loki-mode 11.17.11 → 11.17.13

package/docs/v10/BOARD.md

@@ -413,7 +413,7 @@ set is declared to avoid overlap with those and with each other.
 | REL-GUARD-b | REL-GUARD follow-ups: guard rows run in a clean detached worktree of HEAD, fail closed on missing tsv or zero suites, timeout 300, env -u LOKI_RUN_TMP | scripts/release.sh, scripts/impacted-gate.sh, tests/test-release-sh.sh, tests/test-impacted-gate.sh | HIGH | bash tests/test-release-sh.sh | merged@2026-10-16T23:46Z | Round 1 BLOCK 729cb804 (dirty-tree refusal blocked every main-checkout release); round 2 8d28a3a47 in final HIGH review (D98). Round 2 APPROVED (release-sh 43/0, dry run against the real global-guards.tsv with a dirty red row: PASS 23 suites rc 0 in 196s). Ships in 11.17.7. |
 | REL-GUARD-c | REL-GUARD-b follow-ups: an interrupted release leaves a registered guard worktree (prune does not reclaim it while the dir exists), so remove stale loki-guard.* registrations at function start or via a scoped trap; prune after the rm; log the chmod 700 failure branch | scripts/release.sh, tests/test-release-sh.sh | LOW | bash tests/test-release-sh.sh | merged@2026-10-16T23:51Z | c78236338+7fa0b91d9, LOW approved; release-sh 49/0, no-tmp-sweep 8/0, sigpipe 4/0.  Source: REL-GUARD-b HIGH round 2 non-blocking notes 1-3. |
 | Q17-01 | Slack "Run finished" message shows the stored receipt verdict, with TAMPERED or UNVERIFIED when the integrity check says so, not only the outcome. It also says "(unattested)" when no verdict is available. | loki-ts/src/util/slack_events.ts, loki-ts/src/engine10/supervisor.ts (the finished-event call site only), loki-ts/tests/engine10/slack_events.test.ts | HIGH | `cd loki-ts && bun test tests/engine10/slack_events.test.ts tests/engine10/output.test.ts`; `cd loki-ts && bunx tsc --noEmit` | merged@2026-10-17T00:57Z | merge of e2f197d94 after TL APPROVE (47 pass rc=0, mutation red 2 fail); follow-up: supervisor-level tampered test |
-| Q17-02 | engine10 console `Cost` line adds "N% of cap $X" when a run cap is set (`--max-cost` or `LOKI_E10_MAX_COST_USD`), so users see how close a `loki start` run came to its cap. Without a cap the line is byte-identical to today. | loki-ts/src/engine10/output.ts (costLine only), loki-ts/src/engine10/supervisor.ts (pass the resolved cap into the summary input), loki-ts/tests/engine10/output.test.ts | MEDIUM | `cd loki-ts && bun test tests/engine10/output.test.ts tests/engine10/output_group.test.ts`; `cd loki-ts && bunx tsc --noEmit` | building@2026-10-17T01:07Z | TL BLOCK ff4c80939: no supervisor-level test for the capUsd pass-through; r1 fix building. |
