loki-mode 11.17.102 → 11.18.0

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: An autonomous software factory that knows what it is supposed to deliver, and proves it did. Use when the user says Loki Mode or asks to build, fix or verify software autonomously.
 ---
 
-# Loki Mode v11.17.102
+# Loki Mode v11.18.0
 
 **Current entry points (Loki 10 engine):** `loki "<task>"`, `loki owner/repo#N` and `loki quick "<task>"` run the Loki 10 engine and end with a signed receipt (`loki verify`). `loki backlog owner/repo --all` runs many issues in parallel. Guide: `docs/v10/GUIDE.md`. The skill instructions below, and `loki start`, describe the previous bash loop. PRD-file starts (`loki start ./prd.md`) and the opencode provider still run on it until FC38-SWEEP ports them; the legacy-engine command and the LOKI_ENGINE switch remain removed. Prefer `loki owner/repo#N` for issues.
 
@@ -483,4 +483,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v11.17.102 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**
+**v11.18.0 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**

package/VERSION

@@ -1 +1 @@
-11.17.102
+11.18.0

package/dashboard/__init__.py

@@ -7,6 +7,6 @@ Modules:
     control: Session control helpers (status, atomic writes, origin check)
 """
 
-__version__ = "11.17.102"
+__version__ = "11.18.0"
 
 __all__ = ["__version__"]

package/docs/CLI-REFERENCE.md

@@ -1,6 +1,6 @@
 # CLI reference
 
-Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.17.102. Do not edit by hand.
+Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.18.0. Do not edit by hand.
 Hidden and legacy-only commands are omitted; see `docs/v10/CLI-MODERN.md` for the full inventory.
 
 | Command | Description |

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 Loki Mode, by [Autonomi](https://www.autonomi.dev/), turns a spec or an issue into a verified pull request with a receipt you can check. This page covers installing it, a first run, and the options around it.
 
-**Version:** v11.17.102
+**Version:** v11.18.0
 
 **Engine note:** `loki start` is the primary command. `loki start`, `loki "<task>"`, `loki owner/repo#N` and `loki quick` all run the Loki 10 engine, whatever the flag order or input form (PRD file, issue ref, task or one-word brief). The previous loop runs only on `--engine legacy`, `LOKI_ENGINE=legacy`, or for one call when a flag Loki 10 cannot honor is present. See the [user guide](v10/GUIDE.md) and the [5-minute quickstart](QUICKSTART.md).
 

