loki-mode 11.15.0 → 11.17.1

package/dashboard/build_supervisor.py

@@ -97,6 +97,8 @@ _PROVIDER_AUTH_COMMANDS = {
     "cline": ("cline", "auth", "status"),
 }
 _PROVIDER_READINESS_COMMANDS = {
+    # P12-26b scoped out: fixed sandboxed printf probe that must run Bash; a restrictive
+    # policy would report a false provider-auth failure. Listed in the guard test.
     "claude": (
         "claude",
         "--dangerously-skip-permissions",

package/docs/CLI-REFERENCE.md

@@ -1,6 +1,6 @@
 # CLI reference
 
-Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.15.0. Do not edit by hand.
+Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.17.1. Do not edit by hand.
 Hidden and legacy-only commands are omitted; see `docs/v10/CLI-MODERN.md` for the full inventory.
 
 | Command | Description |
@@ -159,3 +159,4 @@ Hidden and legacy-only commands are omitted; see `docs/v10/CLI-MODERN.md` for th
 | `loki metrics` | Metrics |
 | `loki sentrux` | Architecture sensor |
 | `loki magic` | Magic modules |
+| `loki steer` | Nudge a running build |

package/docs/EVALUATING.md

@@ -225,7 +225,7 @@ One set of definitions for the effort and honesty numbers, used by the bench rep
 - Term misleading completion: Loki or the agent claimed done and was wrong. Bench name `false_completion` = (reported success and not accepted) / reported success. `loki trust` name `false_verified` = VERIFIED claims later FAILED / VERIFIED claims. Same idea, same denominator (claims of success). Null when nothing claimed success.
 - Term cost per accepted: total spend across ALL attempts, failures included, divided by accepted. Null when nothing was accepted, and null when any run's cost is unmeasured (a partial sum is not a total; the bench also reports a lower bound). Never zero for an unknown.
 - Interventions by type: counts of blocking pauses that waited on a person, split into `steer`, `input`, `authorization` and `repair` (a fixed enum, no free text). Written to `.loki/state/interventions.json` at the pause site; shown in `loki trust`, HANDOFF.md and the proof as `interventions_detail`. Absent means not recorded, not zero.
-- Waited versus active minutes: only `waited_s` is measured, the wall-clock seconds a run sat blocked on a person. It is an upper bound on human attention. Active minutes (time a person actually spent working) are NOT measured and are never reported. `loki trust` labels the figure "waited, upper bound".
+- Waited versus active minutes: `waited_s` is the wall-clock seconds a run sat blocked on a person, an upper bound on human attention. `active_s` (in `interventions.json` and `interventions_detail`) is the measured time a person actually worked on steer, input, authorization and repair events, recorded only when both timestamps were measured. `loki trust` shows "Active minutes per accepted" only when every run measured it, otherwise "n/a (not measured)"; an unmeasured value is never reported as 0. Status: the runner does not yet write `active_s` (nothing calls `recordActiveSeconds`), so `loki trust` shows n/a until the writer slice lands. Only non-negative integers are accepted; a float or negative value is dropped as unmeasured.
 - Retries: iterations to completion, taken from the proof `iterations.count` (`loki trust` iterations axis). A retry is not an intervention.
 
 ---

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 Loki Mode, by [Autonomi](https://www.autonomi.dev/), turns a spec or an issue into a verified pull request with a receipt you can check. This page covers installing it, a first run, and the options around it.
 
-**Version:** v11.15.0
+**Version:** v11.17.1
 
 **Engine note:** `loki start` is the primary command. `loki start`, `loki "<task>"`, `loki owner/repo#N` and `loki quick` all run the Loki 10 engine, whatever the flag order or input form (PRD file, issue ref, task or one-word brief). The previous loop runs only on `--engine legacy`, `LOKI_ENGINE=legacy`, or for one call when a flag Loki 10 cannot honor is present. See the [user guide](v10/GUIDE.md) and the [5-minute quickstart](QUICKSTART.md).
 

