Record intervention type and waited minutes at the pause site: Extend the existing interventions.json write in handlePause to also keep by_type counts {steer,input,authorization,repair} (mapped from the existing pause reasons: HUMAN_INPUT.md=input, PAUSE/checkpoint=authorization, budget/council force-review=repair/steer as appropriate, enum only, no free text)  | loki-ts/src/runner/intervention.ts, autonomy/run.sh, autonomy/lib/proof-generator.py | MEDIUM | Extend loki-ts/tests/runner/autonomous.test.ts (already drives intervention signals at :167-176): red = assert interventions.json has by_type + waited_s after a | building@2026-10-16T00:12Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
+| FV-outcome-metrics-2 | Add effort-per-outcome block to loki trust (cost, retries, misleading claims, interventions by type): Extend the existing trust derivation (TrustRun + computeTrajectory + formatTrajectoryHuman/Json) with: per-run cost_usd (proof.cost.usd, null when unmeasured), interventions_by_type and waited_s (from slice 1, null when absent), and an 'Outcome effort' summary: accepted = verdict VERIFIED; misleadin | loki-ts/src/metrics/trust.ts, autonomy/lib/trust_trajectory.py, loki-ts/src/commands/trust.ts | LOW | Extend loki-ts/tests/metrics/trust.test.ts (intervention axis block at :161) and tests/test_trust_trajectory.py: red = fixture of 4 proofs (2 VERIFIED, 1 false_ | building@2026-10-16T00:12Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
+| FV-outcome-metrics-3 | Surface the metric in HANDOFF.md and the final run line on engine10: Make engine10 handoff stop saying 'not recorded' for interventions: in composeHandoff read .loki/state/interventions.json (count, by_type, waited_s) when no steer.consumed/intervention events exist, render 'interventions N (input 1, authorization 1); waited 4m' and keep 'not recorded' only when the  | loki-ts/src/util/run_summary.ts | LOW | Extend loki-ts/tests/util/run_summary.test.ts: red = write interventions.json fixture in the temp repoDir, call composeHandoff/renderHandoff, expect the by-type | building@2026-10-16T00:12Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
+| FV-outcome-metrics-4 | Document metric definitions and align bench report to the same names: Add one 'Outcome analytics' section to the existing docs/EVALUATING.md defining accepted outcome, misleading completion (= attribution.py false_completion = trust false_verified), cost per accepted, interventions by type, waited vs active minutes (active minutes explicitly NOT measured; only waited  | docs/EVALUATING.md, benchmarks/bench/attribution.py | LOW | Extend the existing attribution test (benchmarks/bench tests, e.g. the one asserting false_completion and cost_per_accepted in the report) with an assertion tha | building@2026-10-16T00:12Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
+| FV-gh-steer-1 | Trigger server: authorized issue_comment steers, unauthorized ignored: Add handle_issue_comment_event to EVENT_HANDLERS: on action=created, comment on an issue/PR with a known run (match repo#N), require comment.author_association in OWNER/MEMBER/COLLABORATOR (same set as verify_pr.ts:150), skip bot/self comments and edited/deleted, one-line-bound the body, then run `l | autonomy/trigger-server.py, docs/DEPLOYMENT.md | HIGH | Extend tests/test_trigger.py TestEventRouting: red first with MEMBER comment -> steer args fired, NONE/CONTRIBUTOR comment -> 'skipped', bot comment skipped, fo | building@2026-10-16T00:12Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
+| FV-gh-steer-2 | Steer carries intent revision + actor + source: Make `loki steer` (and chat /steer through the same writer) record a numbered revision header (rev N, actor, source=cli/chat/github comment URL) in HUMAN_INPUT.md, and have steer.ts consumeSteer archive it and append an entry to .loki/intent-revisions.jsonl so scope changes are an auditable revision | autonomy/loki, loki-ts/src/util/steer.ts, loki-ts/tests/e10ext/steer.test.ts | MEDIUM | Extend loki-ts/tests/e10ext/steer.test.ts: red-then-green that consumeSteer on a header-bearing file returns the guidance and appends a revision record with rev | building@2026-10-16T00:12Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
+| FV-gh-steer-3 | Project engine10 status onto the originating issue (single updating comment): Generalise the supervisor's failure-only CommentStep (supervisor.ts:196-198) into a status projector: at plan done, steer applied, blocked, PR opened, and done, upsert ONE marker-tagged comment (<!-- loki-status -->) on the issue via a new `issue-comment --update` mode in engine10-push.sh (find by m | loki-ts/src/engine10/supervisor.ts, autonomy/lib/engine10-push.sh, loki-ts/src/engine10/types.ts | MEDIUM | Extend the existing supervisor test (loki-ts/tests/engine10 supervisor/issue_ref_e2e.test.ts with its fake gh in tests/engine10/fixtures/issue-ref/bin/gh): red- | building@2026-10-16T00:12Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
