loki-mode 11.12.1 → 11.15.0

package/docs/v10/CLI-MODERN.md

@@ -11,7 +11,7 @@ Classes: KEEP-MODERN (v10-native or engine-neutral), UPDATE (live but needs mode
 - DROP-LEGACY: 32
 - DELETE: 14
 - Total rows: 138
-- Registry paths (commands and nested subcommands): 193
+- Registry paths (commands and nested subcommands): 194
 
 ## Commands
 
@@ -139,7 +139,7 @@ Classes: KEEP-MODERN (v10-native or engine-neutral), UPDATE (live but needs mode
 | trigger | autonomy/loki | DROP-LEGACY | Legacy engine |
 | failover | autonomy/loki | DROP-LEGACY | Legacy engine |
 | reset | autonomy/loki | DROP-LEGACY | Legacy engine |
-| merge | autonomy/loki | DROP-LEGACY | Legacy parallel mode |
+| merge | autonomy/loki | DROP-LEGACY | Bash PR merge gate |
 | heal | autonomy/loki | DROP-LEGACY | Legacy engine |
 | migrate | autonomy/loki | DROP-LEGACY | Superseded by modernize |
 | dogfood | autonomy/loki | DROP-LEGACY | Legacy engine |

package/docs/v10/DECISIONS.md

@@ -265,6 +265,7 @@ One entry per decision: context, choice, why, how to reverse. Newest last.
 - modernize/ gets its own cap of 4,000 lines in the same test: 25 planned modules (MODERNIZE.md section 13) at about 150 lines each plus 15% slack. M-24's view moves to mod/dashboard.ts. M-14 stays under 20 lines in wall.ts and calls into mod/oracle/.
 - Core never imports modernize/ (the cli.ts TABLE string is exempt), so the split cannot hide core code.
 - Hitting either cap means re-slice or delete, never raise. Ruled by the CTO (opus) on the Chief of Staff's request; implemented by E-76.
+- 2026-10-15 (M-22/M-23 integration): loki-ts/src/util/ may host engine10 entry points and modernize helpers that would push modernize/ past its cap (util/modernize_unit.ts for remote unit jobs, util/python.ts for pytest running and parsing); they import engine10, engine10 core never imports them.
 
 ## D34. 2026-09-28: large tier is real upstream PRs, one size gate, legacy moves to M-27
 

package/docs/v10/ENGINE.md

@@ -248,6 +248,8 @@ Required keys: `type`, `stage` (null for run-level events), `ts` (ISO UTC, ms),
 
 Unknown is never 0. A missing cost is `usd: null`, and every reader renders null as "not measured".
 
+**Work-item state (one vocabulary).** `workItemState(events, nowMs?)` in `util/run_outputs.ts` (beside `phaseOf`) folds the log into one name per run, used by `loki status --json` (`state`), `phaseOf` (resume) and chat (which shells to status): `received` (run.started only), `prepared` (intake done), `planned` (plan done or wall seen), `executing` (implement running), `validating` (implement done, or verify/fix/commit/seal/pr/deep seen), `ready_to_ship` (receipt.sealed). Terminal states come only from run.completed: `completed`, `waiting_for_input` (verdict SPEC_CONFLICT), `budget_stopped` (cap.hit with verdict PARTIAL or FAILED), `failed`, `cancelled`. `stalled` needs the clock argument and 30 minutes without events on an unfinished run.
+
 ## 6. Process topology and Rule of Two
 
 The process that reads untrusted issue text into an LLM context never holds a push token. The PR step runs as a separate process.