+| Q17-02 | engine10 console `Cost` line adds "N% of cap $X" when a run cap is set (`--max-cost` or `LOKI_E10_MAX_COST_USD`), so users see how close a `loki start` run came to its cap. Without a cap the line is byte-identical to today. | loki-ts/src/engine10/output.ts (costLine only), loki-ts/src/engine10/supervisor.ts (pass the resolved cap into the summary input), loki-ts/tests/engine10/output.test.ts | MEDIUM | `cd loki-ts && bun test tests/engine10/output.test.ts tests/engine10/output_group.test.ts`; `cd loki-ts && bunx tsc --noEmit` | merged@2026-10-17T02:12Z | merge 5f1cde7f2 dist 70e4a9b12; TL r2 APPROVE 11eac46fa, rebased to 5032a1912 (supervisor.ts conflict, TL APPROVE resolution). TL BLOCK ff4c80939: no supervisor-level test for the capUsd pass-through; r1 fix building. |
 | Q17-03 | Verify's flaky list becomes a rerun signal in `decideRecovery`. A fail-then-pass check no longer burns a fix round, while a real failure still does. The fail-safe default is kept. | loki-ts/src/runner/recovery_policy.ts, loki-ts/tests/runner/harness_intelligence.test.ts | MEDIUM | `cd loki-ts && bun test tests/runner/harness_intelligence.test.ts`; `cd loki-ts && bunx tsc --noEmit` | merged@2026-10-17T00:52Z | TL APPROVE 3dec444fa (bun test runner+engine10+util 4157 pass 0 fail, 3/3 mutations red) |
 | Q17-04 | FC-68 siblings: `assert-wall-executed.sh` also fails the release smoke when an expected non-Wall check (lint, mutation proof, cross review) is missing from the receipt `checks[]` without a failing exit. | scripts/assert-wall-executed.sh, scripts/real-run.sh (SC_* knob in the existing scenario parser), tests/test-real-run-guards.sh | HIGH | `bash tests/test-real-run-guards.sh`; `bash -n scripts/assert-wall-executed.sh scripts/real-run.sh` | parked@2026-10-17T00:20Z | D98 park after HIGH r2 BLOCK on b617d3e1f: B1 fixed, B2 not; SC_EXPECT_CHECKS=node is met by the Wall check node:loki_wall_* alone (verify.ts:277, wall.ts:22), so a dropped non-Wall test still passes. Re-sliced as Q17-04b. r2 fix b617d3e1f (wall guard 36/0); HIGH r2 review running. FAILURE-CLASSES.md:643 FC-68 "Siblings: any other check a receipt could lose without a failing exit ... is not yet counted". Release gate, so HIGH. Needs red-then-green: a receipt with the lint check dropped must go red. |
 | Q17-04b | Q17-04 re-slice: real-run scenarios pin the exact non-Wall check names (trivial-sum node:sum.test.js, two-bug node:lib.test.js) on top of b617d3e1f, plus a guard test where only the Wall test is a node check and token node:sum.test.js fails | tests/real-run/scenarios/trivial-sum.sh, tests/real-run/scenarios/two-bug.sh, tests/test-wall-executed-guard.sh | MEDIUM | `bash tests/test-wall-executed-guard.sh`; `bash tests/test-sigpipe-guard.sh` | merged@2026-10-17T00:34Z | TL APPROVE e1bdde7d3 (bare-node mutation caught by structural check); merged with Q17-04 commits. Built e1bdde7d3 (wall guard 0 FAIL, shellcheck rc 0, sigpipe 4/0); TL review running. Source: Q17-04 HIGH r2 finding, fix option 1. Base b617d3e1f (branch q17-04). |
@@ -421,27 +421,29 @@ set is declared to avoid overlap with those and with each other.