+| FV-gh-steer-4 | Steer ack back to the comment + chat parity: After slice 1 steers, acknowledge on the issue with an eyes reaction/short reply naming revision N and 'applies at next plan/implement stage' (or rejection reason for unauthorized: a single line, no run details), via engine10-push.sh. Ensure `loki chat` /steer and `loki start` print the same `rev N` | autonomy/trigger-server.py, autonomy/lib/engine10-push.sh, loki-ts/src/cli/registry.ts | LOW | Extend tests/test_trigger.py: red-then-green that an authorized comment dispatch also invokes the ack command with the revision and an unauthorized one posts no | building@2026-10-16T00:12Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
+| FV-work-item-1 | Canonical work-item state fold (one vocabulary) surfaced in loki status: Add pure workItemState(events) in events.ts next to fold(): maps to received/prepared/planned/executing/validating/ready_to_ship/completed + waiting_for_input(SPEC_CONFLICT)/budget_stopped(cap.hit)/failed/cancelled/stalled, using the same stage events summarize() already reads. Make summarize() (run | loki-ts/src/engine10/events.ts, loki-ts/src/commands/run_status.ts, loki-ts/src/util/run_outputs.ts, docs/v10/ENGINE.md | MEDIUM | Extend loki-ts/tests/commands/run_status.test.ts with event fixtures per state; red first (no `state` field), green after fold; reuse existing phaseOf cases to  | building@2026-10-16T00:12Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
+| FV-work-item-2 | Record work-item intent on run.started and link answers to parent run: Extend the existing opts.started payload (supervisor.ts:69,138) with actor (git user / LOKI_ACTOR / trigger source), policy_revision (sha256 of policies file read by policyGate, run_outputs.ts:170), budget_usd cap, and parent_run. Have runAnswer (blocked_answer.ts:74) pass parent via env LOKI_PARENT | loki-ts/src/engine10/supervisor.ts, loki-ts/src/features/blocked_answer.ts, loki-ts/src/util/run_outputs.ts | MEDIUM | Extend loki-ts/tests/features/blocked_answer.test.ts: red = launched env lacks LOKI_PARENT_RUN / started event lacks parent_run; green after wiring. Add one sup | building@2026-10-16T00:12Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
+| FV-work-item-3 | Surface PR reuse truthfully (existing flag) and make resume skip duplicate creation provably: Make engine10-push.sh push-pr print a second marker (e.g. line 'reused') when `gh pr list --head` found an open PR (push.sh:160-166); pr.ts parse it (pr.ts:117-126) to set existing true/false instead of null, remove the 'contract gap' comment (pr.ts:4-6). resumePublish and startRecovery already pass | autonomy/lib/engine10-push.sh, loki-ts/src/engine10/stages/pr.ts, loki-ts/src/util/run_outputs.ts | HIGH | Extend existing pr stage test and tests/test-acceptance-resume-idempotence.sh: red = replay with open PR yields existing:null; green = existing:true and gh pr c | building@2026-10-16T00:12Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
+| FV-work-item-4 | Durable trigger intake dedup keyed on origin+issue+head: Persist seen_delivery ids to a small JSONL under the trigger server's existing state dir (append on accept, load bounded N at startup) in trigger-server.py:1049-1086, and add a second key (event repo#issue + action + head sha) so a redelivery with a new delivery id or a server restart does not re-di | autonomy/trigger-server.py, tests/test_trigger_server_hardening.py | HIGH | Extend tests/test_trigger_server_hardening.py: red = new Dispatcher instance on same state dir re-dispatches same delivery id; green = returns duplicate. Second | building@2026-10-16T00:12Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
+| FV-tracker-writeback-1 | Slack allowlist fails closed: Unset LOKI_SLACK_ALLOWED_USERS rejects all (explicit '*' opts in to open) in slack_inbound.ts; add same user gate to trigger-server /slack using form user_id. Update docs/slack.md:24 and startup message. | loki-ts/src/contrib/slack_inbound.ts, autonomy/trigger-server.py, docs/slack.md | HIGH | Extend loki-ts/tests/features/slack_inbound.test.ts (unset -> NOT_ALLOWED, '*' -> allowed; red against current :91) and tests/test_trigger_server_hardening.py _ | building@2026-10-16T00:12Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
+| FV-tracker-writeback-2 | Phase-aware shared writeback contract in writeback.ts: Extend WritebackInput with origin {kind, ref} and phase (started/blocked/done/failed); commentText per phase; optional Jira transition (LOKI_JIRA_DONE_TRANSITION id) and Linear state (LOKI_LINEAR_DONE_STATE). Fall back to intake creds (JIRA_BASE_URL/JIRA_EMAIL/JIRA_API_TOKEN/LINEAR_API_KEY) so intak | loki-ts/src/integrations/writeback.ts, loki-ts/src/engine10/stages/pr.ts | MEDIUM | New loki-ts/tests/integrations/writeback.test.ts is justified because B6 test claimed in RELEASE-11.md:43 does not exist; stub fetch, assert comment per phase,  | building@2026-10-16T00:12Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