package/docs/v10/BOARD.md

@@ -44,6 +44,31 @@ merge (all touch trust-core or security-relevant surfaces), oldest first.
 |---|---|---|---|---|---|---|
 | PF-1 | pkill-scoping fix | main @ 9cd51d1a | autonomy/run.sh (kill_provider_child), tests/test-kill-provider-child-scoping.sh, docs/v10/DECISIONS.md (D15) | HIGH | released@2026-09-27T01:33Z | Founder-reported: every loki-mode session ending via signal (supervisor signal, double Ctrl+C, Ctrl+C in perpetual mode) ran an unscoped `pkill -f` matching ANY process on the machine by command-line substring, terminating unrelated Claude Code sessions. Fixed to scope by process group. Shipped as v9.54.1, ahead of the swarm queue. |
 | PF-2 | P7 scanner gap fix | main @ fa5de15f | tests/moat/p7-no-fabricated-data.sh | HIGH | released@2026-09-27T15:00Z | Round 5, unanimous 4/4 APPROVE under a corrected scoping rule (only a regression/false-positive/weakening introduced by the diff blocks; a pre-existing gap the diff doesn't worsen is a new slice, not a veto). Rebased onto current main, merged fa5de15f, pushed. 10 candidate follow-up slices recorded below (B-1..B-8 plus 2 more from the review). Shipped in v9.56.0 (merged before the 14:16:24Z release push of b651b98d; on npm 15:00:06Z). |
+| P12-17 | Slack thread steer | main @ 2d333d158 | loki-ts/src/contrib/slack_inbound.ts + test | MEDIUM | released@2026-10-16T17:19Z | reviewed and merged; v11.16.0 was never published, shipped in v11.17.0 |
+| P12-12 | stall watchdog | main @ 4c0ee6dbf | engine10 session, runner watchdog + tests | MEDIUM | released@2026-10-16T17:19Z | reviewed and merged; v11.16.0 was never published, shipped in v11.17.0 |
+| P12-16 | chat commands | main @ 6d6f69f73 | autonomy/lib/chat.sh, tests/test-doctor-ux.sh | MEDIUM | released@2026-10-16T17:19Z | reviewed and merged; v11.16.0 was never published, shipped in v11.17.0 |
+| P12-24 | doctor min claude version | main @ e6754c961 | doctor, compat manifest | LOW | released@2026-10-16T17:19Z | reviewed and merged; v11.16.0 was never published, shipped in v11.17.0 |
+| P12-21 | per-stage cost | main @ 44c0810f2 | cost breakdown | MEDIUM | released@2026-10-16T17:19Z | reviewed and merged; v11.16.0 was never published, shipped in v11.17.0 |
+| P12-31 | active human minutes | main @ 9e2604b95 | trust, proof | MEDIUM | released@2026-10-16T17:19Z | reviewed and merged; v11.16.0 was never published, shipped in v11.17.0 |
+| P12-25 | provider isolation matrix | main @ 8c256963b | tests/providers, guard revert | MEDIUM | released@2026-10-16T17:19Z | reviewed and merged; v11.16.0 was never published, shipped in v11.17.0 |
+| P12-03 | merge pinned to proven head | main @ b3ff4bb1d | merge, proofs | HIGH | released@2026-10-16T17:19Z | reviewed and merged; v11.16.0 was never published, shipped in v11.17.0 |
+| P12-06 | council file:line anchors | main @ 40ee4c1a9 | council | MEDIUM | released@2026-10-16T17:19Z | reviewed and merged; v11.16.0 was never published, shipped in v11.17.0 |
+| P12-04 | respond refuses moved head | main @ 6da9172e6 | verify-pr respond | HIGH | released@2026-10-16T17:19Z | reviewed and merged; v11.16.0 was never published, shipped in v11.17.0 |
+| P12-07 | per-stage resume (07b-07g) | main @ f5c54cbb7 | engine10 resume, autonomy/loki start | HIGH | released@2026-10-16T17:19Z | v11.17.0, reviewed and merged |
+| P12-01 | Seal drift and receipt tamper checks (01b, 01c) | main @ f5c54cbb7 | loki verify, proofs | HIGH | released@2026-10-16T17:19Z | v11.17.0, reviewed and merged |
+| P12-26 | compiled Claude permission policy (26b, 26c) | main @ f5c54cbb7 | src/policies, launch sites | HIGH | released@2026-10-16T17:19Z | v11.17.0, reviewed and merged |
+| P12-09 | quota wait-then-rerun (09b) | main @ f5c54cbb7 | runner retry_class | MEDIUM | released@2026-10-16T17:19Z | v11.17.0, reviewed and merged |
+| P12-08 | work-item ids and lifecycle states (08b, 08c) | main @ f5c54cbb7 | engine10 state, loki status | MEDIUM | released@2026-10-16T17:19Z | v11.17.0, reviewed and merged |
+| P12-02 | post-Wall steer blocks Seal (02b, 02c) | main @ f5c54cbb7 | steer, seal | HIGH | released@2026-10-16T17:19Z | v11.17.0, reviewed and merged |
+| P12-03b | dirty-tree proof fails closed (03c, 03d) | main @ f5c54cbb7 | proofs | HIGH | released@2026-10-16T17:19Z | v11.17.0, reviewed and merged |
+| P12-05 | Wall holdout, off by default | main @ f5c54cbb7 | engine10 wall | HIGH | released@2026-10-16T17:19Z | v11.17.0, reviewed and merged |
+| P12-16b | chat /run reports only a live run | main @ f5c54cbb7 | autonomy/lib/chat.sh | MEDIUM | released@2026-10-16T17:19Z | v11.17.0, reviewed and merged |
+| P12-17b | Slack echo redaction | main @ f5c54cbb7 | contrib/slack | MEDIUM | released@2026-10-16T17:19Z | v11.17.0, reviewed and merged |
+| P12-23 | start flag parsing (23b) | main @ f5c54cbb7 | autonomy/loki | LOW | released@2026-10-16T17:19Z | v11.17.0, reviewed and merged |
+| P12-29 | configured Claude Code eval arm | main @ f5c54cbb7 | eval/loki10 | MEDIUM | released@2026-10-16T17:19Z | v11.17.0, reviewed and merged |
+| P12-30 | eval task families with hidden tests | main @ f5c54cbb7 | eval/loki10 | MEDIUM | released@2026-10-16T17:19Z | v11.17.0, reviewed and merged |
+| P12-40 | uncited-claim guard (40b) | main @ f5c54cbb7 | structural checks | LOW | released@2026-10-16T17:19Z | v11.17.0, reviewed and merged |
+| P12-CAP | engine10 core line cap | main @ f5c54cbb7 | tests | LOW | released@2026-10-16T17:19Z | v11.17.0, reviewed and merged |
 
