loki-mode 11.12.1 → 11.17.1

package/docs/v10/BOARD.md

@@ -44,6 +44,31 @@ merge (all touch trust-core or security-relevant surfaces), oldest first.
 |---|---|---|---|---|---|---|
 | PF-1 | pkill-scoping fix | main @ 9cd51d1a | autonomy/run.sh (kill_provider_child), tests/test-kill-provider-child-scoping.sh, docs/v10/DECISIONS.md (D15) | HIGH | released@2026-09-27T01:33Z | Founder-reported: every loki-mode session ending via signal (supervisor signal, double Ctrl+C, Ctrl+C in perpetual mode) ran an unscoped `pkill -f` matching ANY process on the machine by command-line substring, terminating unrelated Claude Code sessions. Fixed to scope by process group. Shipped as v9.54.1, ahead of the swarm queue. |
 | PF-2 | P7 scanner gap fix | main @ fa5de15f | tests/moat/p7-no-fabricated-data.sh | HIGH | released@2026-09-27T15:00Z | Round 5, unanimous 4/4 APPROVE under a corrected scoping rule (only a regression/false-positive/weakening introduced by the diff blocks; a pre-existing gap the diff doesn't worsen is a new slice, not a veto). Rebased onto current main, merged fa5de15f, pushed. 10 candidate follow-up slices recorded below (B-1..B-8 plus 2 more from the review). Shipped in v9.56.0 (merged before the 14:16:24Z release push of b651b98d; on npm 15:00:06Z). |
+| P12-17 | Slack thread steer | main @ 2d333d158 | loki-ts/src/contrib/slack_inbound.ts + test | MEDIUM | released@2026-10-16T17:19Z | reviewed and merged; v11.16.0 was never published, shipped in v11.17.0 |
+| P12-12 | stall watchdog | main @ 4c0ee6dbf | engine10 session, runner watchdog + tests | MEDIUM | released@2026-10-16T17:19Z | reviewed and merged; v11.16.0 was never published, shipped in v11.17.0 |
+| P12-16 | chat commands | main @ 6d6f69f73 | autonomy/lib/chat.sh, tests/test-doctor-ux.sh | MEDIUM | released@2026-10-16T17:19Z | reviewed and merged; v11.16.0 was never published, shipped in v11.17.0 |
+| P12-24 | doctor min claude version | main @ e6754c961 | doctor, compat manifest | LOW | released@2026-10-16T17:19Z | reviewed and merged; v11.16.0 was never published, shipped in v11.17.0 |
+| P12-21 | per-stage cost | main @ 44c0810f2 | cost breakdown | MEDIUM | released@2026-10-16T17:19Z | reviewed and merged; v11.16.0 was never published, shipped in v11.17.0 |
+| P12-31 | active human minutes | main @ 9e2604b95 | trust, proof | MEDIUM | released@2026-10-16T17:19Z | reviewed and merged; v11.16.0 was never published, shipped in v11.17.0 |
+| P12-25 | provider isolation matrix | main @ 8c256963b | tests/providers, guard revert | MEDIUM | released@2026-10-16T17:19Z | reviewed and merged; v11.16.0 was never published, shipped in v11.17.0 |
+| P12-03 | merge pinned to proven head | main @ b3ff4bb1d | merge, proofs | HIGH | released@2026-10-16T17:19Z | reviewed and merged; v11.16.0 was never published, shipped in v11.17.0 |
+| P12-06 | council file:line anchors | main @ 40ee4c1a9 | council | MEDIUM | released@2026-10-16T17:19Z | reviewed and merged; v11.16.0 was never published, shipped in v11.17.0 |
+| P12-04 | respond refuses moved head | main @ 6da9172e6 | verify-pr respond | HIGH | released@2026-10-16T17:19Z | reviewed and merged; v11.16.0 was never published, shipped in v11.17.0 |
+| P12-07 | per-stage resume (07b-07g) | main @ f5c54cbb7 | engine10 resume, autonomy/loki start | HIGH | released@2026-10-16T17:19Z | v11.17.0, reviewed and merged |
+| P12-01 | Seal drift and receipt tamper checks (01b, 01c) | main @ f5c54cbb7 | loki verify, proofs | HIGH | released@2026-10-16T17:19Z | v11.17.0, reviewed and merged |
+| P12-26 | compiled Claude permission policy (26b, 26c) | main @ f5c54cbb7 | src/policies, launch sites | HIGH | released@2026-10-16T17:19Z | v11.17.0, reviewed and merged |
+| P12-09 | quota wait-then-rerun (09b) | main @ f5c54cbb7 | runner retry_class | MEDIUM | released@2026-10-16T17:19Z | v11.17.0, reviewed and merged |
+| P12-08 | work-item ids and lifecycle states (08b, 08c) | main @ f5c54cbb7 | engine10 state, loki status | MEDIUM | released@2026-10-16T17:19Z | v11.17.0, reviewed and merged |
+| P12-02 | post-Wall steer blocks Seal (02b, 02c) | main @ f5c54cbb7 | steer, seal | HIGH | released@2026-10-16T17:19Z | v11.17.0, reviewed and merged |
+| P12-03b | dirty-tree proof fails closed (03c, 03d) | main @ f5c54cbb7 | proofs | HIGH | released@2026-10-16T17:19Z | v11.17.0, reviewed and merged |
+| P12-05 | Wall holdout, off by default | main @ f5c54cbb7 | engine10 wall | HIGH | released@2026-10-16T17:19Z | v11.17.0, reviewed and merged |
+| P12-16b | chat /run reports only a live run | main @ f5c54cbb7 | autonomy/lib/chat.sh | MEDIUM | released@2026-10-16T17:19Z | v11.17.0, reviewed and merged |
+| P12-17b | Slack echo redaction | main @ f5c54cbb7 | contrib/slack | MEDIUM | released@2026-10-16T17:19Z | v11.17.0, reviewed and merged |
+| P12-23 | start flag parsing (23b) | main @ f5c54cbb7 | autonomy/loki | LOW | released@2026-10-16T17:19Z | v11.17.0, reviewed and merged |
+| P12-29 | configured Claude Code eval arm | main @ f5c54cbb7 | eval/loki10 | MEDIUM | released@2026-10-16T17:19Z | v11.17.0, reviewed and merged |
+| P12-30 | eval task families with hidden tests | main @ f5c54cbb7 | eval/loki10 | MEDIUM | released@2026-10-16T17:19Z | v11.17.0, reviewed and merged |
+| P12-40 | uncited-claim guard (40b) | main @ f5c54cbb7 | structural checks | LOW | released@2026-10-16T17:19Z | v11.17.0, reviewed and merged |
+| P12-CAP | engine10 core line cap | main @ f5c54cbb7 | tests | LOW | released@2026-10-16T17:19Z | v11.17.0, reviewed and merged |
 
 ## Fixed on main already (not slices; recorded for PO context)
 
@@ -250,7 +275,7 @@ set is declared to avoid overlap with those and with each other.
 | S-188 | BACKLOG 123: overview proof card wording has no test of its own | legacy-ui/tests/loki-overview-proof-card.node.test.mjs (new) | LOW | node --test legacy-ui/tests/loki-overview-proof-card.node.test.mjs passes: no proof reads Not evaluated, a headline carries the recorded-copy prefix, gaps null reads uncertainty not measured; deleting the prefix in a scratch copy fails it | released@2026-09-27T20:54Z | Source: 19:57Z cut. Batch 7 (wf_a3ea2c8c-560), build then review. Review APPROVE on 6d965cca; in train 13, main 28e62e44 pushed 20:35:00 (`git ls-remote origin refs/heads/main` = 28e62e44). Published in v9.74.0 (`npm view loki-mode version` = 9.74.0; npm time 2026-09-27T20:54Z). |
 | S-189 | BACKLOG 114: learning dashboard renders failed metrics and trends reads as no data | legacy-ui/components/loki-learning-dashboard.js (metrics and trends load plus their two empty branches only), legacy-ui/tests/loki-learning-dashboard-fetch-error.node.test.mjs (new) | LOW | node --test legacy-ui/tests/loki-learning-dashboard-fetch-error.node.test.mjs passes: rejected metrics and trends render Could not load; an empty trends response still renders No trend data available | released@2026-09-27T20:54Z | Source: 19:57Z cut. Batch 7 (wf_a3ea2c8c-560), build then review. Review APPROVE on a746655f; in train 13, main 28e62e44 pushed 20:35:00 (`git ls-remote origin refs/heads/main` = 28e62e44). Published in v9.74.0 (`npm view loki-mode version` = 9.74.0; npm time 2026-09-27T20:54Z). |
 | S-190 | BACKLOG 112: R3 design doc describes project_total_usd as a plain sum | docs/R3-COST-OBSERVABILITY-DESIGN.md | LOW | grep -n 'sum of per-run proof costs' docs/R3-COST-OBSERVABILITY-DESIGN.md exits 1; grep -n project_total_partial docs/R3-COST-OBSERVABILITY-DESIGN.md prints at least one line | released@2026-09-27T21:15Z | Source: 19:57Z cut. Batch 8 (wf_ff8d537c-40e), build then review. Review APPROVE on 1d6786bf; in train 14, main 04af133a pushed 20:58:10 (`git ls-remote origin refs/heads/main` = 04af133a). Published in v9.75.0 (`npm view loki-mode version` = 9.75.0; npm time 2026-09-27T21:15Z). |
-| S-191 | Bring tests/test-review-assurance-tail.sh under 60 s wall time with bounded concurrency, keeping every per-case budget and assertion unchanged. | tests/test-review-assurance-tail.sh, tests/shard-durations.tsv (update its row) | RED: `time bash tests/test-review-assurance-tail.sh` over 60 s today (memory says load-flaky). GREEN: under 60 s on 3 consecutive runs, with identical pass counts printed, and every case still runs (compare the case-name lists before and after). Under `LOKI_TEST_JOBS=1` it still passes. Each parallel case uses its own run-owned temp dir; record and wait on your own PIDs only. Reuse built commit 63396544 (branch worktree-wf_ff8d537c-40e-4) as a starting point after rebasing. No CHANGELOG. | MEDIUM | merged@2026-10-03T10:50Z | df4f23207..328ad1f05 on main (MEDIUM TL APPROVE), shard row 116 to 45 |
+| S-191 | Bring tests/test-review-assurance-tail.sh under 60 s wall time with bounded concurrency, keeping every per-case budget and assertion unchanged. | tests/test-review-assurance-tail.sh, tests/shard-durations.tsv (update its row) | RED: `time bash tests/test-review-assurance-tail.sh` over 60 s today (memory says load-flaky). GREEN: under 60 s on 3 consecutive runs, with identical pass counts printed, and every case still runs (compare the case-name lists before and after). Under `LOKI_TEST_JOBS=1` it still passes. Each parallel case uses its own run-owned temp dir; record and wait on your own PIDs only. Reuse built commit 63396544 (branch worktree-wf_ff8d537c-40e-4) as a starting point after rebasing. No CHANGELOG. | MEDIUM | released@2026-10-16T00:49Z | df4f23207..328ad1f05 on main (MEDIUM TL APPROVE), shard row 116 to 45 |
 | S-192 | BACKLOG 112: no test drives the web-app WebSocket status push payload for unmeasured cost | web-app/tests/test_status_push_unmeasured.py (new), web-app/server.py (lift the nested status reader only if needed) | MEDIUM | python3 -m pytest -q web-app/tests/test_status_push_unmeasured.py passes: no tokens gives cost null and max_iterations null, priced tokens give a number; forcing 0.0 in a scratch copy fails case 1 | released@2026-09-27T21:15Z | Source: 19:57Z cut. Batch 8 (wf_ff8d537c-40e), build then review. Review APPROVE on 0b6deb16; in train 14, main 04af133a pushed 20:58:10 (`git ls-remote origin refs/heads/main` = 04af133a). Published in v9.75.0 (`npm view loki-mode version` = 9.75.0; npm time 2026-09-27T21:15Z). |
 | S-193 | Velocity: v10-ops worktree-budget prints how many worktrees a batch may open before dispatch | scripts/v10-ops.sh (new worktree-budget subcommand), tests/test-v10-ops.sh | LOW | bash tests/test-v10-ops.sh exits 0; scripts/v10-ops.sh worktree-budget 15 prints 15 minus the .claude/worktrees entries in git worktree list --porcelain, and at or over the cap prints 0 and exits 1 | released@2026-09-27T21:15Z | Source: 19:57Z cut. Batch 8 (wf_ff8d537c-40e), build then review. Review APPROVE on a0d7a34d; in train 14, main 04af133a pushed 20:58:10 (`git ls-remote origin refs/heads/main` = 04af133a). Published in v9.75.0 (`npm view loki-mode version` = 9.75.0; npm time 2026-09-27T21:15Z). |
 | S-194 | BACKLOG 108: LOKI_AUTO_PR pushes a branch whose history still holds user files | autonomy/run.sh (create_session_pr only; does not overlap S-175 or S-195), tests/test-auto-pr-agent-committed-refuse.sh (new) | HIGH | bash tests/test-auto-pr-agent-committed-refuse.sh exits 0: auto path with a record makes no push, returns 1 and prints git reset --soft; advisory path prints the cleanup before git push -u; empty record pushes; removing the record read in a scratch copy fails leg 1; bash tests/test-trusted-push-agent-config.sh exits 0 | released@2026-09-27T21:45Z | Source: 20:12Z cut. Batch 8 (wf_ff8d537c-40e), build then review. 7a4b59d7 review CONCERN; rework in batch 9 (wf_4da25841-89e). Review APPROVE on 52a0ac1e (HIGH re-review APPROVE); in train 16, main 800ac46e pushed 21:25:40 (`git ls-remote origin refs/heads/main` = 800ac46e). Published in v9.76.0 (`npm view loki-mode version` = 9.76.0; npm time 2026-09-27T21:45Z). |
@@ -292,7 +317,7 @@ set is declared to avoid overlap with those and with each other.
 | S-230 | BACKLOG 115/118: ProjectWorkspace labels unknown phases building and Replay Build can never appear | web-app/src/components/ProjectWorkspace.tsx (buildPhase memo ~1401-1410 and Replay Build condition ~1488 only; does not overlap S-229), web-app/src/components/ProjectWorkspace.phase.test.mjs (new) | LOW | node --test web-app/src/components/ProjectWorkspace.phase.test.mjs shows an unrecognized phase is not building and a completed idle session shows Replay Build; cd web-app && npx tsc -b exits 0 | parked@2026-09-27T21:43Z | Source: 20:59Z cut. Paused by CEO P0 (Loki 10 engine). |
 | S-231 | BACKLOG 52: the Moat suite CI check reads as moat proven at 0 of 9 | .github/workflows/test.yml (moat-suite job name only) | LOW | gh api required_status_checks for main does not list Moat suite (else report-only); git grep -n "name: Moat suite" -- .github prints nothing; git grep -n "Moat suite" -- tests scripts .github lists only the step-summary heading; the next push shows the renamed check | parked@2026-09-27T21:43Z | Source: 20:59Z cut. Batch 10 (wf_6fed529f-a3d), build then review. Paused by CEO P0 (Loki 10 engine) before review; built commit 8dddd2d3 kept on branch worktree-wf_6fed529f-a3d-13. |
 | S-232 | autonomy/loki is linted only inside the sentrux test; the lint suite schedules big files last | tests/run-shellcheck.sh, tests/test-sentrux-init-rules.sh (T6 only) | LOW | LOKI_SHELLCHECK_JOBS=4 bash tests/run-shellcheck.sh exits 0, prints Checked ./autonomy/loki, counts match the pre-change capture plus loki; time bash tests/test-sentrux-init-rules.sh exits 0 with 8 passed under 10s; grep -c shellcheck tests/test-sentrux-init-rules.sh prints 0; both timings reported | parked@2026-09-27T21:43Z | Source: 20:59Z cut. Paused by CEO P0 (Loki 10 engine). |
-| S-233 | BACKLOG 72 remainder: refused resume does not name the blocking file or where the earlier commits are | autonomy/run.sh (setup_agent_branch resume block around the no-overwrite-ignore checkout only), tests/test-refused-resume-warning.sh (new) | LOW | bash tests/test-refused-resume-warning.sh exits 0 with the warning naming the conflicting ignored file and the recorded branch; bash tests/test-branch-lifecycle.sh exits 0 | merged@2026-10-03T09:43Z | 1731c5e14. TL APPROVE (red on parent, mutation red, paths with spaces, cap 5, locale-safe fallback). On main: test PASS, bash -n ok, shard 19/0, drift 6/0. Nit: tracked-change refusals also say ignored file(s). |
+| S-233 | BACKLOG 72 remainder: refused resume does not name the blocking file or where the earlier commits are | autonomy/run.sh (setup_agent_branch resume block around the no-overwrite-ignore checkout only), tests/test-refused-resume-warning.sh (new) | LOW | bash tests/test-refused-resume-warning.sh exits 0 with the warning naming the conflicting ignored file and the recorded branch; bash tests/test-branch-lifecycle.sh exits 0 | released@2026-10-16T00:49Z | 1731c5e14. TL APPROVE (red on parent, mutation red, paths with spaces, cap 5, locale-safe fallback). On main: test PASS, bash -n ok, shard 19/0, drift 6/0. Nit: tracked-change refusals also say ignored file(s). |
 | EV-1 | Eval runner and scorer (eval/loki10/harness.py, run.sh, summarize): fresh clone per run, local bare remote, hidden tests after the arm, nonce-verified grading, pre-arm task_invalid checks, provider-only cost | eval/loki10/{harness.py,run.sh,summarize,lib-tmp.sh,README.md,test-harness.sh,fixtures/} | HIGH | bash eval/loki10/test-harness.sh | released@2026-09-28T01:11Z | D29 gate. Built d63fc5c2 (61 passed, 0 failed); adversarial review REJECT on 3cf723be fixed item by item; merging EV-3 and the task nonce fixes on branch worktree-agent-ad850d483c4960e62. d63fc5c2..68bfbc4f (test-harness 77 passed; no-op baseline graded all 29 tasks not completed, none task_invalid, 108s); main 694866fc. Released v9.80.1 (npm view loki-mode time: 2026-09-28T01:11:53Z). |
 | EV-2 | Eval task set: 25 or more real tasks with hidden tests (augmentiq, public issues with merged-fix tests, quickstart briefs) | eval/loki10/tasks/ | HIGH | python3 eval/loki10/harness.py validate eval/loki10/tasks/*/ | released@2026-09-28T01:11Z | 29 tasks (augmentiq 1: the repo has only 3 issues; public 14; quickstart 14); re-review APPROVE (every public task red at ref, green at fix); on main 51b37c6f. Released v9.80.1 (npm view loki-mode time: 2026-09-28T01:11:53Z). |
 | EV-3 | Eval arm config isolation: fresh CLAUDE_CONFIG_DIR per run, one credential passed only to the arm | eval/loki10/harness.py (arm_env, arm_auth), test-harness.sh leg 12, README | HIGH | bash eval/loki10/test-harness.sh | released@2026-09-28T01:11Z | 451ba56c; security review CONCERN (test could not catch a leak) fixed: M1/M2/M4 leak mutations each red; merging into EV-1 branch. 451ba56c (merged via EV-1 branch); main 694866fc. Released v9.80.1 (npm view loki-mode time: 2026-09-28T01:11:53Z). |
@@ -348,10 +373,10 @@ set is declared to avoid overlap with those and with each other.
 | E-62 | Eval harness v10 arm defaults to this repo's bin/loki (never the global loki, which was v9.78.0) and the manifest records its path and the agent SDK version; local-ci and the harness refuse when loki-ts/node_modules differs from bun.lock | eval/loki10/harness.py (loki_bin default, manifest), scripts/local-ci.sh (one check), eval/loki10/test-harness.sh (one leg) | HIGH | bash eval/loki10/test-harness.sh; a leg asserts the v10 arm binary is the repo bin/loki | released@2026-09-28T16:03Z | Source: incident 01:38Z. Wave E19, after EV-13 landed (ea288330). Built 3e8f6dc8 (branch slice-E-62). Opus REJECT (reproduced): the new lockfile check in scripts/local-ci.sh is not in _FAST_KEEP, so the fast tier (the only gate) skips it. Next: rework. Wave E21 (wf_39ab3f7d-8f3). r2. r2 3e4f489c Opus APPROVE; conflicts in eval/loki10/test-harness.sh with EV-11a. Next: one engineer rebases EV-11b first, then E-62, onto main. r3 30047e4e Opus APPROVE (includes EV-11b-r2); merged locally; `bash eval/loki10/test-harness.sh` 114 passed 0 failed, validate all ok. Released in v10.2.1 (npm publish 2026-09-28T16:03Z; every cited commit is an ancestor of the v10.2.1 tag; `git merge-base --is-ancestor`). |
 | E-63 | Pulse STALE_PROGRESS violation when the newest PROGRESS.md entry is over 35 minutes old | scripts/v10-pulse.sh, tests/test-v10-pulse.sh | MEDIUM | bash tests/test-v10-pulse.sh | released@2026-10-03T09:21Z | on main f4876505c; first tag v10.0.0 (drift audit 09:24Z) |
 | E-64 | Lean small path and model cascade (D31): small tasks get one sonnet implement session with the cached repo map, impacted tests, PR; no plan or Wall unless no relevant tests; opus only on a test failure, reason logged; cost per call type | loki-ts/src/engine10 (implement, fix, plan, wall, sizing, session) | HIGH | cd loki-ts && bun test tests/engine10/; then EV-8 5-task measurement | released@2026-09-28T21:01Z | Source: D30, D31. Opus REJECT (47f0d33a): a non-escalated fix round still runs on the top model while the event says no escalation; does not merge onto main. Rework dispatched. Rework APPROVE (branch worktree-wf_4601e7b3-4d8-1: 70bae9be, db2c104f, 01ff7737): non-escalated fix rounds run on the cheap model and the event records the real model. Not merged; must be re-measured (full small arm) before it becomes the default. Merged c9c15f38 (trainE18), session.ts conflict with E-68 resolved to the 30s heartbeat; `bun test tests/engine10/` 444 pass. Still behind the gate: re-measure before default. Released in v10.5.0 (merge c9c15f38 is an ancestor of v10.5.0). |
-| E-65 | Session token diet: find and cut what makes one v10 session cost more than raw claude -p on the same task and model | loki-ts/src/engine10, engine10-only flag in loki-ts/src/runner if needed | HIGH | before/after token table on one task, then the EV-8 5 tasks | merged@2026-09-28T02:38Z | Source: EV-8 variant C (a sonnet session $0.155 to $0.32 vs raw opus $0.216 per whole task). Built 92e3c06c: engine sessions 6 tools, no legacy append, no MCP, settingSources project; prefix 20.4k -> 7.1k tokens; 5 tasks on claude-sonnet-5 v10 4/5 $0.1523 per completed vs raw 4/5 $0.2113. Opus CONCERN: M5 (tools spread removed) and M6 (noAppend ignored) survive 1345 tests; rework sent (query()-level assertion, rebase). Opus APPROVE on rework c9a90cce (M5, M6, M7, M8 all red; runner plus engine10 1347 pass 0 fail, also without claude on PATH). Merged 8b76fd9a with dist rebuilt. EV-8 D (opus, lean, no plan or Wall) 4/5 $0.1571 per completed p50 28s; E (sonnet, lean) 4/5 $0.1519 p50 27.5s; raw opus on the same 5 tasks 5/5 $0.2161 p50 41s (~/loki-ci-logs/ev8r-{D,E}/results.jsonl). |
+| E-65 | Session token diet: find and cut what makes one v10 session cost more than raw claude -p on the same task and model | loki-ts/src/engine10, engine10-only flag in loki-ts/src/runner if needed | HIGH | before/after token table on one task, then the EV-8 5 tasks | released@2026-10-16T00:49Z | Source: EV-8 variant C (a sonnet session $0.155 to $0.32 vs raw opus $0.216 per whole task). Built 92e3c06c: engine sessions 6 tools, no legacy append, no MCP, settingSources project; prefix 20.4k -> 7.1k tokens; 5 tasks on claude-sonnet-5 v10 4/5 $0.1523 per completed vs raw 4/5 $0.2113. Opus CONCERN: M5 (tools spread removed) and M6 (noAppend ignored) survive 1345 tests; rework sent (query()-level assertion, rebase). Opus APPROVE on rework c9a90cce (M5, M6, M7, M8 all red; runner plus engine10 1347 pass 0 fail, also without claude on PATH). Merged 8b76fd9a with dist rebuilt. EV-8 D (opus, lean, no plan or Wall) 4/5 $0.1571 per completed p50 28s; E (sonnet, lean) 4/5 $0.1519 p50 27.5s; raw opus on the same 5 tasks 5/5 $0.2161 p50 41s (~/loki-ci-logs/ev8r-{D,E}/results.jsonl). |
 | EV-11 | Medium eval tier: 15 multi-file tasks with hidden tests, tier field and --tier selection | eval/loki10/tasks/, eval/loki10/harness.py, run.sh | HIGH | python3 eval/loki10/harness.py validate; no-op baseline grades 15 not completed, 0 invalid | released@2026-09-28T21:01Z | Source: D30. Opus CONCERN: 3 of 15 medium tasks verified (ea04f1e0). Rework dispatched to finish the 15. Rework (branch worktree-wf_4601e7b3-4d8-2, head 5718225a): 4 of 15 medium tasks verified (pub-attrs-1313, pub-click-2869, pub-faker-1817, pub-jinja-1413). Opus CONCERN: 11 tasks still missing; leads in eval/loki10/tasks/INDEX.md. Wave E18 rework: 11 missing medium tasks, branch slice-EV-11-medium-15. Opus REJECT: pub-werkzeug-3121 hidden test not verbatim as claimed; pub-werkzeug-3105 grades a feature deletion as completed. Rework wave E19. Rework r2 f7cf7b58 (branch slice-EV-11-r2). Opus REJECT (reproduced): pub-faker-1817 grades a feature deletion (uniqueness tracking removed) as completed. Next: per-task deletion-mutant audit. Wave E21 (wf_39ab3f7d-8f3). Split EV-11a/EV-11b by task, per-task deletion-mutant audit. EV-11a (02e68591, Opus APPROVE) merged into train E22 (9042e964): `bun test tests/engine10/` 547 pass 0 fail, tsc 0, `bash tests/test-v10-pulse.sh` 107 passed, `bash eval/loki10/test-harness.sh` 108 passed. EV-11b (39ee810b, Opus APPROVE) conflicts with EV-11a in harness.py and test-harness.sh (each resolved the EV-11-r2 merge separately); rebase onto main next. EV-11b r2 0d601f64 Opus APPROVE, merged with E-62-r3; gitleaks v8.30.0 dir scan of eval/loki10/tasks finds only the known pub-werkzeug-3271 pin. Released in v10.5.0 (merge d25f9d43 is an ancestor of v10.5.0). |
 | EV-12 | Large eval tier: 10 feature or legacy tasks with hidden tests, including augmentiq-style issues | eval/loki10/tasks/ | HIGH | validate plus no-op baseline over 10 | parked@2026-09-28T18:58Z | Source: D30. Opus REJECT (fbd32234): 3 legacy tasks point at fixtures absent before merge (prepare_failed); spec items missing. Rework dispatched. Rework (branch worktree-wf_4601e7b3-4d8-3, head 0b9a2d91: 10 large tasks, repo-relative fixture sources). Opus REJECT: the repo-relative sources, .. rejection and fixture fixes are reproduced, but the large tasks are still smaller than the medium ones (task-size finding open). Next: rework with genuinely feature-sized tasks. Wave E18 rework: feature-sized large tasks, branch slice-EV-12-large-tasks. Opus REJECT: only lg-rbac reworked (1 of 10 feature-sized); fixture files outside the set. Rework wave E19 (fixtures now in set). Rework r2 237daa65 (branch slice-EV-12-r2). Opus REJECT: large tasks still not all feature-sized (engineer report agrees). Next: split across engineers, a few tasks each. Wave E21 (wf_39ab3f7d-8f3). Split EV-12a/b/c by task. Round 4: EV-12a CONCERN (size bar met by deleted docstrings, about 93-106 added lines), EV-12b REJECT (bundles built by an uncommitted script; no legacy code left), EV-12c REJECT (storage.validate counted but untested). Sent to the CTO for a tier ruling before any further rework. D34 (CTO): synthetic lg-* tasks closed, not merged; replaced by EV-12S (size gate) and EV-12A/B/C (real upstream PRs, 5 needed), then EV-12D (INDEX). Legacy moves to M-27. Wave E24 (wf_55378a48-585): EV-12S approved (rebase onto main pending), large tasks passing review 2 of 5 (lg-werkzeug-1513, lg-werkzeug-1680); EV-12A 1769 fix, EV-12B fresh search, EV-12C hardening building. D38 (CTO): upstream-first hidden tests plus requirements map; EV-12S approved (8ef877e8, merge pending); EV-12E, EV-12F, EV-12G cut. Reviewer shortcut patches saved to ~/loki-ci-logs/ev12-shortcuts/. Parked 18:58Z per D40 (fix medium before large; EV-12F/G deprioritized); branches kept. |
-| M-00 | MODERNIZE.md design (CTO and Architect) and the Part 2 slice table M-01.. | docs/v10/MODERNIZE.md | HIGH | doc under 400 lines with a 20 to 30 slice plan | merged@2026-09-28T02:50Z | Source: D30 Part 2. ETA 02:45Z. Built 17e97855 (399 lines, 30 slices); merges in train E17 (b2ad73ce). |
+| M-00 | MODERNIZE.md design (CTO and Architect) and the Part 2 slice table M-01.. | docs/v10/MODERNIZE.md | HIGH | doc under 400 lines with a 20 to 30 slice plan | released@2026-10-16T00:49Z | Source: D30 Part 2. ETA 02:45Z. Built 17e97855 (399 lines, 30 slices); merges in train E17 (b2ad73ce). |
 | M-01 | Modernize event types, log wrapper and state paths | loki-ts/src/engine10/modernize/types.ts, loki-ts/src/engine10/modernize/log.ts, loki-ts/tests/engine10/modernize/log.test.ts | MEDIUM | cd loki-ts && bun test tests/engine10/modernize/log.test.ts | released@2026-09-28T05:00Z | Source: MODERNIZE.md (D30). Depends on none. Built on branch worktree-wf_4601e7b3-4d8-4 (777f6cdd M-01, 212a7404 M-02, 6b00c05c M-05, 3d8edb5d M-06). TL CONCERN: cluster.ts tarjanSCC recursion overflows the stack on dependency chains of about 20-50k nodes (the M-28/M-29 scale); needs an iterative SCC. Wave E18 (wf_5063e58d-7a5) carries it with the M-05 iterative SCC rework, branch slice-M-05-iterative-scc. Merged f4d98c0b with M-05. Released in v10.1.0 (npm publish 2026-09-28T05:00Z; every cited commit is an ancestor of the v10.1.0 tag; `git merge-base --is-ancestor`). |
 | M-02 | Inventory core: files, languages, build, entry points, tests | loki-ts/src/engine10/modernize/inventory.ts, loki-ts/tests/engine10/modernize/inventory.test.ts, loki-ts/tests/engine10/modernize/fixtures/inv/ | MEDIUM | cd loki-ts && bun test tests/engine10/modernize/inventory.test.ts | released@2026-09-28T05:00Z | Source: MODERNIZE.md (D30). Depends on M-01. Built on branch worktree-wf_4601e7b3-4d8-4 (777f6cdd M-01, 212a7404 M-02, 6b00c05c M-05, 3d8edb5d M-06). TL CONCERN: cluster.ts tarjanSCC recursion overflows the stack on dependency chains of about 20-50k nodes (the M-28/M-29 scale); needs an iterative SCC. Wave E18 with M-05, branch slice-M-05-iterative-scc. Merged f4d98c0b with M-05. Released in v10.1.0 (npm publish 2026-09-28T05:00Z; every cited commit is an ancestor of the v10.1.0 tag; `git merge-base --is-ancestor`). |
 | M-03 | Python import graph via tokenize (lexes py2 source) | loki-ts/src/engine10/modernize/lang/python.ts, autonomy/lib/modernize/py_imports.py, loki-ts/tests/engine10/modernize/python_graph.test.ts | MEDIUM | cd loki-ts && bun test tests/engine10/modernize/python_graph.test.ts | released@2026-09-28T14:26Z | Source: MODERNIZE.md (D30). Depends on M-02. Wave E18, based on the M-02 branch, branch slice-M-03-python-graph. TL REJECT: bare relative from-imports (from . import X) mis-parsed in py_imports.py. Rework wave E19. Rework 8b5e1340 TL APPROVE (sonnet); merged c90d7924; `bun test tests/engine10/` 481 pass 0 fail. Released in v10.1.1 (npm publish 2026-09-28T14:26Z; every cited commit is an ancestor of the v10.1.1 tag; `git merge-base --is-ancestor`). |
@@ -366,17 +391,17 @@ set is declared to avoid overlap with those and with each other.