+| FV-tracker-writeback-3 | Trigger server uses one reply-target contract for Jira, Teams, Sentry: Add reply targets in _handle_jira ({kind:jira,key}), and a jira branch in notify_job_complete posting an ADF comment (reuse existing _post_json with Basic auth from JIRA_* env); make Linear/Jira branches share a small table-driven dispatcher; capture Teams serviceUrl/conversation target if verified. | autonomy/trigger-server.py | MEDIUM | Extend tests/test_trigger_server_hardening.py chat fixture: Jira webhook then completion posts comment to stubbed URL; no target when creds absent; notifier fai | building@2026-10-16T00:12Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
+| FV-tracker-writeback-4 | Docs and loki start wiring truth-up: Rewrite docs/trackers.md to describe actual writeback (comment, phases, transitions, env vars, opt-in) and delete the 'no write back' line; make loki start jira:/linear: refs export LOKI_WRITEBACK_ISSUE so writeback keys off the intake ref; add one line in docs/CLI-REFERENCE.md. | docs/trackers.md, docs/CLI-REFERENCE.md, loki-ts/src/commands/start.ts | LOW | Extend the existing start.ts test (loki-ts/tests, locate by git grep start.ts) to assert env LOKI_WRITEBACK_ISSUE set for jira:PROJ-123 ref and unset for plain  | building@2026-10-16T00:12Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
+| FV-pr-loop-1 | Gate --ship auto-merge on checks + verdict via shared merge gate: Extract the green-check/poll/merge core of cmd_merge into one helper (e.g. _merge_pr_gated <pr>) and make both `loki merge run` and the --ship auto-merge blocks (detached inner script and issue-mode path) call it. Refuse merge when PR is draft, gh pr checks != 0 after polling, or run verdict != VERI | autonomy/loki, docs/merge-queue.md | HIGH | Extend tests/test-loki-merge-queue.sh (has gh stub at :17): red test = --ship path with stubbed `pr checks` exit 1 currently still logs `pr merge`; green = no m | building@2026-10-16T00:12Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
+| FV-pr-loop-2 | CI repair loop: loki pr watch and run hook after PR open: Add `loki merge watch <pr>` (or `--watch` on merge run) that polls `gh pr checks`, on failure fetches failed log tail (`gh run view --log-failed`), runs one bounded repair session via existing loki issue/start run on the PR branch, pushes, and repeats up to N attempts (LOKI_PR_REPAIR_MAX, default 2) | autonomy/loki, loki-ts/src/cli/registry.ts, docs/merge-queue.md | MEDIUM | Extend tests/test-loki-merge-queue.sh with stub: checks fail once then pass after stubbed repair command; assert repair invoked once, push once, merge only afte | building@2026-10-16T00:12Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
+| FV-pr-loop-3 | Review-comment response commits: Reuse GhClient/defaultGh from loki-ts/src/util/pr_lessons.ts to add `loki memory`-adjacent read of OPEN review threads (`gh api pulls/N/comments`), one fix commit per actionable comment, push, and reply to each thread citing the commit sha. Register as `loki pr respond <pr>` extending an existing re | loki-ts/src/util/pr_lessons.ts, loki-ts/src/cli/registry.ts, loki-ts/tests/util/pr_lessons.test.ts | MEDIUM | Extend loki-ts/tests/util/pr_lessons.test.ts using its injected GhClient: fixture with 2 open comments -> assert 2 reply calls containing commit shas, and non-a | building@2026-10-16T00:12Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
+| FV-pr-loop-4 | Record merge/CI outcome in receipt and handoff; policy consent: Write merge outcome (merged / blocked:<gate> / waiting) and last checks state into .loki/state/pr.json next to the existing created record (autonomy/loki:11708) and surface in handoffSection/decisionCommands (run_summary.ts:158). Add a single policy key (e.g. merge.preauthorized + required checks) r | loki-ts/src/util/run_summary.ts, autonomy/loki, loki-ts/tests/util/run_summary.test.ts | LOW | Extend run_summary test (or nearest existing handoff test) : handoff for blocked merge shows gate name and 'waiting at: <gate>' and not 'merged'; red first sinc | building@2026-10-16T00:12Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
+| FV-policy-budget-1 | Propagate run cap to group/unit children and aggregate group spend: In supervisor.ts export the resolved cap (env.LOKI_BUDGET_LIMIT=cap.usd when >0) into the env handed to maybeRunGroup (use `env`, not process.env, supervisor.ts:262) so backlog.py units inherit --max-cost; in backlog.py divide/enforce a group-wide total (sum unit costs at finish, stop launching pend | loki-ts/src/engine10/supervisor.ts, autonomy/lib/backlog.py, autonomy/lib/loki_yaml.py, docs/cost-controls.md | HIGH | Extend tests/test-backlog.sh (group total stops pending units) and loki-ts/tests/engine10/budget_cap.test.ts (env handed to group has LOKI_BUDGET_LIMIT). Red fi | building@2026-10-16T00:12Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
