loki-mode 11.17.101 → 11.17.103
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/SKILL.md +2 -2
- package/VERSION +1 -1
- package/dashboard/__init__.py +1 -1
- package/docs/CLI-REFERENCE.md +1 -1
- package/docs/INSTALLATION.md +1 -1
- package/docs/dev/architecture-reference.md +1 -0
- package/docs/v10/FAILURE-CLASSES.md +35 -0
- package/docs/v10/PROGRESS.md +6 -0
- package/loki-ts/dist/cockpit.js +1 -1
- package/loki-ts/dist/loki.js +1290 -1283
- package/mcp/__init__.py +1 -1
- package/package.json +2 -2
- package/packages/control-plane/dist/server.js +199 -87
- package/plugins/loki-mode/.claude-plugin/plugin.json +1 -1
- package/web-app/dist/assets/{AdminPage-DSJGYumL.js → AdminPage-Be31jIYC.js} +1 -1
- package/web-app/dist/assets/{Avatar-DVxsrfEX.js → Avatar-I4vmLjCg.js} +1 -1
- package/web-app/dist/assets/{Badge-DLLtIvQM.js → Badge-CIfNx6Xl.js} +1 -1
- package/web-app/dist/assets/{Button-DAyVA7mU.js → Button-CQF48fm9.js} +1 -1
- package/web-app/dist/assets/{CockpitPage-CF5cNHR_.js → CockpitPage-B74RL_EL.js} +1 -1
- package/web-app/dist/assets/{ComparePage-CHLo66No.js → ComparePage-NAn3Uj2e.js} +1 -1
- package/web-app/dist/assets/{ErrorBoundary-Y7HdiEu9.js → ErrorBoundary-CV_yphkX.js} +1 -1
- package/web-app/dist/assets/{EvidenceReceiptPanel-8zXYO2-F.js → EvidenceReceiptPanel-CIVjkE8j.js} +1 -1
- package/web-app/dist/assets/{GitHubIssuesPanel-2BY91j89.js → GitHubIssuesPanel-EG6T-14q.js} +1 -1
- package/web-app/dist/assets/{GitHubPRsPanel-Bk2p_NV0.js → GitHubPRsPanel-CsOkTFM_.js} +1 -1
- package/web-app/dist/assets/{HomePage-BXAp8WvL.js → HomePage-PW-K4Hzi.js} +2 -2
- package/web-app/dist/assets/{LoginPage-uflglYRk.js → LoginPage-MGXi2v1I.js} +1 -1
- package/web-app/dist/assets/{MagicPage-zYt576mT.js → MagicPage-Csq66LLV.js} +1 -1
- package/web-app/dist/assets/{MetricsPage-BUH_gujC.js → MetricsPage-DFMDeAbr.js} +1 -1
- package/web-app/dist/assets/{NotFoundPage-DAXP26VD.js → NotFoundPage-IhuTK_Qp.js} +1 -1
- package/web-app/dist/assets/{ProjectPage-C4ztOAbB.js → ProjectPage-B5pMwXID.js} +3 -3
- package/web-app/dist/assets/{ProjectsPage-yN7k5C7o.js → ProjectsPage-C2uDWzcH.js} +1 -1
- package/web-app/dist/assets/{SettingsPage-BZBl94NZ.js → SettingsPage-BRQ1HxpD.js} +1 -1
- package/web-app/dist/assets/{ShowcasePage-QA4PUdY2.js → ShowcasePage-Jrmv9_q8.js} +1 -1
- package/web-app/dist/assets/{SystemSettingsPage-DWuQnpoH.js → SystemSettingsPage-DWNM4v8o.js} +1 -1
- package/web-app/dist/assets/{TeamsPage-2PpAKMeX.js → TeamsPage-B8pFA2gq.js} +1 -1
- package/web-app/dist/assets/{TemplatesPage-Bf2q1WkF.js → TemplatesPage-DCXwtsA5.js} +1 -1
- package/web-app/dist/assets/{TerminalOutput-BG7OHTGl.js → TerminalOutput-w7CNtXVu.js} +1 -1
- package/web-app/dist/assets/{activity-B19QgRZX.js → activity-Dm1K7wnl.js} +1 -1
- package/web-app/dist/assets/{bell-2x39NR4Y.js → bell-BQj7hAlJ.js} +1 -1
- package/web-app/dist/assets/{bot-CKeM2yXE.js → bot-Cw7FtEcg.js} +1 -1
- package/web-app/dist/assets/{check-4F3sF2p_.js → check-Depj9TyN.js} +1 -1
- package/web-app/dist/assets/{chevron-left-yWZaZ1cO.js → chevron-left-6tBsSbyP.js} +1 -1
- package/web-app/dist/assets/{circle-alert-CMVv2D6y.js → circle-alert-h_5TnEiB.js} +1 -1