package/docs/v10/FAILURE-CLASSES.md

@@ -1215,6 +1215,17 @@ L0 review rule (ENGINE-LAWS.md L0): a fix that adds an `if` or a regex about the
 - Hardening 2 (HIGH re-review of 9a4267335, D99): a changed TEST file can also be reached through a workspace link (node_modules/shared/helper.test.js), so test-files-only is not enough. depsSeeHead (util/base_guard.ts) withholds the excusal whenever the dependency dirs the base rerun would link can see head sources: any top-level or @scope/* node_modules entry that is a symlink whose realpath is inside the repo, or a .venv holding a .pth, *.egg-link or direct_url.json that names the repo; an unreadable dependency dir counts as seeing head. This gate is in addition to the test-files-only gate. Fixture: verify_prered.test.ts "reviewer repro 2" (red before the guard).
 - Hardening 3 (round 3 HIGH review, D99): depsSeeHead now walks node_modules and .venv recursively without following symlinks (so node_modules/foo/node_modules/shared -> ../../../shared is seen), inspects every symlink target, and withholds when a target is inside the repo but outside the dependency dir it lives in (an npm .bin link or a pnpm store link stays self-contained). The repo is compared as given and as realpath (/var vs /private/var, a symlinked repo dir). Editable-install files (.pth, .egg-link, direct_url.json with its file:// URL decoded by fileURLToPath so %20 matches, and __editable___*_finder.py) are checked for the repo path, each named path also by realpath. The walk is bounded at 50000 entries; exceeding it or any read error other than a missing dir withholds. The helper logic lives in util/base_guard.ts (zeroOnBase, depsSeeHead), outside the engine core cap. A pnpm workspace package links to a path inside the repo but outside node_modules, so workspace pnpm repos are withheld; that is fail-safe, and the excusal is effectively inert wherever workspace links or editable installs exist.
 - Stated plainly: the motivating incident (FireLater#20, a run that edits source) stays NOT PROVEN by design. The excusal only fires for runs that changed test files alone with dependencies that cannot see head; Seal accuracy outranks delivered accuracy.
+- Superseded 2026-10-19 (founder principle: a PARTIAL caused by the harness, not by missing proof, is a bug) by FC-REPO-SKIPPED-TEST-DOWNGRADES: source-editing runs are now eligible; the dependency-visibility gate (depsSeeHead) and the no-test-config-edit gate remain.
+
+## FC-REPO-SKIPPED-TEST-DOWNGRADES A relevant test the repo itself skips (zero tests on base and head, file untouched) downgraded the verdict to PARTIAL
+- User-visible vs raw: user-visible. FireLater#20 run e10-20261019T171919Z-cc1c sealed PARTIAL with every executed check green: verify selected `backend/tests/integration/request-approval-race.test.ts` (wholly `describe.skip`, needs a real DB, unchanged by the run), it executed zero tests (events.jsonl seq 60, result not_run, reason "no tests executed (ran 0 tests, empty or all skipped)"), and verdictOf returns PARTIAL for any check whose result is not pass. FC-ZERO-ON-BASE had already removed the "not run:" note for such a check but (a) never excused it from the verdict, (b) never fired for a task-named (relevant) test, and (c) never fired when the run edited any non-test file.
+- Law broken: a result the change did not cause is never charged to the change (A-112 base-comparison contract); and a harness-caused gap is a bug, not a missing proof (founder principle 2026-10-19). Zero-executed stays fail-closed whenever it could be about the change.
+- Siblings swept: every runner that maps "ran 0 tests" to not_run goes through classifyCheck (util/check_result.ts) and so through the one zeroOnBase base rerun: vitest, jest, pytest, node:test, bun, go test, cargo. Runners whose zero is not measurable on base (no runner output parsed, base cut or missing) never excuse. Package and full-suite not_run lines (a suite is a command, not a file) are unchanged and still downgrade.
+- Mechanism (one, extended): verify.ts subtractBase candidate filter drops its `!rel.has` exclusion (a relevant, non-Wall, non-holdout, untouched not_run with the NO_TESTS_REASON is measured on the pristine base like any other), and `zeroOk` no longer requires the run to have changed test files only (it keeps: no test configuration edit; zeroOnBase still withholds whenever the linked dependency dirs can see head, depsSeeHead). Zero on base too puts the name in `skipped_on_base`. seal.ts then (1) leaves exactly those not_run checks out of the verdictOf input (as pre_red fails already are), (2) records each in the receipt with `repo_skipped: true` and result not_run (never dropped), (3) writes the non-blocking note "skipped by the repo on base and head: <check>". Guards kept in verdictOf: the run still needs an executed passing n>0 check (FC-16 proof) and, after a limit kill, targetProofOf (n>0 pass of a Wall or relevant test): a skipped target is never a proof. Wall and holdout checks are never candidates in verify (they are excluded from the zero-candidate filter); seal additionally refuses a skipped_on_base name that matches a Wall file path (equal to the path after the runner prefix, or ending with / plus it). It does not cross-check target_checks: a relevant (task-named) test is eligible by design, and a skipped one is never a proof because target_checks lists only passing checks.