package/docs/v10/MODERNIZE.md

@@ -381,7 +381,7 @@ The report never states more than the equivalence data proves. It is sealed and
 | M-20 | Wave verify: full build, integration and original suite | mod/wave.ts, T/wave.test.ts | MEDIUM | Wb T/wave.test.ts | M-17, M-19 |
 | M-21 | Wave ship: one PR per wave with unit receipts, draft unless all proven | mod/ship.ts, T/ship.test.ts | HIGH | Wb T/ship.test.ts | M-20 |
 | M-22 | Unit-level resume after coordinator crash | mod/resume.ts, T/resume.test.ts | MEDIUM | Wb T/resume.test.ts | M-17, E-39 |
-| M-23 | Remote units via POST /jobs kind unit, Helm worker.engine v10, local re-verify | autonomy/trigger-server.py (unit job kind only), deploy/helm/autonomi/templates/job-worker.yaml, deploy/helm/autonomi/values.yaml, mod/remote.ts, T/remote.test.ts, tests/test-trigger-server-unit-jobs.py | HIGH | python3 tests/test-trigger-server-unit-jobs.py && Wb T/remote.test.ts | M-17 |
+| M-23 | Remote units via POST /jobs kind unit, Helm worker.engine v10, local re-verify | autonomy/trigger-server.py (unit job kind only), deploy/helm/autonomi/templates/job-worker.yaml, deploy/helm/autonomi/values.yaml, loki-ts/src/util/modernize_unit.ts, T/remote.test.ts, tests/test-trigger-server-unit-jobs.py | HIGH | python3 tests/test-trigger-server-unit-jobs.py && Wb T/remote.test.ts | M-17 |
 | M-24 | Dashboard /modernize view | loki-ts/src/engine10/dashboard/modernize.ts, loki-ts/src/engine10/dashboard/server.ts (one route), T/dashboard.test.ts | LOW | Wb T/dashboard.test.ts | M-01 |
 | M-25 | Final report and verdict (COMPLETE only if all proven), sealed | mod/report.ts, T/report.test.ts | HIGH | Wb T/report.test.ts | M-13, M-21 |
 | M-26 | End-to-end: py2 fixture repo modernized with stub provider | T/e2e.test.ts, T/fixtures/e2e_py2/ | MEDIUM | Wb T/e2e.test.ts | M-08, M-22, M-25 |
@@ -398,3 +398,34 @@ The report never states more than the equivalence data proves. It is sealed and
 - Red: the test file is missing or asserts the absent behavior.
 - Green: every assertion named in the goal holds.
 - Each HIGH slice needs a unanimous opus review (D12).
+
+## 14. Fan-out alignment: G-04 cloud dispatch and the M-23 unit job (G-05)
+
+Both fan-outs hand one independent piece of work to a remote worker and accept the result only after the coordinator checks it. They share one shape so a single dispatcher can drive either.
+
+**M-23 unit job schema** (POST /jobs, same bearer token as every job kind; the schema is closed and any other field is rejected with 400):
+
+| Field | Bound | Required |
+|---|---|---|
+| `kind` | the literal `unit` | yes |
+| `repo` | `owner/name`, at most 140 chars, no leading dash, no `.` or `..` segment | yes |
+| `ref` | git ref, at most 200 chars, no `..`, no leading dash | yes |
+| `unit` | unit id, `[A-Za-z0-9][A-Za-z0-9_.-]{0,127}`, never contains `~` | yes |
+| `mid` | `mod-<utc>-<6 hex>` | no |
+| `target` | `python3` or `java21` | no |
+
+The worker runs `loki modernize unit --repo <repo> --ref <ref> --unit <unit>` (plus `--mid` and `--target` when given). It fetches repo@ref into a run-owned temp directory with the safe_git helpers, runs the unit there through the same unit runner as a local run, and removes the directory afterwards. A checkout failure, a runner failure or any verdict other than PROVEN exits nonzero with the reason on stderr; exit 2 means bad arguments or runners that are not wired yet.
+
+**G-04 dispatch fields mapped onto it** (scripts/cloud-dispatch.sh, docs/v10/SWARM.md "Cloud dispatch"):
+
+| G-04 field | M-23 field | Rule |
+|---|---|---|
+| slice id (`SLICE-ID`) | `unit` | Same unit-id charset; the id is the unit of fan-out and of overlap checks. |
+| branch `cloud/<slice-id>` | `ref` | The worker works on this ref (G-04 also returns it); the coordinator never merges a ref it did not name. |
+| repository of the checkout | `repo` | Always `owner/name`; no URL, no userinfo. |
+| file set (overlap check) | the unit's own files | Resolved coordinator-side from plan.json before dispatch; never sent in the job. Overlap with in-flight work refuses the dispatch in both. |
+| tier and governor max | scheduler `--workers` | Concurrency is the governor cap, not a job field. |
+| cloud session id (BOARD note) | server job `id` | Recorded by the coordinator against the unit (events.jsonl for M-23, the BOARD row for G-04). |
+| PR and check conclusion | local re-verify | The PR check result and the remote "passed" are claims. The coordinator re-verifies locally (equivalence check for a unit, required checks for a slice) and merges only if both agree. |
+
+Shared rules: credentials are never in the payload (the token is an Authorization header for POST /jobs, and the cloud session uses its own login); an unobserved or unknown remote outcome is not a pass; a remote pass with a failing local re-verify never merges; dispatch refuses rather than guesses when the schema, the overlap check or the cap cannot be evaluated.