- package/web-app/dist/assets/{clock-B73y-HjH.js → clock-BicamaH9.js} +1 -1
- package/web-app/dist/assets/{cloud-DY2rAmZf.js → cloud-7bdTVn-1.js} +1 -1
- package/web-app/dist/assets/{code-xml-B0TSkFsr.js → code-xml-R3Q0a7hL.js} +1 -1
- package/web-app/dist/assets/{database-DtFpb-5M.js → database-baW5gP4L.js} +1 -1
- package/web-app/dist/assets/{dollar-sign-CpQrnNzy.js → dollar-sign-DeSgV7a_.js} +1 -1
- package/web-app/dist/assets/{file-code-corner-n_LVjVlC.js → file-code-corner-Bv4999-z.js} +1 -1
- package/web-app/dist/assets/{file-plus-DBazo6sC.js → file-plus-nKIjzhFg.js} +1 -1
- package/web-app/dist/assets/{globe-DRAOq9zG.js → globe-7KIOSZdM.js} +1 -1
- package/web-app/dist/assets/{hammer-BMAJcbOt.js → hammer-BrO8N9it.js} +1 -1
- package/web-app/dist/assets/{index-BRXwDqho.js → index-BS7F6Hkn.js} +3 -3
- package/web-app/dist/assets/{layers-DA52g4VD.js → layers-C8pYIPyS.js} +1 -1
- package/web-app/dist/assets/{loader-circle-CiudNyEn.js → loader-circle-DcsRxv6z.js} +1 -1
- package/web-app/dist/assets/{lock-pdPLMeIV.js → lock-C1xygww2.js} +1 -1
- package/web-app/dist/assets/{package-BJaEhXRn.js → package-CvmQCdPh.js} +1 -1
- package/web-app/dist/assets/{plus-B02mfKg8.js → plus-BvHJZTXE.js} +1 -1
- package/web-app/dist/assets/{refresh-cw-Be77lY9T.js → refresh-cw-Cm6RXEdW.js} +1 -1
- package/web-app/dist/assets/{rotate-ccw-3ZzNbbS6.js → rotate-ccw-DOQhaRrx.js} +1 -1
- package/web-app/dist/assets/{scroll-text-CAEh1b9S.js → scroll-text-DQliR_DQ.js} +1 -1
- package/web-app/dist/assets/{server-DvsYm58b.js → server-Pnsb21Jn.js} +1 -1
- package/web-app/dist/assets/{shield-alert-B0OlkOcu.js → shield-alert-DMJlLpYj.js} +1 -1
- package/web-app/dist/assets/{thumbs-up-CuZV2EPG.js → thumbs-up--s57eX4a.js} +1 -1
- package/web-app/dist/assets/{trash-2-CwC4tvYA.js → trash-2-DAX0fW09.js} +1 -1
- package/web-app/dist/assets/{trending-down-BuirR3f2.js → trending-down-DtojAVWB.js} +1 -1
- package/web-app/dist/assets/{trending-up-B7amM0mF.js → trending-up-Ct9CNAKz.js} +1 -1
- package/web-app/dist/assets/{upload-BLPBN-f3.js → upload-LLZudyee.js} +1 -1
- package/web-app/dist/assets/{usePolling-B201_skn.js → usePolling-CjIINLCp.js} +1 -1
- package/web-app/dist/assets/{user-iVW3gDvf.js → user-CVCOxlyK.js} +1 -1
- package/web-app/dist/index.html +1 -1
package/SKILL.md
CHANGED
|
@@ -3,7 +3,7 @@ name: loki-mode
|
|
|
3
3
|
description: An autonomous software factory that knows what it is supposed to deliver, and proves it did. Use when the user says Loki Mode or asks to build, fix or verify software autonomously.
|
|
4
4
|
---
|
|
5
5
|
|
|
6
|
-
# Loki Mode v11.17.
|
|
6
|
+
# Loki Mode v11.17.103
|
|
7
7
|
|
|
8
8
|
**Current entry points (Loki 10 engine):** `loki "<task>"`, `loki owner/repo#N` and `loki quick "<task>"` run the Loki 10 engine and end with a signed receipt (`loki verify`). `loki backlog owner/repo --all` runs many issues in parallel. Guide: `docs/v10/GUIDE.md`. The skill instructions below, and `loki start`, describe the previous bash loop. PRD-file starts (`loki start ./prd.md`) and the opencode provider still run on it until FC38-SWEEP ports them; the legacy-engine command and the LOKI_ENGINE switch remain removed. Prefer `loki owner/repo#N` for issues.