+| FV-policy-budget-2 | Live in-session cap: map worker cap to child env and fix dead BUDGET_LIMIT watcher: In session.ts childEnv set LOKI_BUDGET_LIMIT to remaining cap (LOKI_E10_MAX_COST_USD minus meter sum, floor 0.01) so providers.ts:668 applies SDK maxBudgetUsd for claude; change session.ts:195 watchBudget gate to read the same resolved cap (LOKI_E10_MAX_COST_USD) and compare against the worker meter | loki-ts/src/engine10/session.ts, loki-ts/src/e10ext/budget_cap.ts, loki-ts/src/providers/provider_guard.ts | HIGH | Extend loki-ts/tests/engine10/budget_cap.test.ts: unit-test remaining() and that childEnv for a run with LOKI_E10_MAX_COST_USD=2 carries LOKI_BUDGET_LIMIT<=2 (r | building@2026-10-16T00:12Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
+| FV-policy-budget-3 | Cap applies on default runner path, spec-first, and --attempts as one total: (a) runner/autonomous.ts:1176 default budgetLimit to loadDefaultMaxCostUsd() when an API key is set and no flag/env, mirroring resolveCap (reuse resolveCap, no new parser); (b) start.ts:317 push --max-cost for specFirst before returning; (c) runner/attempts.ts divide the cap across N attempts (pass  | loki-ts/src/runner/autonomous.ts, loki-ts/src/commands/start.ts, loki-ts/src/runner/attempts.ts, loki-ts/src/e10ext/budget_cap.ts | MEDIUM | Extend loki-ts/tests/commands/start tests (parseStartArgs/runEngine10 argv includes --max-cost for spec-first) and runner attempts test; red first: argv for `-- | building@2026-10-16T00:12Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
+| FV-policy-budget-4 | Durable budget_stopped state and persisted per-task spend across restart: On BUDGET_STOP write .loki/runs/<id>/budget.json (cap, spent, source, outcome budget_stopped) from supervisor.ts when outcome==BUDGET_STOP (extend run_summary.ts:54 and status.ts to show it), and seed capMeter on a rerun of the same task (startRecovery key) with prior spend from that file via an env | loki-ts/src/engine10/supervisor.ts, loki-ts/src/e10ext/budget_cap.ts, loki-ts/src/util/run_summary.ts, loki-ts/src/commands/status.ts, docs/cost-controls.md | MEDIUM | Extend loki-ts/tests/engine10/budget_cap.test.ts: capMeter seeded with 4 of 5 trips over() after $1; supervisor writes budget.json on BUDGET_STOP. Red: seed env | building@2026-10-16T00:12Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
+| COST-1 | Effort rightsize default-on: implement and Wall at medium effort, fix escalation kept | loki-ts/src/contrib/effort_policy.ts, loki-ts/src/engine10/session.ts | MEDIUM | tests/engine10/effort_policy.test.ts | building@2026-10-16T00:12Z | Cost audit 2026-10-16: no measured run reaches 0.5x raw yet (best 0.68x lean config). |
+| COST-2 | Cascade default-on for low-risk tasks (sonnet first, escalate on failure) | loki-ts/src/engine10/sizing.ts, model_rank.ts | HIGH | cascade test beside fix.ts | parked@2026-10-16T00:12Z | Engine Law L1 and D50 Sonnet accuracy loss; needs CTO call plus a measured arm. Cost audit 2026-10-16: no measured run reaches 0.5x raw yet (best 0.68x lean config). |
+| COST-3 | Skip Wall when low risk and existing impacted tests cover the change (seal NOT PROVEN where skipped) | loki-ts/src/engine10/stages/wall.ts, sizing.ts | HIGH | wall tests | parked@2026-10-16T00:12Z | moat change; needs CTO call plus a measured arm. Cost audit 2026-10-16: no measured run reaches 0.5x raw yet (best 0.68x lean config). |
+| COST-4 | Gate xreview and any reviewer on risk tier (medium/high only) | loki-ts/src/engine10/stages/xreview.ts | LOW | xreview test | building@2026-10-16T00:12Z | Cost audit 2026-10-16: no measured run reaches 0.5x raw yet (best 0.68x lean config). |
+| COST-5 | Merge plan into implement via the plan chain resume (one fewer cold prefix) | loki-ts/src/engine10/stages/implement.ts | MEDIUM | conflict_resume tests | building@2026-10-16T00:12Z | Cost audit 2026-10-16: no measured run reaches 0.5x raw yet (best 0.68x lean config). |
+| COST-6 | Measure cost per accepted task vs raw Claude Code: attribution.py --execute, 8 tasks, n=3, Sonnet 5.5, receipt cost.usd vs total_cost_usd; target ratio 0.5 | benchmarks/bench/attribution.py, docs/v10/METRICS.md | MEDIUM | attribution dry-run | parked@2026-10-16T00:12Z | paid eval, needs founder go on spend. Cost audit 2026-10-16: no measured run reaches 0.5x raw yet (best 0.68x lean config). |
+| FC-09u | FC-09 siblings: pnpm-workspace.yaml overrides/packageExtensions and .yarnrc.yml packageExtensions join RUNNER_CONFIGS | loki-ts/src/features/runner_config.ts, loki-ts/tests/engine10/runner_config.test.ts | HIGH | each probe caps | ready@2026-10-16T00:12Z | After FC-09t review. |