 | M-12 | Oracle seal, held-out split, 80% floor, up-front NOT PROVEN | loki-ts/src/engine10/modernize/oracle/seal.ts, loki-ts/tests/engine10/modernize/oracle_seal.test.ts | HIGH | cd loki-ts && bun test tests/engine10/modernize/oracle_seal.test.ts | released@2026-09-28T21:01Z | Source: MODERNIZE.md (D30). Depends on M-09. Opus REJECT (reproduced): delete-and-reseal defeats tamper evidence (hashes stored beside the data). Next: rework. r2 d9026ec6 Opus APPROVE (reseal refused via the append-only log); merged dc827b80 (on top of v10.2.2): full `cd loki-ts && bun test` 2277 pass 0 fail, `bash tests/test-engine10-dist.sh` 18 passed, `bash tests/test-v10-pulse.sh` 117 passed. Released in v10.5.0 (merge b71d80fa is an ancestor of v10.5.0). |
 | M-13 | Equivalence checker with sealed normalizers and contract output | loki-ts/src/engine10/modernize/equiv.ts, loki-ts/tests/engine10/modernize/equiv.test.ts, loki-ts/tests/engine10/modernize/fixtures/equiv/ | HIGH | cd loki-ts && bun test tests/engine10/modernize/equiv.test.ts | released@2026-09-28T22:26Z | Source: MODERNIZE.md (D30). Depends on M-12. Wave E27 (wf_bcacb1d1-e76). Wave E27 stopped 18:37Z (founder: over budget, load 50). REJECT (reproduced): a unit whose oracle seal is NOT_PROVEN still gets a clean equivalence pass. Branch slice-M-13-equiv kept. Dispatched 21:18Z sonnet (founder 17:10 staffing directive). r2 b379c171 REJECT (3 blockers), r3 89ea40ae REJECT on B3 (normalizers still caller-supplied: tolerance 1e9 after the new tree gives PROVEN). D42 (4): only fix (a), sealOracle hashes the normalizers; M-13 may edit the M-12 seal file for this only. r4 dispatched 21:42Z. r4 fe3cae28 opus APPROVE (normalizer hash in the oracle seal; tolerance 1e9 after seal gives NOT_PROVEN; hand-edited sealed.json refused; canonical hash over all 3 fields). Merged. Released in v10.5.3 (merge cb1ef386 is an ancestor of v10.5.3). |
 | M-14 | Wall pre-sealed mode: oracle plus conformance, green base is an error | loki-ts/src/engine10/stages/wall.ts (pre-sealed branch only), loki-ts/tests/engine10/modernize/wall_presealed.test.ts | HIGH | cd loki-ts && bun test tests/engine10/modernize/wall_presealed.test.ts | released@2026-09-28T23:18Z | Source: MODERNIZE.md (D30). Depends on M-12, E-54. D33: states its net core line delta; core must stay under 5,000 (92 lines of headroom shared by E-67, E-66, E-61, M-14, merge order E-67, E-66, E-61); offset any excess by deleting dead core code. Wave E27 (wf_bcacb1d1-e76). Wave E27 stopped 18:37Z (founder: over budget, load 50). REJECT: branch empty (no commits). Dispatched 21:51Z. r1 867cffab opus REJECT: crash/OOM/signal exits read as red; bare ImportError enum reads a missing third-party package as red; no file sha256 or verify; no binding to the oracle seal. r2 dispatched 21:57Z. r2 86d078eb (crash/signal exits not_run; inRepo on collection errors; file sha256 plus verify; oracle seal required; base_sha recorded); presealed 26/26, modernize 222/0; opus re-review 22:04Z. r2 86d078eb opus: B1, B3, B4 fixed; B2 still open (inRepo is a caller-supplied flag: name six with inRepo true gives red). r3 derives it from the repo tree. r3 ef4fa166 opus APPROVE (inRepo derived from the real tree via realpath; symlinks and .. names give not_run; verify re-runs verifySeal). Merged; modernize suite green. Released in v10.5.5 (merge c8f9a7d0 is an ancestor of v10.5.5). |
-| M-15 | Unit runner: card to v10 run with oracle Wall and equiv check | loki-ts/src/engine10/modernize/unit.ts, loki-ts/tests/engine10/modernize/unit.test.ts | HIGH | cd loki-ts && bun test tests/engine10/modernize/unit.test.ts | merged@2026-10-15T23:40Z | Source: MODERNIZE.md (D30). Depends on M-13, M-14. Requirement from the M-13 review: call sealOracle with the card normalizers before implement, and test that ordering. From the M-14 review: derive the failing module from the traceback file path under the target runtime (site-packages can shadow a repo name); resolve the module part of an AttributeError so real reds are sealable; call verifyPreSealedWall and verifySeal before trusting a Wall. Dispatched 22:09Z (M-13, M-14 merged).  WIND-DOWN 2026-09-28: opus r1 REJECT (B1 importer frame made a missing third-party package red; B2 PROVEN without conformance re-run or ablation) fixed at 03b35a69 on slice-M-15 (modernize plus budget 250/0, both red then green on real pytest 9.0.2). NEXT: opus r2 review of 03b35a69, then merge. Opus r3 REJECT (18:40Z): B1 added pytest.toml/.pytest.ini or test file bypasses conformance to PROVEN with u.py unmodernized; r4 widens drift rules, adds throwing-stub ablation test, re-syncs the collection rule to E-125 6fc6e950. M-17 must build the production runStub. PARKED 20:05Z by the adoption directive (docs/v10/PROGRESS.md 20:05Z); resumes after Tier 0 is green. |
+| M-15 | Unit runner: card to v10 run with oracle Wall and equiv check | loki-ts/src/engine10/modernize/unit.ts, loki-ts/tests/engine10/modernize/unit.test.ts | HIGH | cd loki-ts && bun test tests/engine10/modernize/unit.test.ts | released@2026-10-16T00:49Z | Source: MODERNIZE.md (D30). Depends on M-13, M-14. Requirement from the M-13 review: call sealOracle with the card normalizers before implement, and test that ordering. From the M-14 review: derive the failing module from the traceback file path under the target runtime (site-packages can shadow a repo name); resolve the module part of an AttributeError so real reds are sealable; call verifyPreSealedWall and verifySeal before trusting a Wall. Dispatched 22:09Z (M-13, M-14 merged).  WIND-DOWN 2026-09-28: opus r1 REJECT (B1 importer frame made a missing third-party package red; B2 PROVEN without conformance re-run or ablation) fixed at 03b35a69 on slice-M-15 (modernize plus budget 250/0, both red then green on real pytest 9.0.2). NEXT: opus r2 review of 03b35a69, then merge. Opus r3 REJECT (18:40Z): B1 added pytest.toml/.pytest.ini or test file bypasses conformance to PROVEN with u.py unmodernized; r4 widens drift rules, adds throwing-stub ablation test, re-syncs the collection rule to E-125 6fc6e950. M-17 must build the production runStub. PARKED 20:05Z by the adoption directive (docs/v10/PROGRESS.md 20:05Z); resumes after Tier 0 is green. |
 | M-16 | Deterministic codemods first (futurize, OpenRewrite) or skipped | loki-ts/src/engine10/modernize/codemod.ts, loki-ts/tests/engine10/modernize/codemod.test.ts | MEDIUM | cd loki-ts && bun test tests/engine10/modernize/codemod.test.ts | released@2026-09-28T16:03Z | Source: MODERNIZE.md (D30). Depends on M-02. Built 0a8bbe6c (branch slice-M-16-codemods); TL review died on the 04:48Z access outage. Wave E21 (wf_39ab3f7d-8f3). TL review. TL APPROVE of 0a8bbe6c; merged into train E22 (9042e964): `bun test tests/engine10/` 547 pass 0 fail, tsc 0, `bash tests/test-v10-pulse.sh` 107 passed, `bash eval/loki10/test-harness.sh` 108 passed. Released in v10.2.1 (npm publish 2026-09-28T16:03Z; every cited commit is an ancestor of the v10.2.1 tag; `git merge-base --is-ancestor`). |
-| M-17 | Scheduler: N workers, worktrees, cascade, best-of-2, budget stop | loki-ts/src/engine10/modernize/scheduler.ts, loki-ts/tests/engine10/modernize/scheduler.test.ts | HIGH | cd loki-ts && bun test tests/engine10/modernize/scheduler.test.ts | merged@2026-10-16T00:00Z | Source: MODERNIZE.md (D30). Depends on M-15. |
+| M-17 | Scheduler: N workers, worktrees, cascade, best-of-2, budget stop | loki-ts/src/engine10/modernize/scheduler.ts, loki-ts/tests/engine10/modernize/scheduler.test.ts | HIGH | cd loki-ts && bun test tests/engine10/modernize/scheduler.test.ts | released@2026-10-16T00:49Z | Source: MODERNIZE.md (D30). Depends on M-15. |
 | M-18 | Re-slice non-equivalent units to depth 2, then NOT PROVEN | loki-ts/src/engine10/modernize/reslice.ts, loki-ts/tests/engine10/modernize/reslice.test.ts | MEDIUM | cd loki-ts && bun test tests/engine10/modernize/reslice.test.ts | released@2026-09-28T23:18Z | Source: MODERNIZE.md (D30). Depends on M-05, M-13.  Merged 20c51512 after TL r2 APPROVE (f41e7e70; reslice 13/0, modernize 241/0 on main). Released in v10.5.5 (merge 20c51512 is an ancestor of v10.5.5). |
 | M-19 | Strangler targets and routes.json (py2/dual/py3, per-module release) | loki-ts/src/engine10/modernize/routes.ts, loki-ts/src/engine10/modernize/targets/python3.ts, loki-ts/src/engine10/modernize/targets/java21.ts, loki-ts/tests/engine10/modernize/routes.test.ts | MEDIUM | cd loki-ts && bun test tests/engine10/modernize/routes.test.ts | released@2026-09-28T16:03Z | Source: MODERNIZE.md (D30). Depends on M-05. Built 3299d359 (branch slice-M-19-routes); TL review died on the 04:48Z access outage. Wave E21 (wf_39ab3f7d-8f3). TL review. TL APPROVE of 3299d359; merged into train E22 (9042e964): `bun test tests/engine10/` 547 pass 0 fail, tsc 0, `bash tests/test-v10-pulse.sh` 107 passed, `bash eval/loki10/test-harness.sh` 108 passed. Released in v10.2.1 (npm publish 2026-09-28T16:03Z; every cited commit is an ancestor of the v10.2.1 tag; `git merge-base --is-ancestor`). |
-| M-20 | Wave verify: full build, integration and original suite | loki-ts/src/engine10/modernize/wave.ts, loki-ts/tests/engine10/modernize/wave.test.ts | MEDIUM | cd loki-ts && bun test tests/engine10/modernize/wave.test.ts | ready@2026-09-28T02:45Z | Source: MODERNIZE.md (D30). Depends on M-17, M-19. |
-| M-21 | Wave ship: one PR per wave with unit receipts, draft unless all proven | loki-ts/src/engine10/modernize/ship.ts, loki-ts/tests/engine10/modernize/ship.test.ts | HIGH | cd loki-ts && bun test tests/engine10/modernize/ship.test.ts | ready@2026-09-28T02:45Z | Source: MODERNIZE.md (D30). Depends on M-20. |
-| M-22 | Unit-level resume after coordinator crash | loki-ts/src/engine10/modernize/resume.ts, loki-ts/tests/engine10/modernize/resume.test.ts | MEDIUM | cd loki-ts && bun test tests/engine10/modernize/resume.test.ts | ready@2026-09-28T02:45Z | Source: MODERNIZE.md (D30). Depends on M-17, E-39. |
-| M-23 | Remote units via POST /jobs kind unit, Helm worker.engine v10, local re-verify | autonomy/trigger-server.py (unit job kind only), deploy/helm/autonomi/templates/job-worker.yaml, deploy/helm/autonomi/values.yaml, loki-ts/src/engine10/modernize/remote.ts, loki-ts/tests/engine10/modernize/remote.test.ts, tests/test-trigger-server-unit-jobs.py | HIGH | python3 tests/test-trigger-server-unit-jobs.py && (cd loki-ts && bun test tests/engine10/modernize/remote.test.ts) | ready@2026-09-28T02:45Z | Source: MODERNIZE.md (D30). Depends on M-17. |
+| M-20 | Wave verify: full build, integration and original suite | loki-ts/src/engine10/modernize/wave.ts, loki-ts/tests/engine10/modernize/wave.test.ts | MEDIUM | cd loki-ts && bun test tests/engine10/modernize/wave.test.ts | released@2026-10-16T01:20Z | b3df49d8d APPROVED (sonnet review, mutant killed), riding fv-train. Source: MODERNIZE.md (D30). Depends on M-17, M-19. |
+| M-21 | Wave ship: one PR per wave with unit receipts, draft unless all proven | loki-ts/src/engine10/modernize/ship.ts, loki-ts/tests/engine10/modernize/ship.test.ts | HIGH | cd loki-ts && bun test tests/engine10/modernize/ship.test.ts | released@2026-10-16T02:04Z | Source: MODERNIZE.md (D30). Depends on M-20. |
+| M-22 | Unit-level resume after coordinator crash | loki-ts/src/engine10/modernize/resume.ts, loki-ts/tests/engine10/modernize/resume.test.ts | MEDIUM | cd loki-ts && bun test tests/engine10/modernize/resume.test.ts | released@2026-10-16T02:04Z | Source: MODERNIZE.md (D30). Depends on M-17, E-39. |
+| M-23 | Remote units via POST /jobs kind unit, Helm worker.engine v10, local re-verify | autonomy/trigger-server.py (unit job kind only), deploy/helm/autonomi/templates/job-worker.yaml, deploy/helm/autonomi/values.yaml, loki-ts/src/engine10/modernize/remote.ts, loki-ts/tests/engine10/modernize/remote.test.ts, tests/test-trigger-server-unit-jobs.py | HIGH | python3 tests/test-trigger-server-unit-jobs.py && (cd loki-ts && bun test tests/engine10/modernize/remote.test.ts) | released@2026-10-16T02:04Z | Source: MODERNIZE.md (D30). Depends on M-17. |
 | M-24 | Dashboard /modernize view | loki-ts/src/engine10/dashboard/modernize.ts, loki-ts/src/engine10/dashboard/server.ts (one route), loki-ts/tests/engine10/modernize/dashboard.test.ts | LOW | cd loki-ts && bun test tests/engine10/modernize/dashboard.test.ts | released@2026-09-28T16:03Z | Source: MODERNIZE.md (D30). Depends on M-01. Built fe3dd87a (branch slice-M-24-dashboard); TL review died on the 04:48Z access outage. Wave E21 (wf_39ab3f7d-8f3). TL review. TL APPROVE of fe3dd87a; merged into train E22 (9042e964): `bun test tests/engine10/` 547 pass 0 fail, tsc 0, `bash tests/test-v10-pulse.sh` 107 passed, `bash eval/loki10/test-harness.sh` 108 passed. Released in v10.2.1 (npm publish 2026-09-28T16:03Z; every cited commit is an ancestor of the v10.2.1 tag; `git merge-base --is-ancestor`). |
-| M-25 | Final report and verdict (COMPLETE only if all proven), sealed | loki-ts/src/engine10/modernize/report.ts, loki-ts/tests/engine10/modernize/report.test.ts | HIGH | cd loki-ts && bun test tests/engine10/modernize/report.test.ts | ready@2026-09-28T02:45Z | Source: MODERNIZE.md (D30). Depends on M-13, M-21. |
+| M-25 | Final report and verdict (COMPLETE only if all proven), sealed | loki-ts/src/engine10/modernize/report.ts, loki-ts/tests/engine10/modernize/report.test.ts | HIGH | cd loki-ts && bun test tests/engine10/modernize/report.test.ts | released@2026-10-16T02:40Z | Source: MODERNIZE.md (D30). Depends on M-13, M-21. |
 | M-26 | End-to-end: py2 fixture repo modernized with stub provider | loki-ts/tests/engine10/modernize/e2e.test.ts, loki-ts/tests/engine10/modernize/fixtures/e2e_py2/ | MEDIUM | cd loki-ts && bun test tests/engine10/modernize/e2e.test.ts | ready@2026-09-28T02:45Z | Source: MODERNIZE.md (D30). Depends on M-08, M-22, M-25. |
 | M-27 | Legacy-Bench pilot harness; confirm public set; calibrate cap | eval/modernize/pilot.py, eval/modernize/test-pilot.sh | HIGH | bash eval/modernize/test-pilot.sh | ready@2026-09-28T02:45Z | Source: MODERNIZE.md (D30). Depends on M-26. D34: absorbs the D30 large-tier legacy coverage. |
 | M-28 | 200K scale run (Mercurial 4.x, measured first, fallback Calibre) | eval/modernize/scale.py, eval/modernize/SCALE.md | HIGH | python3 eval/modernize/scale.py --target hg --dry-run-first | ready@2026-09-28T02:45Z | Source: MODERNIZE.md (D30). Depends on M-27. |
@@ -433,16 +458,16 @@ set is declared to avoid overlap with those and with each other.
 | G-01 | Usage governor (D39): scripts/usage-governor.py sums usage (output, input, cache read, cache write) from ~/.claude/projects/**/*.jsonl per model, role (from workflow labels and agent types where recorded) and hour; stores founder plan-percentage readings (docs/v10/usage-readings.tsv) and fits tokens-per-percent as a labelled estimate; projects 5-hour window and weekly usage; outputs max engineers for the next hour; checks and records whether Claude Code exposes plan usage directly (statusline input rate-limit fields, /usage) and uses it when it does | scripts/usage-governor.py, docs/v10/usage-readings.tsv, tests/test-usage-governor.sh | HIGH | fixture jsonl plus readings gives a stated projection and max-engineer number; missing readings reads "uncalibrated", never a number presented as fact | released@2026-09-28T21:01Z | Source: founder 17:44Z. First in the queue; everything obeys it. r2 de8e1f76 opus REJECT: weekly reset 1h off across DST; fixes 2 and 4 unguarded. r3 dispatched 19:00Z. r3 fa279532 opus APPROVE (DST reset fixed; fixes 2 and 4 mutation-guarded by T14/T15); merged c2ae4347; governor 25/0, logger 16/0, run-shellcheck.sh passes, shard coverage 19/0, drift 6/0. Open non-blocking: weekly tokens counted from computed Wednesday not live resets_at-7d; no test for live-reset preference; "uncalibrated" label when idle. Released in v10.5.0 (merge c2ae4347 is an ancestor of v10.5.0). |
 | G-02 | Pulse BUDGET_BURN and OPUS_SHARE violations plus an hourly METRICS.md usage section (tokens per role and model, cost per merged slice, window and weekly projections, max engineers, releases per hour, merged slices per hour and per million tokens), all from G-01 | scripts/v10-pulse.sh (two checks), tests/test-v10-pulse.sh, docs/v10/METRICS.md (section header only) | MEDIUM | fixtures: opus 31% fires OPUS_SHARE; a projection of 86% fires BUDGET_BURN; uncalibrated reads UNKNOWN | released@2026-09-28T21:01Z | Source: founder 17:44Z. Depends on G-01. Serialize after E-89..E-91 (same file). Dispatched 19:09Z, sonnet engineer (G-01 merged; goes before E-90/E-91, which rebase after). Built f172b9b6 (rebased onto E-91), test-v10-pulse.sh 138/0, 7 T48 subtests red on unmodified pulse first; 46 min vs 30 budget (large pulse file). Tech Lead review 19:55Z. Tech Lead APPROVE (pulse 0.61s wall, governor keys match usage-governor.py:562-591, null max is UNKNOWN); merged. Released in v10.5.0 (merge 8f93cb9f is an ancestor of v10.5.0). |
 | G-03 | docs/v10/SCALE.md: what the Max 20x plan sustains around the clock (from G-01 measurements and calibration), what 50 parallel engineers need (API pay-as-you-go with a rate-limit tier, or Team/Enterprise), cost per day estimates labelled as estimates, and the ramp gates (governor allows, merged slices per hour rising, merged work per token not falling) | docs/v10/SCALE.md | HIGH | every number cites a measurement or is labelled an estimate with its basis | released@2026-09-28T21:01Z | Source: founder 17:44Z. CTO (opus) authors. Billing is the founder decision. Merged as 4708cee1 (row status was stale). Released in v10.5.0 (merge 62b495a5 is an ancestor of v10.5.0). |
-| G-04 | Cloud fan-out (HIGH, CTO-owned): dispatch ready slices with no file overlap with in-flight work as Claude Code cloud sessions that open PRs from their own branches; the Release Manager merges PRs whose checks concluded success with gh pr merge; every dispatch recorded in BOARD.md with its cloud session id; ramp 25 to 50 only when the governor allows and merged slices per hour rose | scripts/cloud-dispatch.sh, docs/v10/SWARM.md (one section), tests/test-cloud-dispatch.sh | HIGH | dry-run dispatch prints the exact command and the BOARD row it would write; refuses when the governor max is reached or file sets overlap | merged@2026-10-03T13:44Z | Built 0a90538a8: dry-run default, --live needs verified `claude --cloud` (no cloud subcommand in 2.1.288), refusals 10/11/12; test 25/0, overlap mutation 3 red. Governor uncalibrated so every dispatch refuses (fail safe). Opus HIGH review running. First real --live is a founder probe. r2 building (F1-F6 + A1/A6/A7/A8). r2 11b6e1b73 (62/62 /bin/bash, red 51/62 on r1); opus re-review running. r2 opus BLOCK (R2-1: paths inside parentheses dropped from overlap). r3 building: R2-1 + leader-ancestor check, --live stub tests, mode preserve. r3 e99768c74 opus APPROVE (9 mutants red, 85/0). Merged 7982bb471..4321d1665; on main 85/0 /bin/bash, shard coverage 19/0. Advisories carded: --live is a session check not an agent check (policy: RM/CoS only); paren prose like e.g becomes a token; A2/A3/A7; after/range dependency wording. |
-| G-05 | The same fan-out as loki modernize remote-worker mode (POST /jobs kind unit, Helm worker.engine v10): align G-04 with M-23 | (design note in docs/v10/MODERNIZE.md, one section) | MEDIUM | the note maps G-04 dispatch fields to the M-23 job schema | ready@2026-09-28T17:50Z | Source: founder 17:44Z. Depends on G-04 and M-17. |
-| EV-15 | Re-run the medium tier (7 tasks, raw and v10, 2 runs each, same model) with every result file written under ~/loki-ci-logs/eval/ev15-<arm>-r<n>/ (outside any worktree) and a per-task table of which runs failed and why (hidden-test failure, timeout, no PR, cost) | eval/loki10 results (outside the repo), docs/v10/METRICS.md (one section) | HIGH | 28 rows, 0 arm_unavailable; per-task failure reasons cited from the result files | merged@2026-09-28T19:40Z | Source: EV-14 evidence lost (17:36Z incident) and v10 lost on all three medium axes. Governor-gated (paid run). D40 priority 1: running (wf_4af22d00-9fb), results under ~/loki-ci-logs/eval. Done 19:19Z: raw 10/14 $0.5085 p50 56s; v10 9/14, cost at least $0.788 (E-98 correction) p50 128s. Files durable under ~/loki-ci-logs/eval/ev15-*. |
+| G-04 | Cloud fan-out (HIGH, CTO-owned): dispatch ready slices with no file overlap with in-flight work as Claude Code cloud sessions that open PRs from their own branches; the Release Manager merges PRs whose checks concluded success with gh pr merge; every dispatch recorded in BOARD.md with its cloud session id; ramp 25 to 50 only when the governor allows and merged slices per hour rose | scripts/cloud-dispatch.sh, docs/v10/SWARM.md (one section), tests/test-cloud-dispatch.sh | HIGH | dry-run dispatch prints the exact command and the BOARD row it would write; refuses when the governor max is reached or file sets overlap | released@2026-10-16T00:49Z | Built 0a90538a8: dry-run default, --live needs verified `claude --cloud` (no cloud subcommand in 2.1.288), refusals 10/11/12; test 25/0, overlap mutation 3 red. Governor uncalibrated so every dispatch refuses (fail safe). Opus HIGH review running. First real --live is a founder probe. r2 building (F1-F6 + A1/A6/A7/A8). r2 11b6e1b73 (62/62 /bin/bash, red 51/62 on r1); opus re-review running. r2 opus BLOCK (R2-1: paths inside parentheses dropped from overlap). r3 building: R2-1 + leader-ancestor check, --live stub tests, mode preserve. r3 e99768c74 opus APPROVE (9 mutants red, 85/0). Merged 7982bb471..4321d1665; on main 85/0 /bin/bash, shard coverage 19/0. Advisories carded: --live is a session check not an agent check (policy: RM/CoS only); paren prose like e.g becomes a token; A2/A3/A7; after/range dependency wording. |
+| G-05 | The same fan-out as loki modernize remote-worker mode (POST /jobs kind unit, Helm worker.engine v10): align G-04 with M-23 | (design note in docs/v10/MODERNIZE.md, one section) | MEDIUM | the note maps G-04 dispatch fields to the M-23 job schema | released@2026-10-16T02:04Z | Source: founder 17:44Z. Depends on G-04 and M-17. |
+| EV-15 | Re-run the medium tier (7 tasks, raw and v10, 2 runs each, same model) with every result file written under ~/loki-ci-logs/eval/ev15-<arm>-r<n>/ (outside any worktree) and a per-task table of which runs failed and why (hidden-test failure, timeout, no PR, cost) | eval/loki10 results (outside the repo), docs/v10/METRICS.md (one section) | HIGH | 28 rows, 0 arm_unavailable; per-task failure reasons cited from the result files | released@2026-10-16T00:49Z | Source: EV-14 evidence lost (17:36Z incident) and v10 lost on all three medium axes. Governor-gated (paid run). D40 priority 1: running (wf_4af22d00-9fb), results under ~/loki-ci-logs/eval. Done 19:19Z: raw 10/14 $0.5085 p50 56s; v10 9/14, cost at least $0.788 (E-98 correction) p50 128s. Files durable under ~/loki-ci-logs/eval/ev15-*. |
 | E-98 | Diagnose why v10 loses to raw on medium (EV-15 per-task failures): for each task v10 failed and raw completed, read the v10 run log and name the stage and cause (plan, Wall, implement, verify, fix rounds, cap), then cut fix slices | docs/v10/ENGINE.md (findings section) | HIGH | each finding cites a result file path and a log line | released@2026-09-28T21:01Z | Source: EV-14. Depends on EV-15. CTO (opus) analysis. D40 priority 1: CTO analysis runs after EV-15 in the same workflow. docs/v10/MEDIUM-ANALYSIS.md merged d496db89. Top cause: verify hard-codes python, so 27/27 pytest checks were not_run and no fix round ever fired. Cards E-98a..f below. Released in v10.5.0 (merge 8b41ad40 is an ancestor of v10.5.0). |
 | E-98a | verify uses the project interpreter (.venv, venv, $VIRTUAL_ENV, python3, python); a check on a system interpreter adds a not_proven line | loki-ts/src/engine10/stages/verify.ts, loki-ts/tests/engine10/verify*.test.ts | HIGH | fixture red then green (.venv shim, no python on PATH); core +12 max | released@2026-09-28T21:01Z | Source: MEDIUM-ANALYSIS.md. Dispatched 19:40Z sonnet; opus review. r1 31af475c opus REJECT: seal.ts never reads verify not_proven (git grep "verify?.not_proven" rc=1), so a system-interpreter pass still seals VERIFIED; $VIRTUAL_ENV trusted outside the repo. r2 dispatched 19:53Z with seal.ts added to the file set, plus ruff resolution and a behavioral red. r2 cabf16ef opus APPROVE (seal PARTIAL on verify not_proven, receipts byte-stable without the flag, realpath-scoped VIRTUAL_ENV); merged 5cdd611d; verify+seal 36/0. Combined with E-98b/c/d the core is 5003 (budget.test.ts FAIL, Received 5003): fix-forward E-111. Released in v10.5.0 (merge 5cdd611d is an ancestor of v10.5.0). |
 | E-111 | P0 (local main red): engine10 core is 5003 lines after E-98a/b/c/d merged (budget.test.ts Received 5003, cap 5000). Cut at least 25 lines of dead or duplicated code from loki-ts/src/engine10 (outside modernize/) with no behavior change, leaving room for E-98e (+10) | loki-ts/src/engine10 (non-modernize), no test changes except budget | MEDIUM | budget.test.ts passes at 4978 or less; cd loki-ts && bun test tests/engine10 has no new failures vs main | released@2026-09-28T21:01Z | Source: merge of E-98a at 20:10Z. Dispatched sonnet. opus REJECT r1 (deleted prStage/intakeStage, test-engine10-dist 16/2); APPROVE r2 f286f6ec; merged f059c87a, dist rebuilt e1363c67; core 4976, engine10 668/0, dist 18/0. Released in v10.5.0 (merge f059c87a is an ancestor of v10.5.0). |
 | E-112 | v10-guard: refuse a path-wide `git checkout <ref> -- .` (or `git restore --source <ref> .`) when cwd is the main checkout, so a read-only reviewer cannot overwrite the shared tree; allowed inside .claude/worktrees/* | scripts/v10-guard.sh, tests/test-v10-guard.sh | LOW | fixture: the command in the main checkout is blocked, the same in a worktree is allowed, a single-file checkout is allowed (red first) | released@2026-09-28T21:01Z | Source: E-98e Tech Lead review 20:19Z ran `git checkout slice-E-98e -- .` then `git checkout main -- .` in the main checkout (tree restored clean, but it could have clobbered concurrent merges). Built f4515ec9 (6 new block cases red on the old guard); Tech Lead APPROVE (7 allow probes incl. single-file checkout, branch switch, heredoc text all exit 0); merged; test-v10-guard.sh 170/0. Released in v10.5.0 (merge 06c01b6c is an ancestor of v10.5.0). |
 | E-113 | P0 (main red at a4623675): tests/test-release-notes.sh T9l/T9n/--include fixtures build padding with yes piped to head under pipefail; on the Linux runner only the 34-byte header was written. Generate padding without a pipe | tests/test-release-notes.sh | LOW | passes locally and under the CI condition (SIGPIPE ignored); old version shown red there | released@2026-09-28T21:01Z | Source: Tests run on a4623675 shard 4/8: "[FAIL] T9n fixture is not in the intended size band ... 34 bytes". Passes 41/0 on macOS. Dispatched 20:39Z. Built 74ffd928 (pipe-free printf loops; macOS could not reproduce the Linux drop even under trap PIPE, so CI is the proof). Tech Lead APPROVE (bytes identical: T9l 132034, T9n 98034, T9o 224089). Merged; 41/0 locally. Released in v10.5.0 (merge f6c3add4 is an ancestor of v10.5.0). |
 | E-114 | CI Security Audit gitleaks must not trust a pushed .gitleaks.toml or new .gitleaksignore entries: scan with the default rules plus the config from the previous release tag (or refuse the job when the pushed range changes .gitleaks.toml), and report any .gitleaksignore line added in the range for review | .github/workflows/security-audit.yml, tests/test-security-audit-config.sh | HIGH | a workflow-level test (act or a script that runs the same step) shows a range that adds a zero-rule .gitleaks.toml plus a secret fails the job (red first) | released@2026-09-28T22:26Z | Source: E-110 opus review 21:09Z: the gitleaks step (security-audit.yml:276) loads the checkout own .gitleaks.toml, so the same zero-rule config trick that bypassed the pre-push scan works against CI (no --config at security-audit.yml:276). CTO-level change to a release gate. Dispatched 21:11Z sonnet; opus review before merge. opus REJECT r1 (event.before chain from an ungated push, repro "no leaks found"), REJECT r2 (no-tag fallback to origin/main~1 fails open), APPROVE r3 b30c2870 (base = last release tag; no tag: default rules and any tip .gitleaks.toml refused); also fixed the scan-coverage baseline shape broken by 6358e0a6. Merged; audit-config 15/0, scan-coverage 31/0. Released in v10.5.3 (merge 8b62cd2b is an ancestor of v10.5.3). |
-| E-115 | Verify: a passing lint on a system ruff adds its own not_proven line ("lint ran on the system ruff") instead of reusing "tests ran on the system interpreter" | loki-ts/src/engine10/stages/verify.ts, loki-ts/tests/engine10/verify.test.ts | LOW | unit test: system ruff pass gives the lint line, not the tests line (red first); core stays under 5000 | merged@2026-09-30T18:49Z | Source: E-98a r2 opus review (advisory). Held 21:31Z: worktree cap (15). Held 22:01Z: touches core verify.ts while S41-16 has core at 4997/5000. |
+| E-115 | Verify: a passing lint on a system ruff adds its own not_proven line ("lint ran on the system ruff") instead of reusing "tests ran on the system interpreter" | loki-ts/src/engine10/stages/verify.ts, loki-ts/tests/engine10/verify.test.ts | LOW | unit test: system ruff pass gives the lint line, not the tests line (red first); core stays under 5000 | released@2026-10-16T00:49Z | Source: E-98a r2 opus review (advisory). Held 21:31Z: worktree cap (15). Held 22:01Z: touches core verify.ts while S41-16 has core at 4997/5000. |
 | E-116 | seal.test.ts has no SPEC_CONFLICT case: add real-seal tests (not a copy of seal.ts:110) proving SPEC_CONFLICT survives verify pass, verify fail plus fix, and never upgrades to VERIFIED | loki-ts/tests/engine10/seal.test.ts | LOW | new cases red on a mutated seal.ts that drops the spec_conflict branch | released@2026-09-28T22:02Z | Source: E-98b opus review note 4. Built fbc79ac9 (4 real-seal tests; red when seal.ts:109 removed); Tech Lead review 21:30Z. Tech Lead APPROVE fbc79ac9 (imports the real sealStage; gap test honest); merged; seal.test.ts 18/0. Released in v10.5.2 (merge f4087942 is an ancestor of v10.5.2). |
 | E-117 | Pulse DEPENDS_ON parsing: expand range shorthand ("Depends on E-98a..e", "M-20..M-23") into each id so a dependency on b..e is not silently dropped | scripts/v10-pulse.sh (dependency parse only), tests/test-v10-pulse.sh | LOW | fixture: "Depends on E-98a..c" with E-98b unmerged is blocked (red first) | released@2026-09-28T22:02Z | Source: E-91 Tech Lead review. Dispatched 21:31Z sonnet. Tech Lead REJECT 5f59bfed: numeric range uncapped (M-1..M-9999 expands to 9999 ids into the injected pulse); r2 caps at 50. r2 d99963e3 caps numeric spans at 50 (the Tech Lead blocker); merged; test-v10-pulse.sh 146/0. Released in v10.5.2 (merge ab909f95 is an ancestor of v10.5.2). |
 | E-118 | Usage governor leftovers from G-01 review: a non-numeric used_percentage or a non-dict rate_limits in a live reading must be ignored, not crash; the "uncalibrated" label must not show when calibration exists but no engineers were active | scripts/usage-governor.py, tests/test-usage-governor.sh | LOW | fixtures for each case (red first); 30/30 existing still pass | released@2026-09-28T23:18Z | Source: G-01 r2/r3 opus review non-blocking notes. Held 21:31Z: worktree cap (15). Dispatched 22:01Z. Built 7ef9183a (TypeError and AttributeError reproduced first); Tech Lead APPROVE (bad reading degrades to uncalibrated, never a healthy 0%; E-109 cache untouched); merged; 36/0. Released in v10.5.5 (merge 66ef537d is an ancestor of v10.5.5). |
@@ -458,8 +483,8 @@ set is declared to avoid overlap with those and with each other.