|
|
9
9
|
|
|
@@ -483,4 +483,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
|
|
|
483
483
|
|
|
484
484
|
---
|
|
485
485
|
|
|
486
|
-
**v11.17.
|
|
486
|
+
**v11.17.103 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**
|
package/VERSION
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
11.17.
|
|
1
|
+
11.17.103
|
package/dashboard/__init__.py
CHANGED
package/docs/CLI-REFERENCE.md
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
# CLI reference
|
|
2
2
|
|
|
3
|
-
Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.17.
|
|
3
|
+
Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.17.103. Do not edit by hand.
|
|
4
4
|
Hidden and legacy-only commands are omitted; see `docs/v10/CLI-MODERN.md` for the full inventory.
|
|
5
5
|
|
|
6
6
|
| Command | Description |
|
package/docs/INSTALLATION.md
CHANGED
|
@@ -2,7 +2,7 @@
|
|
|
2
2
|
|
|
3
3
|
Loki Mode, by [Autonomi](https://www.autonomi.dev/), turns a spec or an issue into a verified pull request with a receipt you can check. This page covers installing it, a first run, and the options around it.
|
|
4
4
|
|
|
5
|
-
**Version:** v11.17.
|
|
5
|
+
**Version:** v11.17.103
|
|
6
6
|
|
|
7
7
|
**Engine note:** `loki start` is the primary command. `loki start`, `loki "<task>"`, `loki owner/repo#N` and `loki quick` all run the Loki 10 engine, whatever the flag order or input form (PRD file, issue ref, task or one-word brief). The previous loop runs only on `--engine legacy`, `LOKI_ENGINE=legacy`, or for one call when a flag Loki 10 cannot honor is present. See the [user guide](v10/GUIDE.md) and the [5-minute quickstart](QUICKSTART.md).
|
|
8
8
|
|
|
@@ -113,3 +113,4 @@ extract_learnings_from_session (autonomy/run.sh) mirrors learnings and decisions
|
|
|
113
113
|
- Parallel units: `route.ts` maybeRunGroup defaults to `features/speed/run_group.ts`, which freezes per-unit acceptance (`features/contract.ts`), runs units, merges with `engine10/integrate.ts` and seals once via sealGroup.
|
|
114
114
|
- Lessons: every sealed run appends a receipt fact (`LOKI_AUTO_LEARN_PR`, default on) outside the receipt body; `implement.ts` injects lessons and relevant learnings inside the untrusted-data fence; `loki memory brief --task T` prints the same block.
|
|
115
115
|
|
|
116
|
+
- Wall publish (FC-VERIFIED-PR-WITHOUT-ITS-TEST): on a VERIFIED seal only, `publishWall` (`util/check_result.ts`, called from `stages/seal.ts`) makes ONE child commit (trailer `Loki-Wall-Publish: <runId>`) of the SEALED Wall bytes (`runDir/wall`, hash-checked against `wall.files[].sha256`) that verify ran and passed (`publishableWall`). Before writing, the realpath of each Wall file's parent directory must be inside the repo, and an existing file or symlink is removed first. The child commit runs with hooks and signing OFF (the default `git()` call, no `userHooks`), so a pre-commit hook cannot add files or rewrite the Wall bytes. Afterwards the commit must touch exactly the published paths and each committed blob must equal the blob hash of the sealed bytes (computed in process, never read from the worktree); on any mismatch the child is rolled back (`update-ref` HEAD to the product head plus `read-tree`), nothing is published and a NOT PROVEN note is added. The receipt binds the PRODUCT head (head_sha, tree, diff_sha256 are computed before the child commit). A re-seal binds `HEAD^` only when HEAD's message has the exact trailer line for this run, HEAD touches only paths of this run's `wall.files`, and every blob sha256 matches (`wallChild`); a forged trailer is not enough. `util/seal_drift.ts` accepts a moved HEAD after head_sha as benign only when every commit after it is such a Wall publish commit (linear, trailer line for the receipt's run_id, only `wall.files` paths, blob sha256 equal to the sealed one); any commit after head_sha that carries this run's trailer but fails that check is head drift (UNCHECKED). Later commits without the trailer stay under the TEN-GATES-16 sealed-path overlap rule. The PR body gains an "Acceptance tests" section. Commit stage and `backstopCommit` still drop Wall files. `LOKI_COMMIT_WALL=0` restores the old behavior (nothing published).