 ## Fixed on main already (not slices; recorded for PO context)
 

package/docs/v10/CLI-MODERN.md

@@ -6,9 +6,9 @@ Classes: KEEP-MODERN (v10-native or engine-neutral), UPDATE (live but needs mode
 
 ## Counts
 
-- KEEP-MODERN: 70
+- KEEP-MODERN: 71
 - UPDATE: 22
-- DROP-LEGACY: 32
+- DROP-LEGACY: 31
 - DELETE: 14
 - Total rows: 138
 - Registry paths (commands and nested subcommands): 194
@@ -143,7 +143,7 @@ Classes: KEEP-MODERN (v10-native or engine-neutral), UPDATE (live but needs mode
 | heal | autonomy/loki | DROP-LEGACY | Legacy engine |
 | migrate | autonomy/loki | DROP-LEGACY | Superseded by modernize |
 | dogfood | autonomy/loki | DROP-LEGACY | Legacy engine |
-| steer | autonomy/loki | DROP-LEGACY | Needs legacy prompt injection |
+| steer | autonomy/loki | KEEP-MODERN | Session control |
 | outcomes | autonomy/loki | DROP-LEGACY | Legacy outcome store |
 | worktree | autonomy/loki | DROP-LEGACY | Legacy parallel mode |
 | wt | autonomy/loki | DELETE | Alias of worktree; shown only under 'loki help aliases' |

package/docs/v10/DECISIONS.md

@@ -583,6 +583,7 @@ The $20.00 default per-run cap stays. It is a hard stop on priced sessions only;
 6. Cap: 90s small, 180s normal, LOKI_E10_WALL_LIMIT_S may override up to 300s, fixed before the session. A Wall timeout stays not_run, never red or already_satisfied, and Seal discloses it.
 7. Ships behind LOKI_E10_WALL_MANIFEST with a lift row (augmentiq#52 plus 2 brownfield tasks, manifest off versus on). Lower lift drops the change. Slices W1-S1..W1-S4 on BOARD; S1 to S3 touch the engine10 core and wait for core budget room.
 