 | E-128 | BACKLOG 147: P7 scanner misses a useMemo factory that calls an already-registered fabricator instead of returning a literal | tests/moat/p7-no-fabricated-data.sh | HIGH | bash tests/moat/p7-no-fabricated-data.sh | released@2026-09-30T18:50Z | Source: BACKLOG 147; the file's own comment at p7-no-fabricated-data.sh:987 names the gap. Same file as E-131: one engineer takes both. Released in v10.5.7 (merge 8a4e1510 is an ancestor of v10.5.7). |
 | E-129 | BACKLOG 117 remainder: WhatsNew.tsx hardcodes a stale CURRENT_VERSION (9.55.0) that drifts from the shipped release | web-app/src/components/WhatsNew.tsx, tests/test-whatsnew-version-sync.sh | LOW | bash tests/test-whatsnew-version-sync.sh | released@2026-09-30T18:50Z | Source: BACKLOG 117. Evidence: WhatsNew.tsx:5 against VERSION 10.5.3. Released in v10.5.7 (merge 0c9daffc is an ancestor of v10.5.7). |
 | E-130 | D41 item 4 (speed): cache dependency install by lockfile hash in the bash parallel-worktree bootstrap | autonomy/run.sh (create_worktree only), tests/test-worktree-install-cache.sh | MEDIUM | bash tests/test-worktree-install-cache.sh | released@2026-09-30T18:50Z | Source: D41 item 4. Evidence: run.sh:6298-6304 installs unconditionally on every worktree. Released in v10.5.7 (merge 17af0439 is an ancestor of v10.5.7). |
-| E-131 | BACKLOG 146: P7 sink regex misses a computed or bracket-indexed sink name, for example window[sinkName](rows) | tests/moat/p7-no-fabricated-data.sh | HIGH | bash tests/moat/p7-no-fabricated-data.sh | merged@2026-09-30T18:11Z | Source: BACKLOG 146. Evidence: SETTER regex at p7-no-fabricated-data.sh:771 matches only literal names. Same engineer as E-128. |
-| E-132 | Wall classifier: a missing test runner (python -m pytest exits 1 with No module named pytest) reads as red, not not_run; D42 red requires the runner to start and at least one test to fail, so require a pytest summary line with failed before red | loki-ts/src/engine10/stages/wall.ts, loki-ts/tests/engine10/wall.test.ts | HIGH | cd loki-ts and bun test tests/engine10/wall.test.ts with a pytest-less python first on PATH | merged@2026-10-01T06:47Z | Source: main red on 04d3ac9c and 708c2907 (CI Bun job had no pytest); reproduced locally with a pytest-less venv, tests (3b) and (4) read fail 1. Seal still refuses later (not_run), so no false VERIFIED, but the Wall mis-seals. Coordinate with E-125 (same classifier). Core budget binds. |
+| E-131 | BACKLOG 146: P7 sink regex misses a computed or bracket-indexed sink name, for example window[sinkName](rows) | tests/moat/p7-no-fabricated-data.sh | HIGH | bash tests/moat/p7-no-fabricated-data.sh | released@2026-10-16T00:49Z | Source: BACKLOG 146. Evidence: SETTER regex at p7-no-fabricated-data.sh:771 matches only literal names. Same engineer as E-128. |
+| E-132 | Wall classifier: a missing test runner (python -m pytest exits 1 with No module named pytest) reads as red, not not_run; D42 red requires the runner to start and at least one test to fail, so require a pytest summary line with failed before red | loki-ts/src/engine10/stages/wall.ts, loki-ts/tests/engine10/wall.test.ts | HIGH | cd loki-ts and bun test tests/engine10/wall.test.ts with a pytest-less python first on PATH | released@2026-10-16T00:49Z | Source: main red on 04d3ac9c and 708c2907 (CI Bun job had no pytest); reproduced locally with a pytest-less venv, tests (3b) and (4) read fail 1. Seal still refuses later (not_run), so no false VERIFIED, but the Wall mis-seals. Coordinate with E-125 (same classifier). Core budget binds. |
 | E-133 | release.sh guard: refuse to commit dist maps that contain an absolute path (a node_modules symlink in a release worktree wrote 133 /Users paths into loki.js.map and one into cockpit.js.map at v10.5.4) | scripts/release.sh, tests/test-release-dist-guard.sh | MEDIUM | bash tests/test-release-dist-guard.sh | released@2026-09-30T18:50Z | Source: v10.5.4 cut 2026-09-28, caught by hand before commit (paths rewritten to ../node_modules/). Guard: grep the dist maps for an absolute or home-directory path after the bump and exit nonzero. Released in v10.5.7 (merge 53918a30 is an ancestor of v10.5.7). |
 | E-134 | spawn_env_fsmonitor.test.ts positive control fails on Bun 1.4.2 (Nightly red 2026-09-29 and 09-30, both OSes): Bun no longer inherits the START env for a spawn with no env option, so the bare control call stops leaking the canary and the test proves nothing there. Keep the product assertions unconditional; add a control that passes the canary explicitly so the hook is proven to record env on any Bun; report which inheritance mode the running Bun has | loki-ts/tests/runner/spawn_env_fsmonitor.test.ts | HIGH | cd loki-ts and bun test tests/runner/spawn_env_fsmonitor.test.ts on Bun 1.3.13 and on latest | released@2026-09-30T18:50Z | Source: Nightly run 36719756873 job 109901555421 (bun-v1.4.2): control record held the withheld sentinel, not the canary. Product calls still did not leak. Security guard, opus review. Released in v10.5.7 (merge f0ba0d4d is an ancestor of v10.5.7). |
 | E-135 | Post-Release Smoke PyPI install gives up after about 10.5 min (6 attempts, 30s steps) while the published version is still propagating; v10.5.5 failed this way though PyPI now has it. Add --no-cache-dir and widen the window | .github/workflows/post-release-smoke.yml | LOW | bash -n on the step script; a rerun of the smoke on the next release | released@2026-09-30T18:50Z | Source: Post-Release Smoke run 36497082408 job 109179083720 (FATAL loki-mode-sdk==10.5.5 not installable after retries); PyPI shows 10.5.5 on 2026-09-30. Rerun of the failed jobs requested. Released in v10.5.7 (merge 1d4975a1 is an ancestor of v10.5.7). |
@@ -469,19 +494,19 @@ set is declared to avoid overlap with those and with each other.
 | E-139 | spawn_env_fsmonitor.test.ts follow-ups from E-134 review: comments at lines 16-17 and 114 overstate Bun 1.4.2 (Bun.spawn and Bun.spawnSync with no env still inherit the START env; only node:child_process inherits current), name spawn_env_guard.test.ts as the guard for them; line 94 driver should run process.execPath, not the bun on PATH | loki-ts/tests/runner/spawn_env_fsmonitor.test.ts | LOW | cd loki-ts and bun test tests/runner/spawn_env_fsmonitor.test.ts | released@2026-09-30T23:00Z | Source: E-134 opus review 2026-09-30 (probe: Bun.spawn on 1.4.2 printed START env). |
 | E-140 | Something deletes run-owned loki-run.* directories under TMPDIR while another agent is using them (an opus reviewer's dir and its Bun 1.4.2 binary vanished mid-review on 2026-09-30; unfamiliar dirs with e10ext subdirs appeared inside). Find the sweeper (a test cleanup, a trap, or a script removing loki-run.* by pattern) and make it remove only its own validated dir | the offending script or test (to locate), plus a guard test | HIGH | a guard that plants two run-owned dirs and runs the suspected cleanup, asserting the foreign one survives | released@2026-09-30T19:22Z | Source: E-134 opus review cleanup note 2026-09-30. CLAUDE.md forbids sweeping TMPDIR by pattern. Released in v10.5.8 (merge 98eadf90 is an ancestor of v10.5.8). |
 | E-141 | treeswap passes an explicit env to its git spawns (spawn_env_guard, BACKLOG 149) | loki-ts/src/e10ext/treeswap.ts and its test | MEDIUM | bun test tests/e10ext | released@2026-09-30T18:50Z | Merged c2305c99 via 0bf98fd0. S41-13 binding note records the scrubbed-env requirement. Released in v10.5.7 (merge 0bf98fd0 is an ancestor of v10.5.7). |
-| E-142 | D44-C follow-ups: structural-checks changed_chars diffs against the merge-base (committed dashes/emoji caught), typecheck prints SKIP without node_modules, register test-v10-ops.sh and fix the IGNORE comment (slow, not hanging) | scripts/structural-checks.sh, tests/test-structural-checks.sh, tests/test-registration-coverage.sh, tests/run-all-tests.sh, tests/shard-durations.tsv | LOW | bash tests/test-structural-checks.sh; each check under 10s | merged@2026-09-30T18:49Z | Source: D44-C TL review (APPROVE with notes). |
-| E-143 | Follow-ups from E-87/E-140 reviews: pin audit_verdict created_at tie-to-failure with a test; test-no-tmp-sweep static scan also flags find -delete and find -exec rm shapes; move hardcoded /tmp fixtures (test-stop-process-group, test-audit-chain-cross-file, test-memory-cli, test-lsp-diagnostics-regression, test-watch-command, test-provider-source-cli, test-issue-providers) under loki_run_tmp_create | tests/test_release_required_ci.py, tests/test-no-tmp-sweep.sh, the listed tests | LOW | each named suite passes; a tie fixture expects rc 1 | merged@2026-09-30T19:19Z | Source: E-87 and E-140 TL reviews (both APPROVE). |
+| E-142 | D44-C follow-ups: structural-checks changed_chars diffs against the merge-base (committed dashes/emoji caught), typecheck prints SKIP without node_modules, register test-v10-ops.sh and fix the IGNORE comment (slow, not hanging) | scripts/structural-checks.sh, tests/test-structural-checks.sh, tests/test-registration-coverage.sh, tests/run-all-tests.sh, tests/shard-durations.tsv | LOW | bash tests/test-structural-checks.sh; each check under 10s | released@2026-10-16T00:49Z | Source: D44-C TL review (APPROVE with notes). |
+| E-143 | Follow-ups from E-87/E-140 reviews: pin audit_verdict created_at tie-to-failure with a test; test-no-tmp-sweep static scan also flags find -delete and find -exec rm shapes; move hardcoded /tmp fixtures (test-stop-process-group, test-audit-chain-cross-file, test-memory-cli, test-lsp-diagnostics-regression, test-watch-command, test-provider-source-cli, test-issue-providers) under loki_run_tmp_create | tests/test_release_required_ci.py, tests/test-no-tmp-sweep.sh, the listed tests | LOW | each named suite passes; a tie fixture expects rc 1 | released@2026-10-16T00:49Z | Source: E-87 and E-140 TL reviews (both APPROVE). |
 | E-144 | tests/test-v10-ops.sh hardcodes the live docs/v10/BOARD.md path (line ~589) and md5-checks it, so a concurrent board edit fails it and it breaks the no-home-path rule; point it at a fixture copy under a run-owned temp dir | tests/test-v10-ops.sh | LOW | bash tests/test-v10-ops.sh rc=0 while BOARD.md is edited concurrently; tests/test-no-hardcoded-paths.sh | released@2026-09-30T19:46Z | Source: E-142 TL review (v10-ops failed 2 checks once on a live board edit, passed on rerun). Released in v10.5.9 (merge 86e11caf is an ancestor of v10.5.9). |
-| E-145 | tests/test-watch-command.sh leaves an orphaned run.sh (bash /tmp/loki-run-*.sh .../test-once/prd.md, reparented to launchd, sleep 300 loop) when the suite is killed by a timeout; two found and stopped by literal PID at 18:44Z (40 and 30 min old). Trap EXIT/TERM in the suite to stop its own recorded child PIDs, and move its /tmp paths under loki_run_tmp_create | tests/test-watch-command.sh | LOW | kill the suite with timeout 20; no orphan survives (check by recorded PID) | merged@2026-09-30T19:53Z | Source: pulse ORPHAN_WORKTREE twice. Coordinate with E-143 (same file, /tmp fixture move). |
-| E-146 | structural-checks follow-ups from E-142 review: print a stderr warning when no base ref resolves (today it silently scans only the working tree, so committed violations pass); the added-line pattern ^\+[^+] skips an added line whose content starts with +; drop the unused SC variable in tests/test-structural-checks.sh:9 (SC2034) | scripts/structural-checks.sh, tests/test-structural-checks.sh | LOW | test cases for no-base-ref warning and a ++ added line, red first | merged@2026-09-30T19:19Z | Source: E-142 TL review (APPROVE with notes). |
+| E-145 | tests/test-watch-command.sh leaves an orphaned run.sh (bash /tmp/loki-run-*.sh .../test-once/prd.md, reparented to launchd, sleep 300 loop) when the suite is killed by a timeout; two found and stopped by literal PID at 18:44Z (40 and 30 min old). Trap EXIT/TERM in the suite to stop its own recorded child PIDs, and move its /tmp paths under loki_run_tmp_create | tests/test-watch-command.sh | LOW | kill the suite with timeout 20; no orphan survives (check by recorded PID) | released@2026-10-16T00:49Z | Source: pulse ORPHAN_WORKTREE twice. Coordinate with E-143 (same file, /tmp fixture move). |
+| E-146 | structural-checks follow-ups from E-142 review: print a stderr warning when no base ref resolves (today it silently scans only the working tree, so committed violations pass); the added-line pattern ^\+[^+] skips an added line whose content starts with +; drop the unused SC variable in tests/test-structural-checks.sh:9 (SC2034) | scripts/structural-checks.sh, tests/test-structural-checks.sh | LOW | test cases for no-base-ref warning and a ++ added line, red first | released@2026-10-16T00:49Z | Source: E-142 TL review (APPROVE with notes). |
 | E-147 | tests/test-trust-core-probe-isolation.sh:37 wraps tests/test-trust-core-tests-detect.sh in `timeout 50`; on a loaded CI runner it hit rc=124 after all 9 visible cases passed (main Tests run 36760845105, shard 3/8, SHA 2b0d2e4d; the same SHA passed on train/4 run 36760063079). Measure the inner suite on CI, set the budget from the measurement with margin, and report the case that was running at the kill so a real hang still fails loudly | tests/test-trust-core-probe-isolation.sh, tests/shard-durations.tsv if its row changes | LOW | inner suite under a 3x load stressor passes; a planted hang still fails with the case name | released@2026-09-30T19:22Z | Source: D44 MAIN_RED on 2b0d2e4d (timeout flake). Rerun of the failed job in flight. Released in v10.5.8 (merge 2b0d2e4d is an ancestor of v10.5.8). |
-| E-148 | Review follow-ups: test-stop-process-group.sh still kills by `pkill -f "loki-$PGTEST_TAG"` (pattern kill, forbidden by CLAUDE.md): replace with recorded PIDs or a process-group kill; test-audit-chain-cross-file.sh test 1 reads the real ~/.loki/dashboard/audit (fails on hosts with old tampered data): make it hermetic; E-147 timeout message says "after all cases passed" when there was zero output: say "no PASS output (possible hang before the first case)" | tests/test-stop-process-group.sh, tests/test-audit-chain-cross-file.sh, tests/test-trust-core-probe-isolation.sh | LOW | each suite passes on a host with a tampered ~/.loki audit file; no pkill -f remains | merged@2026-09-30T19:53Z | Source: E-143 and E-147 TL reviews (APPROVE with notes). |
+| E-148 | Review follow-ups: test-stop-process-group.sh still kills by `pkill -f "loki-$PGTEST_TAG"` (pattern kill, forbidden by CLAUDE.md): replace with recorded PIDs or a process-group kill; test-audit-chain-cross-file.sh test 1 reads the real ~/.loki/dashboard/audit (fails on hosts with old tampered data): make it hermetic; E-147 timeout message says "after all cases passed" when there was zero output: say "no PASS output (possible hang before the first case)" | tests/test-stop-process-group.sh, tests/test-audit-chain-cross-file.sh, tests/test-trust-core-probe-isolation.sh | LOW | each suite passes on a host with a tampered ~/.loki audit file; no pkill -f remains | released@2026-10-16T00:49Z | Source: E-143 and E-147 TL reviews (APPROVE with notes). |
 | E-149 | loki-ts/tests/engine10/modernize/java_capture.test.ts "unitClassesFromGraph (M-04 integration)" times out at bun's 5s default under CI load (5169ms, Coverage run 36764748814 on train/5 1cd5feac; also failed on train/2 and in a local full run): measure, make it cheaper or set an explicit measured timeout; sweep modernize tests over 2.5s | loki-ts/tests/engine10/modernize/*.test.ts | LOW | before/after durations under 3x load; bun test tests/engine10/modernize 0 fail | released@2026-09-30T20:08Z | Source: D44 train/5 red (Coverage). Rerun of the failed job in flight. Released in v10.5.10 (merge 2394dc4a is an ancestor of v10.5.10). |
 | E-151 | Release blocker guard: v10.5.10 (69ebc03e) shipped loki-ts/dist/loki.js.map stale because the bump changed it (version literal 10.5.9 to 10.5.10 changed length, shifting mappings) and the release commit staged a fixed file list. scripts/release.sh --bump-only should print every file it changed (including dist maps), and a check (in release.sh or a pre-push rule for "release: v*" commits) should refuse a release commit that leaves a stamped tracked file modified in the worktree | scripts/release.sh, tests/test-release-dist-guard.sh | LOW | fixture: a bump that changes the map, commit without it, check refuses; with it, passes | released@2026-09-30T21:23Z | Source: v10.5.10 release; interim procedure: assert `git status --porcelain` is empty after the release commit before pushing. Map corrected on the next train. Released in v10.5.11 (merge bd5834a9 is an ancestor of v10.5.11). |
 | E-152 | release.sh --bump-only "stage these files:" list must print a copy-paste command that works: loki-ts/dist is gitignored, so `git add loki-ts/dist/loki.js` refuses (seen 19:58Z on train/7); print `git add -f` for paths under an ignored directory (git check-ignore) and plain `git add` otherwise | scripts/release.sh, tests/test-release-dist-guard.sh | LOW | fixture with an ignored-but-tracked dist file: the printed command stages it | released@2026-10-01T06:40Z | Source: first live use of E-151 --check-clean caught the unstaged dist (rc=1). |
-| E-153 | Incident 20:16Z: a reviewer's fixture setup ran `git commit` with the MAIN CHECKOUT as cwd, committing author `t <t@t>` "init" that replaced the real package.json with a fixture and added sum.js/sum.test.js (local only, never pushed; undone with `git reset --keep 1c96ab16`). Guard: a pre-commit hook in .githooks refusing any commit in this repository whose author email is not the repo-local identity (git config user.email) unless LOKI_ALLOW_FOREIGN_AUTHOR=1, so fixture commits made in the wrong cwd fail loudly; fixture commits in real temp repos are unaffected | .githooks/pre-commit, tests/test-pre-commit-author-guard.sh | LOW | red first: in a scratch clone with the hook installed, `git -c user.email=t@t commit` is refused; the repo identity commits | merged@2026-10-01T08:51Z | Source: loki-seal r2 review fixture (agent stopped at 20:17Z). Reviewer prompts now require `git -C "$FIXTURE"` and a pwd check under LOKI_RUN_TMP. |
-| S41-10b | Static-first fixed-rules block for the implement and fix briefs (S41-10 card remainder): a byte-identical rules block in the cache-stable prefix, per-task context after it; drive-letter and ~ plan paths filtered like absolute ones | loki-ts/src/engine10/stages/implement.ts, fix.ts (prefix only), loki-ts/src/e10ext/context.ts and tests | MEDIUM | red first: two different tasks produce byte-identical prefix bytes; core net-zero lines | merged@2026-09-30T19:19Z | Source: S41-10 reviews (APPROVE r2, remainder). |
-| S41-20h | Medium-task MINING pass (no task building): shortlist 12 candidate merged PRs whose shape survives the one-file probe (a semantic or signature change in file A that an independently tested caller in file B must match; not helper extraction, parameter threading, moved classes or typing-only files), each with a written one-file-fix attempt run against the upstream tests and its result | eval/loki10/tasks/CANDIDATES.md (new) | MEDIUM | every shortlisted PR has a failing one-file attempt recorded with command and rc | merged@2026-09-30T19:19Z | Source: S41-20b/c/d/e/f: 11 of 16 candidates fell to a reviewer one-file fix; S41-20f built 0. |
+| E-153 | Incident 20:16Z: a reviewer's fixture setup ran `git commit` with the MAIN CHECKOUT as cwd, committing author `t <t@t>` "init" that replaced the real package.json with a fixture and added sum.js/sum.test.js (local only, never pushed; undone with `git reset --keep 1c96ab16`). Guard: a pre-commit hook in .githooks refusing any commit in this repository whose author email is not the repo-local identity (git config user.email) unless LOKI_ALLOW_FOREIGN_AUTHOR=1, so fixture commits made in the wrong cwd fail loudly; fixture commits in real temp repos are unaffected | .githooks/pre-commit, tests/test-pre-commit-author-guard.sh | LOW | red first: in a scratch clone with the hook installed, `git -c user.email=t@t commit` is refused; the repo identity commits | released@2026-10-16T00:49Z | Source: loki-seal r2 review fixture (agent stopped at 20:17Z). Reviewer prompts now require `git -C "$FIXTURE"` and a pwd check under LOKI_RUN_TMP. |
+| S41-10b | Static-first fixed-rules block for the implement and fix briefs (S41-10 card remainder): a byte-identical rules block in the cache-stable prefix, per-task context after it; drive-letter and ~ plan paths filtered like absolute ones | loki-ts/src/engine10/stages/implement.ts, fix.ts (prefix only), loki-ts/src/e10ext/context.ts and tests | MEDIUM | red first: two different tasks produce byte-identical prefix bytes; core net-zero lines | released@2026-10-16T00:49Z | Source: S41-10 reviews (APPROVE r2, remainder). |
+| S41-20h | Medium-task MINING pass (no task building): shortlist 12 candidate merged PRs whose shape survives the one-file probe (a semantic or signature change in file A that an independently tested caller in file B must match; not helper extraction, parameter threading, moved classes or typing-only files), each with a written one-file-fix attempt run against the upstream tests and its result | eval/loki10/tasks/CANDIDATES.md (new) | MEDIUM | every shortlisted PR has a failing one-file attempt recorded with command and rc | released@2026-10-16T00:49Z | Source: S41-20b/c/d/e/f: 11 of 16 candidates fell to a reviewer one-file fix; S41-20f built 0. |
 | D44-A | Green main by construction: scripts/train-promote.sh fast-forwards main only to a train SHA with green Tests, Bun Parity and Coverage; pre-push refuses a push to main unless it is Tier B green, a VERSION-only bump on a green parent, or docs-only (LOKI_D44_EMERGENCY override logged) | scripts/train-promote.sh, .githooks/pre-push, tests/test-train-promote.sh, docs/v10/TRAINS.md | HIGH | bash tests/test-train-promote.sh | parked@2026-09-30T20:04Z | Source: D44 item 1. PARKED 20:05Z by the adoption directive (docs/v10/PROGRESS.md 20:05Z); resumes after Tier 0 is green. |
 | D44-B | Pulse RELEASE_CADENCE (green unreleased main commit older than 20 min) and MAIN_RED_BY_MERGE; hourly releases per hour into METRICS.md | scripts/v10-pulse.sh, scripts/metrics-releases-append.py, pulse tests | MEDIUM | the pulse test file plus the metrics script self-test | parked@2026-10-03T09:21Z | drift audit 09:22Z: building since 2026-09-30 with no live builder or commit; parked, re-slice if still wanted |
 | D44-C | Structural checks under 10 s each (shard rows, hardcoded paths, registration, doc drift, line budgets) as scripts/structural-checks.sh, run first in Tier A (also on train/** push) and in the local-ci fast tier | scripts/structural-checks.sh, .github/workflows/tier-a.yml, scripts/local-ci.sh, tests/test-structural-checks.sh | MEDIUM | bash tests/test-structural-checks.sh | merged@2026-09-30T18:27Z | Source: D44 item 3; four red mains on 2026-09-30. |
@@ -604,15 +629,15 @@ Source: ~/git/autonomi-dev/research/2026-09-30-adoption/SWARM-PROMPT-ADOPTION.md
 | A-02 | First-run gate: scripts/first-run-gate.sh (throwaway HOME, bugrepo from firstrun-repro/bugrepo-original, the README's default entry point, stub-provider mode for CI, real-provider mode for promotion) asserting: exit 0 only if npm test fully green; no new files outside the fix except .loki/; printed receipt digest equals what loki verify checks; loki verify OK exit 0; receipt signed; output 15 lines or fewer without --verbose; wall time recorded. Step 1: reproduce each defect from the directive on current main and classify code bug vs machine artifact | scripts/first-run-gate.sh, tests/test-first-run-gate.sh, docs/v10/FIRST-RUN-GATE.md (defect table) | HIGH | gate runs in stub mode in CI as a NON-required job; the defect table cites command and rc per defect | released@2026-09-30T21:23Z | Gates `latest` (via A-01 promote). Released in v10.5.11 (merge 8641dac4 is an ancestor of v10.5.11). |
 | A-03 | Tier 0 architecture split (opus Architect): slice items 1 Seal correctness, 2 clean first run, 3 signed by default, 5 honest outcomes into non-overlapping file sets with Wall checks, one writer per file, shrink-or-flat per D33; Seal correctness builds on slice-E-125 | docs/v10/ADOPTION-PLAN.md | HIGH | every slice card has a file set, a Wall check tied to a gate assertion, and a line budget | released@2026-09-30T21:23Z | Item 4 (one engine) waits until 1 to 3 pass the gate. Released in v10.5.11 (merge 26dd66b8 is an ancestor of v10.5.11). |
 | A-04 | loki-seal: a Claude Code skill plus hook that runs the repo's real test suite on the current diff, refuses done on red or on deleted, skipped, xfailed or weakened tests or CI config (diff scan plus a tree hash of existing tests), prints a 5-line receipt; zero model cost, no dangerous flags; self-contained, no LICENSE file; SUBMIT.md drafts only; a 20-second vhs or asciinema script | packages/loki-seal/** | HIGH | fixture repos: deleting a failing test is blocked; a real fix passes; each weakening class caught | released@2026-10-01T00:52Z | Tier 1 wedge; answers issue #42. Released in v10.5.13 (merge a61e1721 is an ancestor of v10.5.13). |
-| A-04b | loki-seal follow-ups from opus r5: reset the hook-error counter after a successful stop; fall back to stop_hook_active repetition when the tmpdir is read-only or full; tests must write loki-seal-err-* counter files under LOKI_RUN_TMP, not the real os.tmpdir() | packages/loki-seal/** | MEDIUM | package tests plus demo dry-run; no files left in the real tmpdir after the suite | merged@2026-10-01T08:56Z | Source: A-04 opus r5 APPROVE notes. |
+| A-04b | loki-seal follow-ups from opus r5: reset the hook-error counter after a successful stop; fall back to stop_hook_active repetition when the tmpdir is read-only or full; tests must write loki-seal-err-* counter files under LOKI_RUN_TMP, not the real os.tmpdir() | packages/loki-seal/** | MEDIUM | package tests plus demo dry-run; no files left in the real tmpdir after the suite | released@2026-10-16T00:49Z | Source: A-04 opus r5 APPROVE notes. |
 | A-09 | README under 150 lines (directive item 9): line 1 "Your agent says done. Loki proves it." (veto pending, founder queue 10); line 2 "An autonomous software factory that knows what it is supposed to deliver, and proves it did." (D45); then the loki-seal 20-second GIF (placeholder until recorded), then two install lines (loki-seal first, `npx loki-mode tour` second); flags, internal paths, version stamps and app-builder comparisons move to docs; remove the commercial-editions sentence from the top and the npm total-downloads and Docker pulls badges; define "Seal" in one sentence or stop using the word; package.json description and SKILL.md description use line 2 verbatim (SKILL.md header and footer version rules still apply) | README.md, docs/ (moved sections), package.json (description only), SKILL.md (description only) | MEDIUM | README <= 150 lines; no retracted claims (directive Never list); structural checks (SKILL.md sync, readme version) pass | released@2026-10-01T00:52Z | Source: directive item 9 plus D45. Released in v10.5.13 (merge 38ffd386 is an ancestor of v10.5.13). |
-| A-04c | loki-seal reads the delivery contract (D45): from the task or issue the user gave the session (prompt text, a linked issue, a spec file), derive the acceptance checks and refuse "done" until the checks tied to that request pass, not only "the suite is green"; when no contract can be derived, say so on the receipt (NOT VERIFIED: no contract) instead of passing on green alone. Design first (how the hook sees the user request: transcript_path from the hook input, first user message), then build; zero model cost stays a constraint | packages/loki-seal/** | HIGH | fixtures: a session asking for behavior X with a green suite that never tests X is NOT VERIFIED; with a test for X passing it PASSes | merged@2026-10-03T09:40Z | 25ea817d6..4c597cc35 (5 rounds cherry-picked; CHANGELOG deduped b3f162d61). Opus r5 APPROVE: N1-N7 closed, seal suite 72/72 on main. Advisory A1 forged runner lines and A3 Known-limits gap filed as A-04d. |
-| A-103b | Seal lists each discarded Wall test in not_proven as "wall test discarded: <path> (<class>)" (A-103 kept seal.ts out of its file set; today only a count appears via base_run not_run) | loki-ts/src/engine10/stages/seal.ts, its test | HIGH | fixture: a discarded Wall file appears by path in not_proven | merged@2026-10-03T08:37Z | main d34a2d519, opus HIGH APPROVE (2 mutations red, engine10 1166/0); dist rebuilt, guard 13/0, seal 54/0. Non-blocking: filter runDir/wall on WALL_PREFIX; not_run suffix assumes the wall.ts removal rule |
+| A-04c | loki-seal reads the delivery contract (D45): from the task or issue the user gave the session (prompt text, a linked issue, a spec file), derive the acceptance checks and refuse "done" until the checks tied to that request pass, not only "the suite is green"; when no contract can be derived, say so on the receipt (NOT VERIFIED: no contract) instead of passing on green alone. Design first (how the hook sees the user request: transcript_path from the hook input, first user message), then build; zero model cost stays a constraint | packages/loki-seal/** | HIGH | fixtures: a session asking for behavior X with a green suite that never tests X is NOT VERIFIED; with a test for X passing it PASSes | released@2026-10-16T00:49Z | 25ea817d6..4c597cc35 (5 rounds cherry-picked; CHANGELOG deduped b3f162d61). Opus r5 APPROVE: N1-N7 closed, seal suite 72/72 on main. Advisory A1 forged runner lines and A3 Known-limits gap filed as A-04d. |
+| A-103b | Seal lists each discarded Wall test in not_proven as "wall test discarded: <path> (<class>)" (A-103 kept seal.ts out of its file set; today only a count appears via base_run not_run) | loki-ts/src/engine10/stages/seal.ts, its test | HIGH | fixture: a discarded Wall file appears by path in not_proven | released@2026-10-16T00:49Z | main d34a2d519, opus HIGH APPROVE (2 mutations red, engine10 1166/0); dist rebuilt, guard 13/0, seal 54/0. Non-blocking: filter runDir/wall on WALL_PREFIX; not_run suffix assumes the wall.ts removal rule |
 | A-101 | Receipt canonicalization and verify help (item 1) | see docs/v10/ADOPTION-PLAN.md A-101 | HIGH | first-run-gate assertion per plan card | released@2026-09-30T21:23Z | Wave per plan section 5; one writer per file. Released in v10.5.11 (merge 5ea92836 is an ancestor of v10.5.11). |
 | A-102 | Test-runner detection: node:test plus fixtures for all six runners (item 1) | see plan A-102 | HIGH | first-run-gate assertion per plan card | released@2026-10-01T00:52Z | Wave per plan section 5; one writer per file. Released in v10.5.13 (merge 0990afb8 is an ancestor of v10.5.13). |
 | A-104 | Commit only the fix (items 1 and 2, v10) | see plan A-104 | HIGH | first-run-gate assertion per plan card | released@2026-09-30T21:23Z | Wave per plan section 5; one writer per file. Released in v10.5.11 (merge d86a5817 is an ancestor of v10.5.11). |
-| A-104b | A-104 opus follow-ups: run the unstage reset as `git --literal-pathspecs reset` and check its rc (a path starting with `:(top)` was read as a pathspec and committed); match "manifest changed" per directory in monorepos (a stray lockfile in packages/b rode along with a packages/a manifest change); judge new lockfiles and Wall files against the run base, not HEAD, so files the agent commits during implement are also excluded | loki-ts/src/engine10/stages/seal.ts, loki-ts/tests/engine10/seal.test.ts | HIGH | fixtures for each case red first; seal-then-verify still matches | merged@2026-10-01T09:45Z | Source: A-104 opus review (APPROVE with notes). seal.ts writer order: after A-121. |