|
|
@@ -1215,6 +1215,17 @@ L0 review rule (ENGINE-LAWS.md L0): a fix that adds an `if` or a regex about the
|
|
|
1215
1215
|
- Hardening 2 (HIGH re-review of 9a4267335, D99): a changed TEST file can also be reached through a workspace link (node_modules/shared/helper.test.js), so test-files-only is not enough. depsSeeHead (util/base_guard.ts) withholds the excusal whenever the dependency dirs the base rerun would link can see head sources: any top-level or @scope/* node_modules entry that is a symlink whose realpath is inside the repo, or a .venv holding a .pth, *.egg-link or direct_url.json that names the repo; an unreadable dependency dir counts as seeing head. This gate is in addition to the test-files-only gate. Fixture: verify_prered.test.ts "reviewer repro 2" (red before the guard).
|
|
1216
1216
|
- Hardening 3 (round 3 HIGH review, D99): depsSeeHead now walks node_modules and .venv recursively without following symlinks (so node_modules/foo/node_modules/shared -> ../../../shared is seen), inspects every symlink target, and withholds when a target is inside the repo but outside the dependency dir it lives in (an npm .bin link or a pnpm store link stays self-contained). The repo is compared as given and as realpath (/var vs /private/var, a symlinked repo dir). Editable-install files (.pth, .egg-link, direct_url.json with its file:// URL decoded by fileURLToPath so %20 matches, and __editable___*_finder.py) are checked for the repo path, each named path also by realpath. The walk is bounded at 50000 entries; exceeding it or any read error other than a missing dir withholds. The helper logic lives in util/base_guard.ts (zeroOnBase, depsSeeHead), outside the engine core cap. A pnpm workspace package links to a path inside the repo but outside node_modules, so workspace pnpm repos are withheld; that is fail-safe, and the excusal is effectively inert wherever workspace links or editable installs exist.
|
|
1217
1217
|
- Stated plainly: the motivating incident (FireLater#20, a run that edits source) stays NOT PROVEN by design. The excusal only fires for runs that changed test files alone with dependencies that cannot see head; Seal accuracy outranks delivered accuracy.
|
|
1218
|
+
- Superseded 2026-10-19 (founder principle: a PARTIAL caused by the harness, not by missing proof, is a bug) by FC-REPO-SKIPPED-TEST-DOWNGRADES: source-editing runs are now eligible; the dependency-visibility gate (depsSeeHead) and the no-test-config-edit gate remain.
|
|
1219
|
+
|
|
1220
|
+
## FC-REPO-SKIPPED-TEST-DOWNGRADES A relevant test the repo itself skips (zero tests on base and head, file untouched) downgraded the verdict to PARTIAL
|
|
1221
|
+
- User-visible vs raw: user-visible. FireLater#20 run e10-20261019T171919Z-cc1c sealed PARTIAL with every executed check green: verify selected `backend/tests/integration/request-approval-race.test.ts` (wholly `describe.skip`, needs a real DB, unchanged by the run), it executed zero tests (events.jsonl seq 60, result not_run, reason "no tests executed (ran 0 tests, empty or all skipped)"), and verdictOf returns PARTIAL for any check whose result is not pass. FC-ZERO-ON-BASE had already removed the "not run:" note for such a check but (a) never excused it from the verdict, (b) never fired for a task-named (relevant) test, and (c) never fired when the run edited any non-test file.
|
|
1222
|
+
- Law broken: a result the change did not cause is never charged to the change (A-112 base-comparison contract); and a harness-caused gap is a bug, not a missing proof (founder principle 2026-10-19). Zero-executed stays fail-closed whenever it could be about the change.
|
|
1223
|
+
- Siblings swept: every runner that maps "ran 0 tests" to not_run goes through classifyCheck (util/check_result.ts) and so through the one zeroOnBase base rerun: vitest, jest, pytest, node:test, bun, go test, cargo. Runners whose zero is not measurable on base (no runner output parsed, base cut or missing) never excuse. Package and full-suite not_run lines (a suite is a command, not a file) are unchanged and still downgrade.