+| CPE24-P2a | Checkpoint rollback restores only an allowlist (session.json, dashboard-state.json, CONTINUITY.md, autonomy-state.json, state, queue) and refuses nested symlinks | packages/control-plane/src/server/routes/checkpoints.ts plus test | MEDIUM | planted audit/ in a checkpoint does not overwrite .loki/audit | released@2026-10-15T23:55Z | rv-trust3 advisory on P2. |
+| CPE24-P4a | Legacy /api/control/* callers require ctx.local (or isLoopbackHost) like /v1 | packages/control-plane/src/server/legacy/routes-control.ts plus test | MEDIUM | non-loopback Host refused on legacy control | released@2026-10-15T23:55Z | rv-trust3 advisory on P4. |
+| CP-NITS1 | CP run page nits from the 10.10.2 smoke: Wall row describes the Wall ("Wrote acceptance checks (n files)" or "skipped: no checks written"); local repo with no remote shows the folder name, not REPO UNMEASURED; receipt text read from receipt.json on disk like the derived diff; diffstat failures cached (F1); leading-dash sha fixture | packages/control-plane/src/server plus ui run page plus tests | MEDIUM | CP suite green; a signed receipt on disk renders its text; a no-remote repo shows its folder name | released@2026-10-15T23:55Z | Peer smoke 21:27Z plus CP follow-up review F1. |
+| FC-01b | Monorepo visual-evidence skip reason: with backend/ and frontend/ package.json and no root manifest, say "no dev, preview or start script in backend/ or frontend/", not "no package.json" | visual evidence path in loki-ts/src plus test | LOW | monorepo fixture prints the per-package reason | released@2026-10-15T23:55Z | FC-01 sibling (Engine Law L5). |
+| FC-19b | Spec-conflict resume near the stage limit: skip the resume when under about 60s of the implement window remains, or keep the first conflict when the resume is aborted, so the run ends BLOCKED with its question instead of a limit failure | loki-ts/src/util/conflict_resume.ts plus machine.ts plus test | MEDIUM | a fake first session that uses the window then conflicts ends BLOCKED with its question | released@2026-10-15T23:55Z | review-fc19 non-blocking follow-up, from reading machine.ts runStage. |
+| CP-START | FC-20 (LATER list): root-cause the CP home Start "HTTP 404" (route mismatch, stale CP process serving a newer UI, or the loopback guard) and fix it at the shared layer (UI and server version match; a stale CP restarts or refuses a newer UI); never show a bare HTTP status, show a sentence with the next step; repo chip lists registered repos by name plus Browse; choosing a smaller model shows one muted line ("haiku: fastest, may be less accurate") and never blocks. The composer itself is redefined by CP-ASK (founder 22:03Z): greenfield-from-composer is dropped | packages/control-plane server and ui plus tests | MEDIUM | a forced 404 renders a sentence, a version-skewed UI gets the restart sentence | released@2026-10-15T23:55Z | Founder bug via steering 22:01Z, rescoped by founder 22:03Z. Do not displace FC-15 or FC-16. |
+| R15-F1 | `loki intent show <run>`: print a past run's intent card, the answer and the NOT STATED line; unknown run exits 1 | loki-ts/src/commands/run_status.ts (extend: intent subview), loki-ts/src/cli.ts (one case line), its existing run_status test file | MEDIUM | cd loki-ts && bun test on the run_status test file and tests/commands/cli_help_routes.test.ts; read-only; registered in help and completion | merged@2026-10-15T23:30Z | Source: BACKLOG-D91 134-F1. Extend-never-duplicate: no new command file. |
+| R15-F2 | `loki quickstart --explain-match`: top 3 template scores plus confidence label; below strength 2 says no strong match | autonomy/quickstart.sh, tests/test-quickstart-explain-match.sh (new: no quickstart test owns match scoring; needs runner registration, shard row, timeout -k, shellcheck) | MEDIUM | bash tests/test-quickstart-explain-match.sh; flag-off output byte-identical; bash 3.2 | merged@2026-10-15T23:30Z | Source: BACKLOG-D91 134-F4, issue 217 visibility. |
+| R15-E1 | `loki memory learn --recent N`: learn from the last N merged PRs with a per-PR summary (N max 20) | loki-ts/src/util/pr_lessons.ts (extend), loki-ts/src/commands/memory.ts (learn case only), loki-ts/tests/util/pr_lessons.test.ts | MEDIUM | cd loki-ts && bun test tests/util/pr_lessons.test.ts; learnFromPr unchanged | merged@2026-10-15T23:30Z | Source: BACKLOG-D91 134-F3. |
+| R15-E2 | Reviewer brief names the repo tests that import each changed file (cap 3 plus +N more), from engine10/testmap.ts | loki-ts/src/util/reviewer_brief.ts (extend), loki-ts/tests/util/reviewer_brief.test.ts | MEDIUM | cd loki-ts && bun test tests/util/reviewer_brief.test.ts; LOKI_REVIEWER_BRIEF=0 byte-identical; static scan only | merged@2026-10-15T23:30Z | Source: BACKLOG-D91 134-F2. |
+| R15-B1 | FC38-TIMEOUT: the two 'no bun on PATH' cases get an explicit it() timeout above their 60s spawn bound; record the failing text under 8 parallel copies first | loki-ts/tests/runner/attempts-dispatch.test.ts | LOW | 4 parallel copies, 5 of 5 green; product code untouched; stop if failure is not a timeout | rejected@2026-10-15T23:30Z | Stale premise: attempts-dispatch.test.ts already sets setDefaultTimeout(130_000); under 8 copies the only failure was the line-110 engine10 test at 130s (CPU starvation). FAILURE-CLASSES FC-38. Source: BACKLOG-D91 132-B3. |