-| A-104c | A-104b r2 opus follow-up (code reading, not reproduced): a FAILED run now reaches backstopCommit in supervisor.ts (around lines 93-98 and 229), which runs git add -A with hooks off, so a run whose commit stage failed could still commit Wall files, stray lockfiles and the user's pre-run dirty files, and hasDiff could push them as a draft PR (E-67 behaviour). Reproduce first; then make the backstop honor the same exclusions as the commit stage, or skip it when the commit stage itself failed | loki-ts/src/engine10/supervisor.ts, its test | failed-commit run leaves no new commit with Wall files, lockfiles or pre-run dirty files, and opens no PR | HIGH | merged@2026-10-01T10:03Z | none |
+| A-104b | A-104 opus follow-ups: run the unstage reset as `git --literal-pathspecs reset` and check its rc (a path starting with `:(top)` was read as a pathspec and committed); match "manifest changed" per directory in monorepos (a stray lockfile in packages/b rode along with a packages/a manifest change); judge new lockfiles and Wall files against the run base, not HEAD, so files the agent commits during implement are also excluded | loki-ts/src/engine10/stages/seal.ts, loki-ts/tests/engine10/seal.test.ts | HIGH | fixtures for each case red first; seal-then-verify still matches | released@2026-10-16T00:49Z | Source: A-104 opus review (APPROVE with notes). seal.ts writer order: after A-121. |
+| A-104c | A-104b r2 opus follow-up (code reading, not reproduced): a FAILED run now reaches backstopCommit in supervisor.ts (around lines 93-98 and 229), which runs git add -A with hooks off, so a run whose commit stage failed could still commit Wall files, stray lockfiles and the user's pre-run dirty files, and hasDiff could push them as a draft PR (E-67 behaviour). Reproduce first; then make the backstop honor the same exclusions as the commit stage, or skip it when the commit stage itself failed | loki-ts/src/engine10/supervisor.ts, its test | failed-commit run leaves no new commit with Wall files, lockfiles or pre-run dirty files, and opens no PR | HIGH | released@2026-10-16T00:49Z | none |
 | D50-F1 | D50 lift fix 1 (aiq-52, expected no_change_needed): v10 printed ALREADY_SATISFIED but left source changes from implement (harness no_source_diff=false), so it scored not completed; raw sonnet checked first and changed nothing. On ALREADY_SATISFIED, restore source to base before commit, PR or seal; fail closed to FAILED if the restore fails | loki-ts/src/engine10 (outcome path), its tests, dist | fixture with implement edits plus ALREADY_SATISFIED ends with an empty diff, no commit, no PR; VERIFIED runs keep changes | HIGH | merged@2026-10-01T11:45Z f391ba33f (r5, opus approved, train/56) | none |
 | D50-F2 | D50 lift fix 2 (humanize-174): the task changes behaviour that existing tests encode; raw sonnet fixed code and updated the assertions (2/3), v10 BLOCKED as spec conflict or hit the iteration cap (0/3). Needs a design that permits spec-required assertion changes, recorded in the receipt, without opening a test-weakening loophole. Opus architect first | engine10 intake, plan, wall, verify, seal (per design) | humanize-174-shaped fixture completes with the assertion changes listed in NOT PROVEN; a weakening attack still fails | HIGH | rejected@2026-10-01T12:40Z: S1+S2 (71997e6c, a2941555) opus REJECT. Moat holds (any existing-test edit seals PARTIAL). Blocking: the per-spec label fires on any literal swap whose test calls a task word (if True to False, range(10) to range(0), tolerance 1e-3 to 1e3) and drops the weakened-test flag, a false Seal claim. No lift: context.ts:23 still makes tests append-only, so humanize-174 still ends SPEC_CONFLICT. Rework D50-F2r (honest label) building; lift fix D50-F2-S3 needs a CTO call | none |
 | D50-F2r | D50-F2 rework, honest label only: label a test value change only on the expected side of an assert comparison or a parametrize expected value, only when the old or new value appears in the task text; wording 'assertion value changed (not shown to be required by the task): file:line old -> new' and keep the 'weakened test' line beside it; exclude control flow, range, tolerances, approx kwargs, decorators | loki-ts/src/e10ext classifier, engine10 verify and seal wiring, tests, dist | probes C D E F G H K from the F2 review all keep 'weakened test'; A labelled only when 5 appears in the task; verdict PARTIAL in every case | HIGH | parked@2026-10-03T09:21Z | drift audit 09:22Z: r2 rejected, no live builder since 2026-10-01; parked per D68 drop-red; re-open as a fresh slice when D50-F2-S3 is ranked |
@@ -653,70 +678,70 @@ Source: ~/git/autonomi-dev/research/2026-09-30-adoption/SWARM-PROMPT-ADOPTION.md
 | D51-B14 | D51 Phase B B14 (flag LOKI_WORKSPACES, docs/v10/D51-PHASE-B.md): Dashboard group card (per-repo rows, integration row, stale-evidence badge) | legacy-ui-static/start.html | Playwright: a fixture group renders 2 repo rows plus integration; a mismatched head SHA shows stale | LOW | parked@2026-10-03T09:52Z | superseded by D51-B14r |
 | D51-B15 | D51 Phase B B15 (flag LOKI_WORKSPACES, docs/v10/D51-PHASE-B.md): 10x metric: PRs per wall-clock hour and per attention minute from group.json timestamps | autonomy/lib/workspace_metrics.py, tests/workspace/95-metrics.sh | a fixture group gives the hand-computed rate; unmeasured runs are reported, not counted as zero | LOW | parked@2026-10-03T09:40Z | Superseded by PO-WS-METRICS-1 (624b5d964, merged): integration.json timestamps plus workspace_metrics.py. |
 | D51-B16 | D51 Phase B B16 (flag LOKI_WORKSPACES, docs/v10/D51-PHASE-B.md): Docs plus flag flip after the whole-feature Wall: a 2-repo fixture (lib and app) ends with 2 PRs and integration passed | docs/WORKSPACES.md, tests/workspace/99-e2e.sh | the e2e part passes on CI with the stub provider; one real run is recorded in METRICS.md | MEDIUM | parked@2026-10-03T09:52Z | superseded by D51-B16r (flag flip already landed, D63 C8) |
-| INTEL-1 | Standards-based receipts (competitive intel 2026-10-01): emit the Seal as an in-toto Statement in a DSSE envelope, verifiable by stock tools (in-toto verify, cosign verify-blob) as well as loki verify; V10-VISION names this stack | loki-ts/src/engine10 seal and receipt export, loki keys, tests, dist | a stock tool verifies a real receipt in a test; a tampered envelope fails both the stock tool and loki verify | HIGH | merged@2026-10-03T08:35Z | main c3031c9aa, opus APPROVE (14 probes, dsse+verify_cmd 44/0); dist rebuilt, guard 13/0; follow-ups in INTEL-1b |
-| INTEL-1b | INTEL-1 opus non-blocking follow-ups: (1) all-unknown-keyid multi-sig envelope returns UNCHECKED rc 2 not TAMPERED, and document threshold-of-1; (2) export refuses unless outcome VERIFIED or ALREADY_SATISFIED (a FAILED run exports rc 0 today; docs say "a verified v10 receipt"); (3) envelope on the run-id path requires predicate.run_id equal to the run id, or envelopes only via explicit file path; (4) export reads the receipt once and signs the verified bytes; (5) keyid follows receipt kid after rotation | loki-ts/src (dsse export and verify), loki-ts/tests/engine10/dsse.test.ts, CHANGELOG.md, docs | HIGH | red-then-green test per item; dsse+verify_cmd green; dist guard 13/0 | merged@2026-10-03T08:58Z | merged d64de6b5b, 794566ce6 (opus HIGH r2 APPROVE; 71/0, guard 13/0); r2 92775fa58 in opus HIGH re-review (group export fixed, core delta 0); r1 HIGH BLOCK: export read hook leaked into verifyGroup, so a genuine group receipt read as TAMPERED; r2 fixes in progress; opus HIGH review dispatched for d6c8f797f; Source: INTEL-1 opus review 08:35Z. Sonnet builder dispatched; opus HIGH review after |
-| INTEL-2 | Visible hard cost cap by default: the v10 start line shows the per-run cap; BUDGET_STOP (exit 3) enforces it; loki.yaml budgets.per_run or --max-cost sets it; conservative default with rationale in DECISIONS. Check what already exists first (BUDGET_STOP, LOKI_E10_CAP_S) | engine10 start line and budget path, loki.yaml schema, docs, tests | a run over the cap stops with exit 3 and BUDGET_STOP; the start line names the cap; the default is recorded in DECISIONS | MEDIUM | merged@2026-10-03T04:26Z | none |
-| INTEL-3 | Reviewer-first PR body: delivery contract, each acceptance criterion mapped to changed files and the proving check, then NOT PROVEN, readable in 60 seconds | engine10 pr body rendering, tests | a fixture PR body lists every Wall criterion with its file and check; NOT PROVEN last; under a fixed line budget | MEDIUM | merged@2026-10-03T08:32Z | main 0bab386c2+d4865ed9e, TL r2 APPROVE (3 mutations red); dist rebuilt, guard 13/0, features 91/0 |
+| INTEL-1 | Standards-based receipts (competitive intel 2026-10-01): emit the Seal as an in-toto Statement in a DSSE envelope, verifiable by stock tools (in-toto verify, cosign verify-blob) as well as loki verify; V10-VISION names this stack | loki-ts/src/engine10 seal and receipt export, loki keys, tests, dist | a stock tool verifies a real receipt in a test; a tampered envelope fails both the stock tool and loki verify | HIGH | released@2026-10-16T00:49Z | main c3031c9aa, opus APPROVE (14 probes, dsse+verify_cmd 44/0); dist rebuilt, guard 13/0; follow-ups in INTEL-1b |
+| INTEL-1b | INTEL-1 opus non-blocking follow-ups: (1) all-unknown-keyid multi-sig envelope returns UNCHECKED rc 2 not TAMPERED, and document threshold-of-1; (2) export refuses unless outcome VERIFIED or ALREADY_SATISFIED (a FAILED run exports rc 0 today; docs say "a verified v10 receipt"); (3) envelope on the run-id path requires predicate.run_id equal to the run id, or envelopes only via explicit file path; (4) export reads the receipt once and signs the verified bytes; (5) keyid follows receipt kid after rotation | loki-ts/src (dsse export and verify), loki-ts/tests/engine10/dsse.test.ts, CHANGELOG.md, docs | HIGH | red-then-green test per item; dsse+verify_cmd green; dist guard 13/0 | released@2026-10-16T00:49Z | merged d64de6b5b, 794566ce6 (opus HIGH r2 APPROVE; 71/0, guard 13/0); r2 92775fa58 in opus HIGH re-review (group export fixed, core delta 0); r1 HIGH BLOCK: export read hook leaked into verifyGroup, so a genuine group receipt read as TAMPERED; r2 fixes in progress; opus HIGH review dispatched for d6c8f797f; Source: INTEL-1 opus review 08:35Z. Sonnet builder dispatched; opus HIGH review after |
+| INTEL-2 | Visible hard cost cap by default: the v10 start line shows the per-run cap; BUDGET_STOP (exit 3) enforces it; loki.yaml budgets.per_run or --max-cost sets it; conservative default with rationale in DECISIONS. Check what already exists first (BUDGET_STOP, LOKI_E10_CAP_S) | engine10 start line and budget path, loki.yaml schema, docs, tests | a run over the cap stops with exit 3 and BUDGET_STOP; the start line names the cap; the default is recorded in DECISIONS | MEDIUM | released@2026-10-16T00:49Z | none |
+| INTEL-3 | Reviewer-first PR body: delivery contract, each acceptance criterion mapped to changed files and the proving check, then NOT PROVEN, readable in 60 seconds | engine10 pr body rendering, tests | a fixture PR body lists every Wall criterion with its file and check; NOT PROVEN last; under a fixed line budget | MEDIUM | released@2026-10-16T00:49Z | main 0bab386c2+d4865ed9e, TL r2 APPROVE (3 mutations red); dist rebuilt, guard 13/0, features 91/0 |
 | D50-F1b | D50-F1 structural follow-up (CTO call B): run engine10 in a worktree on base per run instead of the user checkout, copying uncommitted user edits in via git stash create; run files stay under the user .loki; PR pushes from the worktree branch; removes the restore and pre-existing-dirty class by construction | loki-ts/src/engine10 supervisor, worker, intake, seal/discard, pr, their tests, dist | user checkout byte-identical after any outcome; dirty user edits visible to the run; ALREADY_SATISFIED leaves no diff; VERIFIED opens the PR from the worktree branch | HIGH | parked@2026-10-01T12:20Z: e69eeec2 REJECTED by opus. Blocking: dirty user edits snapshotted into the pushed branch and receipt base; ignored deps (node_modules, .venv, .env) absent in the worktree, VERIFIED fixture STALLED. Rework needs refuse-dirty in main(), start from HEAD, a dependency strategy (CoW clone or install step) and kill cleanup; CTO call | D50-F1 |
 | A-120 | One signing key, auto-generated (item 3) | see plan A-120 | HIGH | first-run-gate assertion per plan card | released@2026-10-01T00:52Z | Wave per plan section 5; one writer per file. Released in v10.5.13 (merge 1e1417b9 is an ancestor of v10.5.13). |
 | A-132 | Legacy: no HANDOFF.md, USAGE.md or lockfile in a fix commit (item 2) | see plan A-132 | MEDIUM | first-run-gate assertion per plan card | released@2026-10-01T00:52Z | Wave per plan section 5; one writer per file. Released in v10.5.13 (merge 297c2d1f is an ancestor of v10.5.13). |
-| A-133 | Legacy: skip Council evidence probes on a trivial diff (item 2) | see plan A-133 | HIGH | first-run-gate assertion per plan card | merged@2026-09-30T21:08Z | Wave per plan section 5; one writer per file. |
+| A-133 | Legacy: skip Council evidence probes on a trivial diff (item 2) | see plan A-133 | HIGH | first-run-gate assertion per plan card | released@2026-10-16T00:49Z | Wave per plan section 5; one writer per file. |
 | A-132b | A-132 card promised build_prompt fixture-61 (the gated quick-PRD case) but the merged slice never committed it; it sits untracked in the A-132-133 worktree. Commit it with its index.json entry, prove it passes and is red with the gate removed | loki-ts/tests/fixtures/build_prompt/fixture-61/, index.json | LOW | build_prompt.test.ts covers fixture-61 | released@2026-10-01T00:52Z | worktree .claude/worktrees/agent-a101928295ea43bb7 holds the files Released in v10.5.13 (merge 297c2d1f is an ancestor of v10.5.13). |
 | A-103 | Wall never leaves a test that fails for unrelated reasons (item 1) | see plan A-103 | HIGH | first-run-gate assertion per plan card | released@2026-10-01T00:52Z | Wave per plan section 5; one writer per file. Released in v10.5.13 (merge 634124cb is an ancestor of v10.5.13). |
 | A-111 | Empty, skipped or hung checks are NOT VERIFIED (item 5) | see plan A-111 | HIGH | first-run-gate assertion per plan card | released@2026-10-01T00:52Z | Wave per plan section 5; one writer per file. Released in v10.5.13 (merge fa082acc is an ancestor of v10.5.13). |
 | A-103c | A-103 opus note: apply the missing-module not_run rule only when node's failing-tests block shows a file-level `test failed`, so a child node process crashing on a missing package (inherited stdio) cannot discard a real TypeError red; add the child-crash fixture | loki-ts/src/engine10/stages/wall.ts, loki-ts/tests/engine10/wall_runner.test.ts | HIGH | child-crash fixture red | released@2026-10-01T00:52Z | after A-103 Released in v10.5.13 (merge 774885e3 is an ancestor of v10.5.13). |
 | A-103d | A-103c opus note: nested Jest globals on node 20/22 TAP (`t.test("inner", () => expect(...))`) classify red (a false FAILED that keeps a bad Wall test) because nested yaml is indented 6 spaces and `^ {2}name:` misses it; node 26 gives not_run. Match `^ +name:` and `^ +stack:` at any indent. Pre-existing since 0cc1dea4 | loki-ts/src/engine10/stages/wall.ts, wall_runner.test.ts | HIGH | nested Jest-globals fixture not_run on node 20/22/26 | released@2026-10-01T00:52Z | CI runs node 22 Released in v10.5.13 (merge 634124cb is an ancestor of v10.5.13). |
-| A-111b | A-111 opus note: discount a zero-test trailer only when the test name equals the path under test, so one real passing test named like a bare filename (`a.test.js`) is not not_run | loki-ts/src/engine10/stages/verify.ts, its test | MEDIUM | bare-filename-named test passes | merged@2026-09-30T22:37Z | after A-113 (verify.ts) |
+| A-111b | A-111 opus note: discount a zero-test trailer only when the test name equals the path under test, so one real passing test named like a bare filename (`a.test.js`) is not not_run | loki-ts/src/engine10/stages/verify.ts, its test | MEDIUM | bare-filename-named test passes | released@2026-10-16T00:49Z | after A-113 (verify.ts) |
 | E-154 | Incident 17:14Z: tests wrote real signing keys to the founder's `~/.loki/keys` once signing became default (A-121, A-122 builders). Central guard: tests/run-all-tests.sh, the bun test preload and conftest set LOKI_RECEIPT_SIGNING_KEY_FILE/HOME to a run-owned path, plus a check that fails when a test run creates `~/.loki/keys` | tests/run-all-tests.sh, loki-ts bunfig preload, tests/conftest.py, new guard test | MEDIUM | guard test red when a test writes the real key dir | released@2026-10-01T01:19Z | after A-121, A-122 Released in v10.5.14 (merge 0d8a5dce is an ancestor of v10.5.14). |
-| E-155 | Incident 21:58Z: a shell test run from the MAIN checkout (633 diff-selected tests, xargs -P 4, 17:58:16 local) switched HEAD to the stale branch loki/session-1789047299-95963; main ref intact, restored by `git checkout main` 33s later. Candidates running that second: test-metrics-command, test-metrics-json-unmeasured, test-migration-post-edit-revert, test-mirofish-integration, test-magic-injection. A stray root bun.lock also appeared at 17:54. Guard: tests/run-all-tests.sh records `git symbolic-ref HEAD` + status before and fails loudly when any test changes the parent checkout branch; bisect the culprit with that guard | tests/run-all-tests.sh, culprit test | MEDIUM | guard test red when a test runs git checkout in the parent repo | merged@2026-09-30T22:27Z | process fix already applied: shell batches run only in a disposable worktree |
+| E-155 | Incident 21:58Z: a shell test run from the MAIN checkout (633 diff-selected tests, xargs -P 4, 17:58:16 local) switched HEAD to the stale branch loki/session-1789047299-95963; main ref intact, restored by `git checkout main` 33s later. Candidates running that second: test-metrics-command, test-metrics-json-unmeasured, test-migration-post-edit-revert, test-mirofish-integration, test-magic-injection. A stray root bun.lock also appeared at 17:54. Guard: tests/run-all-tests.sh records `git symbolic-ref HEAD` + status before and fails loudly when any test changes the parent checkout branch; bisect the culprit with that guard | tests/run-all-tests.sh, culprit test | MEDIUM | guard test red when a test runs git checkout in the parent repo | released@2026-10-16T00:49Z | process fix already applied: shell batches run only in a disposable worktree |
 | E-154c | CORRECTED PREMISE (builder, 59c1cb54): CI shards set LOKI_TEST_SHARD, not LOKI_TEST_LIST (a list-only mode that runs nothing), so sharded CI DOES run the guards; the train/14 failure was the guard test inheriting LOKI_TEST_SHARD. Slice adds shard-mode guard checks only. Original claim: the E-154/E-155 guards (run-owned signing key default, real ~/.loki/keys snapshot, parent HEAD check) are skipped whenever LOKI_TEST_LIST is set, and CI shards set it, so sharded CI runs carry NO guard: a test writing the real key dir or switching the parent branch would pass on CI. Make the guards active in shard mode too (the LOKI_TEST_LIST skip was presumably for selective local runs) and keep the guard test hermetic | tests/run-all-tests.sh, tests/test-e154-e155-guards.sh | MEDIUM | guard checks run and pass under LOKI_TEST_LIST | released@2026-10-01T01:19Z | found while fixing train/14 shard 6 Released in v10.5.14 (merge 0d8a5dce is an ancestor of v10.5.14). |
 | E-156 | Incident 22:00Z: pre-push gitleaks (generic-api-key) blocked train/11 on the key FILE NAME string `.loki/keys/receipt-ed25519.pem` (seal.ts:68, seal.test.ts:174, dist/loki.js:1244); no key material. Fixed by exact .gitleaksignore fingerprints, but any future commit that rewrites the minified dist line re-triggers and can block a release push. Durable fix needs a CTO call: a narrow `.gitleaks.toml` allowlist (regexTarget=secret, `^receipt-ed25519\.pem$`, extend defaults) pushed with LOKI_ALLOW_GITLEAKS_CONFIG_CHANGE=1 plus a test that a real key in the same position is still caught | .gitleaks.toml, tests/test-pre-push-gitleaks.sh | HIGH | real-key fixture still flagged; filename allowed | released@2026-10-01T01:19Z | CTO approval (security scan config) Released in v10.5.14 (merge 314b89fe is an ancestor of v10.5.14). |
-| E-157 | D46: Security Audit verdict reuse. (a) security-audit.yml also runs on push to train/** so every train tip gets the full --all gitleaks scan before main is fast-forwarded; (b) required-ci reuses the parent Security Audit verdict for an eligible VERSION-only bump under the existing eligibility rule (diff is VERSION plus generated version stamps only, parent run success at that exact SHA). Moat test: a non-VERSION-only bump still re-runs Security Audit. Supersedes FOUNDER-QUEUE 14 | .github/workflows/security-audit.yml, release.yml (required-ci), tests | HIGH | non-VERSION-only bump re-runs the scan | merged@2026-10-01T03:03Z | after slice-D46-ci; r3 opus APPROVE 57b511d2; DROPPED from train/21 (D46): STEP 1 re-indent broke S-132 normalizer parity (test-version-bump-only 28/1), reverted 7d1a0f15, r4 with CI-health |
-| E-159 | Pre-existing secret-scan gaps found by the E-157 r2 opus reviewer: (a) an evil merge, a merge commit whose OWN content adds a secret (merge -s ours --no-commit, token in the merge commit), is invisible to both the PARENT..SHA range scan and the --all scan (only `gitleaks dir` found it); (b) pinned gitleaks 8.30.0 exits 0 when its internal git log fails (invalid range), a latent fail-open. Fix: --diff-merges=first-parent (or -m) in --log-opts for both modes or a working-tree scan at the release SHA; guard `git rev-list RANGE` success or treat `[git] fatal` as failure | scripts/security-audit-gitleaks.sh, workflows, tests | HIGH | evil-merge and bad-range fixtures fail the scan | merged@2026-10-01T03:03Z | CI-health engineer after E-157 r3; r1 opus REJECT 5f33451d: stdin merge scan false-positives on real history (v10.5.13..14 rc 1), Wall checks skip in CI |
+| E-157 | D46: Security Audit verdict reuse. (a) security-audit.yml also runs on push to train/** so every train tip gets the full --all gitleaks scan before main is fast-forwarded; (b) required-ci reuses the parent Security Audit verdict for an eligible VERSION-only bump under the existing eligibility rule (diff is VERSION plus generated version stamps only, parent run success at that exact SHA). Moat test: a non-VERSION-only bump still re-runs Security Audit. Supersedes FOUNDER-QUEUE 14 | .github/workflows/security-audit.yml, release.yml (required-ci), tests | HIGH | non-VERSION-only bump re-runs the scan | released@2026-10-16T00:49Z | after slice-D46-ci; r3 opus APPROVE 57b511d2; DROPPED from train/21 (D46): STEP 1 re-indent broke S-132 normalizer parity (test-version-bump-only 28/1), reverted 7d1a0f15, r4 with CI-health |
+| E-159 | Pre-existing secret-scan gaps found by the E-157 r2 opus reviewer: (a) an evil merge, a merge commit whose OWN content adds a secret (merge -s ours --no-commit, token in the merge commit), is invisible to both the PARENT..SHA range scan and the --all scan (only `gitleaks dir` found it); (b) pinned gitleaks 8.30.0 exits 0 when its internal git log fails (invalid range), a latent fail-open. Fix: --diff-merges=first-parent (or -m) in --log-opts for both modes or a working-tree scan at the release SHA; guard `git rev-list RANGE` success or treat `[git] fatal` as failure | scripts/security-audit-gitleaks.sh, workflows, tests | HIGH | evil-merge and bad-range fixtures fail the scan | released@2026-10-16T00:49Z | CI-health engineer after E-157 r3; r1 opus REJECT 5f33451d: stdin merge scan false-positives on real history (v10.5.13..14 rc 1), Wall checks skip in CI |
 | E-160 | D46 runner contention (peer steer 02:11Z): a green train SHA fast-forwarded to main re-runs Tests (8 shards), Bun Parity, Security Audit and First-run gate on the identical SHA, doubling runner load and queueing the next train. Proposal: on push to main, a first job checks for a successful run of the same workflow at the same SHA from a train/** push and, if found, exits success recording the reused run id (D28: same SHA = same tree); any SHA not train-tested runs in full. CTO call FIRST: OPERATING-MODEL says "Tier B full verification on every main commit (never cancelled on main)"; confirm reuse does not weaken Release required-ci, branch-conditional steps (train vs main), or the Security Audit range (base tag config). Sequence after E-157 r4 (same files) | .github/workflows/test.yml, bun-parity.yml, security-audit.yml, tests/test_release_required_ci.py | HIGH | main push of a train-green SHA records reuse and finishes in under 1 min; an untested SHA runs in full; a train-red SHA is not reused | released@2026-10-03T09:41Z | Stale ready row: already merged as 943355729 (opus approved, D55) and shipped in v10.6.0. A 09:40Z builder found no diff. |
-| E-161 | INCIDENT 02:46Z: an opus reviewer ran `git checkout --detach <tag>` x7 plus a `.gitleaksignore` overwrite in the SHARED main checkout (reflog 02:46:04Z to 02:46:38Z). Cause: its run-owned clone dir was deleted, the next `cd` into a new clone failed, and the shell cwd fell back to the main checkout; every later command ran there. Restored by the Chief of Staff (`git checkout main`, fafe50dd, clean). Guard: v10-guard.sh (PreToolUse) blocks `git checkout`/`git switch`/`git reset`/`git worktree remove` and writes to tracked files when cwd resolves to the main checkout and the caller is an agent (not the leader session); agent prompts use `cd DIR` followed by an exit-on-failure check. Test: a hook test with cwd=main checkout blocks a detached checkout and allows it in a worktree | scripts/v10-guard.sh, tests | HIGH | detached checkout in main checkout blocked; same in a worktree allowed | merged@2026-10-01T06:47Z | GUARDS.md entry |
-| E-162 | Founder "faster" (03:05Z): slice CI runs only Tier A plus diff-selected suites (the existing Tier A selection), Bun Parity and the structural guards; the full 8-shard Tests stays on train/** and main, and the train stays the release verdict. Frees runners and targets about 2 min slice CI | .github/workflows/test.yml (slice-* job matrix only), tests | HIGH | slice-* push runs no 8-shard matrix; train/** and main still run all 8 shards; a slice touching a suite runs that suite | merged@2026-10-01T05:22Z | after E-157 r4 (same file) |
-| E-165 | tests/test-mirofish-integration.sh line 413 runs `autonomy/loki start --no-mirofish` in the repo root: a live autonomous build that ran about 45 min, switched a worktree branch to loki/session-* and committed a docs change (found by DOC-02). Guard: the test must run against a run-owned fixture repo with a stub provider and LOKI_NO_BROWSER=1, never the repo root; add a structural guard that no test launches start/run against REPO_ROOT | tests/test-mirofish-integration.sh, a structural guard | HIGH | the test never runs loki start in the repo root; guard catches a planted case | merged@2026-10-01T06:52Z | P0 guard (D26) |
-| E-166 | Jira auto-sync never starts: src/integrations/sync-subscriber.js builds JiraApiClient without the required email and apiToken, so LOKI_JIRA_URL plus LOKI_JIRA_TOKEN do nothing (DOC-02 added a known-issue note to the setup docs). Fix the wiring or remove the advertised auto-sync | src/integrations/sync-subscriber.js, tests | MEDIUM | with env set, the subscriber constructs a working client (mocked API) | merged@2026-10-01T06:43Z | none |
+| E-161 | INCIDENT 02:46Z: an opus reviewer ran `git checkout --detach <tag>` x7 plus a `.gitleaksignore` overwrite in the SHARED main checkout (reflog 02:46:04Z to 02:46:38Z). Cause: its run-owned clone dir was deleted, the next `cd` into a new clone failed, and the shell cwd fell back to the main checkout; every later command ran there. Restored by the Chief of Staff (`git checkout main`, fafe50dd, clean). Guard: v10-guard.sh (PreToolUse) blocks `git checkout`/`git switch`/`git reset`/`git worktree remove` and writes to tracked files when cwd resolves to the main checkout and the caller is an agent (not the leader session); agent prompts use `cd DIR` followed by an exit-on-failure check. Test: a hook test with cwd=main checkout blocks a detached checkout and allows it in a worktree | scripts/v10-guard.sh, tests | HIGH | detached checkout in main checkout blocked; same in a worktree allowed | released@2026-10-16T00:49Z | GUARDS.md entry |
+| E-162 | Founder "faster" (03:05Z): slice CI runs only Tier A plus diff-selected suites (the existing Tier A selection), Bun Parity and the structural guards; the full 8-shard Tests stays on train/** and main, and the train stays the release verdict. Frees runners and targets about 2 min slice CI | .github/workflows/test.yml (slice-* job matrix only), tests | HIGH | slice-* push runs no 8-shard matrix; train/** and main still run all 8 shards; a slice touching a suite runs that suite | released@2026-10-16T00:49Z | after E-157 r4 (same file) |
+| E-165 | tests/test-mirofish-integration.sh line 413 runs `autonomy/loki start --no-mirofish` in the repo root: a live autonomous build that ran about 45 min, switched a worktree branch to loki/session-* and committed a docs change (found by DOC-02). Guard: the test must run against a run-owned fixture repo with a stub provider and LOKI_NO_BROWSER=1, never the repo root; add a structural guard that no test launches start/run against REPO_ROOT | tests/test-mirofish-integration.sh, a structural guard | HIGH | the test never runs loki start in the repo root; guard catches a planted case | released@2026-10-16T00:49Z | P0 guard (D26) |
+| E-166 | Jira auto-sync never starts: src/integrations/sync-subscriber.js builds JiraApiClient without the required email and apiToken, so LOKI_JIRA_URL plus LOKI_JIRA_TOKEN do nothing (DOC-02 added a known-issue note to the setup docs). Fix the wiring or remove the advertised auto-sync | src/integrations/sync-subscriber.js, tests | MEDIUM | with env set, the subscriber constructs a working client (mocked API) | released@2026-10-16T00:49Z | none |
 | P0-promote-bun | Auto-promote of 10.5.22 failed: promote.yml ran the first-run gate without bun, the installed CLI fell back to legacy, 7 v10 checks failed and the cost check crashed (IndexError). Install bun before the gate; cost check fails closed; explicit engine-fallback check | .github/workflows/promote.yml, scripts/first-run-gate.sh, tests/test-first-run-gate.sh | test-first-run-gate 56/0 incl. fallback fixture; gate --stub 0 failed | HIGH | merged@2026-10-01T07:09Z | opus CTO APPROVE 5bdfe2f8 |
-| E-167 | Gate the no-bun path end to end (CTO follow-up to P0-promote-bun): run the default entry with bun absent from PATH and assert the legacy receipt, NOT VERIFIED on a skipped target and the documented exit codes, with the legacy 15-line budget and legacy verify (the v10 leg keeps 8 lines; scripts/first-run-gate.sh:123 forces LOKI_ENGINE=v10 for verify, which is why a bun-less run failed digest, verify and signed); the promote gate currently proves only the bun path | scripts/first-run-gate.sh, tests/test-first-run-gate.sh | no-bun stub run fails closed on a skipped test; clean no-bun run reads its legacy receipt | MEDIUM | merged@2026-10-01T07:52Z | none |
-| E-161b | E-161 false block: the hook judges a detaching checkout by the hook cwd (the main checkout) and ignores a preceding checked cd into a linked worktree; at 07:20Z a cd into the release worktree followed by git checkout --detach was blocked (RULE8), and the release only proceeded via git -C. Resolve the effective directory from a leading checked cd or from git -C before applying RULE8 | scripts/v10-guard.sh, tests/test-v10-guard.sh | checked cd into a linked worktree then detach: allowed; cwd main with no cd: blocked; git -C linked: allowed | HIGH | merged@2026-10-01T08:31Z | none |
+| E-167 | Gate the no-bun path end to end (CTO follow-up to P0-promote-bun): run the default entry with bun absent from PATH and assert the legacy receipt, NOT VERIFIED on a skipped target and the documented exit codes, with the legacy 15-line budget and legacy verify (the v10 leg keeps 8 lines; scripts/first-run-gate.sh:123 forces LOKI_ENGINE=v10 for verify, which is why a bun-less run failed digest, verify and signed); the promote gate currently proves only the bun path | scripts/first-run-gate.sh, tests/test-first-run-gate.sh | no-bun stub run fails closed on a skipped test; clean no-bun run reads its legacy receipt | MEDIUM | released@2026-10-16T00:49Z | none |