|
|
1224
|
+
- Mechanism (one, extended): verify.ts subtractBase candidate filter drops its `!rel.has` exclusion (a relevant, non-Wall, non-holdout, untouched not_run with the NO_TESTS_REASON is measured on the pristine base like any other), and `zeroOk` no longer requires the run to have changed test files only (it keeps: no test configuration edit; zeroOnBase still withholds whenever the linked dependency dirs can see head, depsSeeHead). Zero on base too puts the name in `skipped_on_base`. seal.ts then (1) leaves exactly those not_run checks out of the verdictOf input (as pre_red fails already are), (2) records each in the receipt with `repo_skipped: true` and result not_run (never dropped), (3) writes the non-blocking note "skipped by the repo on base and head: <check>". Guards kept in verdictOf: the run still needs an executed passing n>0 check (FC-16 proof) and, after a limit kill, targetProofOf (n>0 pass of a Wall or relevant test): a skipped target is never a proof. Wall and holdout checks are never candidates in verify (they are excluded from the zero-candidate filter); seal additionally refuses a skipped_on_base name that matches a Wall file path (equal to the path after the runner prefix, or ending with / plus it). It does not cross-check target_checks: a relevant (task-named) test is eligible by design, and a skipped one is never a proof because target_checks lists only passing checks.
|
|
1225
|
+
- Intake zero baseline (replaces the manifest-text gate and the environment fingerprint, both bypassed by content-level edits: remove optdep and uninstall it, move the line between dependency blocks, delete node_modules/optdep/index.js keeping its package.json; the base rerun links HEAD's node_modules and .venv, so any environment edit the run makes is invisible to it): a zero check is excused ONLY when the same check was also zero at INTAKE, on the base commit in an environment the agent had not touched (REPOMEM pattern). Measured on the real FireLater#20 artifact: the intake baseline recorded only `npm test` failing ids (unattributable) and per-package full suites, never per-file results, so the check was not covered; intake now calls probeZeroChecks (verify.ts, one run of each detected test file, bounded by 300 files and 120 s, never throws) and records `zero_baseline: {measured, zero}`. verify excuses a name only if it is in `zero`; a check not measured there (over the bound, cut, missing, absent field) is withheld. The base rerun (zeroOnBase) stays as a second, stricter requirement. depsChangedBeyondAdditions, depsFingerprint and depsEnvKept were deleted: under the baseline rule they add no protection (a pre-change measurement is immune to later edits). Residual: a repo with more than 300 test files only excuses the probed ones. Fixtures: verify_prered.test.ts removed dependency, BYPASS1, BYPASS2, BYPASS3, check absent from the baseline, missing baseline (negatives), FireLater#20-shaped additions-only run, probeZeroChecks.
|
|
1226
|
+
- Residual: a dependency that changes how an unchanged file registers tests would need a symlink into head (withheld) or a config edit (withheld). Base not measured (no base worktree, cut, missing) keeps today's behavior.
|
|
1227
|
+
- Fixture: loki-ts/tests/engine10/verify_prered.test.ts describe "FC-REPO-SKIPPED-TEST-DOWNGRADES" (relevant skip with source edit is skipped_on_base; diff-touched file, Wall file, zero-on-head-but-ran-on-base, test-config edit stay fail-closed) and loki-ts/tests/engine10/seal.test.ts "FC-REPO-SKIPPED-TEST-DOWNGRADES" (verdict VERIFIED with receipt repo_skipped and note; unlisted not_run, no executed proof, Wall name and base-not-measured all still PARTIAL).
|
|
1228
|
+
- Separate finding (no code change): bare "council" and "security scan" in the NOT PROVEN of that run are the high-tier deep items (check_result.ts deepGaps). They never enter verdictOf (seal adds them to notes after the verdict is computed). They did not run because the fast engine defers them to the detached post-PR deep verify (supervisor.ts, spawned only after pr.opened); this run had pr_url null (no pr.opened or deep.started event), so they could not run. Not a verdict cause here; tracked as an observation that a PARTIAL run never gets its deep verify.
|
|
1218
1229
|
## FC-FULLSUITE-ANSI-IDS A repo whose full suite was already red on base ended FAILED because the head full-suite run parsed no failure ids from colored output (FULLSUITE-ANSI-IDS)
|
|
1219
1230
|
- User-visible vs raw: user-visible. FireLater#20 on loki 11.17.74: a frontend vitest suite with 307 known failing ids in `.loki/state/repo-profile.json` ended FAILED "full suite: frontend failed". Raw: the head run's output was colored, `failIds` returned [] (stripped, the same output yields 296 ids, all inside the base set), and attributeFullSuite treats ids=[] as "introduced (blocking)". The fix brief also carried only the command, so the fixer saw no failure text.
|
|
1220
1231
|
- Law: a parser reads what the tool said, not how it was painted (FC-69); a user's environment must not change a verdict; unknown never excuses, but the reason it is unknown must be named.