+- Intake zero baseline (replaces the manifest-text gate and the environment fingerprint, both bypassed by content-level edits: remove optdep and uninstall it, move the line between dependency blocks, delete node_modules/optdep/index.js keeping its package.json; the base rerun links HEAD's node_modules and .venv, so any environment edit the run makes is invisible to it): a zero check is excused ONLY when the same check was also zero at INTAKE, on the base commit in an environment the agent had not touched (REPOMEM pattern). Measured on the real FireLater#20 artifact: the intake baseline recorded only `npm test` failing ids (unattributable) and per-package full suites, never per-file results, so the check was not covered; intake now calls probeZeroChecks (verify.ts, one run of each detected test file, bounded by 300 files and 120 s, never throws) and records `zero_baseline: {measured, zero}`. verify excuses a name only if it is in `zero`; a check not measured there (over the bound, cut, missing, absent field) is withheld. The base rerun (zeroOnBase) stays as a second, stricter requirement. depsChangedBeyondAdditions, depsFingerprint and depsEnvKept were deleted: under the baseline rule they add no protection (a pre-change measurement is immune to later edits). Residual: a repo with more than 300 test files only excuses the probed ones. Fixtures: verify_prered.test.ts removed dependency, BYPASS1, BYPASS2, BYPASS3, check absent from the baseline, missing baseline (negatives), FireLater#20-shaped additions-only run, probeZeroChecks.
+- Residual: a dependency that changes how an unchanged file registers tests would need a symlink into head (withheld) or a config edit (withheld). Base not measured (no base worktree, cut, missing) keeps today's behavior.
+- Fixture: loki-ts/tests/engine10/verify_prered.test.ts describe "FC-REPO-SKIPPED-TEST-DOWNGRADES" (relevant skip with source edit is skipped_on_base; diff-touched file, Wall file, zero-on-head-but-ran-on-base, test-config edit stay fail-closed) and loki-ts/tests/engine10/seal.test.ts "FC-REPO-SKIPPED-TEST-DOWNGRADES" (verdict VERIFIED with receipt repo_skipped and note; unlisted not_run, no executed proof, Wall name and base-not-measured all still PARTIAL).
+- Separate finding (no code change): bare "council" and "security scan" in the NOT PROVEN of that run are the high-tier deep items (check_result.ts deepGaps). They never enter verdictOf (seal adds them to notes after the verdict is computed). They did not run because the fast engine defers them to the detached post-PR deep verify (supervisor.ts, spawned only after pr.opened); this run had pr_url null (no pr.opened or deep.started event), so they could not run. Not a verdict cause here; tracked as an observation that a PARTIAL run never gets its deep verify.
 ## FC-FULLSUITE-ANSI-IDS A repo whose full suite was already red on base ended FAILED because the head full-suite run parsed no failure ids from colored output (FULLSUITE-ANSI-IDS)
 - User-visible vs raw: user-visible. FireLater#20 on loki 11.17.74: a frontend vitest suite with 307 known failing ids in `.loki/state/repo-profile.json` ended FAILED "full suite: frontend failed". Raw: the head run's output was colored, `failIds` returned [] (stripped, the same output yields 296 ids, all inside the base set), and attributeFullSuite treats ids=[] as "introduced (blocking)". The fix brief also carried only the command, so the fixer saw no failure text.
 - Law: a parser reads what the tool said, not how it was painted (FC-69); a user's environment must not change a verdict; unknown never excuses, but the reason it is unknown must be named.
@@ -1388,3 +1399,11 @@ L0 review rule (ENGINE-LAWS.md L0): a fix that adds an `if` or a regex about the
 - Siblings swept: runFullSuite legacy per-runner path (commands come from FULL_SUITE_CMD, always frameworks, unchanged); base_guard and wall use real runners (unchanged).
 - Mechanism: check_result.ts isExitCodedScript (every segment a plain interpreter-plus-script run, nothing naming a test framework or containing "test"; anything ambiguous is a framework) feeds classifyCheck exitCoded: pass on rc 0, fail on rc != 0, count "n/a (exit-coded check, not a test runner)", never an n, so it is never executed proof. A framework with no summary stays UNMEASURED. FC-16 on the target is unchanged.
 - Fixture: tests/util/check_result.test.ts and tests/engine10/monorepo_cwd.test.ts (red before: missing export), tests/engine10/seal.test.ts (Wall n>0 plus exit-coded full suite is VERIFIED with one reviewer credited by a real review).
+
+## FC-UNOWNED-FILE-OWNED-BY-TESTLESS-PACKAGE A changed file no package owns made every unrelated test-less package own the diff, so a proven run sealed PARTIAL
+- User-visible vs raw: user-visible. claude-code#81826 on 11.17.102 sealed PARTIAL with "full suite: package scripts defines no test command" although the diff touched only plugins/ralph-wiggum/{hooks/stop-hook.sh,scripts/setup-ralph-loop.sh} and the passing Wall (n=4) executed both scripts. Run e10-20261019T191337Z-08db.
+- Law: ownership is positive evidence, never absence of an owner; an unowned file is proven or named, never silently passed or silently blamed on an unrelated package.
+- Cause (measured): runPackageSuites `owns` returned true for any test-less package whenever any product file had no owning package.
+- Siblings swept: execProves (reused as the proof), the proofFiles credit, quoted and unresolved paths (quoted still owned by all, fail-safe), FC-WALL-FILE-OWNS-EVERY-PACKAGE.
+- Mechanism: a test-less package owns an unowned file only if it is the repo-root package. Unowned product files are proven by execProves (Wall red on base, green on head, whole product diff unowned); otherwise one NOT PROVEN note "changed file <f> belongs to no package and no passing check exercised it".
+- Fixture: loki-ts/tests/engine10/monorepo_cwd.test.ts tests FC-UNOWNED-FILE-OWNED-BY-TESTLESS-PACKAGE. Red on 00bc53d72 (5 fail), green after.