+| E-161b | E-161 false block: the hook judges a detaching checkout by the hook cwd (the main checkout) and ignores a preceding checked cd into a linked worktree; at 07:20Z a cd into the release worktree followed by git checkout --detach was blocked (RULE8), and the release only proceeded via git -C. Resolve the effective directory from a leading checked cd or from git -C before applying RULE8 | scripts/v10-guard.sh, tests/test-v10-guard.sh | checked cd into a linked worktree then detach: allowed; cwd main with no cd: blocked; git -C linked: allowed | HIGH | released@2026-10-16T00:49Z | none |
 | P0-nobun | D48 flip does nothing on a bun-less npm install: bin/loki falls back to legacy without bun, and loki-ts/dist/loki.js is built for target bun (node gives ReferenceError: Bun is not defined). Make the Loki 10 engine run without a preinstalled bun (node-runnable build, or bun shipped as an npm dependency) and, when neither works, say so plainly on the start line. Architect plan first | bin/loki, loki-ts/scripts/build.ts, package.json (per plan) | bun-less host runs the v10 default or prints the plain cannot-run line; promote gate no-bun leg (E-167) passes | HIGH | merged@2026-10-01T07:52Z | opus architect plan in progress |
-| E-169 | Docker image and Homebrew formula use the same bun resolver as bin/loki (peer condition 3 for founder queue 17): the Docker image must contain a working bun so the default runs Loki 10; the Homebrew formula must either depend on bun or let the resolver print the plain cannot-run line | Dockerfile, Dockerfile.sandbox, the Homebrew formula (find it) | docker run of the image prints the Loki 10 start line; brew-style layout resolves bun or prints the plain line | MEDIUM | merged@2026-10-01T08:31Z | none |
-| E-170 | Verify what still works after npm install --omit=optional before documenting it as a slim install: it also drops the existing @anthropic-ai optional packages (about 247MB of the measured 370MB delta). List which commands break and either document the slim path with its limits or recommend against it | package.json, docs/INSTALLATION.md | a scripted --omit=optional install runs loki --version, loki quick on the stub provider and loki verify; results recorded | LOW | merged@2026-10-01T11:32Z | measured 08:33Z on 10.5.25 (haiku): slim 30,280 KB vs full 407,656 KB; omits @anthropic-ai/claude-agent-sdk, bun, @opentelemetry/*; --version, help, doctor and quick (stub claude) reported rc 0. NOT yet documented: the report omitted the stderr evidence of the plain cannot-run line on quick; re-check that before adding the slim path to docs/INSTALLATION.md |
+| E-169 | Docker image and Homebrew formula use the same bun resolver as bin/loki (peer condition 3 for founder queue 17): the Docker image must contain a working bun so the default runs Loki 10; the Homebrew formula must either depend on bun or let the resolver print the plain cannot-run line | Dockerfile, Dockerfile.sandbox, the Homebrew formula (find it) | docker run of the image prints the Loki 10 start line; brew-style layout resolves bun or prints the plain line | MEDIUM | released@2026-10-16T00:49Z | none |
+| E-170 | Verify what still works after npm install --omit=optional before documenting it as a slim install: it also drops the existing @anthropic-ai optional packages (about 247MB of the measured 370MB delta). List which commands break and either document the slim path with its limits or recommend against it | package.json, docs/INSTALLATION.md | a scripted --omit=optional install runs loki --version, loki quick on the stub provider and loki verify; results recorded | LOW | released@2026-10-16T00:49Z | measured 08:33Z on 10.5.25 (haiku): slim 30,280 KB vs full 407,656 KB; omits @anthropic-ai/claude-agent-sdk, bun, @opentelemetry/*; --version, help, doctor and quick (stub claude) reported rc 0. NOT yet documented: the report omitted the stderr evidence of the plain cannot-run line on quick; re-check that before adding the slim path to docs/INSTALLATION.md |
 | D49-auto | Auto-promote to latest on Post-Release Smoke success (founder D49) | .github/workflows/promote.yml, tests/test_release_next_tag.py | HIGH | smoke-success from Release promotes; manual smoke never promotes; not-lower guard | merged@2026-10-01T03:03Z | opus APPROVE 5510b8c8. Follow-ups (D49-auto-b): not-lower guard fails OPEN on an npm error (make it fail closed); loki-mode-sdk latest has no not-lower guard; a newer queued promote can replace a pending one in a release burst |
 | D51-A3 | Headless `loki backlog owner/repo --all/--label/--issues` plus loki.yaml (schema, validator, env overrides) | autonomy/lib/backlog.py, autonomy/lib/loki_yaml.py, autonomy/loki, schemas/loki-yaml.schema.json, tests/test-backlog.sh | HIGH | backlog 47/0 | merged@2026-10-01T03:11Z | sonnet APPROVE 14ff9ae2; follow-up D51-A3b: `loki_yaml.py show` echoes a token pasted into git.token_env (redact x-secret-ref fields); no-parser test case; re-run of a failed issue discards its kept worktree |
 | D51-A4 | Slack on the v10 path (PR opened, BLOCKED, finished), webhook from the env var named by LOKI_SLACK_WEBHOOK_ENV, URL redacted, 5s bounded post | loki-ts/src/e10ext/slack_events.ts, engine10/supervisor.ts, tests | MEDIUM | slack tests 40/0 | merged@2026-10-01T03:11Z | sonnet APPROVE adb838b2; one labelled test message after it ships |
 | D48-r10 | loki-seal in the repo plugin marketplace (`/plugin marketplace add asklokesh/loki-mode`, `/plugin install loki-seal@loki-mode`), README line 4 | .claude-plugin/marketplace.json, README.md, tests/test-loki-seal-marketplace.sh | MEDIUM | clean-HOME install works; marketplace test 8/0 | merged@2026-10-01T03:11Z | sonnet APPROVE 5ecab20d; nit: blank line between README lines 3 and 4 (DOC-01 owns README) |
 | P0-t15 | train/15 and train/17 red: quiet `loki quick` default output 16 lines (stderr noise: mkdir .loki/config File exists, 2 caveman bootstrap lines, echo broken pipe). Fix: caveman notices to the quiet run log, fold a sentinel-only .loki/config into the config dir (never ~/.loki), SIGPIPE reset via python3 re-exec guarded by an import probe | autonomy/run.sh, autonomy/loki, tests/test-quick-config-safety.sh | MEDIUM | default output at most 15 lines; ~/.loki/config untouched from $HOME; broken python3 still runs | released@2026-10-01T02:27Z | r1 REJECT (config clobber, python3 guard); r2 54da8960 APPROVE (config-safety 5/0, receipt-order 14/0 at 12 lines, crash-cli 57/0) Released in v10.5.16 (merge e7e39e27 is an ancestor of v10.5.16). |
 | A-113 | Stop reasons: STALLED and the fatal classifier (item 5) | see plan A-113 | HIGH | first-run-gate assertion per plan card | released@2026-10-01T01:19Z | Wave per plan section 5; one writer per file. Released in v10.5.14 (merge 0377398d is an ancestor of v10.5.14). |
-| A-114 | FALSE VERIFIED ON MAIN (found by the A-112 opus reviewer, repro m6 on 4ad430ad): bugrepo plus an unrelated red test; the agent changes only other.js; verify selects only node:other.test.js (testmap from the diff), so the task's own target test sums.test.js is never run and the run seals VERIFIED rc=0 while it is red. Fix: the relevant tests of the task-named files (hasRelevantTests / impacted(likely), the lean-path Wall stand-in) are ALWAYS selected by verify, whatever the diff touches | loki-ts/src/engine10/stages/verify.ts or testmap selection, tests | HIGH | m6 fixture seals FAILED | merged@2026-09-30T22:37Z | coordinate with A-112 (verify.ts, same target notion); P0 moat |
+| A-114 | FALSE VERIFIED ON MAIN (found by the A-112 opus reviewer, repro m6 on 4ad430ad): bugrepo plus an unrelated red test; the agent changes only other.js; verify selects only node:other.test.js (testmap from the diff), so the task's own target test sums.test.js is never run and the run seals VERIFIED rc=0 while it is red. Fix: the relevant tests of the task-named files (hasRelevantTests / impacted(likely), the lean-path Wall stand-in) are ALWAYS selected by verify, whatever the diff touches | loki-ts/src/engine10/stages/verify.ts or testmap selection, tests | HIGH | m6 fixture seals FAILED | released@2026-10-16T00:49Z | coordinate with A-112 (verify.ts, same target notion); P0 moat |
 | A-115 | TIER 0 (steer 22:50Z). FALSE VERIFIED ON MAIN (A-112 opus reviewer, c10 on 275b4fc0): a conftest.py that skips the target test (and the unrelated red one) seals VERIFIED rc=0, "2 passed, 2 skipped", nothing disclosed. Seal accuracy: a relevant check with more skipped tests than base, or a diff touching conftest.py / pytest.ini / pyproject [tool.pytest] / jest or node test config, must not count as a pass or as progress; list it in NOT PROVEN | loki-ts/src/engine10/stages/verify.ts, failures.ts, tests | HIGH | c10 and e9 fixtures seal FAILED or NOT VERIFIED | released@2026-10-01T00:52Z | core at the 5000 cap: needs an offset (A-150) Released in v10.5.13 (merge bdb332e3 is an ancestor of v10.5.13). |
 | A-115b | A-115 opus notes: (1) an honest fix that also appends a new test to a relevant test file, in a repo with an unrelated red test, ends STALLED/FAILED instead of PARTIAL: the edited file is excluded from progress so the unrelated red is never subtracted; allow progress when the file's pre-existing target ids went red to green; (2) the node base-count fallback sums every `pass N`/`fail N` line, so a base test printing them inflates the count (safe-direction false PARTIAL); take the last pass and last fail lines | loki-ts/src/engine10/stages/verify.ts, verify_weak.test.ts | HIGH | both fixtures | released@2026-10-01T01:53Z | Released in v10.5.15 (merge 945f58ec is an ancestor of v10.5.15). |
 | A-119 | P0 FALSE VERIFIED ON MAIN (A-115b opus reviewer, reproduced on bba2e5ec): rename the target test file and weaken its expectation (sum.test.js => sum.spec.test.js with 6 changed to 5), add a comment to sum.js: rc=0 Outcome VERIFIED, receipt shows node:sum.spec.test.js pass, sum.js still buggy. verify only sees relevant test files that still exist on head; seal writes `weakened test: sum.test.js` (seal.ts:205) but that line never downgrades the verdict. Fix: seal's `weakened test:` downgrades to PARTIAL like verify's not_proven | loki-ts/src/engine10/stages/seal.ts, tests | HIGH | rename-and-weaken fixture: not VERIFIED, rc!=0 | released@2026-10-01T01:53Z | Tier 0 Released in v10.5.15 (merge c41a2b83 is an ancestor of v10.5.15). |
 | A-119b | A-119 opus review (REJECT on pre-existing holes, A-119 landed as a strict improvement): weakening still ends VERIFIED via (1) a helper file a base test imports (eq=()=>{}), (2) snapshot or fixture edits (__snapshots__/*.snap, tests/fixtures/*.json), (3) tests isTestFile (testmap.ts:51) does not recognise: __tests__/*.js, mocha test/*.js, cargo tests/*.rs, including rename to .bak. Also: verdictOf returns ALREADY_SATISFIED before the weakened downgrade when implement says already_done; package.json jest testPathIgnorePatterns and vite.config.ts test.exclude skip config detection. Fix: widen the seal.ts weakTests predicate to any changed/deleted base path under test/, tests/, __tests__/, __snapshots__/, fixtures dirs plus non-test files a base test imports; check weakened before the already_done early return; add vite.config and in-block jest keys to CFG detection | loki-ts/src/engine10/stages/seal.ts, verify.ts (CFG only), tests | HIGH | each repro gives not-VERIFIED; source-only fix and new test stay VERIFIED | rejected@2026-10-01T05:12Z | |
-| A-117 | FALSE VERIFIED IN `loki verify` (A-130 r2 opus reviewer): on a run whose events.jsonl was tampered (append, edit, truncate, delete), the run now ends FAILED (A-130) but the receipt on disk still says VERIFIED with no tamper mark, because the worker sealed it before the supervisor detected the tamper; `loki verify` prints verdict: VERIFIED rc=0. Fix: record the tamper on the receipt via the registered receipt.addendum event (hash-chained) or have verify check the event log hash; verify must say TAMPERED and exit non-zero | loki-ts/src/engine10/verify_cmd.ts, supervisor.ts or seal.ts, tests | HIGH | tampered-log fixture: loki verify TAMPERED rc!=0 | merged@2026-10-01T02:50Z | after A-130 (supervisor.ts); r2: opus REJECT, tail truncation erases post-seal tamper, fix = signed final log line |
-| A-118 | Exit-honest policy gap on the DEFAULT path (A-115 r2 finding): legacy `loki quick` prints `Evidence Receipt: NOT VERIFIED` yet exits rc 0 on a run whose target test was skipped; G1 exit-honest counts a skipped test as green, so it does not catch this. CTO call: should legacy quick exit non-zero on NOT VERIFIED when a relevant test was skipped/weakened, and should G1 count skipped as not-green? | autonomy/run.sh (quick exit path), scripts/first-run-gate.sh G1 | HIGH | skipped-target legacy run exits non-zero; G1 treats skipped as not green | merged@2026-10-01T05:12Z | D47 decided: rc 3 on tests_integrity failed (skip added, runner config changed, test file deleted/renamed); assertion edits disclosed rc 0; G1 green needs pass 2 fail 0, 9b asserts rc 3. Files: proof-generator.py, run.sh after generate_proof_of_run, first-run-gate.sh, docs/exit-codes.md. Blocks promote of `latest`; built df404970, opus review |
+| A-117 | FALSE VERIFIED IN `loki verify` (A-130 r2 opus reviewer): on a run whose events.jsonl was tampered (append, edit, truncate, delete), the run now ends FAILED (A-130) but the receipt on disk still says VERIFIED with no tamper mark, because the worker sealed it before the supervisor detected the tamper; `loki verify` prints verdict: VERIFIED rc=0. Fix: record the tamper on the receipt via the registered receipt.addendum event (hash-chained) or have verify check the event log hash; verify must say TAMPERED and exit non-zero | loki-ts/src/engine10/verify_cmd.ts, supervisor.ts or seal.ts, tests | HIGH | tampered-log fixture: loki verify TAMPERED rc!=0 | released@2026-10-16T00:49Z | after A-130 (supervisor.ts); r2: opus REJECT, tail truncation erases post-seal tamper, fix = signed final log line |
+| A-118 | Exit-honest policy gap on the DEFAULT path (A-115 r2 finding): legacy `loki quick` prints `Evidence Receipt: NOT VERIFIED` yet exits rc 0 on a run whose target test was skipped; G1 exit-honest counts a skipped test as green, so it does not catch this. CTO call: should legacy quick exit non-zero on NOT VERIFIED when a relevant test was skipped/weakened, and should G1 count skipped as not-green? | autonomy/run.sh (quick exit path), scripts/first-run-gate.sh G1 | HIGH | skipped-target legacy run exits non-zero; G1 treats skipped as not green | released@2026-10-16T00:49Z | D47 decided: rc 3 on tests_integrity failed (skip added, runner config changed, test file deleted/renamed); assertion edits disclosed rc 0; G1 green needs pass 2 fail 0, 9b asserts rc 3. Files: proof-generator.py, run.sh after generate_proof_of_run, first-run-gate.sh, docs/exit-codes.md. Blocks promote of `latest`; built df404970, opus review |
 | A-112b | A-112 readability debt: subtractBase in verify.ts was folded to reach 4999 of 5000 core lines (9 lines over 200 chars, longest 347; un/progress/base-run loop each on one line). Unfold when A-150 frees budget; no behaviour change | loki-ts/src/engine10/stages/verify.ts | MEDIUM | budget test plus verify_prered unchanged | ready@2026-09-30T22:37Z | after A-150 |
 | A-113b | A-110 opus notes on A-113: (1) under the CLI invoker (LOKI_E10_INVOKER=cli) the provider child stderr never reaches the fatal classifier (the *-impl.stderr.log is empty), so a credit/auth failure printed on plain stderr gives stop:null and burns the fix rounds; (2) machine.ts re-records the previous signature when a verify crashes, so a crashed verify counts toward a stall. Fix both in session.ts/machine.ts, with end-to-end tests through the real worker | loki-ts/src/engine10/session.ts, machine.ts, tests | HIGH | CLI stderr credit line stops fatal; crashed verify does not count as a stall repeat | released@2026-10-01T01:19Z | keep the A-110 escalated emit; the A-110 reviewer plugin probe is a good e2e template Released in v10.5.14 (merge 0377398d is an ancestor of v10.5.14). |
 | A-121 | v10 signs and verifies natively (item 3) | see plan A-121 | HIGH | first-run-gate assertion per plan card | released@2026-10-01T00:52Z | Wave per plan section 5; one writer per file. Released in v10.5.13 (merge 08b31271 is an ancestor of v10.5.13). |
 | A-122 | Delete the GPG signing layer (item 3, deletion) | see plan A-122 | HIGH | first-run-gate assertion per plan card | released@2026-10-01T00:52Z | Wave per plan section 5; one writer per file. Released in v10.5.13 (merge cb738c36 is an ancestor of v10.5.13). |
 | A-121b | A-121 opus note: a receipt downgrade exits 0. Anyone can edit the body, recompute receipt_sha256 and null the jwt to get UNSIGNED rc 0 on `loki verify`, and the legacy deploy gate refuses UNSIGNED but the v10 verify does not. Decide the signed-by-default policy: once a local key exists, UNSIGNED on a receipt from this machine exits non-zero (or the receipt records its kid outside the hashed body) | loki-ts/src/engine10/verify_cmd.ts, stages/seal.ts, tests | HIGH | downgrade fixture exits non-zero | released@2026-10-01T03:00Z | D47 decided: UNSIGNED exits 3 on both engines (verify_cmd.ts EXIT_BY_VERDICT, autonomy/verify.sh _verify_receipt_digest), --allow-unsigned / LOKI_VERIFY_ALLOW_UNSIGNED=1 accepts with explicit line; update tests/test-engine10-live-pr.sh 115-122; verify never creates a key |
-| A-121c | A-121b opus finding B: legacy `loki verify` passes a WELL-FORMED token with an unknown kid at rc 0 (`attestation: UNCHECKED`, `VERDICT: VERIFIED`) with or without the local key; engine10 gives rc 2. A forger can always mint such a token, so on legacy a downgrade-to-foreign-kid is a pass. D47 kept legacy UNCHECKED unchanged because it also covers honest cross-machine verification. CTO call: make legacy UNCHECKED non-zero (parity with engine10 rc 2), now that D48 row 2 adds `loki verify --pubkey` as the honest cross-machine path? Also: a missing .loki/state/last-proof-id.txt makes legacy verify skip the receipt check entirely and pass (pre-existing, A-134) | autonomy/loki (_deploy_receipt_verdict, verify), tests | HIGH | unknown-kid forged token exits non-zero on legacy; honest cross-machine path documented | merged@2026-10-03T09:18Z | merged 1a8a9c7bc, 15c0a26eb (opus HIGH r2 APPROVE; receipt-order 38/0, quiet-tail 6/0, deploy-receipt-gate 27/0, exit-codes-documented 19/0) |
+| A-121c | A-121b opus finding B: legacy `loki verify` passes a WELL-FORMED token with an unknown kid at rc 0 (`attestation: UNCHECKED`, `VERDICT: VERIFIED`) with or without the local key; engine10 gives rc 2. A forger can always mint such a token, so on legacy a downgrade-to-foreign-kid is a pass. D47 kept legacy UNCHECKED unchanged because it also covers honest cross-machine verification. CTO call: make legacy UNCHECKED non-zero (parity with engine10 rc 2), now that D48 row 2 adds `loki verify --pubkey` as the honest cross-machine path? Also: a missing .loki/state/last-proof-id.txt makes legacy verify skip the receipt check entirely and pass (pre-existing, A-134) | autonomy/loki (_deploy_receipt_verdict, verify), tests | HIGH | unknown-kid forged token exits non-zero on legacy; honest cross-machine path documented | released@2026-10-16T00:49Z | merged 1a8a9c7bc, 15c0a26eb (opus HIGH r2 APPROVE; receipt-order 38/0, quiet-tail 6/0, deploy-receipt-gate 27/0, exit-codes-documented 19/0) |
 | A-110 | One named outcome, fixed exit ladder, --json (items 1 and 5) | see plan A-110 | HIGH | first-run-gate assertion per plan card | released@2026-10-01T00:52Z | Wave per plan section 5; one writer per file. Released in v10.5.13 (merge 47ac1ccc is an ancestor of v10.5.13). |
 | A-112 | Baseline subtract: judge only the delta (item 5) | see plan A-112 | HIGH | first-run-gate assertion per plan card | released@2026-10-01T00:52Z | Wave per plan section 5; one writer per file. Released in v10.5.13 (merge 69f1a910 is an ancestor of v10.5.13). |
 | A-123 | Doctor: only the selected provider blocks, one Ready line (item 3) | see plan A-123 | MEDIUM | first-run-gate assertion per plan card | released@2026-10-01T00:52Z | Wave per plan section 5; one writer per file. Released in v10.5.13 (merge 275b4fc0 is an ancestor of v10.5.13). |
 | A-134 | Legacy: receipt after the final commit, chatter behind --verbose (item 2) | see plan A-134 | MEDIUM | first-run-gate assertion per plan card | released@2026-10-01T00:52Z | Wave per plan section 5; one writer per file. Released in v10.5.13 (merge 7d3edf96 is an ancestor of v10.5.13). |
-| A-134b | A-134 opus notes: (1) standalone autonomy/verify.sh prints no attestation line (only `loki verify` has _deploy_receipt_verdict); print `attestation: UNCHECKED (run via loki verify)` instead of silence; (2) the quiet failure tail grep `[Ff]ailed` matched the RALPH system-prompt line and printed ~1.5k chars; anchor to `^\[(ERROR|WARN)\]` or cap line length; (3) the quiet inner run starts as a background job so its stdin is /dev/null even from a TTY: pause-mode keypress resume changes for quiet runs; (4) `loki quick --verbose` is also the A-122 cmd_quick flag, done | autonomy/verify.sh, autonomy/run.sh | MEDIUM | each note has a test | merged@2026-10-01T05:22Z | |
-| A-134c | A-134b r1 review finding: provider call sites in autonomy/run.sh (mainline claude -p at about 25455/25460, provider_invoke_argv about 1050/1053) do not redirect stdin, so under LOKI_VERBOSE=1 (and any non-quiet path) a parent stdin pipe that never closes blocks `claude -p` reading stdin (pre-existing). Fix: `< /dev/null` at provider invocations that pass the prompt as an argument | autonomy/run.sh (provider call sites only), providers/*.sh, tests | MEDIUM | never-closing stdin pipe: verbose `loki quick` completes under timeout 60 | merged@2026-10-01T09:00Z | |
+| A-134b | A-134 opus notes: (1) standalone autonomy/verify.sh prints no attestation line (only `loki verify` has _deploy_receipt_verdict); print `attestation: UNCHECKED (run via loki verify)` instead of silence; (2) the quiet failure tail grep `[Ff]ailed` matched the RALPH system-prompt line and printed ~1.5k chars; anchor to `^\[(ERROR|WARN)\]` or cap line length; (3) the quiet inner run starts as a background job so its stdin is /dev/null even from a TTY: pause-mode keypress resume changes for quiet runs; (4) `loki quick --verbose` is also the A-122 cmd_quick flag, done | autonomy/verify.sh, autonomy/run.sh | MEDIUM | each note has a test | released@2026-10-16T00:49Z | |
+| A-134c | A-134b r1 review finding: provider call sites in autonomy/run.sh (mainline claude -p at about 25455/25460, provider_invoke_argv about 1050/1053) do not redirect stdin, so under LOKI_VERBOSE=1 (and any non-quiet path) a parent stdin pipe that never closes blocks `claude -p` reading stdin (pre-existing). Fix: `< /dev/null` at provider invocations that pass the prompt as an argument | autonomy/run.sh (provider call sites only), providers/*.sh, tests | MEDIUM | never-closing stdin pipe: verbose `loki quick` completes under timeout 60 | released@2026-10-16T00:49Z | |
 | A-130 | v10 quiet by default (item 2) | see plan A-130 | MEDIUM | first-run-gate assertion per plan card | released@2026-10-01T01:19Z | Wave per plan section 5; one writer per file. Released in v10.5.14 (merge a518bfea is an ancestor of v10.5.14). |
 | A-130b | A-130 Reason line prints first_error from a failing check verbatim (capped at 200 chars, control chars stripped) but unredacted: a `ghp_` token in a test failure line reaches the terminal. No TS redactor is reachable from engine10 core (only autonomy/lib/proof_redact.py). Port the token patterns to a small TS helper outside core or redact first_error where it is captured in verify | loki-ts/src (util), verify.ts or output.ts, tests | MEDIUM | ghp_/sk- token in first_error prints redacted | released@2026-10-01T02:27Z | ; sonnet APPROVE be50510f (redaction before cap, parity with proof_redact.py) Released in v10.5.16 (merge f214a0fa is an ancestor of v10.5.16). |
-| D61-17 | D62 P1: D61 slice 17, speed eval tier (8 spd- tasks per D67, arms v10-parallel, v10-seq, raw-claude, tokens per completed) | eval/loki10/tasks/spd-*, eval/loki10/harness.py, eval/loki10/summarize, eval/loki10/test-harness.sh | MEDIUM | merged@2026-10-03T02:57Z | train/82 e072e47a9. Harness 181 passed, 0 failed. D67 speed tier, not a D34 large-tier result. |
-| D61-01 | D62 P1: D61 slice 1, pre-model stage timer | engine10/supervisor.ts, engine10/output.ts, tests engine10/premodel_timing.test.ts | MEDIUM | merged@2026-10-03T02:28Z | train/81 dd2995153, red on Tests; carried in train/82 e072e47a9. Behind LOKI_SPEED=1. |
-| D61-08 | D62 P1: D61 slice 8, deterministic decomposer DAG | new engine10/decompose.ts, tests engine10/decompose.test.ts | MEDIUM | merged@2026-10-03T02:28Z | train/81 dd2995153, red on Tests; carried in train/82 e072e47a9. Behind LOKI_SPEED=1. |
+| D61-17 | D62 P1: D61 slice 17, speed eval tier (8 spd- tasks per D67, arms v10-parallel, v10-seq, raw-claude, tokens per completed) | eval/loki10/tasks/spd-*, eval/loki10/harness.py, eval/loki10/summarize, eval/loki10/test-harness.sh | MEDIUM | released@2026-10-16T00:49Z | train/82 e072e47a9. Harness 181 passed, 0 failed. D67 speed tier, not a D34 large-tier result. |
+| D61-01 | D62 P1: D61 slice 1, pre-model stage timer | engine10/supervisor.ts, engine10/output.ts, tests engine10/premodel_timing.test.ts | MEDIUM | released@2026-10-16T00:49Z | train/81 dd2995153, red on Tests; carried in train/82 e072e47a9. Behind LOKI_SPEED=1. |
+| D61-08 | D62 P1: D61 slice 8, deterministic decomposer DAG | new engine10/decompose.ts, tests engine10/decompose.test.ts | MEDIUM | released@2026-10-16T00:49Z | train/81 dd2995153, red on Tests; carried in train/82 e072e47a9. Behind LOKI_SPEED=1. |
 | D62-FIX | D62 P3: root action.yml routes to Loki 10 (no `--simple`), plus one real end-to-end BUDGET_STOP exit 3 test | action.yml, tests for action and budget e2e | MEDIUM | merged@2026-10-03T02:28Z | train/81 dd2995153, red on Tests; carried in train/82 e072e47a9. |
-| D61-02 | D62 P1: D61 slice 2, lean prefix default plus byte-identity guard | e10ext/lean_prefix.ts, stages/implement.ts, stages/fix.ts | MEDIUM | merged@2026-10-03T02:00Z | train/80 5520e26ae, red on Tests (P9 CI flake that predates the train) and Coverage; carried in train/82 e072e47a9. |
-| D61-07 | D62 P1: D61 slice 7, worktree dependency prep | autonomy/lib/worktree_prep.py, tests/test-worktree-prep.sh | MEDIUM | merged@2026-10-03T02:00Z | train/80 5520e26ae, red on Tests (P9 CI flake that predates the train) and Coverage; carried in train/82 e072e47a9. |
+| D61-02 | D62 P1: D61 slice 2, lean prefix default plus byte-identity guard | e10ext/lean_prefix.ts, stages/implement.ts, stages/fix.ts | MEDIUM | released@2026-10-16T00:49Z | train/80 5520e26ae, red on Tests (P9 CI flake that predates the train) and Coverage; carried in train/82 e072e47a9. |
+| D61-07 | D62 P1: D61 slice 7, worktree dependency prep | autonomy/lib/worktree_prep.py, tests/test-worktree-prep.sh | MEDIUM | released@2026-10-16T00:49Z | train/80 5520e26ae, red on Tests (P9 CI flake that predates the train) and Coverage; carried in train/82 e072e47a9. |
 | D62-VIS | D62 P2a: visual evidence in PRs (local Playwright screenshots of changed pages in the PR body) | loki-ts/src/features/visual_evidence.ts, engine10/stages/seal.ts, tests | MEDIUM | merged@2026-10-03T02:57Z | train/82 e072e47a9 with D12 B1-B3 fixes (e035e9929). LOKI_VISUAL_EVIDENCE stays off until the HIGH re-review approves. |
 | D62-JIRA | D62 P2c: Jira and Linear intake into v10 via autonomy/issue-providers.sh, intake only | loki-ts/src/features/tracker_intake.ts, tests | MEDIUM | merged@2026-10-03T02:28Z | train/81 dd2995153, red on Tests; carried in train/82 e072e47a9. |
 | D64-VIS | D64 1: visual evidence, local Playwright screenshots plus trace or video of changed pages in the PR body and receipt | new loki-ts/src/engine10/evidence_visual.ts, engine10/pr_body.ts hook, tests | MEDIUM | parked | D64 withdrawn 00:25Z; not started. |
@@ -728,8 +753,8 @@ Source: ~/git/autonomi-dev/research/2026-09-30-adoption/SWARM-PROMPT-ADOPTION.md
 | D64-MEM | D64 9: project memory (D50 item 3) in the v10 context pack | new loki-ts/src/e10ext/project_memory.ts, tests | MEDIUM | parked | D64 withdrawn 00:25Z; not started. |
 | D64-INTAKE | D64 10: Jira, Linear and Sentry intake into v10 via autonomy/issue-providers.sh | autonomy/issue-providers.sh, v10 intake ref parsing, tests | MEDIUM | parked | D64 withdrawn 00:25Z; not started. |
 | D64-EASE | D64 ease: first-run gate ease row (time to first PR, prompt count), published in METRICS | first-run gate script, docs/v10/FIRST-RUN-GATE.md, METRICS | MEDIUM | parked | D64 withdrawn 00:25Z; not started. |
-| D61-05 | D65: D61 slice 5, warm engine socket in the dashboard daemon | engine10/dashboard/server.ts, new engine10/warm.ts, tests | MEDIUM | merged@2026-10-03T02:28Z | train/81 dd2995153, red on Tests; carried in train/82 e072e47a9. |
-| D61-06 | D65: D61 slice 6, CLI warm client with 50ms socket try and cold fallback | engine10/cli.ts, new engine10/warm_client.ts, tests | MEDIUM | merged@2026-10-03T02:28Z | train/81 dd2995153, red on Tests; carried in train/82 e072e47a9. |
+| D61-05 | D65: D61 slice 5, warm engine socket in the dashboard daemon | engine10/dashboard/server.ts, new engine10/warm.ts, tests | MEDIUM | released@2026-10-16T00:49Z | train/81 dd2995153, red on Tests; carried in train/82 e072e47a9. |
+| D61-06 | D65: D61 slice 6, CLI warm client with 50ms socket try and cold fallback | engine10/cli.ts, new engine10/warm_client.ts, tests | MEDIUM | released@2026-10-16T00:49Z | train/81 dd2995153, red on Tests; carried in train/82 e072e47a9. |
 | D65-CP | D65 D63-3: Control Plane as the default UI plus BLOCKED answer UI | packages/control-plane, loki control wiring | MEDIUM | merged@2026-10-03T02:28Z | train/81 dd2995153, red on Tests; carried in train/82 e072e47a9. |
 | D65-SLACK | D65 D63-4: Slack two-way (@loki starts a run, BLOCKED answers return) | new integrations slack module, docs | MEDIUM | merged@2026-10-03T02:28Z | train/81 dd2995153, red on Tests; carried in train/82 e072e47a9. |
 | D65-SPEC | D65 D63-6: spec to delivery contract with criteria traced in the receipt | loki-ts/src/features/contract.ts, receipt fields | MEDIUM | merged@2026-10-03T02:57Z | train/82 e072e47a9 with D12 C1 fixes (4bf0f5236) and spawn env (32b9db508). LOKI_CONTRACT stays off until the HIGH re-review approves. |
@@ -739,19 +764,19 @@ Source: ~/git/autonomi-dev/research/2026-09-30-adoption/SWARM-PROMPT-ADOPTION.md
 | D65-SPEC-F1 | D12 should-fix from the HIGH re-review: contract read requires a regular file with a size cap (a FIFO at .loki/contract.json hangs seal), and malformed or unreadable criteria add one NOT PROVEN line instead of being dropped | loki-ts/src/features/contract.ts, tests/features/contract.test.ts | MEDIUM | merged@2026-10-03T03:13Z | Review af6ddde5 2026-10-03T03:03Z; fails closed today, no false VERIFIED. TL APPROVE; 92bf182b4 plus D70 default-on 960f4b57c in train/83 1a63ad156. |
 | D65-SPEC-F2 | D12 should-fix (design): snapshot or hash .loki/contract.json at intake so the implementing agent cannot edit it before seal | loki-ts/src/features/contract.ts, engine10 intake | HIGH | merged@2026-10-03T08:22Z | opus r2 APPROVE (mutation red 2/18); main 4bf62e271 054caef8b + dist 4088f8cb3 |
 | D62-VIS-F1 | D12 should-fix: SIGKILL the dev server process group after a short grace (a SIGTERM-ignoring server survives capture); verifyReceipt requires regular files for evidence_screens (path "." throws EISDIR) | loki-ts/src/features/visual_evidence.ts, tests/features/visual_evidence.test.ts | MEDIUM | merged@2026-10-03T10:22Z | merged 95254a6cf a8d9873f9 c5a8743d7 (opus r3 APPROVE; finish() reaps groups every exit, mutation red), dist 0ab093f25 guard 13/0, bun 48/0. Advisories A1 pgid reuse, A2 bg dev server killed at worker exit (follow-up) |