|
|
@@ -1277,6 +1288,14 @@ L0 review rule (ENGINE-LAWS.md L0): a fix that adds an `if` or a regex about the
|
|
|
1277
1288
|
- Mechanism: one `product` list in runPackageSuites, the changed files minus this run's passing Wall files (the same set execProves excludes). Unknown diff or a Wall-only diff stays owned (fail-safe). A failed Wall has no proofFiles, so nothing is excluded.
|
|
1278
1289
|
- Fixture: loki-ts/tests/engine10/monorepo_cwd.test.ts test "FC-WALL-FILE-OWNS-EVERY-PACKAGE" (N/A with a passing root Wall and an untouched test-less package; NOT PROVEN when the Wall failed or an unowned product path is present). Red on HEAD 2739c8e26 (1 fail), green after (38/0).
|
|
1279
1290
|
|
|
1291
|
+
## FC-VERIFIED-PR-WITHOUT-ITS-TEST A VERIFIED run's pushed branch never contained the acceptance test that made it VERIFIED
|
|
1292
|
+
- User-visible vs raw: user-visible. anthropics/claude-code#81826, run e10-20261019T171807Z-7698, sealed VERIFIED; its commit changed 2 product files and tests/loki_wall_ralph_max_iterations.test.ts stayed untracked, so the PR reviewer saw "Missing tests: the diff has no test changes" for the very test that ran green.
|
|
1293
|
+
- Law: a proof a reviewer is asked to trust must be reproducible from the pushed branch (evidence or it did not happen). Not product, but publishable once the verdict is sealed.
|
|
1294
|
+
- Cause (measured): commit_filter.ts dropSet drops every WALL_FILE (loki_wall_*) in the commit stage and in backstopCommit, and nothing publishes the Wall afterwards, even on VERIFIED.
|
|
1295
|
+
- Siblings swept: backstopCommit (killed or crashed worker: stays dropped), discardIfSatisfied, runPackageSuites proofFiles (FC-WALL-FILE-OWNS-EVERY-PACKAGE), flagOutsideScope, formatChanged, receipt diff_sha256 and head_sha, seal_drift head check, reviewer_body changed-files list: none sees a Wall file as product, because the Wall is published in a SEPARATE child commit made at seal after the verdict.
|
|
1296
|
+
- Mechanism: publishableWall (util/check_result.ts) selects the Wall files verify ran and passed (target_checks + executed proof), reads the SEALED copy under runDir/wall and requires it to hash to wall.files[].sha256 (mismatch: not published, NOT PROVEN note). The seal stage, only when the verdict is VERIFIED, writes the sealed bytes and makes one child commit (trailer Loki-Wall-Publish). The receipt binds the PRODUCT head (head_sha, tree, diff_sha256 computed before the child commit); the pushed head is its child whose only change is Wall files, so sealDrift reads it as benign head movement (no overlap with the sealed diff). The PR body gains an "Acceptance tests" section (paths and the exact verify command). Opt-out LOKI_COMMIT_WALL=0.
|
|
1297
|
+
- Fixture: loki-ts/tests/engine10/seal.test.ts describe "FC-VERIFIED-PR-WITHOUT-ITS-TEST" and loki-ts/tests/engine10/pr_body_golden.test.ts (publish on VERIFIED, sealed bytes not agent bytes, failed/not-run/PARTIAL/opt-out/backstop keep dropping, receipt head and diff unchanged, PR body section). Red on base 4ade2c9a6, green after.
|
|
1298
|
+
|
|
1280
1299
|
## FC-CHANGED-PATH-QUOTED A non-ASCII changed path came back from git as a quoted octal escape, so no consumer of changedFiles could match it to a package, Wall file or test
|
|
1281
1300
|
- User-visible vs raw: user-visible. A diff in `frontend/src/café.ts` made the test-less frontend package read as not owned by the diff, its note became N/A, not_proven was empty and the run could seal VERIFIED with the frontend edit unproven (HIGH re-review of FC-SEAL-NA-AS-UNPROVEN r2).
|
|
1282
1301
|
- Law broken: a git path must be the real path; an unresolvable path must fail safe, never read as "not in the package".
|
|
@@ -1372,3 +1391,19 @@ L0 review rule (ENGINE-LAWS.md L0): a fix that adds an `if` or a regex about the
|
|
|
1372
1391
|
- Siblings swept: autonomy/lib/engine10-push.sh `_e10_local_push` (same fetch-from-path into a temp repo, left unchanged on purpose: its pinned origin is a local path, so a lazy blob fetch would read the operator's own local repo, which holds every object, and there is no remote network credential to seed; the partial-clone failure is a remote-origin shape); autonomy/lib/engine10-push-gitlab.sh (same fetch from "$dir"; fixed with the same seeding, kept logically equivalent in the child because it is a standalone script that cannot source run.sh, and tests/test-engine10-push-gitlab.sh runs it that way); loki-ts/src/runner/attempts.ts only calls the shell push and holds no copy. No other fetch or clone from the agent repo path exists in autonomy/ or loki-ts/src.