+8. P12-05 holdout, behind LOKI_WALL_HOLDOUT_RATIO (default 0 = off, opt-in; founder decision C-C4 pending on the default ratio and block versus warn): a deterministic subset (sha256 of run id and test id, max(1, round(ratio*N)), none under 3 Wall tests) is kept outside the repo and runDir, copied in only by verify as blocking holdout:N checks, and its private store is removed when the run ends. Preconditions before C-C4 may enable it by default: (a) pin the holdout hashes outside the store (run memory or the sealed event) and check them at verify, because the manifest is self-attesting today; (b) drop targetDir from the manifest; (c) scrub first_error for holdout checks before it reaches the fix stage; (d) close the rmSync/mkdirSync symlink race on the shared OS tmp dir; (e) define resume, since the run-end cleanup deletes the store.
 
 ## D78
 2026-10-03T10:39Z, CoS (D69). GitHub push protection rejected train/94 because commit 04f62ff4e (SEC-SCAN-1) carried planted fake AWS key literals in tests/test-secret-scan.sh. Nothing in the range was on origin, so the 124 unpushed main commits were rewritten locally (filter-branch index-filter on that one file): each literal is split with an adjacent empty single-quoted string, so bash builds the same value and the scanner test still blocks it (6/0). The tree diff from the old head was that file only. This was not a force-push, and no protection bypass was requested. Commit SHAs cited on BOARD and PROGRESS for 10:25Z and earlier today, after a185ce16, are pre-rewrite and resolve only through the reflog. Rule: a test fixture never holds a scanner-matching secret literal, split it at write time.

package/docs/v10/ENGINE.md

@@ -248,7 +248,7 @@ Required keys: `type`, `stage` (null for run-level events), `ts` (ISO UTC, ms),
 
 Unknown is never 0. A missing cost is `usd: null`, and every reader renders null as "not measured".
 
-**Work-item state (one vocabulary).** `workItemState(events, nowMs?)` in `util/run_outputs.ts` (beside `phaseOf`) folds the log into one name per run, used by `loki status --json` (`state`), `phaseOf` (resume) and chat (which shells to status): `received` (run.started only), `prepared` (intake done), `planned` (plan done or wall seen), `executing` (implement running), `validating` (implement done, or verify/fix/commit/seal/pr/deep seen), `ready_to_ship` (receipt.sealed). Terminal states come only from run.completed: `completed`, `waiting_for_input` (verdict SPEC_CONFLICT), `budget_stopped` (cap.hit with verdict PARTIAL or FAILED), `failed`, `cancelled`. `stalled` needs the clock argument and 30 minutes without events on an unfinished run.
+**Work-item state (one vocabulary).** `workItemState(events, nowMs?)` in `util/run_outputs.ts` (beside `phaseOf`) folds the log into one name per run, used by `loki status --json` (`state`), `phaseOf` (resume) and chat (which shells to status): `received` (run.started only), `prepared` (intake done), `planned` (plan done or wall seen), `executing` (implement running), `validating` (implement done, or verify/fix/commit/seal/pr/deep seen), `ready_to_ship` (receipt.sealed), `delivering` (pr.opened, written by the supervisor, run not yet complete), `observing` (delivering plus deep.started, the supervisor's detached post-PR deep verify is running). Terminal states come only from run.completed: `completed`, `waiting_for_input` (verdict SPEC_CONFLICT), `budget_stopped` (cap.hit with verdict PARTIAL or FAILED), `failed`, `cancelled`. `stalled` needs the clock argument and 30 minutes without events on an unfinished run.
 