-| D61-03 | D61 slice 3, lean eligibility without a named file behind LOKI_SPEED | engine10/sizing.ts, features/speed/lean_select.ts, tests engine10/sizing_lean.test.ts | MEDIUM | merged@2026-10-03T03:13Z | TL APPROVE; 999ea6af3 in train/83 1a63ad156. |
-| D61-09 | D61 slice 9, decomposability check with strict-schema confirm | features/speed/decompose_check.ts, tests engine10/decompose_check.test.ts | MEDIUM | merged@2026-10-03T03:13Z | TL APPROVE; 0393c5a6b in train/83 1a63ad156. |
-| D61-15 | D61 slice 15, live unit grid (dashboard /g/<group>, Control Plane group_id) | features/speed/group_grid.ts, engine10/dashboard, packages/control-plane runs and drizzle 0001 | MEDIUM | merged@2026-10-03T03:14Z | TL APPROVE plus should-fix (400 on bad encoding); 024a4d16b, 79eac0297 on main for train/84. Add a drizzle 0001 snapshot before the next schema change. |
-| D61-10 | D61 slice 10, unit runner (backlog.py --dag) | autonomy/lib/backlog.py, tests/test-backlog-units.sh | MEDIUM | merged@2026-10-03T03:15Z | TL APPROVE; ad4f4b926. Follow-up D61-10-F1 1e844e066 TL APPROVE (30/0), approved@2026-10-03T03:33Z. |
-| D61-11 | D61 slice 11, unit run mode (write-set fence, pack-only brief, unit cost cap) | features/speed/unit_mode.ts, e10ext/scope.ts, e10ext/context.ts | HIGH | (not recorded; see Notes) | merged@2026-10-03T12:52Z | 48006fdbe..a56978deb, opus HIGH r3 APPROVE (169/0, tsc 0). Fence and pack-only brief only: unitCapEnv has no caller, so no unit cost cap is enforced yet (see D61-11b). |
-| D61-11b | Wire the unit cost cap (unitCapEnv) into the real unit spawn path, fail closed with a NOT PROVEN note on a bad unit spec, read the spec at intake from outside the worktree, and state in slice 12 that FAILED units are never merged (backstopCommit runs add -A unfenced) | features/speed/unit_mode.ts, e10ext/scope.ts, e10ext/context.ts | HIGH | merged@2026-10-03T13:16Z | Merged f6dea72bd+5e6b5e9c3, dist 095f17e79. r2 opus APPROVE (18 containment cases, revert-red 22/1, supervisor rc=2 probe). Main: budget+unit_mode+features+supervisor 320/0, tsc 0, dist guard 13/0. Advisories carded: gate maybeRunGroup on !u; supervisor main() rc=2 test; win32 sep. |
+| D61-03 | D61 slice 3, lean eligibility without a named file behind LOKI_SPEED | engine10/sizing.ts, features/speed/lean_select.ts, tests engine10/sizing_lean.test.ts | MEDIUM | released@2026-10-16T00:49Z | TL APPROVE; 999ea6af3 in train/83 1a63ad156. |
+| D61-09 | D61 slice 9, decomposability check with strict-schema confirm | features/speed/decompose_check.ts, tests engine10/decompose_check.test.ts | MEDIUM | released@2026-10-16T00:49Z | TL APPROVE; 0393c5a6b in train/83 1a63ad156. |
+| D61-15 | D61 slice 15, live unit grid (dashboard /g/<group>, Control Plane group_id) | features/speed/group_grid.ts, engine10/dashboard, packages/control-plane runs and drizzle 0001 | MEDIUM | released@2026-10-16T00:49Z | TL APPROVE plus should-fix (400 on bad encoding); 024a4d16b, 79eac0297 on main for train/84. Add a drizzle 0001 snapshot before the next schema change. |
+| D61-10 | D61 slice 10, unit runner (backlog.py --dag) | autonomy/lib/backlog.py, tests/test-backlog-units.sh | MEDIUM | released@2026-10-16T00:49Z | TL APPROVE; ad4f4b926. Follow-up D61-10-F1 1e844e066 TL APPROVE (30/0), approved@2026-10-03T03:33Z. |
+| D61-11 | D61 slice 11, unit run mode (write-set fence, pack-only brief, unit cost cap) | features/speed/unit_mode.ts, e10ext/scope.ts, e10ext/context.ts | HIGH | (not recorded; see Notes) | released@2026-10-16T00:49Z | 48006fdbe..a56978deb, opus HIGH r3 APPROVE (169/0, tsc 0). Fence and pack-only brief only: unitCapEnv has no caller, so no unit cost cap is enforced yet (see D61-11b). |
+| D61-11b | Wire the unit cost cap (unitCapEnv) into the real unit spawn path, fail closed with a NOT PROVEN note on a bad unit spec, read the spec at intake from outside the worktree, and state in slice 12 that FAILED units are never merged (backstopCommit runs add -A unfenced) | features/speed/unit_mode.ts, e10ext/scope.ts, e10ext/context.ts | HIGH | released@2026-10-16T00:49Z | Merged f6dea72bd+5e6b5e9c3, dist 095f17e79. r2 opus APPROVE (18 containment cases, revert-red 22/1, supervisor rc=2 probe). Main: budget+unit_mode+features+supervisor 320/0, tsc 0, dist guard 13/0. Advisories carded: gate maybeRunGroup on !u; supervisor main() rc=2 test; win32 sep. |
 | P1-DISCARD-PROTO | discardIfSatisfied uses `f in pre` (e10ext/discard.ts:36): prototype-named files (constructor, toString) survive the ALREADY_SATISFIED discard, so the run reports completed with a source diff (breaks D50-F1). Use Object.hasOwn plus a real-git test | loki-ts/src/e10ext/discard.ts, loki-ts/tests/e10ext/discard*.test.ts | HIGH | merged@2026-10-03T05:10Z | opus APPROVE (real-git probe: 8 prototype names incl __proto__ and a/constructor all discarded; parent code discarded 1); cherry-picked 6e6a74680, e10ext 92/0. Sibling scope.ts:20-21 hole covered by D61-11 r3 |
 | D61-12 | D61 slice 12, integrator (ordered merges, fix units, 2-round cap) | features/speed/integrate.ts, tests features/speed/integrate.test.ts | HIGH | parked@2026-10-03T04:47Z | Round 7 opus BLOCK 5b788e895: exemption launders drops (B1,B2), context false positive (B3); round 8 is final: three-way containment, no exemption, else drop 04:47Z: round 8 opus BLOCK on 35a7b0c32 (C1-C4, S3: a dropped unit change reported merged and ready; E6 mode-only false fail). Final round spent: dropped from this window per D73; integrator design rework next window. |
-| D61-14 | D61 slice 14, group events plus terminal unit table | features/speed/group_output.ts, engine10/events.ts | MEDIUM | merged@2026-10-03T03:22Z | TL APPROVE; 61c598412. Should-fix: unref() the default repaint timer (fold into D61-16 caller slice). |
-| D61-04 | D61 slice 4, already-done off path | engine10 intake, features/speed | HIGH | merged@2026-10-03T05:22Z | opus r5 APPROVE (r4 probes 6/0, tar escape fails closed on BSD and GNU, 5 mutations red); cherry-picked 1f5873e2e..9c8ea1dea, dist 588658b36, docs 35deef1f9; engine10/features/e10ext 1338/0 on main |
+| D61-14 | D61 slice 14, group events plus terminal unit table | features/speed/group_output.ts, engine10/events.ts | MEDIUM | released@2026-10-16T00:49Z | TL APPROVE; 61c598412. Should-fix: unref() the default repaint timer (fold into D61-16 caller slice). |
+| D61-04 | D61 slice 4, already-done off path | engine10 intake, features/speed | HIGH | released@2026-10-16T00:49Z | opus r5 APPROVE (r4 probes 6/0, tar escape fails closed on BSD and GNU, 5 mutations red); cherry-picked 1f5873e2e..9c8ea1dea, dist 588658b36, docs 35deef1f9; engine10/features/e10ext 1338/0 on main |
 | D61-04-F | D61-04 should-fixes: base-tree temp copy leaks on SIGTERM/process.exit (cli.ts:350,359 skip finally); 4 race tests in already_done.test.ts leak one copy each (gate never released); empty root leak if mkdirSync(tree) throws | loki-ts/src/features/speed/already_done_async.ts, loki-ts/tests/engine10/already_done.test.ts | MEDIUM | merged@2026-10-03T05:31Z | Source: D61-04 r5 opus review. Core engine10 net 0 Built 5186f4717 (red 0/2, green 2/0, engine10+features 1243/0); sonnet TL review dispatched. TL APPROVE (54/0); cherry-picked, dist e6ac78c02, dist guard 13/0. Note: settle() uses fixed 300ms; poll if flaky. |
-| D61-13 | D61 slice 13, one Seal plus combined receipt with per-unit sub-receipts | engine10/stages/seal.ts, types.ts, pr_body.ts, features/speed | HIGH | merged@2026-10-03T04:25Z | Round 3 opus APPROVE a2c3d9cb2 (B2 held-UNCHECKED fixed, 4 mutations red, moat 4/9); cherry-picked 203eb79a2..116a17ad8, dist 7ad4a44e9. Pushes core to 5001 lines, P0-CORE-BUDGET trims |
-| D61-16 | D61 slice 16, route loki "<task>" and loki <file> through the decomposer behind LOKI_SPEED | engine10/cli.ts, supervisor.ts, features/speed/route.ts | HIGH | merged@2026-10-03T03:55Z | Opus APPROVE 37804c1b6; cherry-picked bb11c63e5 into train 85. Hardening D61-16-F in review. |
+| D61-13 | D61 slice 13, one Seal plus combined receipt with per-unit sub-receipts | engine10/stages/seal.ts, types.ts, pr_body.ts, features/speed | HIGH | released@2026-10-16T00:49Z | Round 3 opus APPROVE a2c3d9cb2 (B2 held-UNCHECKED fixed, 4 mutations red, moat 4/9); cherry-picked 203eb79a2..116a17ad8, dist 7ad4a44e9. Pushes core to 5001 lines, P0-CORE-BUDGET trims |
+| D61-16 | D61 slice 16, route loki "<task>" and loki <file> through the decomposer behind LOKI_SPEED | engine10/cli.ts, supervisor.ts, features/speed/route.ts | HIGH | released@2026-10-16T00:49Z | Opus APPROVE 37804c1b6; cherry-picked bb11c63e5 into train 85. Hardening D61-16-F in review. |
 | D63-C1 | CP-AUTH: bearer token on /v1/*, refuse non-loopback without token, Host check | control plane app, docs CONTROL-PLANE | HIGH | merged | Round 2 opus APPROVE; merged with C10 as bdf20587f, 180e1e283 (train 86) |
 | P0-VERIFY-ARG | loki verify without --pubkey drops args[0] and verifies the latest run (false green, from b073d50a1) | loki-ts/src/engine10/keys_cmd.ts, tests | HIGH | merged@2026-10-03T05:03Z | opus r3 APPROVE (B1 core net +2, B2/B3 mutations red, CLI test 7/0); cherry-picked 02e71bd41..78606f613, dist 7bfa73a64, dist guard 13/0 |
 | D63-C10 | CONTAINERS: token required in image docs, Helm and ECS | Dockerfile.control-plane, deploy/helm, deploy/ecs, docs | MEDIUM | merged | TL APPROVE 645c35a7f (helm required guard mutation red, 46/0); merged 1b2174fff (train 86) |
@@ -797,19 +822,19 @@ Source: ~/git/autonomi-dev/research/2026-09-30-adoption/SWARM-PROMPT-ADOPTION.md
 | PO-SESSION-COMMIT-1 | S-219 + S-220 re-cut (legacy run.sh): a failed git add -A makes the session commit silently commit nothing; the untrack step's global git reset drops force-staged agent files from the session commit | autonomy/run.sh (commit_session_changes add block ~11065 and _loki_untrack_agent_committed_user_files ~10985 only), tests/test-session-commit-add-failure.sh (new), tests/test-untrack-keeps-force-staged.sh (new), both registered in the runner with shard rows, CHANGELOG.md | both new tests rc 0 and red when the rc check or git reset -q is restored in a scratch copy; bash tests/test-branch-lifecycle.sh rc 0; bash -n autonomy/run.sh; shellcheck on changed files; structural-checks.sh rc 0 | MEDIUM | merged@2026-10-03T09:40Z | 939e23126. TL APPROVE (exit 128 aborts the add, index restore reproduced, both mutants red). On main: new tests 7/0 and 5/0, bash -n ok, shard 19/0, drift 6/0. |
 | PO-COUNCIL-LABEL-TEST-1 | S-213 re-cut: the Council vote header in cost.html and the council prefix plus title on the proofs.html badge have no test of their own | legacy-ui/tests/static-council-vote-label.node.test.mjs (new; reads legacy-ui-static/proofs.html and cost.html, edits neither) | node --test legacy-ui/tests/static-council-vote-label.node.test.mjs passes (proofs.html line 152 prefix and title, cost.html line 308 header); renaming the header or dropping the title in a scratch copy fails it | LOW | merged@2026-10-03T09:35Z | c331cde1a (r2 23f2c4e5f: content-anchored matching, shard row). CoS verified on main: node --test 2/0, shard coverage 19/0, drift 6/0. Test-only, no CHANGELOG. |
 | PO-P7-SINKS-1 | E-138: P7 no-fabricated-data scanner misses optional-call sinks and one-hop aliases (setRows?.([...]), window[k]?.(rows), const s = setRows; s(rows), a memo that forwards a fabricator result) | tests/moat/p7-no-fabricated-data.sh (and its red and green fixtures under tests/moat/ only) | bash tests/moat/p7-no-fabricated-data.sh with a red and a green fixture per form, each red before the change; the existing fixtures keep their verdicts; moat suite 4/9 or better unchanged | HIGH | merged@2026-10-03T09:46Z | b2b592b29. Opus APPROVE: 13 added findings, 0 removed, real tree 0 findings, each arm mutation-red. On main all four P7 cases PASS. Advisory: SCALAR_READ exclusion has no pinning fixture. |
-| A-04d | A-04c follow-up (opus r5 advisories A1, A3): loki-seal Known limits must name empty body or early return, an assertion only in a helper declared after the test, same-name or keyword collisions across files, and forged runner-format lines printed by a test; fix the README sentence the matched test body must contain an assertion | packages/loki-seal/README.md, packages/loki-seal/skills/loki-seal/SKILL.md, CHANGELOG.md | grep finds each of the four limits in README Known limits; bash packages/loki-seal/test/run.sh 72/0; no code change | LOW | merged@2026-10-03T09:46Z | aa4770f57; seal suite 72/0. Plus 0b-fix: escaped U+2714/U+2716 marks in an A-04c fixture that turned structural-checks emoji scan red on main. |
+| A-04d | A-04c follow-up (opus r5 advisories A1, A3): loki-seal Known limits must name empty body or early return, an assertion only in a helper declared after the test, same-name or keyword collisions across files, and forged runner-format lines printed by a test; fix the README sentence the matched test body must contain an assertion | packages/loki-seal/README.md, packages/loki-seal/skills/loki-seal/SKILL.md, CHANGELOG.md | grep finds each of the four limits in README Known limits; bash packages/loki-seal/test/run.sh 72/0; no code change | LOW | released@2026-10-16T00:49Z | aa4770f57; seal suite 72/0. Plus 0b-fix: escaped U+2714/U+2716 marks in an A-04c fixture that turned structural-checks emoji scan red on main. |
 | D51-B13r | Read-only workspace runs API over integration.json (runs never produce group.json) | dashboard/api_workspaces.py (new), dashboard/api_operator.py (2 GET routes only), tests/dashboard/test_api_workspaces.py (new) | `python3 -m pytest tests/dashboard/test_api_workspaces.py -q` (red: module absent) | MEDIUM | merged@2026-10-03T10:14Z | merged 6d927b5c6 (TL approve; cherry-pick of 4fbb99b40), wall shard 19/0 drift 6/0 |
 | D51-B14r | Start page "Workspace runs" card: per-repo rows, integration row, stale badge; an unreadable run shows an error, never an empty card | legacy-ui-static/start.html, legacy-ui/tests/start-workspace-card.node.test.mjs (new), run-all-tests.sh line | `node --test legacy-ui/tests/start-workspace-card.node.test.mjs` (red: no card) | LOW | merged@2026-10-03T10:50Z | 1280b2781 + 7329ab5f1 on main (TL APPROVE r2, node 5/0, red 4/1) |
 | D51-B16r | E2E through the real CLI routes, plus the "verify a workspace run" doc | tests/workspace/99-e2e.sh (new), docs/WORKSPACES.md | `bash tests/test-workspace.sh` (red: 99-e2e asserts absent) | MEDIUM | merged@2026-10-03T10:14Z | merged 4341f84a5 (approve; cherry-pick of ef73d6c6d), test-workspace 33/0 |
 | WS-INTERRUPT | SIGTERM/SIGINT writes integration.json status=interrupted; status lists an unreadable run as "unreadable" | autonomy/lib/workspace.py (stop, _runs, status only), tests/workspace/55-interrupt.sh (new) | `bash tests/test-workspace.sh` | MEDIUM | merged@2026-10-03T10:14Z | merged 52f510d71 (approve; cherry-pick of e70cdcc6d) |
 | WS-PREP-BOUND | Bound the prep lock to 120s then FAILED; refuse relative-symlink escape and source-path shebangs | autonomy/lib/worktree_prep.py, tests/test-worktree-prep.py | `python3 tests/test-worktree-prep.py` | MEDIUM | merged@2026-10-03T10:14Z | merged 7c37faa8d (approve; cherry-pick of a2f2718d3), test-worktree-prep OK |
 | P2-FV-EXIT | fast_verify exit codes: INCONCLUSIVE=3, unknown flag=64, missing root=2; retire the overdue pending line | autonomy/lib/fast_verify.py (main only), tests/test-fast-verify.sh, tests/moat/pending.txt (1 line), docs/exit-codes.md (--fast row) | `bash tests/moat/run.sh` no rule failed, P2 passes on both routes | HIGH | merged@2026-10-03T10:22Z | merged c4afa7344 458dfdfb5 (TL r2 APPROVE): --path alias, --help 0; airgap 4/0, fast-verify 17/0, moat P2.fast-verify-inconclusive-not-zero PASS on main |
-| S-215r | proof-pr.sh python cannot be shadowed by a cwd json.py | autonomy/lib/proof-pr.sh (render_evidence_receipt_md), tests/test-proof-pr-no-cwd-shadow.sh (new) | the new test (red on main) | HIGH | merged@2026-10-03T10:14Z | merged c6536dfe2 (opus approve; cherry-pick of b4176f42e). On main checkout proof-pr suite 5/1 only on the .loki/state/provider leg: the gitignored file predates the slice (Sep 30 17:58), environmental; builder worktree 6/0. CoS decision 10:14Z |
-| S-216r | verify.sh python readers are isolated from cwd shadowing | autonomy/verify.sh (reader sites 190,591,1269,1271,1295,1337,1339,1441), tests/test-verify-no-cwd-shadow.sh (new) | the new test | HIGH | merged@2026-10-03T10:35Z | r3 opus APPROVE; cherry-picked 100535de2 f38a93966 77b84becc; main: cwd-shadow 20/0, test-verify 25/0; test now flags only a provider file created during the run (6185c5249); CHANGELOG deduped. Advisories: label no-interpreter as inconclusive, add a dynamic leg for line 3117 |
-| S-218r | _loki_untracked_status cannot run a repo-local fsmonitor | autonomy/run.sh (_loki_untracked_status only), tests/test-untracked-status-fsmonitor.sh (new) | the new test | HIGH | merged@2026-10-03T10:56Z | r5 opus APPROVE (version spoofs, nonce, B1 retry all fail closed); main 0b6604fd9 + CHANGELOG collapse 1ff144efb; fsmonitor 21/0, branch-lifecycle 83/83; advisories A1 digit-length cap, A2 two-call race; in train/95 |
+| S-215r | proof-pr.sh python cannot be shadowed by a cwd json.py | autonomy/lib/proof-pr.sh (render_evidence_receipt_md), tests/test-proof-pr-no-cwd-shadow.sh (new) | the new test (red on main) | HIGH | released@2026-10-16T00:49Z | merged c6536dfe2 (opus approve; cherry-pick of b4176f42e). On main checkout proof-pr suite 5/1 only on the .loki/state/provider leg: the gitignored file predates the slice (Sep 30 17:58), environmental; builder worktree 6/0. CoS decision 10:14Z |
+| S-216r | verify.sh python readers are isolated from cwd shadowing | autonomy/verify.sh (reader sites 190,591,1269,1271,1295,1337,1339,1441), tests/test-verify-no-cwd-shadow.sh (new) | the new test | HIGH | released@2026-10-16T00:49Z | r3 opus APPROVE; cherry-picked 100535de2 f38a93966 77b84becc; main: cwd-shadow 20/0, test-verify 25/0; test now flags only a provider file created during the run (6185c5249); CHANGELOG deduped. Advisories: label no-interpreter as inconclusive, add a dynamic leg for line 3117 |
+| S-218r | _loki_untracked_status cannot run a repo-local fsmonitor | autonomy/run.sh (_loki_untracked_status only), tests/test-untracked-status-fsmonitor.sh (new) | the new test | HIGH | released@2026-10-16T00:49Z | r5 opus APPROVE (version spoofs, nonce, B1 retry all fail closed); main 0b6604fd9 + CHANGELOG collapse 1ff144efb; fsmonitor 21/0, branch-lifecycle 83/83; advisories A1 digit-length cap, A2 two-call race; in train/95 |
 | HONEST-READ-1 | A corrupt or denied file gives 503 or an error row, never an empty list | dashboard/server.py (list_proofs, memory patterns/episodes/skills/index only), legacy-ui-static/proofs.html, tests/dashboard/test_unreadable_not_empty.py (new) | `python3 -m pytest tests/dashboard/test_unreadable_not_empty.py -q` | LOW | merged@2026-10-03T10:14Z | merged 05c0940e9 (approve; cherry-pick of a29956235), pytest 12 passed |
-| S-226r | An unmeasured cost reads "unmeasured", not $0.00, in stats and status on both routes (absorbs S-227) | autonomy/loki (cmd_stats, cmd_status budget block), loki-ts/src/commands/stats.ts, loki-ts/src/commands/status.ts (readBudgetField), tests/test-stats-unmeasured-cost.sh + tests/test-status-budget-unmeasured.sh (new) | both new tests plus `cd loki-ts && bun test` | MEDIUM | merged@2026-10-03T10:14Z | merged e2c283a40 (approve; cherry-pick of 72df5665e), stats 8/0 status 8/0 |
-| S-231r | Rename the CI moat job to what it proves | .github/workflows/test.yml (job name and summary echo only) | `git grep -n "name: Moat suite" -- .github` prints nothing | LOW | merged@2026-10-03T11:19Z | d8cb2bc9c on main; TL APPROVE (job id kept, no display-name consumer; CoS verified no protection or ruleset context) |
+| S-226r | An unmeasured cost reads "unmeasured", not $0.00, in stats and status on both routes (absorbs S-227) | autonomy/loki (cmd_stats, cmd_status budget block), loki-ts/src/commands/stats.ts, loki-ts/src/commands/status.ts (readBudgetField), tests/test-stats-unmeasured-cost.sh + tests/test-status-budget-unmeasured.sh (new) | both new tests plus `cd loki-ts && bun test` | MEDIUM | released@2026-10-16T00:49Z | merged e2c283a40 (approve; cherry-pick of 72df5665e), stats 8/0 status 8/0 |
+| S-231r | Rename the CI moat job to what it proves | .github/workflows/test.yml (job name and summary echo only) | `git grep -n "name: Moat suite" -- .github` prints nothing | LOW | released@2026-10-16T00:49Z | d8cb2bc9c on main; TL APPROVE (job id kept, no display-name consumer; CoS verified no protection or ruleset context) |
 | PO-TEST-1 | Tests for scripts/metrics-usage-append.py | tests/test-metrics-usage-append.sh (new), runner and shard registration | red-then-green, shellcheck, structural guards; never writes the real METRICS.md | LOW | merged@2026-10-03T09:01Z | merged 41103e5c3 (TL APPROVE; suite + shard/registration guards green)|
 | PO-TEST-2 | Tests for scripts/check-inline-scripts.js | tests/test-check-inline-scripts.sh (new), runner and shard registration | valid exits 0, broken fixture exits 1, structural guards | LOW | merged@2026-10-03T09:01Z | merged 8b3fa5af4 (TL APPROVE; suite + shard/registration guards green)|
 | PO-TEST-3 | Tests for scripts/clean-test-branches.sh safety rules | tests/test-clean-test-branches.sh (new), runner and shard registration | refusals proven in a throwaway repo; mutation dropping main refusal goes red; structural guards | MEDIUM | merged@2026-10-03T09:01Z | merged 75953c210 (TL APPROVE; suite + shard/registration guards green)|
@@ -871,53 +896,53 @@ Source: ~/git/autonomi-dev/research/2026-09-30-adoption/SWARM-PROMPT-ADOPTION.md
 | D82-WALL0 | Empty Wall seal is NOT PROVEN; nested Wall files collected | loki-ts engine10 wall and seal | HIGH | opus APPROVE r2, wall+seal 101/0 | merged@15:33Z 9b87e50c8 | D82 10.7.0 big train |
 | D83-CPE | Enterprise Control Plane UI rebuild, slices CPE-01..26 per docs/v10/CP-ENTERPRISE-UI.md, integrating on branch cpe-base | packages/control-plane, loki-ts engine10 run_pid | HIGH | per-slice Wall checks, opus on 04/07/09/14 | building@15:33Z (01,03,05,21 on cpe-base; 04,07 in opus review; 02,09 building) | D83 10.8.0 |
 | FC-09r | FC-09 rework f4eccfeac BLOCKED by rv-trust3 (reproduced): package.json pretest/posttest/test:* edits return no runner-config note; compare the whole scripts object, and have verify compare base vs head runner sections; add go.mod replace, Cargo.toml [patch], package.json overrides/imports, tsconfig paths | loki-ts/src/features/runner_config.ts plus its tests | HIGH | bun repro: a pretest-only edit caps the verdict; runner_config tests green | released@2026-10-15T23:55Z | Do not merge f4eccfeac as is. Opus reviewer. |
-| FC-09s | FC-09 sibling sweep from the FC-09r opus review (bun probe reproduced): runner_config misses (1) Cargo.toml top-level dotted keys such as patch.crates-io.serde = { path = "fake" } before [package]; (2) go.work replace directives (go.work is not in RUNNER_CONFIGS); (3) babel.config.*, .babelrc, .pnpmfile.cjs, Cargo [[test]] harness=false and Cargo [dev-dependencies] path=; also add one verify-stage case where a package.json pretest edit caps the verdict | loki-ts/src/features/runner_config.ts, loki-ts/tests/engine10/runner_config.test.ts, loki-ts/tests/engine10/verify_weak.test.ts | HIGH | each probe above caps the verdict to NOT PROVEN; a plain version bump still does not cap | merged@2026-10-16T00:00Z | FC-09 sibling (L5). No core engine10 lines (4998 of 5000). |
-| FC-09t | FC-09s opus review follow-ups (all reproduced as pre-existing misses): P1 Cargo section headers with a trailing comment or inner spaces ([patch.crates-io] # local, [ patch.crates-io ], [dev-dependencies] # t) are not seen, so path= under them does not cap; Cargo [dependencies] and [workspace.dependencies] path= (parity with npm depGuard); dev-dependency git =; [[test]] path = and [lib] test = false; go.work use ./x lines and a new go.work with only use lines; .pnpmfile.mjs | loki-ts/src/features/runner_config.ts, loki-ts/tests/engine10/runner_config.test.ts | HIGH | each probe caps; plain version bumps do not cap | review@2026-10-16T00:27Z | r4 5f4e626bb on branch fc09t-wip in Opus round-4 review (r2 9e00d7c21 and r3 064cb191b were Opus-BLOCKED). FC-09 sibling (L5). No core engine10 lines. |
-| FV-evidence-sha-1 | Bind integration status and exit code into the composite: In composeComposite and verifyComposite (seal_group.ts), read integration.json status/exit_code. Seal throws unless status is passed or not_configured. Verify returns TAMPERED when status is failed/interrupted or exit_code is nonzero. Add integration {status, exit_code, log_sha256, heads} to Composi | loki-ts/src/features/speed/seal_group.ts | HIGH | Extend loki-ts/tests/engine10/seal_group.test.ts: writeWs fixture (line ~341) with status:failed. Red: current code seals VERIFIED then verify passes; green: se | building@2026-10-16T00:12Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
-| FV-evidence-sha-2 | Bind integration.log hash and require non-null heads: In composeComposite refuse null/missing heads[repo] and, when log_sha256 is non-null, recompute sha256 of <run>/integration.log and throw on mismatch/missing. In verifyComposite do the same (TAMPERED on log mismatch) and make integrated-head mismatch TAMPERED rather than UNCHECKED (matches seal). Ke | loki-ts/src/features/speed/seal_group.ts | HIGH | Extend seal_group.test.ts tests at ~458 (null head) and ~406 (head edit): add log swap case; update null-head expectation to seal-refuse, add legacy-case UNCHEC | building@2026-10-16T00:12Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
-| FV-evidence-sha-3 | Show SHAs and integration status in verify output and fix stale note: Make `loki verify <run-dir>/composite.json` and the --seal-composite output print per-repo head_sha, integration status and log hash (verify_cmd.ts:132 and the composite verify branch near :111-122). Delete the stale `seal: False` and 'only when the run seals one' note in workspace.py run_integratio | loki-ts/src/engine10/verify_cmd.ts, autonomy/lib/workspace.py | MEDIUM | Extend loki-ts/tests/engine10/verify_cmd.test.ts (composite output contains each 40-hex head and 'integration: passed') and the existing workspace python test f | building@2026-10-16T00:12Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
-| FV-evidence-sha-4 | Correct workspace guide on what the Seal covers, reachable from chat: Update docs/WORKSPACES.md lines 39, 55-59: state integration.json, integration status, log hash and every head SHA are inside the signed composite; list the new TAMPERED conditions (failed status, log swap, head mismatch); state explicitly that deployed-SHA binding is not implemented. Remove the now | docs/WORKSPACES.md | LOW | Extend the existing docs/claims guard test if present (grep tests for WORKSPACES.md); otherwise a grep assertion in seal_group.test.ts is not needed: manual che | building@2026-10-16T00:12Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
-| FV-readiness-env-1 | Readiness score + findings in loki doctor --repo: Add pure function repoReadiness(profile, reqs) in repo_profile.ts returning {score 0-100, grade, findings[{id,severity,message,fix}]}. Rules from existing profile fields: no test cmd (-30), baseline not run/timed out/not attributable (-15), baseline red with N failing ids (-20, fix: 'loki start will | loki-ts/src/runner/repo_profile.ts, loki-ts/src/commands/doctor.ts | LOW | Extend loki-ts/tests/runner/harness_intelligence.test.ts REPOMEM block (near :764 and :634): red = assert readiness absent/undefined fails for profiles with no  | building@2026-10-16T00:12Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
-| FV-readiness-env-2 | doctor --repo builds the profile on demand (--fix applies safe repo repair): When profile is absent, `loki doctor --repo` calls the existing ensureProfile(process.cwd()) (honours LOKI_REPO_BASELINE=0, never throws) instead of printing 'none yet'; keep read-only printing when a fresh profile exists. Allow --repo --fix to mean 'build/refresh profile' (replace the exit-64 rejec | loki-ts/src/commands/doctor.ts, loki-ts/src/runner/repo_profile.ts | MEDIUM | Extend harness_intelligence.test.ts :764 test: red = absent profile in a temp git repo with package.json test script prints 'none yet'; green = doctor --repo cr | building@2026-10-16T00:12Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
-| FV-readiness-env-3 | Reach readiness from loki start and loki chat: Add /doctor (alias /ready) slash to loki chat delegating via _chat_do "$loki" doctor --repo (plus --json passthrough), listed in _chat_help. In loki start's existing first-run/summary output, print the one-line 'Readiness: NN/100' from the same repoReadiness helper after intake builds the profile (i | autonomy/lib/chat.sh, loki-ts/src/engine10/stages/intake.ts | LOW | Extend an existing chat test if present (grep tests/ for chat help assertions, e.g. tests/test-first-run-funnel-coverage.sh) to assert /doctor appears in /help  | building@2026-10-16T00:12Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
-| FV-readiness-env-4 | Docs reconcile + remove dead doctor-fix.py: Update docs/CLI-REFERENCE.md and docs/cli-reference.md (merge into one if one is a duplicate, delete the other and fix links) doctor row to list --json --fix --requirements --repo and readiness score; add a short Readiness section. Verify then delete autonomy/lib/doctor-fix.py and tests/test_doctor_ | docs/CLI-REFERENCE.md, docs/cli-reference.md, autonomy/lib/doctor-fix.py, tests/test_doctor_fix_plan.py | LOW | Existing docs-vs-help guard (grep tests/ for CLI-REFERENCE checks) must stay green; after deletion run tests/run-all-tests.sh doctor subset (test-doctor-ux.sh,  | building@2026-10-16T00:12Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
-| FV-docs-pin-1 | Fix `loki answer` wording everywhere: Change 'Resume a BLOCKED run' to 'Start a follow-up run from a BLOCKED run with your answer' in the single registry string and help text; run generate-stale-zero.sh so CLI-REFERENCE regenerates; fix README.md:105 and autonomy/loki:1685 help; add one line to docs/slack.md that CLI `loki answer` has t | loki-ts/src/cli/registry.ts, loki-ts/src/cli.ts, README.md, autonomy/loki, docs/slack.md, docs/CLI-REFERENCE.md | LOW | Extend loki-ts/tests registry/help snapshot test (or tests/test-docs-cli-drift.sh): red = grep 'Resume a BLOCKED' returns hits in registry.ts/README/cli.ts; gre | building@2026-10-16T00:12Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
-| FV-docs-pin-2 | Correct wiki/Providers.md capability table from provider files: Edit existing table (wiki/Providers.md:11-18) to match providers/*.sh: context windows, codex parallel (max 2, degraded), cline MCP yes; add Degraded column; add a one-line 'source: providers/*.sh PROVIDER_* vars' note. Mirror the same facts in README.md:116 only if it disagrees. No new doc. | wiki/Providers.md, README.md | LOW | Extend tests/test-no-stale-facts.sh (or test-docs-cli-drift.sh) with a check that for each provider the doc row's Parallel/MCP/context value equals the provider | building@2026-10-16T00:12Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
-| FV-docs-pin-3 | Reconcile Node floor and install claims: Make README.md:142 and docs/INSTALLATION.md:60 say Node 20+ (matches package.json engines >=20.0.0 and wiki/Installation.md:11); verify against bin/loki runtime check for the Node guard and keep the stricter source of truth. | README.md, docs/INSTALLATION.md, wiki/Installation.md | LOW | Extend tests/test-no-stale-facts.sh: red = grep 'Node.js 18' README/INSTALLATION; add assertion that min-Node string in docs equals package.json engines.node; g | building@2026-10-16T00:12Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