+| R15-B2 | Issue 213: test-review-assurance-tail.sh polls child pid files with a sleep 0.01 spin that misses its window under sharded load; replace with a bounded count wait, reproduce first | tests/test-review-assurance-tail.sh | LOW | 8 of 8 parallel runs 44/0; mutation goes red; stop if not reproducible | rejected@2026-10-15T23:30Z | Failed to attribute: no pid-file failure under load; failures are wall-clock bound asserts (requirements timeout, hosted DA, semantic shard 8000ms); trial bounded wait still 43/3. FAILURE-CLASSES FC-53 (closest; add sibling line only if mechanism differs). Source: gh issue 213. |
 | CP-ASK | Founder 22:03Z: "we are not a vibe coding tool". The CP home box becomes Ask Loki: search, learn, compare runs, and ask anything about Loki Mode, past runs, receipts, repos and issues. Default provider claude (or any configured provider and model the user picks); the model gets all of that data (read-only tools or MCP over runs, receipts, events, METRICS, repos, gh issues and PRs); answers are async jobs the user can leave and come back to, listed in the CP. Read-only: Ask never edits a repo or starts a build | Architect slices first (10-40 slices, feature flag); packages/control-plane routes and ui, a read-only data layer, provider invocation | HIGH | the founder asks "compare my last two runs on FireLater" and gets a cited answer async in the CP; Ask cannot write to any repo | building@2026-10-04T00:06Z | Plan docs/v10/CP-ASK-PLAN.md (15 slices behind LOKI_CP_ASK=1, waves {1,4,6,8} {2,5,7} {3,9} 10 11 {12,13} 14 15); founder questions decided as FOUNDER-QUEUE row 20. Slice 1 (MCP read-only mode) seated. Founder direct directive 22:03Z. Architect plan first. | 00:33Z: slices 1 (9f454444a, plus fix-forward F1/F2 7bcffc70f, opus APPROVE), 4 (2a0ad3fc1) and 8 (d1b38e508) merged; flag off; next wave 2/5/6/7. 
 | FC-21 | FC-21: (a) a limit in implement still runs verify on the existing work plus the fix rounds the budget allows, never seal directly; (b) the run cap scales with task size (sizing and Project Model), with a generous subscription default set in loki.yaml; (c) implement is told its remaining time; (d) the CLI summary, CP and PR body read receipt.verdict (one outcome) | loki-ts/src/engine10 run orchestration, the budget and sizing modules, the CLI summary, plus tests | MEDIUM | a fake implement limit is followed by verify; CLI outcome equals receipt.verdict for 4 verdicts; a large task gets a larger cap; core cap under 5000 | released@2026-10-03T23:33Z | Released in v10.10.5. FireLater#17 gate on 10.10.3 PARTIAL (steering 22:08Z). P0 tier with FC-16/FC-15. Built 21fec9deb; opus review-fc21 APPROVE on merge e80abc63a (suites 1719/0, budget 27/0, tsc rc=0 with real node_modules); merged 881f1275f. Advisories A1-A4 filed as FC-21b. Ships in one train with FC-15 and FC-16. |
 | FC-21b | FC-21 follow-ups, next train (steering 23:00Z): (1) an implement limit forces PARTIAL only while checks are red or unrun; if the fix rounds make the impacted checks green with n>0 the run earns VERIFIED (L3: what ran is the evidence, not how long implement took); (2) size the run cap from the Project Model and plan (packages and files touched) or a plan-session estimate, never from task-text character count (L0); (3) the CLI outcome must equal receipt.verdict, so a cap stop after a limit cannot print BUDGET_STOP over a PARTIAL or FAILED receipt (L7, was advisory A4); (A1) machine.ts:145 mustJump keys on reason limit only, require r.killed too; (A2) a spec-conflict resume gets the full original budget in the time note and limitS, and the note lands after FINISH_LINE; (A3) yamlRunCapS matches run_cap_s at any depth under budgets, CRLF yaml falls back silently, ls-files count off by one | loki-ts/src/engine10/machine.ts, stages/implement.ts, stages/seal.ts, output.ts, src/util/run_cap.ts, project_model sizing, plus tests | HIGH | a limit then fix-green with n>0 seals VERIFIED, a limit with a red or unrun check seals PARTIAL; the cap for a short task touching many packages exceeds the cap for one file; CLI outcome equals receipt.verdict on a cap stop after a limit; a thrown limit without a kill never reaches VERIFIED; nested per_stage run_cap_s is ignored; a resumed implement gets the remaining time | released@2026-10-04T02:52Z | Plan docs/v10/FC21B-FC22-PLAN.md (slices S1 graph+yaml_key, S5 cap sizing, S4 verdict+L7+A1+A2; S4 last). From review-fc21 22:53Z plus steering 23:00Z. HIGH because it changes the verdict rule (opus reviewer). Architect plan first for the sizing source. e10ext is 1 line under its 1500 cap. Queue after the FireLater#17 gate on 10.10.4. |