|
|
1373
1392
|
- Mechanism: in `_loki_trusted_push`, when the agent repo is partial (extensions.partialclone non-empty, or any remote.<n>.promisor true/yes/on/1, both read as data), the temp repo is seeded with the validated origin URL (captured before a fork destination overwrites it) as promisor remote `loki-base`, and its refs are fetched with --filter=blob:none under the credential runner. The agent pack is thin (deltas against blobs the temp repo knows only by id), so the client lazy-fetches those delta bases from loki-base during the agent fetch; that fetch therefore also runs under the runner, with the agent-dir upload-pack (the only process that reads agent config) started through `--upload-pack '/usr/bin/env -i PATH=/usr/bin:/bin GIT_NO_LAZY_FETCH=1 git upload-pack'`, so no token, helper config, HOME or lazy fetch reaches it. Option chosen over prefetching delta-base blobs (git may pick any blob in the edge trees as a base, so an enumeration is a heuristic that fails closed only on private origins and costs a tree walk on large repos) and over an unfiltered seed (downloads full history). GIT_TERMINAL_PROMPT=0 on both fetches. Non-partial repos take the old path with no extra network or runner. A failed seeding or agent fetch fails closed.
|
|
1374
1393
|
- Fixture: tests/test-engine10-push-gitlab.sh (partial-clone block, red before with "could not stage branch", green after) and tests/test-trusted-push-agent-config.sh "FC-TRUSTED-PUSH-PARTIAL-CLONE" block (a real blob:none clone of a local origin with a history-only blob; pushes the agent branch; asserts the non-partial path never writes remote.loki-base config). Red before (rc=1, no push), green after. Review round 1 (HIGH, reproduced): the agent fetch ran token-less, so a private origin refused the lazy delta-base fetch; both fixtures now add a 20000-line file edited by the agent, an origin that refuses token-less reads through a packObjectsHook in the test global config, and a spy on the agent-dir upload-pack environment. Red on 95bf13b9a for the GitHub path (rc=1, nothing pushed); the GitLab child holds its token process-wide, so only its env-scrub assertion was red there.
|
|
1394
|
+
|
|
1395
|
+
## FC-FULL-SUITE-EXIT-CODED-SCRIPT A project-model full-suite command that is a plain CI checker script (not a test framework) prints no runner summary, so verify recorded it not_run UNMEASURED and a proven change sealed PARTIAL
|
|
1396
|
+
- User-visible vs raw: user-visible. claude-code#81826 on v11.17.101 sealed PARTIAL although the Wall passed with n=7; Not-proven listed "one reviewer", "not run: full suite: repo-root" and "executed count unmeasured".
|
|
1397
|
+
- Law broken: a run seals VERIFIED unless it genuinely cannot be proven; a harness-side parse gap on a command that has no summary to parse must not hold back a proven change.
|
|
1398
|
+
- Cause (measured): the model gave package repo-root the test command `python3 .github/scripts/check_workflow_hardening.py`; it printed "OK: checked 3 job(s) ..." and exited 0; classifyCheck (kind test) needs a parsed count, ran() returned null, result not_run. crossReview returns null for any verdict other than VERIFIED or ALREADY_SATISFIED, so "one reviewer" stayed uncredited only because the run was already PARTIAL.
|
|
1399
|
+
- Siblings swept: runFullSuite legacy per-runner path (commands come from FULL_SUITE_CMD, always frameworks, unchanged); base_guard and wall use real runners (unchanged).
|
|
1400
|
+
- Mechanism: check_result.ts isExitCodedScript (every segment a plain interpreter-plus-script run, nothing naming a test framework or containing "test"; anything ambiguous is a framework) feeds classifyCheck exitCoded: pass on rc 0, fail on rc != 0, count "n/a (exit-coded check, not a test runner)", never an n, so it is never executed proof. A framework with no summary stays UNMEASURED. FC-16 on the target is unchanged.
|
|
1401
|
+
- Fixture: tests/util/check_result.test.ts and tests/engine10/monorepo_cwd.test.ts (red before: missing export), tests/engine10/seal.test.ts (Wall n>0 plus exit-coded full suite is VERIFIED with one reviewer credited by a real review).