 ## 6. Process topology and Rule of Two
 

package/docs/v10/FAILURE-CLASSES.md

@@ -795,3 +795,21 @@ L0 review rule (ENGINE-LAWS.md L0): a fix that adds an `if` or a regex about the
 - Mechanism: scripts/v10-worktree-reap.sh removes (non-force, by exact path) clean worktrees merged into origin/main or idle past 6h by HEAD reflog mtime and not on an active BOARD row; idle dirty ones are salvaged to wt-save/<name> first (node_modules and .rv deleted, loki-ts/dist discarded); detached unmerged HEADs get a wt-save ref; locked and fresh ones are kept. It runs after each main sync in train-cycle.sh and from .githooks/post-merge. scripts/v10-worktree-add.sh enforces the 40G floor (LOKI_WORKTREE_DISK_FLOOR_GB), reaping first. Pulse emits WORKTREE_SPRAWL above 20.
 - Fixture: tests/test-worktree-reap.sh (merged, idle, detached, dirty-idle, .rv, dist-only, dirty-fresh, locked, fresh, BOARD-held, floor refusal, pulse 20 vs 21).
 - Known limits: a locked worktree whose owning agent is dead is kept (the reaper cannot tell dead from alive, so it never touches a locked one); and slice worktrees created by the agent harness bypass the disk floor unless the dispatcher creates them through scripts/v10-worktree-add.sh.
+
+## FC-100 The merge gate accepted a proof not bound to the PR head (MERGE-HEAD-PIN)
+- User saw: a PR could merge on a VERIFIED verdict that was earned by a different commit than the one merged (last-proof-id pointed at whatever ran last, and gh pr merge named no expected head).
+- Law: a verdict binds to the exact bytes it judged; the merge must prove the head it lands equals the head that was proven.
+- Cause (measured): _merge_pr_gated read .loki/state/last-proof-id.txt without comparing facts.git.head_sha to the PR headRefOid, and called gh pr merge without --match-head-commit; a scan that stopped at the first matching proof let an older VERIFIED override a newer NOT_PROVEN.
+- Siblings swept: verify-pr respond headRefOid compare (P12-04, loki-ts); the queue path shares _merge_pr_gated and is pinned too.
+- Mechanism: the gate reads headRefOid, requires every clean (non-dirty) proof for that head to agree on VERIFIED, refuses with gate: head when none exists or the head is unreadable or moved, and merges with --match-head-commit.
+- Fixture: tests/test-loki-merge-queue.sh (pin flag, stale proof, proof resolved by head, older VERIFIED vs newer NOT_PROVEN, dirty proof, unreadable head, head moved).
+- Known limits: a proof without facts.git.head_sha never matches (fails closed); dirty is ignoring .loki/ only.
+
+## FC-101 A receipt field the writer always emits was treated as optional, so deleting it passed as UNSIGNED (RECEIPT-FIELD-OPTIONAL)
+- User saw: a hand-edited receipt with events_sha256, time or time.stages removed (or set to null or a string) verified as UNSIGNED, and --allow-unsigned accepted it.
+- Law: a verifier may treat a field as optional only if some writer omits it; absence of an always-written field is evidence of editing, never a pass.
+- Cause (measured): checkEventLog returned null when events_sha256 was not a string, and the P12-01b stages check accepted any non-object time; seal.ts has written both fields since ad80fd4e6.
+- Siblings swept: the group receipt (seal_group.ts), Python proof receipts and control-plane fixtures never carry these fields and are not gated; signed receipts already cover both fields through receipt_sha256 and the attestation. The control-plane verify fixture (packages/control-plane/test/server/verify.test.ts signed()) and the undo_plan, undo_apply and workspace e2e receipt/1 fixtures are gated and now carry seal-shaped fields (empty-log hash with zero stages).
+- Mechanism: verify_cmd.ts checkEventLog, for schema loki.v10.receipt/1 only, returns TAMPERED naming the missing field (events_sha256 not 64-char lowercase hex, time absent or null, time.stages not a plain object) and ends "Re-run the task to produce a fresh receipt."
+- Fixture: loki-ts/tests/engine10/verify_cmd.test.ts P12-01c (field missing, malformed hash, time removed with stages at top level, time null, stages string, stages array, honest zero-stage receipt stays UNSIGNED); hand-built receipt/1 fixtures in seal_group, log_seal and visual_evidence tests now carry both fields.
+- Known limits: a receipt with a schema variant or no schema field falls to the ungated path and reads UNSIGNED (its receipt_sha256 still must match, and signed ones are covered by the attestation).