package/docs/v10/CLI-MODERN.md

@@ -6,12 +6,12 @@ Classes: KEEP-MODERN (v10-native or engine-neutral), UPDATE (live but needs mode
 
 ## Counts
 
-- KEEP-MODERN: 69
+- KEEP-MODERN: 70
 - UPDATE: 22
 - DROP-LEGACY: 32
 - DELETE: 14
-- Total rows: 137
-- Registry paths (commands and nested subcommands): 191
+- Total rows: 138
+- Registry paths (commands and nested subcommands): 193
 
 ## Commands
 
@@ -28,6 +28,7 @@ Classes: KEEP-MODERN (v10-native or engine-neutral), UPDATE (live but needs mode
 | receipt | bun route, bash fallthrough | DELETE | Alias of proof; shown only under 'loki help aliases' |
 | wiki | bun route, bash fallthrough | KEEP-MODERN | Bun-native knowledge feature |
 | control | bun route, bash fallthrough | KEEP-MODERN | D56 control plane, on by default |
+| intent | loki-ts/src/cli.ts | KEEP-MODERN | Read-only intent view |
 | kpis | loki-ts/src/cli.ts | KEEP-MODERN | Bun-native KPI report |
 | report | bun route, bash fallthrough | UPDATE | Mixed route; only kpis is Bun |
 | trust | bun route, bash fallthrough | KEEP-MODERN | Trust moat surface |

package/docs/v10/FAILURE-CLASSES.md

@@ -291,9 +291,9 @@ L0 review rule (ENGINE-LAWS.md L0): a fix that adds an `if` or a regex about the
 ## FC-24 Agent-written code in the runner's process can forge a pass (summary and exit code)
 - User saw: nothing yet (found in the FC-16b round 2 review, 2026-10-04). Reproduced at f28b15d78 with pytest on python 3.14.6: a conftest.py `pytest_sessionfinish` hook writes "===== 5 passed in 0.01s =====" and calls `os._exit(0)`; the only test is `assert False`; classifyCheck returns {"result":"pass","n":5}. The Go form (init or TestMain prints RUN and PASS for a failing test, then os.Exit(0)) defeated every name check in FC-16b.
 - Law: L2 (fail closed on trust), L3 (what ran is the evidence); Seal accuracy.
-- Siblings (code-path reasoning, only pytest and go reproduced): unittest (atexit or os._exit before the real trailer), jest and vitest (config, globalSetup, setupFiles patch stdout or call process.exit(0)), bun test (preload), node --test (--import or --require hooks), cargo (the test binary is the code), npm test (an arbitrary script). A harness-owned reporter or result file (pytest plugin, jest reporter, JUnit XML) is written inside the same process, so it is forgeable too.
-- Mechanism: none closes it per runner. The runner's summary and exit code come from a process that runs agent-written code. Decision: a test pass is recorded as runner-reported, not tamper-proof (a known L2 limit). Go exit 0 is never a pass (FC-16b, not_run, owner harness, honest L5 reason) because Go has no parseable summary that survives the forgery at lower cost. Candidate later mechanisms: harness re-runs each named Wall test in a fresh process with harness-controlled entry and flags (setup code still runs), and the receipt states the limit in its evidence text.
-- Fixture: the FC-16b forgery fixtures (go init/TestMain early exit asserts not_run); a pytest conftest forgery fixture that documents the limit is a follow-up slice, not a fix.
+- Siblings (code-path reasoning, only pytest and go reproduced): unittest (atexit or os._exit before the real trailer), jest and vitest (config, globalSetup, setupFiles patch stdout or call process.exit(0)), bun test (preload), node --test (--import or --require hooks), cargo (the test binary is the code), npm test (an arbitrary script). A harness-owned reporter or result file (pytest plugin, jest reporter, JUnit XML) is written inside the same process, so it is forgeable too. Modernize unit runner (M-15, modernize/unit.ts): junit rewrite via the argv path plus atexit, and TestReport.from_item_and_call wrap, both reproduced PROVEN at c85b1a443 in all 4 configs. Modernize equivalence case runner and stub ablation (runNew/runStub) run unit code in the case process with cases.jsonl readable (code-path reasoning, not reproduced).
+- Mechanism: none closes it per runner. The runner's summary and exit code come from a process that runs agent-written code. Decision: a test pass is recorded as runner-reported, not tamper-proof (a known L2 limit). Go exit 0 is never a pass (FC-16b, not_run, owner harness, honest L5 reason) because Go has no parseable summary that survives the forgery at lower cost. Candidate later mechanisms: harness re-runs each named Wall test in a fresh process with harness-controlled entry and flags (setup code still runs), and the receipt states the limit in its evidence text. M-15 records conformance as trust "runner_reported" / limit "FC-24" in UnitRunResult.conformance and in the unit.conformance_passed event.
+- Fixture: the FC-16b forgery fixtures (go init/TestMain early exit asserts not_run); the unit.test.ts describe "FC-24 known limit: in-process forgery is runner_reported, not detected (documenting, not a fix)" (B1 and B2, 4 cases, plus controls).
 
 ## FC-25 A git call from the token-holding supervisor runs a plant in the agent's repo config (moat P9 red since v10.10.4)
 - User saw: nothing visible; the moat job of Tests has failed on main since 4fa4e8015 (runs 37160286598 through 37165257952, all "REGRESSION P9.injection-cannot-reach-token": "a plant in the agent's repo config ran holding the real GitHub token: fsmonitor"). 65ce2060b was the last green. The range touched no bash, only loki-ts.

package/docs/v10/MODERNIZE.md

@@ -259,7 +259,7 @@ The report never states more than the equivalence data proves. It is sealed and
 | Input | The unit id, the sealed `cases.jsonl` (sha-verified before use), the new tree, and the target runner. |
 | Normalizers | Declared per unit in the card and sealed with the oracle: float tolerance, set ordering, and named nondeterministic fields. Nothing is implicit. |
 | Output | `{unit, cases, pass, fail, held_out_pass, held_out_fail, rate, branch_pct, failures:[{case, field, old, new}] (max 20), not_proven:[...]}` |
-| Proven equivalent | rate = 100%, held-out rate = 100%, branch_pct of 80% or higher, the no-op ablation goes red, and conformance passes. |
+| Proven equivalent | rate = 100%, held-out rate = 100%, branch_pct of 80% or higher, the no-op ablation goes red, and conformance passes (runner_reported, FC-24: not proof against unit code that subverts the test runner in-process). |
 | Otherwise | PARTIAL with the numbers, or FAILED when rate < 100% after re-slice. |
 