|
|
1402
|
+
|
|
1403
|
+
## FC-UNOWNED-FILE-OWNED-BY-TESTLESS-PACKAGE A changed file no package owns made every unrelated test-less package own the diff, so a proven run sealed PARTIAL
|
|
1404
|
+
- User-visible vs raw: user-visible. claude-code#81826 on 11.17.102 sealed PARTIAL with "full suite: package scripts defines no test command" although the diff touched only plugins/ralph-wiggum/{hooks/stop-hook.sh,scripts/setup-ralph-loop.sh} and the passing Wall (n=4) executed both scripts. Run e10-20261019T191337Z-08db.
|
|
1405
|
+
- Law: ownership is positive evidence, never absence of an owner; an unowned file is proven or named, never silently passed or silently blamed on an unrelated package.
|
|
1406
|
+
- Cause (measured): runPackageSuites `owns` returned true for any test-less package whenever any product file had no owning package.
|
|
1407
|
+
- Siblings swept: execProves (reused as the proof), the proofFiles credit, quoted and unresolved paths (quoted still owned by all, fail-safe), FC-WALL-FILE-OWNS-EVERY-PACKAGE.
|
|
1408
|
+
- Mechanism: a test-less package owns an unowned file only if it is the repo-root package. Unowned product files are proven by execProves (Wall red on base, green on head, whole product diff unowned); otherwise one NOT PROVEN note "changed file <f> belongs to no package and no passing check exercised it".
|
|
1409
|
+
- Fixture: loki-ts/tests/engine10/monorepo_cwd.test.ts tests FC-UNOWNED-FILE-OWNED-BY-TESTLESS-PACKAGE. Red on 00bc53d72 (5 fail), green after.
|
package/docs/v10/PROGRESS.md
CHANGED
|
@@ -2677,3 +2677,9 @@ v11.17.21 published (Release success on 462fbc40a; npm latest 11.17.21, next 11.
|
|
|
2677
2677
|
|
|
2678
2678
|
## 2026-10-19T18:37Z (CoS) v11.17.101
|
|
2679
2679
|
- 11.17.101: FC-TRUSTED-PUSH-PARTIAL-CLONE (opus HIGH APPROVE; trusted-push-agent-config 62/0, engine10-push-gitlab 25/0). claude-code#81826 on 11.17.100 sealed VERIFIED but the fork push failed rc=1 in a partial clone.
|
|
2680
|
+
|
|
2681
|
+
## 2026-10-19T19:00Z (CoS) v11.17.102
|
|
2682
|
+
- 11.17.102: FC-VERIFIED-PR-WITHOUT-ITS-TEST (opus HIGH APPROVE after hook BLOCK; seal 121/0, pr_body_golden 17/0, log_seal 19/0) and FC-FULL-SUITE-EXIT-CODED-SCRIPT (opus HIGH APPROVE; check_result 31/0, monorepo_cwd 39/0). claude-code#81826 draft rerun on 11.17.101 sealed PARTIAL on an exit-coded checker script.
|
|
2683
|
+
|
|
2684
|
+
## 2026-10-19T19:33Z (CoS) v11.17.103
|
|
2685
|
+
- 11.17.103: FC-REPO-SKIPPED-TEST-DOWNGRADES (opus HIGH APPROVE x4), FC-FULL-SUITE-EXIT-CODED-SCRIPT attribution (opus HIGH APPROVE; harness_intelligence 108/0) and FC-UNOWNED-FILE-OWNED-BY-TESTLESS-PACKAGE (opus HIGH APPROVE; monorepo_cwd 42/0, red 37/5). claude-code#81826 on 11.17.102 sealed PARTIAL on an unowned plugin file; FireLater#20 on 11.17.100 sealed PARTIAL on a repo-skipped suite.
|
package/loki-ts/dist/cockpit.js
CHANGED
|
@@ -16,4 +16,4 @@ var BJ=Object.defineProperty;var HJ=(J)=>J;function FJ(J,Q){this[J]=HJ.bind(null
|
|
|
16
16
|
`),3}let K=WJ()-2,V=await zJ(G,{protocol:Q,forceText:Z,cols:K});if($)try{let{writeFileSync:q}=await import("fs");q($,V.svg)}catch{}if(V.kind==="image"&&V.data)return process.stdout.write(V.data),0;return process.stderr.write(`FALLBACK ${V.reason||"image unavailable"}
|
|
17
17
|
`),3}if(import.meta.main)eJ().then((J)=>process.exit(J));export{eJ as main};
|
|
18
18
|
|
|
19
|
-
//# debugId=
|
|
19
|
+
//# debugId=3D7AE784FC80270648681F4B5422E5D0
|