package/docs/v10/PROGRESS.md

@@ -2383,3 +2383,6 @@ The swarm is stopped: .loki/V10-STOP exists, the loop has no wake-ups, and the c
 - 2026-10-15T23:56Z Dispatched 7 ready rows (FC-09r, CPE24-P2a, CPE24-P4a, CP-NITS1, FC-01b, FC-19b, CP-START); every one was already on main (fix commits are ancestors of HEAD, reviewers reran tests and mutations on main). BOARD rows were stale at ready; set to released. New FC-09s sibling row from the FC-09r review. M-17 r2 Opus HIGH APPROVED at d0437a578.
 - 2026-10-16T00:00Z Merged M-17 (4d2e9f5f1, Opus HIGH approved r2) and FC-09s (8bfddbe4d, Opus HIGH approved). Fixed the engine10 L7 guard hit (M-15 unit.ts comment said 'not recorded') and a scheduler test type error against the M-15 conformance type (tests field). Both fold into v11.12.0.
 - 2026-10-16T00:30Z v11.12.0 CI red on Linux (never published): full_env_spawn_guard, spawn_env_guard and model_output_regex_guard flagged the M-15/M-17 modernize unit.ts spawns, and the sitecustomize conformance test named a readdir-order-dependent file. Fixed with tokenFreeEnv on both spawns, sorted drift iteration, and a reasoned allowlist entry; shipping as v11.12.1. FC-09t r3 (064cb191b) held out of main on branch fc09t-wip after a second Opus BLOCK (# inside """ strings, \u escapes in quoted keys); r4 rework running. Factory-parity workflow wy3yizr98 building 40 FV slices plus COST-1/4/5 in 12 lanes; COST-2/3/6 parked (Engine Law L1, moat, paid eval).
+- 2026-10-16T01:20Z v11.13.0: fast-forwarded main to fv-train 79a127fa9 (12 factory-parity lanes, FC-09t r5, M-20 wave verify; Opus integration review APPROVED, engine10 2291/0, tsc 0). 43 BOARD rows released; FV-gh-steer-4 and FV-pr-loop-4 back to ready. M-22 approved, M-23 in Opus round 2; both merge next.
+- 2026-10-16T02:04Z v11.14.0: v11.13.0 never published (credentialed_push_guard red: verify-pr respond pushed with its own token). Fixed by routing respond through engine10-push.sh push-pr with origin read once before the fixer runs (Opus HIGH approved r3 after two BLOCKs). Merged M-21 wave ship, M-22 unit resume, M-23 remote units and G-05, FV-pr-loop-4 and FV-gh-steer-4, fv-train follow-ups; engine10 core trimmed to 4946 lines. Guards 158/0, engine10+util 2523 pass (31 route-matrix fails are local TMPDIR-only, green in CI).
+- 2026-10-16T02:40Z v11.15.0: v11.14.0 never published (CI red: route matrix packages link, merge-queue gh PATH and stat order, FC-89 marker); all four fixed. Shipped M-25 sealed final report (row 379 released), resume adopts only landed merges (mutation-checked 18/1 red, 19/0 green), modernize coordinator wiring (Opus round 2 approve; real runs still exit 2 naming four missing pieces), modernize trim 4107 to 3792. Gates: shell 14/14 rc 0, bun guard set 640/1 then L0 allowlist entry dropped (3/0), tsc 0.