package/docs/v10/PROGRESS.md

@@ -2680,3 +2680,15 @@ v11.17.21 published (Release success on 462fbc40a; npm latest 11.17.21, next 11.
 
 ## 2026-10-19T19:00Z (CoS) v11.17.102
 - 11.17.102: FC-VERIFIED-PR-WITHOUT-ITS-TEST (opus HIGH APPROVE after hook BLOCK; seal 121/0, pr_body_golden 17/0, log_seal 19/0) and FC-FULL-SUITE-EXIT-CODED-SCRIPT (opus HIGH APPROVE; check_result 31/0, monorepo_cwd 39/0). claude-code#81826 draft rerun on 11.17.101 sealed PARTIAL on an exit-coded checker script.
+
+## 2026-10-19T19:33Z (CoS) v11.17.103
+- 11.17.103: FC-REPO-SKIPPED-TEST-DOWNGRADES (opus HIGH APPROVE x4), FC-FULL-SUITE-EXIT-CODED-SCRIPT attribution (opus HIGH APPROVE; harness_intelligence 108/0) and FC-UNOWNED-FILE-OWNED-BY-TESTLESS-PACKAGE (opus HIGH APPROVE; monorepo_cwd 42/0, red 37/5). claude-code#81826 on 11.17.102 sealed PARTIAL on an unowned plugin file; FireLater#20 on 11.17.100 sealed PARTIAL on a repo-skipped suite.
+
+## 2026-10-20T01:40Z (CoS) v11.18.0 checkpoint, session paused to Wednesday
+- Founder: release a minor checkpoint and pause until Wednesday. Weekly usage measured at 91.0% (stop line 92%).
+- claude-code#81826: the verified fix (base-10 round-trip overflow check, 7/7 acceptance, bash -n OK) is pushed fast-forward to fork PR asklokesh/claude-code#1, head 3a4d482, with an updated body. The upstream repo only accepts PRs from collaborators, so the fork PR is how it gets delivered.
+- Filed asklokesh/loki-mode #229-#238 (class issues: run isolation, publish integrity, runner from the owning package, risk tier, decomposition, unmapped start flag, weakened-test false positive, Wall proven vs committed path).
+- Resume Wednesday:
+  1. Re-run `loki start asklokesh/loki-mode#233` in a fresh clone, using an engine built from the candidate fix. The installed engine cannot verify a fix to its own runner selection.
+  2. Before any #233 release, require the full loki-ts `bun test` and an opus HIGH review.
+  3. Then work #238, #236, #237, #234, #235 and #230-#232 under #229.

package/loki-ts/dist/cockpit.js

@@ -16,4 +16,4 @@ var BJ=Object.defineProperty;var HJ=(J)=>J;function FJ(J,Q){this[J]=HJ.bind(null
 `),3}let K=WJ()-2,V=await zJ(G,{protocol:Q,forceText:Z,cols:K});if($)try{let{writeFileSync:q}=await import("fs");q($,V.svg)}catch{}if(V.kind==="image"&&V.data)return process.stdout.write(V.data),0;return process.stderr.write(`FALLBACK	${V.reason||"image unavailable"}
 `),3}if(import.meta.main)eJ().then((J)=>process.exit(J));export{eJ as main};
 
-//# debugId=70625FF4EA7AB3FE465CBC2695CA8629
+//# debugId=3D7AE784FC80270648681F4B5422E5D0