-| FV-docs-pin-4 | Stamp wiki pages to current VERSION and fix legacy-engine banner: Replace the 13 stale 10.6.6 version stamps with 11.11.0 (pin to 11.12.0 at release via generate-stale-zero.sh by adding wiki/*.md line-3 stamp to its targets), delete the 'legacy engine, being removed' banner in wiki/CLI-Reference.md:3 and drop or mark rows for commands not in registry (compound, cp | scripts/generate-stale-zero.sh, wiki/CLI-Reference.md, wiki/Architecture.md, wiki/Dashboard.md, wiki/Home.md, tests/test-no-stale-facts.sh | MEDIUM | Extend tests/test-no-stale-facts.sh to scan wiki/*.md version stamps against VERSION (and tests/lib/scan-doc-cli-drift.py to cover wiki/): red = 13 pages flagge | building@2026-10-16T00:12Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
-| FV-deploy-observe-1 | Re-check health after auto-rollback and record it: After a rollback exits 0, re-probe health_url with _deploy_probe_health; add post_rollback_health (healthy/FAILED_HEALTH/unchecked) and health_http_code to the loki.deploy/1 record; replace the 'NOT re-checked' message. Return distinct exit if rollback also unhealthy. | autonomy/loki, docs/SIGNED-RECEIPTS.md | MEDIUM | Extend tests/test-deploy-receipt-gate.sh section 14-18 (line ~740): stub vercel/curl, red = record lacks post_rollback_health and message still says NOT re-chec | building@2026-10-16T00:12Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
-| FV-deploy-observe-2 | Acceptance beyond 2xx: --health-match and artifact evidence: Add `--health-match STR` to loki deploy (and pass-through on start --deploy): probe body must contain STR (e.g. HEAD sha or version) else FAILED_HEALTH; record health_match, health_http_code, tree_sha (git rev-parse HEAD^{tree}) in loki.deploy/1. | autonomy/loki, loki-ts/src/commands/start.ts, loki-ts/src/util/receipt_signer.ts | MEDIUM | Extend tests/test-deploy-receipt-gate.sh (stub curl body): red = mismatching body still reports healthy; green = FAILED_HEALTH exit 4. Extend start-flags allowl | building@2026-10-16T00:12Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
-| FV-deploy-observe-3 | Surface last deploy in `loki status` / `loki chat` context: Read newest .loki/deploys/*.json and show target, head_sha, health_status, rollback, signed/VERIFIED via existing verify path in `loki status` (and the chat context that status feeds). Gives 'observing' state without a new command. | loki-ts/src/commands/status.ts, loki-ts/src/util/receipt_signer.ts, loki-ts/tests/commands | LOW | Extend the existing status command test: fixture .loki/deploys/x.json with FAILED_HEALTH; red = status prints nothing about deploy; green = prints line and flag | building@2026-10-16T00:12Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
-| FV-deploy-observe-4 | Sentry brief correlates alert with latest deploy and culprit owner: In build_sentry_brief/handle_sentry_event, append release/environment from payload and, from the project's .loki/deploys newest record, 'last deploy <sha7> <finished_at> health=<status>' plus git log -1 author/commit for the culprit file when resolvable. Still PR-only, brief stays one sanitized line | autonomy/trigger-server.py, autonomy/issue-providers.sh, docs/sentry-intake.md | HIGH | Extend tests/test_trigger_server_hardening.py (sentry fixture ~line 749): red = brief lacks deploy context with a seeded deploy record; green = present, control | building@2026-10-16T00:12Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
-| FV-outcome-metrics-1 | Record intervention type and waited minutes at the pause site: Extend the existing interventions.json write in handlePause to also keep by_type counts {steer,input,authorization,repair} (mapped from the existing pause reasons: HUMAN_INPUT.md=input, PAUSE/checkpoint=authorization, budget/council force-review=repair/steer as appropriate, enum only, no free text)  | loki-ts/src/runner/intervention.ts, autonomy/run.sh, autonomy/lib/proof-generator.py | MEDIUM | Extend loki-ts/tests/runner/autonomous.test.ts (already drives intervention signals at :167-176): red = assert interventions.json has by_type + waited_s after a | building@2026-10-16T00:12Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
-| FV-outcome-metrics-2 | Add effort-per-outcome block to loki trust (cost, retries, misleading claims, interventions by type): Extend the existing trust derivation (TrustRun + computeTrajectory + formatTrajectoryHuman/Json) with: per-run cost_usd (proof.cost.usd, null when unmeasured), interventions_by_type and waited_s (from slice 1, null when absent), and an 'Outcome effort' summary: accepted = verdict VERIFIED; misleadin | loki-ts/src/metrics/trust.ts, autonomy/lib/trust_trajectory.py, loki-ts/src/commands/trust.ts | LOW | Extend loki-ts/tests/metrics/trust.test.ts (intervention axis block at :161) and tests/test_trust_trajectory.py: red = fixture of 4 proofs (2 VERIFIED, 1 false_ | building@2026-10-16T00:12Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
-| FV-outcome-metrics-3 | Surface the metric in HANDOFF.md and the final run line on engine10: Make engine10 handoff stop saying 'not recorded' for interventions: in composeHandoff read .loki/state/interventions.json (count, by_type, waited_s) when no steer.consumed/intervention events exist, render 'interventions N (input 1, authorization 1); waited 4m' and keep 'not recorded' only when the  | loki-ts/src/util/run_summary.ts | LOW | Extend loki-ts/tests/util/run_summary.test.ts: red = write interventions.json fixture in the temp repoDir, call composeHandoff/renderHandoff, expect the by-type | building@2026-10-16T00:12Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
-| FV-outcome-metrics-4 | Document metric definitions and align bench report to the same names: Add one 'Outcome analytics' section to the existing docs/EVALUATING.md defining accepted outcome, misleading completion (= attribution.py false_completion = trust false_verified), cost per accepted, interventions by type, waited vs active minutes (active minutes explicitly NOT measured; only waited  | docs/EVALUATING.md, benchmarks/bench/attribution.py | LOW | Extend the existing attribution test (benchmarks/bench tests, e.g. the one asserting false_completion and cost_per_accepted in the report) with an assertion tha | building@2026-10-16T00:12Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
-| FV-gh-steer-1 | Trigger server: authorized issue_comment steers, unauthorized ignored: Add handle_issue_comment_event to EVENT_HANDLERS: on action=created, comment on an issue/PR with a known run (match repo#N), require comment.author_association in OWNER/MEMBER/COLLABORATOR (same set as verify_pr.ts:150), skip bot/self comments and edited/deleted, one-line-bound the body, then run `l | autonomy/trigger-server.py, docs/DEPLOYMENT.md | HIGH | Extend tests/test_trigger.py TestEventRouting: red first with MEMBER comment -> steer args fired, NONE/CONTRIBUTOR comment -> 'skipped', bot comment skipped, fo | building@2026-10-16T00:12Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
-| FV-gh-steer-2 | Steer carries intent revision + actor + source: Make `loki steer` (and chat /steer through the same writer) record a numbered revision header (rev N, actor, source=cli/chat/github comment URL) in HUMAN_INPUT.md, and have steer.ts consumeSteer archive it and append an entry to .loki/intent-revisions.jsonl so scope changes are an auditable revision | autonomy/loki, loki-ts/src/util/steer.ts, loki-ts/tests/e10ext/steer.test.ts | MEDIUM | Extend loki-ts/tests/e10ext/steer.test.ts: red-then-green that consumeSteer on a header-bearing file returns the guidance and appends a revision record with rev | building@2026-10-16T00:12Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
-| FV-gh-steer-3 | Project engine10 status onto the originating issue (single updating comment): Generalise the supervisor's failure-only CommentStep (supervisor.ts:196-198) into a status projector: at plan done, steer applied, blocked, PR opened, and done, upsert ONE marker-tagged comment (<!-- loki-status -->) on the issue via a new `issue-comment --update` mode in engine10-push.sh (find by m | loki-ts/src/engine10/supervisor.ts, autonomy/lib/engine10-push.sh, loki-ts/src/engine10/types.ts | MEDIUM | Extend the existing supervisor test (loki-ts/tests/engine10 supervisor/issue_ref_e2e.test.ts with its fake gh in tests/engine10/fixtures/issue-ref/bin/gh): red- | building@2026-10-16T00:12Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
-| FV-gh-steer-4 | Steer ack back to the comment + chat parity: After slice 1 steers, acknowledge on the issue with an eyes reaction/short reply naming revision N and 'applies at next plan/implement stage' (or rejection reason for unauthorized: a single line, no run details), via engine10-push.sh. Ensure `loki chat` /steer and `loki start` print the same `rev N` | autonomy/trigger-server.py, autonomy/lib/engine10-push.sh, loki-ts/src/cli/registry.ts | LOW | Extend tests/test_trigger.py: red-then-green that an authorized comment dispatch also invokes the ack command with the revision and an unauthorized one posts no | building@2026-10-16T00:12Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
-| FV-work-item-1 | Canonical work-item state fold (one vocabulary) surfaced in loki status: Add pure workItemState(events) in events.ts next to fold(): maps to received/prepared/planned/executing/validating/ready_to_ship/completed + waiting_for_input(SPEC_CONFLICT)/budget_stopped(cap.hit)/failed/cancelled/stalled, using the same stage events summarize() already reads. Make summarize() (run | loki-ts/src/engine10/events.ts, loki-ts/src/commands/run_status.ts, loki-ts/src/util/run_outputs.ts, docs/v10/ENGINE.md | MEDIUM | Extend loki-ts/tests/commands/run_status.test.ts with event fixtures per state; red first (no `state` field), green after fold; reuse existing phaseOf cases to  | building@2026-10-16T00:12Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
-| FV-work-item-2 | Record work-item intent on run.started and link answers to parent run: Extend the existing opts.started payload (supervisor.ts:69,138) with actor (git user / LOKI_ACTOR / trigger source), policy_revision (sha256 of policies file read by policyGate, run_outputs.ts:170), budget_usd cap, and parent_run. Have runAnswer (blocked_answer.ts:74) pass parent via env LOKI_PARENT | loki-ts/src/engine10/supervisor.ts, loki-ts/src/features/blocked_answer.ts, loki-ts/src/util/run_outputs.ts | MEDIUM | Extend loki-ts/tests/features/blocked_answer.test.ts: red = launched env lacks LOKI_PARENT_RUN / started event lacks parent_run; green after wiring. Add one sup | building@2026-10-16T00:12Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
-| FV-work-item-3 | Surface PR reuse truthfully (existing flag) and make resume skip duplicate creation provably: Make engine10-push.sh push-pr print a second marker (e.g. line 'reused') when `gh pr list --head` found an open PR (push.sh:160-166); pr.ts parse it (pr.ts:117-126) to set existing true/false instead of null, remove the 'contract gap' comment (pr.ts:4-6). resumePublish and startRecovery already pass | autonomy/lib/engine10-push.sh, loki-ts/src/engine10/stages/pr.ts, loki-ts/src/util/run_outputs.ts | HIGH | Extend existing pr stage test and tests/test-acceptance-resume-idempotence.sh: red = replay with open PR yields existing:null; green = existing:true and gh pr c | building@2026-10-16T00:12Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
-| FV-work-item-4 | Durable trigger intake dedup keyed on origin+issue+head: Persist seen_delivery ids to a small JSONL under the trigger server's existing state dir (append on accept, load bounded N at startup) in trigger-server.py:1049-1086, and add a second key (event repo#issue + action + head sha) so a redelivery with a new delivery id or a server restart does not re-di | autonomy/trigger-server.py, tests/test_trigger_server_hardening.py | HIGH | Extend tests/test_trigger_server_hardening.py: red = new Dispatcher instance on same state dir re-dispatches same delivery id; green = returns duplicate. Second | building@2026-10-16T00:12Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
-| FV-tracker-writeback-1 | Slack allowlist fails closed: Unset LOKI_SLACK_ALLOWED_USERS rejects all (explicit '*' opts in to open) in slack_inbound.ts; add same user gate to trigger-server /slack using form user_id. Update docs/slack.md:24 and startup message. | loki-ts/src/contrib/slack_inbound.ts, autonomy/trigger-server.py, docs/slack.md | HIGH | Extend loki-ts/tests/features/slack_inbound.test.ts (unset -> NOT_ALLOWED, '*' -> allowed; red against current :91) and tests/test_trigger_server_hardening.py _ | building@2026-10-16T00:12Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
-| FV-tracker-writeback-2 | Phase-aware shared writeback contract in writeback.ts: Extend WritebackInput with origin {kind, ref} and phase (started/blocked/done/failed); commentText per phase; optional Jira transition (LOKI_JIRA_DONE_TRANSITION id) and Linear state (LOKI_LINEAR_DONE_STATE). Fall back to intake creds (JIRA_BASE_URL/JIRA_EMAIL/JIRA_API_TOKEN/LINEAR_API_KEY) so intak | loki-ts/src/integrations/writeback.ts, loki-ts/src/engine10/stages/pr.ts | MEDIUM | New loki-ts/tests/integrations/writeback.test.ts is justified because B6 test claimed in RELEASE-11.md:43 does not exist; stub fetch, assert comment per phase,  | building@2026-10-16T00:12Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
-| FV-tracker-writeback-3 | Trigger server uses one reply-target contract for Jira, Teams, Sentry: Add reply targets in _handle_jira ({kind:jira,key}), and a jira branch in notify_job_complete posting an ADF comment (reuse existing _post_json with Basic auth from JIRA_* env); make Linear/Jira branches share a small table-driven dispatcher; capture Teams serviceUrl/conversation target if verified. | autonomy/trigger-server.py | MEDIUM | Extend tests/test_trigger_server_hardening.py chat fixture: Jira webhook then completion posts comment to stubbed URL; no target when creds absent; notifier fai | building@2026-10-16T00:12Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
-| FV-tracker-writeback-4 | Docs and loki start wiring truth-up: Rewrite docs/trackers.md to describe actual writeback (comment, phases, transitions, env vars, opt-in) and delete the 'no write back' line; make loki start jira:/linear: refs export LOKI_WRITEBACK_ISSUE so writeback keys off the intake ref; add one line in docs/CLI-REFERENCE.md. | docs/trackers.md, docs/CLI-REFERENCE.md, loki-ts/src/commands/start.ts | LOW | Extend the existing start.ts test (loki-ts/tests, locate by git grep start.ts) to assert env LOKI_WRITEBACK_ISSUE set for jira:PROJ-123 ref and unset for plain  | building@2026-10-16T00:12Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
-| FV-pr-loop-1 | Gate --ship auto-merge on checks + verdict via shared merge gate: Extract the green-check/poll/merge core of cmd_merge into one helper (e.g. _merge_pr_gated <pr>) and make both `loki merge run` and the --ship auto-merge blocks (detached inner script and issue-mode path) call it. Refuse merge when PR is draft, gh pr checks != 0 after polling, or run verdict != VERI | autonomy/loki, docs/merge-queue.md | HIGH | Extend tests/test-loki-merge-queue.sh (has gh stub at :17): red test = --ship path with stubbed `pr checks` exit 1 currently still logs `pr merge`; green = no m | building@2026-10-16T00:12Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
-| FV-pr-loop-2 | CI repair loop: loki pr watch and run hook after PR open: Add `loki merge watch <pr>` (or `--watch` on merge run) that polls `gh pr checks`, on failure fetches failed log tail (`gh run view --log-failed`), runs one bounded repair session via existing loki issue/start run on the PR branch, pushes, and repeats up to N attempts (LOKI_PR_REPAIR_MAX, default 2) | autonomy/loki, loki-ts/src/cli/registry.ts, docs/merge-queue.md | MEDIUM | Extend tests/test-loki-merge-queue.sh with stub: checks fail once then pass after stubbed repair command; assert repair invoked once, push once, merge only afte | building@2026-10-16T00:12Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
-| FV-pr-loop-3 | Review-comment response commits: Reuse GhClient/defaultGh from loki-ts/src/util/pr_lessons.ts to add `loki memory`-adjacent read of OPEN review threads (`gh api pulls/N/comments`), one fix commit per actionable comment, push, and reply to each thread citing the commit sha. Register as `loki pr respond <pr>` extending an existing re | loki-ts/src/util/pr_lessons.ts, loki-ts/src/cli/registry.ts, loki-ts/tests/util/pr_lessons.test.ts | MEDIUM | Extend loki-ts/tests/util/pr_lessons.test.ts using its injected GhClient: fixture with 2 open comments -> assert 2 reply calls containing commit shas, and non-a | building@2026-10-16T00:12Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
-| FV-pr-loop-4 | Record merge/CI outcome in receipt and handoff; policy consent: Write merge outcome (merged / blocked:<gate> / waiting) and last checks state into .loki/state/pr.json next to the existing created record (autonomy/loki:11708) and surface in handoffSection/decisionCommands (run_summary.ts:158). Add a single policy key (e.g. merge.preauthorized + required checks) r | loki-ts/src/util/run_summary.ts, autonomy/loki, loki-ts/tests/util/run_summary.test.ts | LOW | Extend run_summary test (or nearest existing handoff test) : handoff for blocked merge shows gate name and 'waiting at: <gate>' and not 'merged'; red first sinc | building@2026-10-16T00:12Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
-| FV-policy-budget-1 | Propagate run cap to group/unit children and aggregate group spend: In supervisor.ts export the resolved cap (env.LOKI_BUDGET_LIMIT=cap.usd when >0) into the env handed to maybeRunGroup (use `env`, not process.env, supervisor.ts:262) so backlog.py units inherit --max-cost; in backlog.py divide/enforce a group-wide total (sum unit costs at finish, stop launching pend | loki-ts/src/engine10/supervisor.ts, autonomy/lib/backlog.py, autonomy/lib/loki_yaml.py, docs/cost-controls.md | HIGH | Extend tests/test-backlog.sh (group total stops pending units) and loki-ts/tests/engine10/budget_cap.test.ts (env handed to group has LOKI_BUDGET_LIMIT). Red fi | building@2026-10-16T00:12Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
-| FV-policy-budget-2 | Live in-session cap: map worker cap to child env and fix dead BUDGET_LIMIT watcher: In session.ts childEnv set LOKI_BUDGET_LIMIT to remaining cap (LOKI_E10_MAX_COST_USD minus meter sum, floor 0.01) so providers.ts:668 applies SDK maxBudgetUsd for claude; change session.ts:195 watchBudget gate to read the same resolved cap (LOKI_E10_MAX_COST_USD) and compare against the worker meter | loki-ts/src/engine10/session.ts, loki-ts/src/e10ext/budget_cap.ts, loki-ts/src/providers/provider_guard.ts | HIGH | Extend loki-ts/tests/engine10/budget_cap.test.ts: unit-test remaining() and that childEnv for a run with LOKI_E10_MAX_COST_USD=2 carries LOKI_BUDGET_LIMIT<=2 (r | building@2026-10-16T00:12Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
-| FV-policy-budget-3 | Cap applies on default runner path, spec-first, and --attempts as one total: (a) runner/autonomous.ts:1176 default budgetLimit to loadDefaultMaxCostUsd() when an API key is set and no flag/env, mirroring resolveCap (reuse resolveCap, no new parser); (b) start.ts:317 push --max-cost for specFirst before returning; (c) runner/attempts.ts divide the cap across N attempts (pass  | loki-ts/src/runner/autonomous.ts, loki-ts/src/commands/start.ts, loki-ts/src/runner/attempts.ts, loki-ts/src/e10ext/budget_cap.ts | MEDIUM | Extend loki-ts/tests/commands/start tests (parseStartArgs/runEngine10 argv includes --max-cost for spec-first) and runner attempts test; red first: argv for `-- | building@2026-10-16T00:12Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
-| FV-policy-budget-4 | Durable budget_stopped state and persisted per-task spend across restart: On BUDGET_STOP write .loki/runs/<id>/budget.json (cap, spent, source, outcome budget_stopped) from supervisor.ts when outcome==BUDGET_STOP (extend run_summary.ts:54 and status.ts to show it), and seed capMeter on a rerun of the same task (startRecovery key) with prior spend from that file via an env | loki-ts/src/engine10/supervisor.ts, loki-ts/src/e10ext/budget_cap.ts, loki-ts/src/util/run_summary.ts, loki-ts/src/commands/status.ts, docs/cost-controls.md | MEDIUM | Extend loki-ts/tests/engine10/budget_cap.test.ts: capMeter seeded with 4 of 5 trips over() after $1; supervisor writes budget.json on BUDGET_STOP. Red: seed env | building@2026-10-16T00:12Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
-| COST-1 | Effort rightsize default-on: implement and Wall at medium effort, fix escalation kept | loki-ts/src/contrib/effort_policy.ts, loki-ts/src/engine10/session.ts | MEDIUM | tests/engine10/effort_policy.test.ts | building@2026-10-16T00:12Z | Cost audit 2026-10-16: no measured run reaches 0.5x raw yet (best 0.68x lean config). |
+| FC-09s | FC-09 sibling sweep from the FC-09r opus review (bun probe reproduced): runner_config misses (1) Cargo.toml top-level dotted keys such as patch.crates-io.serde = { path = "fake" } before [package]; (2) go.work replace directives (go.work is not in RUNNER_CONFIGS); (3) babel.config.*, .babelrc, .pnpmfile.cjs, Cargo [[test]] harness=false and Cargo [dev-dependencies] path=; also add one verify-stage case where a package.json pretest edit caps the verdict | loki-ts/src/features/runner_config.ts, loki-ts/tests/engine10/runner_config.test.ts, loki-ts/tests/engine10/verify_weak.test.ts | HIGH | each probe above caps the verdict to NOT PROVEN; a plain version bump still does not cap | released@2026-10-16T00:49Z | FC-09 sibling (L5). No core engine10 lines (4998 of 5000). |
+| FC-09t | FC-09s opus review follow-ups (all reproduced as pre-existing misses): P1 Cargo section headers with a trailing comment or inner spaces ([patch.crates-io] # local, [ patch.crates-io ], [dev-dependencies] # t) are not seen, so path= under them does not cap; Cargo [dependencies] and [workspace.dependencies] path= (parity with npm depGuard); dev-dependency git =; [[test]] path = and [lib] test = false; go.work use ./x lines and a new go.work with only use lines; .pnpmfile.mjs | loki-ts/src/features/runner_config.ts, loki-ts/tests/engine10/runner_config.test.ts | HIGH | each probe caps; plain version bumps do not cap | released@2026-10-16T01:20Z | r5 231b29015 Opus-APPROVED (120 probes), riding fv-train. r5 followed Opus BLOCK on r4 5f4e626bb ([[bin]] harness, required-features, path uncapped; Cargo dep git, package, workspace, rev and package.workspace parity added). r2 9e00d7c21 and r3 064cb191b were also Opus-BLOCKED. FC-09 sibling (L5). No core engine10 lines. |
+| FV-evidence-sha-1 | Bind integration status and exit code into the composite: In composeComposite and verifyComposite (seal_group.ts), read integration.json status/exit_code. Seal throws unless status is passed or not_configured. Verify returns TAMPERED when status is failed/interrupted or exit_code is nonzero. Add integration {status, exit_code, log_sha256, heads} to Composi | loki-ts/src/features/speed/seal_group.ts | HIGH | Extend loki-ts/tests/engine10/seal_group.test.ts: writeWs fixture (line ~341) with status:failed. Red: current code seals VERIFIED then verify passes; green: se | released@2026-10-16T01:20Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
+| FV-evidence-sha-2 | Bind integration.log hash and require non-null heads: In composeComposite refuse null/missing heads[repo] and, when log_sha256 is non-null, recompute sha256 of <run>/integration.log and throw on mismatch/missing. In verifyComposite do the same (TAMPERED on log mismatch) and make integrated-head mismatch TAMPERED rather than UNCHECKED (matches seal). Ke | loki-ts/src/features/speed/seal_group.ts | HIGH | Extend seal_group.test.ts tests at ~458 (null head) and ~406 (head edit): add log swap case; update null-head expectation to seal-refuse, add legacy-case UNCHEC | released@2026-10-16T01:20Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
+| FV-evidence-sha-3 | Show SHAs and integration status in verify output and fix stale note: Make `loki verify <run-dir>/composite.json` and the --seal-composite output print per-repo head_sha, integration status and log hash (verify_cmd.ts:132 and the composite verify branch near :111-122). Delete the stale `seal: False` and 'only when the run seals one' note in workspace.py run_integratio | loki-ts/src/engine10/verify_cmd.ts, autonomy/lib/workspace.py | MEDIUM | Extend loki-ts/tests/engine10/verify_cmd.test.ts (composite output contains each 40-hex head and 'integration: passed') and the existing workspace python test f | released@2026-10-16T01:20Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
+| FV-evidence-sha-4 | Correct workspace guide on what the Seal covers, reachable from chat: Update docs/WORKSPACES.md lines 39, 55-59: state integration.json, integration status, log hash and every head SHA are inside the signed composite; list the new TAMPERED conditions (failed status, log swap, head mismatch); state explicitly that deployed-SHA binding is not implemented. Remove the now | docs/WORKSPACES.md | LOW | Extend the existing docs/claims guard test if present (grep tests for WORKSPACES.md); otherwise a grep assertion in seal_group.test.ts is not needed: manual che | released@2026-10-16T01:20Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
+| FV-readiness-env-1 | Readiness score + findings in loki doctor --repo: Add pure function repoReadiness(profile, reqs) in repo_profile.ts returning {score 0-100, grade, findings[{id,severity,message,fix}]}. Rules from existing profile fields: no test cmd (-30), baseline not run/timed out/not attributable (-15), baseline red with N failing ids (-20, fix: 'loki start will | loki-ts/src/runner/repo_profile.ts, loki-ts/src/commands/doctor.ts | LOW | Extend loki-ts/tests/runner/harness_intelligence.test.ts REPOMEM block (near :764 and :634): red = assert readiness absent/undefined fails for profiles with no  | released@2026-10-16T01:20Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
+| FV-readiness-env-2 | doctor --repo builds the profile on demand (--fix applies safe repo repair): When profile is absent, `loki doctor --repo` calls the existing ensureProfile(process.cwd()) (honours LOKI_REPO_BASELINE=0, never throws) instead of printing 'none yet'; keep read-only printing when a fresh profile exists. Allow --repo --fix to mean 'build/refresh profile' (replace the exit-64 rejec | loki-ts/src/commands/doctor.ts, loki-ts/src/runner/repo_profile.ts | MEDIUM | Extend harness_intelligence.test.ts :764 test: red = absent profile in a temp git repo with package.json test script prints 'none yet'; green = doctor --repo cr | released@2026-10-16T01:20Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
+| FV-readiness-env-3 | Reach readiness from loki start and loki chat: Add /doctor (alias /ready) slash to loki chat delegating via _chat_do "$loki" doctor --repo (plus --json passthrough), listed in _chat_help. In loki start's existing first-run/summary output, print the one-line 'Readiness: NN/100' from the same repoReadiness helper after intake builds the profile (i | autonomy/lib/chat.sh, loki-ts/src/engine10/stages/intake.ts | LOW | Extend an existing chat test if present (grep tests/ for chat help assertions, e.g. tests/test-first-run-funnel-coverage.sh) to assert /doctor appears in /help  | released@2026-10-16T01:20Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
+| FV-readiness-env-4 | Docs reconcile + remove dead doctor-fix.py: Update docs/CLI-REFERENCE.md and docs/cli-reference.md (merge into one if one is a duplicate, delete the other and fix links) doctor row to list --json --fix --requirements --repo and readiness score; add a short Readiness section. Verify then delete autonomy/lib/doctor-fix.py and tests/test_doctor_ | docs/CLI-REFERENCE.md, docs/cli-reference.md, autonomy/lib/doctor-fix.py, tests/test_doctor_fix_plan.py | LOW | Existing docs-vs-help guard (grep tests/ for CLI-REFERENCE checks) must stay green; after deletion run tests/run-all-tests.sh doctor subset (test-doctor-ux.sh,  | released@2026-10-16T01:20Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
+| FV-docs-pin-1 | Fix `loki answer` wording everywhere: Change 'Resume a BLOCKED run' to 'Start a follow-up run from a BLOCKED run with your answer' in the single registry string and help text; run generate-stale-zero.sh so CLI-REFERENCE regenerates; fix README.md:105 and autonomy/loki:1685 help; add one line to docs/slack.md that CLI `loki answer` has t | loki-ts/src/cli/registry.ts, loki-ts/src/cli.ts, README.md, autonomy/loki, docs/slack.md, docs/CLI-REFERENCE.md | LOW | Extend loki-ts/tests registry/help snapshot test (or tests/test-docs-cli-drift.sh): red = grep 'Resume a BLOCKED' returns hits in registry.ts/README/cli.ts; gre | released@2026-10-16T01:20Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
+| FV-docs-pin-2 | Correct wiki/Providers.md capability table from provider files: Edit existing table (wiki/Providers.md:11-18) to match providers/*.sh: context windows, codex parallel (max 2, degraded), cline MCP yes; add Degraded column; add a one-line 'source: providers/*.sh PROVIDER_* vars' note. Mirror the same facts in README.md:116 only if it disagrees. No new doc. | wiki/Providers.md, README.md | LOW | Extend tests/test-no-stale-facts.sh (or test-docs-cli-drift.sh) with a check that for each provider the doc row's Parallel/MCP/context value equals the provider | released@2026-10-16T01:20Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
+| FV-docs-pin-3 | Reconcile Node floor and install claims: Make README.md:142 and docs/INSTALLATION.md:60 say Node 20+ (matches package.json engines >=20.0.0 and wiki/Installation.md:11); verify against bin/loki runtime check for the Node guard and keep the stricter source of truth. | README.md, docs/INSTALLATION.md, wiki/Installation.md | LOW | Extend tests/test-no-stale-facts.sh: red = grep 'Node.js 18' README/INSTALLATION; add assertion that min-Node string in docs equals package.json engines.node; g | released@2026-10-16T01:20Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
+| FV-docs-pin-4 | Stamp wiki pages to current VERSION and fix legacy-engine banner: Replace the 13 stale 10.6.6 version stamps with 11.11.0 (pin to 11.12.0 at release via generate-stale-zero.sh by adding wiki/*.md line-3 stamp to its targets), delete the 'legacy engine, being removed' banner in wiki/CLI-Reference.md:3 and drop or mark rows for commands not in registry (compound, cp | scripts/generate-stale-zero.sh, wiki/CLI-Reference.md, wiki/Architecture.md, wiki/Dashboard.md, wiki/Home.md, tests/test-no-stale-facts.sh | MEDIUM | Extend tests/test-no-stale-facts.sh to scan wiki/*.md version stamps against VERSION (and tests/lib/scan-doc-cli-drift.py to cover wiki/): red = 13 pages flagge | released@2026-10-16T01:20Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
+| FV-deploy-observe-1 | Re-check health after auto-rollback and record it: After a rollback exits 0, re-probe health_url with _deploy_probe_health; add post_rollback_health (healthy/FAILED_HEALTH/unchecked) and health_http_code to the loki.deploy/1 record; replace the 'NOT re-checked' message. Return distinct exit if rollback also unhealthy. | autonomy/loki, docs/SIGNED-RECEIPTS.md | MEDIUM | Extend tests/test-deploy-receipt-gate.sh section 14-18 (line ~740): stub vercel/curl, red = record lacks post_rollback_health and message still says NOT re-chec | released@2026-10-16T01:20Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