package/docs/v10/PROGRESS.md

@@ -2386,3 +2386,7 @@ The swarm is stopped: .loki/V10-STOP exists, the loop has no wake-ups, and the c
 - 2026-10-16T01:20Z v11.13.0: fast-forwarded main to fv-train 79a127fa9 (12 factory-parity lanes, FC-09t r5, M-20 wave verify; Opus integration review APPROVED, engine10 2291/0, tsc 0). 43 BOARD rows released; FV-gh-steer-4 and FV-pr-loop-4 back to ready. M-22 approved, M-23 in Opus round 2; both merge next.
 - 2026-10-16T02:04Z v11.14.0: v11.13.0 never published (credentialed_push_guard red: verify-pr respond pushed with its own token). Fixed by routing respond through engine10-push.sh push-pr with origin read once before the fixer runs (Opus HIGH approved r3 after two BLOCKs). Merged M-21 wave ship, M-22 unit resume, M-23 remote units and G-05, FV-pr-loop-4 and FV-gh-steer-4, fv-train follow-ups; engine10 core trimmed to 4946 lines. Guards 158/0, engine10+util 2523 pass (31 route-matrix fails are local TMPDIR-only, green in CI).
 - 2026-10-16T02:40Z v11.15.0: v11.14.0 never published (CI red: route matrix packages link, merge-queue gh PATH and stat order, FC-89 marker); all four fixed. Shipped M-25 sealed final report (row 379 released), resume adopts only landed merges (mutation-checked 18/1 red, 19/0 green), modernize coordinator wiring (Opus round 2 approve; real runs still exit 2 naming four missing pieces), modernize trim 4107 to 3792. Gates: shell 14/14 rc 0, bun guard set 640/1 then L0 allowlist entry dropped (3/0), tsc 0.
+- 2026-10-16T15:20Z v11.16.0: merged P12-17 Slack steer (2d333d158), P12-12 stall watchdog (4c0ee6dbf), P12-16 chat commands (6d6f69f73) on top of P12-14/04/N3-N4/15/20/24/06/03/31/21/25; budget.test 33/0, tsc 0 errors (outside control-plane). P12-26, P12-07, P12-29, P12-30 sent back on BLOCK; P12-01 in Opus re-review.
+- 2026-10-16T17:19Z v11.17.0: cut at f5c54cbb7 after Tests run 38936426289 passed. Ships everything written under v11.16.0 (never published: four CI guard reds, all fixed) plus engine-plan slices P12-07 resume, P12-01 Seal drift and tamper, P12-26 compiled permission policy, P12-09 quota rerun, P12-08 lifecycle, P12-02 post-Wall steer, P12-03b dirty-tree proofs, P12-05 holdout (off), P12-16b, P12-17b, P12-23, P12-29, P12-30, P12-40, P12-CAP. Queued after release: P12-07h, P12-09c, P12-12/25, P12-30b, P12-16c (all approved); P12-26d in HIGH re-review; P12-01d building.
+- 2026-10-16T17:52Z v11.17.0 never published (help-drift guard red); fixed f0aae2698. Tests on 4ade347be then red on model_output_regex_guard (session.ts baseline 6 vs 4 after P12-12d); fixed f80f2a3f7, Tests pending. v11.17.1 cuts on green. Approved and queued for v11.17.2: P12-07i, 07j, 30c, 30e, 02c+02d, 26e, 12e. In review: P12-02e, 16f, 26f (HIGH). Building: P12-30d, 07k, 01e.
+- 2026-10-16T18:06Z v11.17.1: cut at f80f2a3f7 after Tests run 38942790682 passed. First publish of the v11.16.0 and v11.17.0 content plus P12-01d, 07h, 09c, 12/25, 12c/12d, 26d, 16c-16e, 30b and the help/guard fixes. Queued for v11.17.2: 07j, 07m (2a6a4b196), 30d (with 30e), 02f or 02g (HIGH review), 26e or 26f (HIGH review), 12e, 16f, M-MOD, 07k, 01e. Building: 07n heartbeat.

package/loki-ts/data/finding-schema.json

@@ -63,7 +63,8 @@
                 "description": {
                   "type": "string",
                   "minLength": 1,
-                  "maxLength": 2000
+                  "maxLength": 2000,
+                  "description": "What is wrong. CRITICAL and HIGH issues should cite path:line (e.g. src/a.ts:42); uncited ones are downgraded to MEDIUM."
                 }
               }
             }