 **Target conformance**
@@ -268,6 +268,7 @@ The report never states more than the equivalence data proves. It is sealed and
   - java21: it compiles with `--release 21` and `jdeprscan --for-removal --release 21` is clean.
 - The Wall runs under the target runtime. A Wall that is green before any change is a design error reported as `oracle.flagged`. It is never ALREADY_SATISFIED.
 - `stages/wall.ts` gains a pre-sealed mode (M-14) that takes these files instead of running the author session.
+- Conformance is runner_reported (FC-24): UnitRunResult.conformance and the unit.conformance_passed event carry trust "runner_reported", limit "FC-24". It stops accidental and low-effort false passes, not unit code that subverts pytest inside its own process.
 
 ## 8. Strangler adapters and routing flags per target
 

package/docs/v10/PROGRESS.md

@@ -2371,3 +2371,15 @@ The swarm is stopped: .loki/V10-STOP exists, the loop has no wake-ups, and the c
 - v11.10.0 (58344ed27): Tests run 38816323342 and Release failed: bun route_matrix_mutation B3 and B6 (anchor "let session = await ctx.sessions.run(first);" no longer exists after S41-13, so the mutations were not applied). Not published; npm next stays 11.9.1.
 - Fix: anchor updated to the S41-13 line in loki-ts/tests/engine10/route_matrix_mutation.test.ts (33 pass 0 fail); bun test tests/engine10 2037 pass 0 fail 1 skip.
 - M-15 round 4 (1c9a5e56a) Opus BLOCK: case-insensitive Conftest.py and symlinks under SKIP_DIRS; round 5 (class fixes) in flight.
+
+## 2026-10-15 23:35Z v11.10.1 green, v11.11.0 train
+- v11.10.1 (9d952ff56): Release and Tests success; npm next=11.10.1, GitHub release body set.
+- M-15 round 5 (f6b9bdd7d) and round 6 (c85b1a443) Opus BLOCK. Round 6 reproduced B1 (atexit rewrites the junit via the --junitxml path in sys.argv) and B2 (wrapping TestReport.from_item_and_call), both FC-24. CTO call: option (a), accept FC-24, delete the false "not forgeable" and "unreachable" claims, mark PROVEN conformance runner_reported, keep B1/B2 as documenting fixtures; modernize budget only, core is 4998/5000. Round 7 in flight.
+- R15 refill: six rows cut from BACKLOG-D91; three cards repointed at owning modules (run_status.ts, pr_lessons.ts, reviewer_brief.ts) per extend-never-duplicate.
+- v11.11.0 train: R15-F1 8e7e3c381, R15-F2 8df4a556d, R15-E1 c649c2ac1, R15-E2 b816a26e3, each sonnet Tech Lead APPROVE; dist conflicts resolved by rebuild.
+- R15-B1 rejected: stale premise (setDefaultTimeout(130_000) already present). R15-B2 rejected: issue 213 failures under load are wall-clock bound assertions, not the pid-file spin; trial fix still 43/3.
+- 23:40Z M-15 round 7 (2f7d2a115) Opus HIGH APPROVE against the CTO threat model: conformance is runner_reported (FC-24), false claims deleted, B1/B2 kept as documenting fixtures, unit.test.ts 111/0. Merged as 20a9f2f32 for v11.12.0; M-17 and its chain are unblocked.
+- 2026-10-15T23:52Z v11.11.0 CI red on help/completion drift (never tagged or published); fix folded into v11.12.0 with M-15. M-17 r1 BLOCKED by Opus HIGH (raw execFileSync git in coordinator runs planted hooks, FC-25 sibling); r2 rework running (wf_329c9171-c19). Worktrees 33 -> 22 (11 merged removed).
+- 2026-10-15T23:56Z Dispatched 7 ready rows (FC-09r, CPE24-P2a, CPE24-P4a, CP-NITS1, FC-01b, FC-19b, CP-START); every one was already on main (fix commits are ancestors of HEAD, reviewers reran tests and mutations on main). BOARD rows were stale at ready; set to released. New FC-09s sibling row from the FC-09r review. M-17 r2 Opus HIGH APPROVED at d0437a578.
+- 2026-10-16T00:00Z Merged M-17 (4d2e9f5f1, Opus HIGH approved r2) and FC-09s (8bfddbe4d, Opus HIGH approved). Fixed the engine10 L7 guard hit (M-15 unit.ts comment said 'not recorded') and a scheduler test type error against the M-15 conformance type (tests field). Both fold into v11.12.0.
+- 2026-10-16T00:30Z v11.12.0 CI red on Linux (never published): full_env_spawn_guard, spawn_env_guard and model_output_regex_guard flagged the M-15/M-17 modernize unit.ts spawns, and the sitecustomize conformance test named a readdir-order-dependent file. Fixed with tokenFreeEnv on both spawns, sorted drift iteration, and a reasoned allowlist entry; shipping as v11.12.1. FC-09t r3 (064cb191b) held out of main on branch fc09t-wip after a second Opus BLOCK (# inside """ strings, \u escapes in quoted keys); r4 rework running. Factory-parity workflow wy3yizr98 building 40 FV slices plus COST-1/4/5 in 12 lanes; COST-2/3/6 parked (Engine Law L1, moat, paid eval).