+| FV-deploy-observe-2 | Acceptance beyond 2xx: --health-match and artifact evidence: Add `--health-match STR` to loki deploy (and pass-through on start --deploy): probe body must contain STR (e.g. HEAD sha or version) else FAILED_HEALTH; record health_match, health_http_code, tree_sha (git rev-parse HEAD^{tree}) in loki.deploy/1. | autonomy/loki, loki-ts/src/commands/start.ts, loki-ts/src/util/receipt_signer.ts | MEDIUM | Extend tests/test-deploy-receipt-gate.sh (stub curl body): red = mismatching body still reports healthy; green = FAILED_HEALTH exit 4. Extend start-flags allowl | released@2026-10-16T01:20Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
+| FV-deploy-observe-3 | Surface last deploy in `loki status` / `loki chat` context: Read newest .loki/deploys/*.json and show target, head_sha, health_status, rollback, signed/VERIFIED via existing verify path in `loki status` (and the chat context that status feeds). Gives 'observing' state without a new command. | loki-ts/src/commands/status.ts, loki-ts/src/util/receipt_signer.ts, loki-ts/tests/commands | LOW | Extend the existing status command test: fixture .loki/deploys/x.json with FAILED_HEALTH; red = status prints nothing about deploy; green = prints line and flag | released@2026-10-16T01:20Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
+| FV-deploy-observe-4 | Sentry brief correlates alert with latest deploy and culprit owner: In build_sentry_brief/handle_sentry_event, append release/environment from payload and, from the project's .loki/deploys newest record, 'last deploy <sha7> <finished_at> health=<status>' plus git log -1 author/commit for the culprit file when resolvable. Still PR-only, brief stays one sanitized line | autonomy/trigger-server.py, autonomy/issue-providers.sh, docs/sentry-intake.md | HIGH | Extend tests/test_trigger_server_hardening.py (sentry fixture ~line 749): red = brief lacks deploy context with a seeded deploy record; green = present, control | released@2026-10-16T01:20Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
+| FV-outcome-metrics-1 | Record intervention type and waited minutes at the pause site: Extend the existing interventions.json write in handlePause to also keep by_type counts {steer,input,authorization,repair} (mapped from the existing pause reasons: HUMAN_INPUT.md=input, PAUSE/checkpoint=authorization, budget/council force-review=repair/steer as appropriate, enum only, no free text)  | loki-ts/src/runner/intervention.ts, autonomy/run.sh, autonomy/lib/proof-generator.py | MEDIUM | Extend loki-ts/tests/runner/autonomous.test.ts (already drives intervention signals at :167-176): red = assert interventions.json has by_type + waited_s after a | released@2026-10-16T01:20Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
+| FV-outcome-metrics-2 | Add effort-per-outcome block to loki trust (cost, retries, misleading claims, interventions by type): Extend the existing trust derivation (TrustRun + computeTrajectory + formatTrajectoryHuman/Json) with: per-run cost_usd (proof.cost.usd, null when unmeasured), interventions_by_type and waited_s (from slice 1, null when absent), and an 'Outcome effort' summary: accepted = verdict VERIFIED; misleadin | loki-ts/src/metrics/trust.ts, autonomy/lib/trust_trajectory.py, loki-ts/src/commands/trust.ts | LOW | Extend loki-ts/tests/metrics/trust.test.ts (intervention axis block at :161) and tests/test_trust_trajectory.py: red = fixture of 4 proofs (2 VERIFIED, 1 false_ | released@2026-10-16T01:20Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
+| FV-outcome-metrics-3 | Surface the metric in HANDOFF.md and the final run line on engine10: Make engine10 handoff stop saying 'not recorded' for interventions: in composeHandoff read .loki/state/interventions.json (count, by_type, waited_s) when no steer.consumed/intervention events exist, render 'interventions N (input 1, authorization 1); waited 4m' and keep 'not recorded' only when the  | loki-ts/src/util/run_summary.ts | LOW | Extend loki-ts/tests/util/run_summary.test.ts: red = write interventions.json fixture in the temp repoDir, call composeHandoff/renderHandoff, expect the by-type | released@2026-10-16T01:20Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
+| FV-outcome-metrics-4 | Document metric definitions and align bench report to the same names: Add one 'Outcome analytics' section to the existing docs/EVALUATING.md defining accepted outcome, misleading completion (= attribution.py false_completion = trust false_verified), cost per accepted, interventions by type, waited vs active minutes (active minutes explicitly NOT measured; only waited  | docs/EVALUATING.md, benchmarks/bench/attribution.py | LOW | Extend the existing attribution test (benchmarks/bench tests, e.g. the one asserting false_completion and cost_per_accepted in the report) with an assertion tha | released@2026-10-16T01:20Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
+| FV-gh-steer-1 | Trigger server: authorized issue_comment steers, unauthorized ignored: Add handle_issue_comment_event to EVENT_HANDLERS: on action=created, comment on an issue/PR with a known run (match repo#N), require comment.author_association in OWNER/MEMBER/COLLABORATOR (same set as verify_pr.ts:150), skip bot/self comments and edited/deleted, one-line-bound the body, then run `l | autonomy/trigger-server.py, docs/DEPLOYMENT.md | HIGH | Extend tests/test_trigger.py TestEventRouting: red first with MEMBER comment -> steer args fired, NONE/CONTRIBUTOR comment -> 'skipped', bot comment skipped, fo | released@2026-10-16T01:20Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
+| FV-gh-steer-2 | Steer carries intent revision + actor + source: Make `loki steer` (and chat /steer through the same writer) record a numbered revision header (rev N, actor, source=cli/chat/github comment URL) in HUMAN_INPUT.md, and have steer.ts consumeSteer archive it and append an entry to .loki/intent-revisions.jsonl so scope changes are an auditable revision | autonomy/loki, loki-ts/src/util/steer.ts, loki-ts/tests/e10ext/steer.test.ts | MEDIUM | Extend loki-ts/tests/e10ext/steer.test.ts: red-then-green that consumeSteer on a header-bearing file returns the guidance and appends a revision record with rev | released@2026-10-16T01:20Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
+| FV-gh-steer-3 | Project engine10 status onto the originating issue (single updating comment): Generalise the supervisor's failure-only CommentStep (supervisor.ts:196-198) into a status projector: at plan done, steer applied, blocked, PR opened, and done, upsert ONE marker-tagged comment (<!-- loki-status -->) on the issue via a new `issue-comment --update` mode in engine10-push.sh (find by m | loki-ts/src/engine10/supervisor.ts, autonomy/lib/engine10-push.sh, loki-ts/src/engine10/types.ts | MEDIUM | Extend the existing supervisor test (loki-ts/tests/engine10 supervisor/issue_ref_e2e.test.ts with its fake gh in tests/engine10/fixtures/issue-ref/bin/gh): red- | released@2026-10-16T01:20Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
+| FV-gh-steer-4 | Steer ack back to the comment + chat parity: After slice 1 steers, acknowledge on the issue with an eyes reaction/short reply naming revision N and 'applies at next plan/implement stage' (or rejection reason for unauthorized: a single line, no run details), via engine10-push.sh. Ensure `loki chat` /steer and `loki start` print the same `rev N` | autonomy/trigger-server.py, autonomy/lib/engine10-push.sh, loki-ts/src/cli/registry.ts | LOW | Extend tests/test_trigger.py: red-then-green that an authorized comment dispatch also invokes the ack command with the revision and an unauthorized one posts no | released@2026-10-16T02:04Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
+| FV-work-item-1 | Canonical work-item state fold (one vocabulary) surfaced in loki status: Add pure workItemState(events) in events.ts next to fold(): maps to received/prepared/planned/executing/validating/ready_to_ship/completed + waiting_for_input(SPEC_CONFLICT)/budget_stopped(cap.hit)/failed/cancelled/stalled, using the same stage events summarize() already reads. Make summarize() (run | loki-ts/src/engine10/events.ts, loki-ts/src/commands/run_status.ts, loki-ts/src/util/run_outputs.ts, docs/v10/ENGINE.md | MEDIUM | Extend loki-ts/tests/commands/run_status.test.ts with event fixtures per state; red first (no `state` field), green after fold; reuse existing phaseOf cases to  | released@2026-10-16T01:20Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
+| FV-work-item-2 | Record work-item intent on run.started and link answers to parent run: Extend the existing opts.started payload (supervisor.ts:69,138) with actor (git user / LOKI_ACTOR / trigger source), policy_revision (sha256 of policies file read by policyGate, run_outputs.ts:170), budget_usd cap, and parent_run. Have runAnswer (blocked_answer.ts:74) pass parent via env LOKI_PARENT | loki-ts/src/engine10/supervisor.ts, loki-ts/src/features/blocked_answer.ts, loki-ts/src/util/run_outputs.ts | MEDIUM | Extend loki-ts/tests/features/blocked_answer.test.ts: red = launched env lacks LOKI_PARENT_RUN / started event lacks parent_run; green after wiring. Add one sup | released@2026-10-16T01:20Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
+| FV-work-item-3 | Surface PR reuse truthfully (existing flag) and make resume skip duplicate creation provably: Make engine10-push.sh push-pr print a second marker (e.g. line 'reused') when `gh pr list --head` found an open PR (push.sh:160-166); pr.ts parse it (pr.ts:117-126) to set existing true/false instead of null, remove the 'contract gap' comment (pr.ts:4-6). resumePublish and startRecovery already pass | autonomy/lib/engine10-push.sh, loki-ts/src/engine10/stages/pr.ts, loki-ts/src/util/run_outputs.ts | HIGH | Extend existing pr stage test and tests/test-acceptance-resume-idempotence.sh: red = replay with open PR yields existing:null; green = existing:true and gh pr c | released@2026-10-16T01:20Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
+| FV-work-item-4 | Durable trigger intake dedup keyed on origin+issue+head: Persist seen_delivery ids to a small JSONL under the trigger server's existing state dir (append on accept, load bounded N at startup) in trigger-server.py:1049-1086, and add a second key (event repo#issue + action + head sha) so a redelivery with a new delivery id or a server restart does not re-di | autonomy/trigger-server.py, tests/test_trigger_server_hardening.py | HIGH | Extend tests/test_trigger_server_hardening.py: red = new Dispatcher instance on same state dir re-dispatches same delivery id; green = returns duplicate. Second | released@2026-10-16T01:20Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
+| FV-tracker-writeback-1 | Slack allowlist fails closed: Unset LOKI_SLACK_ALLOWED_USERS rejects all (explicit '*' opts in to open) in slack_inbound.ts; add same user gate to trigger-server /slack using form user_id. Update docs/slack.md:24 and startup message. | loki-ts/src/contrib/slack_inbound.ts, autonomy/trigger-server.py, docs/slack.md | HIGH | Extend loki-ts/tests/features/slack_inbound.test.ts (unset -> NOT_ALLOWED, '*' -> allowed; red against current :91) and tests/test_trigger_server_hardening.py _ | released@2026-10-16T01:20Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
+| FV-tracker-writeback-2 | Phase-aware shared writeback contract in writeback.ts: Extend WritebackInput with origin {kind, ref} and phase (started/blocked/done/failed); commentText per phase; optional Jira transition (LOKI_JIRA_DONE_TRANSITION id) and Linear state (LOKI_LINEAR_DONE_STATE). Fall back to intake creds (JIRA_BASE_URL/JIRA_EMAIL/JIRA_API_TOKEN/LINEAR_API_KEY) so intak | loki-ts/src/integrations/writeback.ts, loki-ts/src/engine10/stages/pr.ts | MEDIUM | New loki-ts/tests/integrations/writeback.test.ts is justified because B6 test claimed in RELEASE-11.md:43 does not exist; stub fetch, assert comment per phase,  | released@2026-10-16T01:20Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
+| FV-tracker-writeback-3 | Trigger server uses one reply-target contract for Jira, Teams, Sentry: Add reply targets in _handle_jira ({kind:jira,key}), and a jira branch in notify_job_complete posting an ADF comment (reuse existing _post_json with Basic auth from JIRA_* env); make Linear/Jira branches share a small table-driven dispatcher; capture Teams serviceUrl/conversation target if verified. | autonomy/trigger-server.py | MEDIUM | Extend tests/test_trigger_server_hardening.py chat fixture: Jira webhook then completion posts comment to stubbed URL; no target when creds absent; notifier fai | released@2026-10-16T01:20Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
+| FV-tracker-writeback-4 | Docs and loki start wiring truth-up: Rewrite docs/trackers.md to describe actual writeback (comment, phases, transitions, env vars, opt-in) and delete the 'no write back' line; make loki start jira:/linear: refs export LOKI_WRITEBACK_ISSUE so writeback keys off the intake ref; add one line in docs/CLI-REFERENCE.md. | docs/trackers.md, docs/CLI-REFERENCE.md, loki-ts/src/commands/start.ts | LOW | Extend the existing start.ts test (loki-ts/tests, locate by git grep start.ts) to assert env LOKI_WRITEBACK_ISSUE set for jira:PROJ-123 ref and unset for plain  | released@2026-10-16T01:20Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
+| FV-pr-loop-1 | Gate --ship auto-merge on checks + verdict via shared merge gate: Extract the green-check/poll/merge core of cmd_merge into one helper (e.g. _merge_pr_gated <pr>) and make both `loki merge run` and the --ship auto-merge blocks (detached inner script and issue-mode path) call it. Refuse merge when PR is draft, gh pr checks != 0 after polling, or run verdict != VERI | autonomy/loki, docs/merge-queue.md | HIGH | Extend tests/test-loki-merge-queue.sh (has gh stub at :17): red test = --ship path with stubbed `pr checks` exit 1 currently still logs `pr merge`; green = no m | released@2026-10-16T01:20Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
+| FV-pr-loop-2 | CI repair loop: loki pr watch and run hook after PR open: Add `loki merge watch <pr>` (or `--watch` on merge run) that polls `gh pr checks`, on failure fetches failed log tail (`gh run view --log-failed`), runs one bounded repair session via existing loki issue/start run on the PR branch, pushes, and repeats up to N attempts (LOKI_PR_REPAIR_MAX, default 2) | autonomy/loki, loki-ts/src/cli/registry.ts, docs/merge-queue.md | MEDIUM | Extend tests/test-loki-merge-queue.sh with stub: checks fail once then pass after stubbed repair command; assert repair invoked once, push once, merge only afte | released@2026-10-16T01:20Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
+| FV-pr-loop-3 | Review-comment response commits: Reuse GhClient/defaultGh from loki-ts/src/util/pr_lessons.ts to add `loki memory`-adjacent read of OPEN review threads (`gh api pulls/N/comments`), one fix commit per actionable comment, push, and reply to each thread citing the commit sha. Register as `loki pr respond <pr>` extending an existing re | loki-ts/src/util/pr_lessons.ts, loki-ts/src/cli/registry.ts, loki-ts/tests/util/pr_lessons.test.ts | MEDIUM | Extend loki-ts/tests/util/pr_lessons.test.ts using its injected GhClient: fixture with 2 open comments -> assert 2 reply calls containing commit shas, and non-a | released@2026-10-16T01:20Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
+| FV-pr-loop-4 | Record merge/CI outcome in receipt and handoff; policy consent: Write merge outcome (merged / blocked:<gate> / waiting) and last checks state into .loki/state/pr.json next to the existing created record (autonomy/loki:11708) and surface in handoffSection/decisionCommands (run_summary.ts:158). Add a single policy key (e.g. merge.preauthorized + required checks) r | loki-ts/src/util/run_summary.ts, autonomy/loki, loki-ts/tests/util/run_summary.test.ts | LOW | Extend run_summary test (or nearest existing handoff test) : handoff for blocked merge shows gate name and 'waiting at: <gate>' and not 'merged'; red first sinc | released@2026-10-16T02:04Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
+| FV-policy-budget-1 | Propagate run cap to group/unit children and aggregate group spend: In supervisor.ts export the resolved cap (env.LOKI_BUDGET_LIMIT=cap.usd when >0) into the env handed to maybeRunGroup (use `env`, not process.env, supervisor.ts:262) so backlog.py units inherit --max-cost; in backlog.py divide/enforce a group-wide total (sum unit costs at finish, stop launching pend | loki-ts/src/engine10/supervisor.ts, autonomy/lib/backlog.py, autonomy/lib/loki_yaml.py, docs/cost-controls.md | HIGH | Extend tests/test-backlog.sh (group total stops pending units) and loki-ts/tests/engine10/budget_cap.test.ts (env handed to group has LOKI_BUDGET_LIMIT). Red fi | released@2026-10-16T01:20Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
+| FV-policy-budget-2 | Live in-session cap: map worker cap to child env and fix dead BUDGET_LIMIT watcher: In session.ts childEnv set LOKI_BUDGET_LIMIT to remaining cap (LOKI_E10_MAX_COST_USD minus meter sum, floor 0.01) so providers.ts:668 applies SDK maxBudgetUsd for claude; change session.ts:195 watchBudget gate to read the same resolved cap (LOKI_E10_MAX_COST_USD) and compare against the worker meter | loki-ts/src/engine10/session.ts, loki-ts/src/e10ext/budget_cap.ts, loki-ts/src/providers/provider_guard.ts | HIGH | Extend loki-ts/tests/engine10/budget_cap.test.ts: unit-test remaining() and that childEnv for a run with LOKI_E10_MAX_COST_USD=2 carries LOKI_BUDGET_LIMIT<=2 (r | released@2026-10-16T01:20Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
+| FV-policy-budget-3 | Cap applies on default runner path, spec-first, and --attempts as one total: (a) runner/autonomous.ts:1176 default budgetLimit to loadDefaultMaxCostUsd() when an API key is set and no flag/env, mirroring resolveCap (reuse resolveCap, no new parser); (b) start.ts:317 push --max-cost for specFirst before returning; (c) runner/attempts.ts divide the cap across N attempts (pass  | loki-ts/src/runner/autonomous.ts, loki-ts/src/commands/start.ts, loki-ts/src/runner/attempts.ts, loki-ts/src/e10ext/budget_cap.ts | MEDIUM | Extend loki-ts/tests/commands/start tests (parseStartArgs/runEngine10 argv includes --max-cost for spec-first) and runner attempts test; red first: argv for `-- | released@2026-10-16T01:20Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
+| FV-policy-budget-4 | Durable budget_stopped state and persisted per-task spend across restart: On BUDGET_STOP write .loki/runs/<id>/budget.json (cap, spent, source, outcome budget_stopped) from supervisor.ts when outcome==BUDGET_STOP (extend run_summary.ts:54 and status.ts to show it), and seed capMeter on a rerun of the same task (startRecovery key) with prior spend from that file via an env | loki-ts/src/engine10/supervisor.ts, loki-ts/src/e10ext/budget_cap.ts, loki-ts/src/util/run_summary.ts, loki-ts/src/commands/status.ts, docs/cost-controls.md | MEDIUM | Extend loki-ts/tests/engine10/budget_cap.test.ts: capMeter seeded with 4 of 5 trips over() after $1; supervisor writes budget.json on BUDGET_STOP. Red: seed env | released@2026-10-16T01:20Z | Factory parity (FACTORY_VS_LOKI_MODE_INTEGRATED_v1.1), founder 10/10 mandate. |
+| COST-1 | Effort rightsize default-on: implement and Wall at medium effort, fix escalation kept | loki-ts/src/contrib/effort_policy.ts, loki-ts/src/engine10/session.ts | MEDIUM | tests/engine10/effort_policy.test.ts | released@2026-10-16T01:20Z | Cost audit 2026-10-16: no measured run reaches 0.5x raw yet (best 0.68x lean config). |
 | COST-2 | Cascade default-on for low-risk tasks (sonnet first, escalate on failure) | loki-ts/src/engine10/sizing.ts, model_rank.ts | HIGH | cascade test beside fix.ts | parked@2026-10-16T00:12Z | Engine Law L1 and D50 Sonnet accuracy loss; needs CTO call plus a measured arm. Cost audit 2026-10-16: no measured run reaches 0.5x raw yet (best 0.68x lean config). |
 | COST-3 | Skip Wall when low risk and existing impacted tests cover the change (seal NOT PROVEN where skipped) | loki-ts/src/engine10/stages/wall.ts, sizing.ts | HIGH | wall tests | parked@2026-10-16T00:12Z | moat change; needs CTO call plus a measured arm. Cost audit 2026-10-16: no measured run reaches 0.5x raw yet (best 0.68x lean config). |
-| COST-4 | Gate xreview and any reviewer on risk tier (medium/high only) | loki-ts/src/engine10/stages/xreview.ts | LOW | xreview test | building@2026-10-16T00:12Z | Cost audit 2026-10-16: no measured run reaches 0.5x raw yet (best 0.68x lean config). |
-| COST-5 | Merge plan into implement via the plan chain resume (one fewer cold prefix) | loki-ts/src/engine10/stages/implement.ts | MEDIUM | conflict_resume tests | building@2026-10-16T00:12Z | Cost audit 2026-10-16: no measured run reaches 0.5x raw yet (best 0.68x lean config). |
+| COST-4 | Gate xreview and any reviewer on risk tier (medium/high only) | loki-ts/src/engine10/stages/xreview.ts | LOW | xreview test | released@2026-10-16T01:20Z | Cost audit 2026-10-16: no measured run reaches 0.5x raw yet (best 0.68x lean config). |
+| COST-5 | Merge plan into implement via the plan chain resume (one fewer cold prefix) | loki-ts/src/engine10/stages/implement.ts | MEDIUM | conflict_resume tests | released@2026-10-16T01:20Z | Cost audit 2026-10-16: no measured run reaches 0.5x raw yet (best 0.68x lean config). |
 | COST-6 | Measure cost per accepted task vs raw Claude Code: attribution.py --execute, 8 tasks, n=3, Sonnet 5.5, receipt cost.usd vs total_cost_usd; target ratio 0.5 | benchmarks/bench/attribution.py, docs/v10/METRICS.md | MEDIUM | attribution dry-run | parked@2026-10-16T00:12Z | paid eval, needs founder go on spend. Cost audit 2026-10-16: no measured run reaches 0.5x raw yet (best 0.68x lean config). |
 | FC-09u | FC-09 siblings: pnpm-workspace.yaml overrides/packageExtensions and .yarnrc.yml packageExtensions join RUNNER_CONFIGS | loki-ts/src/features/runner_config.ts, loki-ts/tests/engine10/runner_config.test.ts | HIGH | each probe caps | ready@2026-10-16T00:12Z | After FC-09t review. |
 | CPE24-P2a | Checkpoint rollback restores only an allowlist (session.json, dashboard-state.json, CONTINUITY.md, autonomy-state.json, state, queue) and refuses nested symlinks | packages/control-plane/src/server/routes/checkpoints.ts plus test | MEDIUM | planted audit/ in a checkpoint does not overwrite .loki/audit | released@2026-10-15T23:55Z | rv-trust3 advisory on P2. |
@@ -935,6 +960,6 @@ Source: ~/git/autonomi-dev/research/2026-09-30-adoption/SWARM-PROMPT-ADOPTION.md
 | CP-ASK | Founder 22:03Z: "we are not a vibe coding tool". The CP home box becomes Ask Loki: search, learn, compare runs, and ask anything about Loki Mode, past runs, receipts, repos and issues. Default provider claude (or any configured provider and model the user picks); the model gets all of that data (read-only tools or MCP over runs, receipts, events, METRICS, repos, gh issues and PRs); answers are async jobs the user can leave and come back to, listed in the CP. Read-only: Ask never edits a repo or starts a build | Architect slices first (10-40 slices, feature flag); packages/control-plane routes and ui, a read-only data layer, provider invocation | HIGH | the founder asks "compare my last two runs on FireLater" and gets a cited answer async in the CP; Ask cannot write to any repo | building@2026-10-04T00:06Z | Plan docs/v10/CP-ASK-PLAN.md (15 slices behind LOKI_CP_ASK=1, waves {1,4,6,8} {2,5,7} {3,9} 10 11 {12,13} 14 15); founder questions decided as FOUNDER-QUEUE row 20. Slice 1 (MCP read-only mode) seated. Founder direct directive 22:03Z. Architect plan first. | 00:33Z: slices 1 (9f454444a, plus fix-forward F1/F2 7bcffc70f, opus APPROVE), 4 (2a0ad3fc1) and 8 (d1b38e508) merged; flag off; next wave 2/5/6/7. 
 | FC-21 | FC-21: (a) a limit in implement still runs verify on the existing work plus the fix rounds the budget allows, never seal directly; (b) the run cap scales with task size (sizing and Project Model), with a generous subscription default set in loki.yaml; (c) implement is told its remaining time; (d) the CLI summary, CP and PR body read receipt.verdict (one outcome) | loki-ts/src/engine10 run orchestration, the budget and sizing modules, the CLI summary, plus tests | MEDIUM | a fake implement limit is followed by verify; CLI outcome equals receipt.verdict for 4 verdicts; a large task gets a larger cap; core cap under 5000 | released@2026-10-03T23:33Z | Released in v10.10.5. FireLater#17 gate on 10.10.3 PARTIAL (steering 22:08Z). P0 tier with FC-16/FC-15. Built 21fec9deb; opus review-fc21 APPROVE on merge e80abc63a (suites 1719/0, budget 27/0, tsc rc=0 with real node_modules); merged 881f1275f. Advisories A1-A4 filed as FC-21b. Ships in one train with FC-15 and FC-16. |
 | FC-21b | FC-21 follow-ups, next train (steering 23:00Z): (1) an implement limit forces PARTIAL only while checks are red or unrun; if the fix rounds make the impacted checks green with n>0 the run earns VERIFIED (L3: what ran is the evidence, not how long implement took); (2) size the run cap from the Project Model and plan (packages and files touched) or a plan-session estimate, never from task-text character count (L0); (3) the CLI outcome must equal receipt.verdict, so a cap stop after a limit cannot print BUDGET_STOP over a PARTIAL or FAILED receipt (L7, was advisory A4); (A1) machine.ts:145 mustJump keys on reason limit only, require r.killed too; (A2) a spec-conflict resume gets the full original budget in the time note and limitS, and the note lands after FINISH_LINE; (A3) yamlRunCapS matches run_cap_s at any depth under budgets, CRLF yaml falls back silently, ls-files count off by one | loki-ts/src/engine10/machine.ts, stages/implement.ts, stages/seal.ts, output.ts, src/util/run_cap.ts, project_model sizing, plus tests | HIGH | a limit then fix-green with n>0 seals VERIFIED, a limit with a red or unrun check seals PARTIAL; the cap for a short task touching many packages exceeds the cap for one file; CLI outcome equals receipt.verdict on a cap stop after a limit; a thrown limit without a kill never reaches VERIFIED; nested per_stage run_cap_s is ignored; a resumed implement gets the remaining time | released@2026-10-04T02:52Z | Plan docs/v10/FC21B-FC22-PLAN.md (slices S1 graph+yaml_key, S5 cap sizing, S4 verdict+L7+A1+A2; S4 last). From review-fc21 22:53Z plus steering 23:00Z. HIGH because it changes the verdict rule (opus reviewer). Architect plan first for the sizing source. e10ext is 1 line under its 1500 cap. Queue after the FireLater#17 gate on 10.10.4. |
-| FC-16b | FC-16 follow-ups: package_suite.ts:33 detects go by first token only (make test, GOFLAGS=x go test fall to the generic path); go -json parsing; load_owner killTree process-group kill; unittest atexit forged trailer | loki-ts/src/engine10 package_suite, load_owner, test classify, plus tests | MEDIUM | make test wrapping go test classifies with runner go; a forged unittest trailer from atexit is not a pass | merged@2026-10-04T00:55Z | Engineer fix-fc16b in worktree. From review-fc16-fc02-integ rounds 4-6. package_suite results never feed seal proof today. Also owed: an end-to-end test running a go Wall file through RealBaseTestRunner (the seal.test.ts case does not guard wall.ts). | 00:33Z: review-fc16b BLOCKED 1b3f594cb (forged go events, unittest multi-Ran); fix 626b46c74 in opus re-review. 
-| FC-22 | FC-22: (a) impacted-test selection is scoped by the Project Model, touched packages plus their real dependents (manifest or import edges), never every package; (b) a selected package with no installed deps gets the Project Model's own install command run once before verify, recorded as a check with its cwd, opt-out by config | loki-ts/src/e10ext/select.ts, project_model resolve and gather, engine10 verify pre-step, plus tests | HIGH | a backend-only change in the monorepo-fc01 fixture selects no frontend test; a selected package without node_modules gets one recorded install check; no guessed command; e10ext under 1500 | merged@2026-10-04T01:08Z | Plan docs/v10/FC21B-FC22-PLAN.md (S1 then S2 selection and S3 install). FireLater#17 gate on 10.10.5 (run e10-20261003T233414Z-30ca) PARTIAL only from 4 over-selected frontend tests (steering 23:47Z). HIGH because selection feeds verify proof. Architect plan first; e10ext is 1 line under its cap. Next train with FC-21b and FC-23. | 00:33Z: S1 merged 88e9e43fb (review-s1 APPROVE). S2 e9e04fe1d in opus review-s2; S3 cb6486550 in opus review-s3. 01:08Z: S3 merged 736f4d436 (review-s3 APPROVE on d2e61c2ff, 3627/0, tsc 0; discard.ts L2 tension to CTO). S2 merged b4022e6fb (review-s2 APPROVE on a62aba7b2, 3624/0, tsc 0) behind LOKI_E10_SCOPE default off. Before the flag flips: F1 root-owned keep test with a non-relative import, F2 verify test.scoped_out event test. The install library is wired by S4. 
+| FC-16b | FC-16 follow-ups: package_suite.ts:33 detects go by first token only (make test, GOFLAGS=x go test fall to the generic path); go -json parsing; load_owner killTree process-group kill; unittest atexit forged trailer | loki-ts/src/engine10 package_suite, load_owner, test classify, plus tests | MEDIUM | make test wrapping go test classifies with runner go; a forged unittest trailer from atexit is not a pass | released@2026-10-16T00:49Z | Engineer fix-fc16b in worktree. From review-fc16-fc02-integ rounds 4-6. package_suite results never feed seal proof today. Also owed: an end-to-end test running a go Wall file through RealBaseTestRunner (the seal.test.ts case does not guard wall.ts). | 00:33Z: review-fc16b BLOCKED 1b3f594cb (forged go events, unittest multi-Ran); fix 626b46c74 in opus re-review. 
+| FC-22 | FC-22: (a) impacted-test selection is scoped by the Project Model, touched packages plus their real dependents (manifest or import edges), never every package; (b) a selected package with no installed deps gets the Project Model's own install command run once before verify, recorded as a check with its cwd, opt-out by config | loki-ts/src/e10ext/select.ts, project_model resolve and gather, engine10 verify pre-step, plus tests | HIGH | a backend-only change in the monorepo-fc01 fixture selects no frontend test; a selected package without node_modules gets one recorded install check; no guessed command; e10ext under 1500 | released@2026-10-16T00:49Z | Plan docs/v10/FC21B-FC22-PLAN.md (S1 then S2 selection and S3 install). FireLater#17 gate on 10.10.5 (run e10-20261003T233414Z-30ca) PARTIAL only from 4 over-selected frontend tests (steering 23:47Z). HIGH because selection feeds verify proof. Architect plan first; e10ext is 1 line under its cap. Next train with FC-21b and FC-23. | 00:33Z: S1 merged 88e9e43fb (review-s1 APPROVE). S2 e9e04fe1d in opus review-s2; S3 cb6486550 in opus review-s3. 01:08Z: S3 merged 736f4d436 (review-s3 APPROVE on d2e61c2ff, 3627/0, tsc 0; discard.ts L2 tension to CTO). S2 merged b4022e6fb (review-s2 APPROVE on a62aba7b2, 3624/0, tsc 0) behind LOKI_E10_SCOPE default off. Before the flag flips: F1 root-owned keep test with a non-relative import, F2 verify test.scoped_out event test. The install library is wired by S4. 
 | FC-23 | FC-23: the Wall writes tests matching the package's module system and test conventions from the Project Model; a lint or type error inside a Wall file is harness-owned, the Wall file is regenerated once or discarded with a NOT PROVEN note, and no fix round is spent on it | loki-ts/src/engine10/stages/wall.ts, the fix-round target filter, project_model conventions, plus tests | MEDIUM | a CommonJS package gets a Wall test with no import.meta; a forced type error in a Wall file yields regenerate-or-discard and zero fix rounds | released@2026-10-04T00:51Z | released@2026-10-04T00:51Z | Merged c0a1c43c2 (38c782386, review-fc23 sonnet APPROVE; nits: duplicate NOT PROVEN line for a discarded file, merged comment in verify.ts).