 | Q17-05b | EL-FC08b at source: the engine redacts secrets in event data before it hashes the log and signs the seal, so an honest run holding a token ships byte-identical lines that the Control Plane hashes itself and reads VERIFIED; the shipper redaction becomes a no-op on already-redacted lines, and any later edit (including a planted [REDACTED]) reads TAMPERED. No client-supplied hash is ever trusted. | loki-ts/src/util/redact.ts, the engine event-log writer that computes events_sha256 (locate via git grep events_sha256 loki-ts/src), packages/control-plane/test/integrity.test.ts | HIGH | `cd packages/control-plane && bun test test/server/`; `cd loki-ts && bun test tests/util/ tests/engine10/` | ready@2026-10-17T00:38Z | Source: Q17-05 HIGH r1 (FAILURE-CLASSES.md:139-140). Architect pass first: confirm the writer call site and the parity with run.sh before building; forgery fixtures A-D from the Q17-05 review must read TAMPERED or UNVERIFIED, never VERIFIED. |
 | Q18-01 | FC-25c(b) remainder: control-plane shipper gitOrigin runs raw execFileSync("git") with a real-token env; convert to safeGit and make the raw-spawn guard scan packages/control-plane | packages/control-plane/src/shipper/discover.ts, loki-ts/tests/util/fc25_raw_spawn_guard.test.ts | HIGH | `cd loki-ts && bun test tests/util/fc25_raw_spawn_guard.test.ts tests/util/fc25_safe_git.test.ts`; `cd packages/control-plane && bun test`; `cd loki-ts && bunx tsc --noEmit` | merged@2026-10-17T00:50Z | HIGH APPROVE dbb93205a (bun test util 289 pass, 6/6 guard mutations caught); follow-up: comment integrations.ts:85 key-path split |
 | Q18-02 | FC-25c(a): allowToken keeps repo-local core.sshCommand, remote.*.uploadpack/receivepack and repo-scope credential.helper; pin them off while the user global helper still works | loki-ts/src/util/safe_git.ts, loki-ts/tests/util/fc25_safe_git.test.ts | HIGH | `cd loki-ts && bun test tests/util/fc25_safe_git.test.ts`; `bash tests/moat/p9-rule-of-two.sh`; `cd loki-ts && bunx tsc --noEmit` | merged@2026-10-17T00:35Z | HIGH r1 APPROVE 730f27460: tests/util 289/0 rc=0, p9 4 PASS, 2 mutations each fail 1 test; merged 38b6b4b13, dist 3a1c1255c. Reviewer ran no hostile-repo probes, so those go to Q18-02b. |
-| Q18-02b | FC-25c(b): run the hostile-repo probes against safe_git allowToken and close any that leak: credential.helper with a leading !, credential.<url>.helper (including = in the url), include.path and includeIf, insteadOf to ext:: or file::, http.proxy and TLS keys, core.askPass, GIT_CONFIG_COUNT, extensions.worktreeConfig | loki-ts/src/util/safe_git.ts, loki-ts/tests/util/fc25_safe_git.test.ts | HIGH | `cd loki-ts && bun test tests/util/`; `bash tests/moat/p9-rule-of-two.sh` | building@2026-10-17T01:17Z | Source: Q18-02 r1 reviewer follow-ups (none were tested). One test per probe; any reproduced leak gets the fix in the same slice. After Q18-03 if both touch the moat case. |
+| Q18-02b | FC-25c(b): run the hostile-repo probes against safe_git allowToken and close any that leak: credential.helper with a leading !, credential.<url>.helper (including = in the url), include.path and includeIf, insteadOf to ext:: or file::, http.proxy and TLS keys, core.askPass, GIT_CONFIG_COUNT, extensions.worktreeConfig | loki-ts/src/util/safe_git.ts, loki-ts/tests/util/fc25_safe_git.test.ts | HIGH | `cd loki-ts && bun test tests/util/`; `bash tests/moat/p9-rule-of-two.sh` | building@2026-10-17T02:08Z | r1 HIGH BLOCK: sslVerify/curloptResolve untested, sslCAInfo/sslCAPath not reset, submodule config bypass; r2 fix in progress. Source: Q18-02 r1 reviewer follow-ups (none were tested). One test per probe; any reproduced leak gets the fix in the same slice. After Q18-03 if both touch the moat case. |
 | Q18-03 | FC-25c guard: moat case fails if allowToken is passed outside base_guard.ts and modernize_unit.ts (SAFEGIT-REPOCONFIG 1+2) | tests/moat/p9-rule-of-two.sh | HIGH | `bash tests/moat/p9-rule-of-two.sh`; `cd loki-ts && bunx tsc --noEmit` | parked@2026-10-17T01:03Z | D98 r2 BLOCK 9a22006f6: moat run.sh rc=0 P9 PROVEN, but fetch-only pin is a prefix match (allowToken: args[0] === "fetch" || ... passes) and positional safeGitEnv check is single-line and stops at nested parens. Re-sliced as Q18-03b. |
-| Q18-03b | Moat P9 allowToken guard closes r2 bypasses: fetch-only pin must end at the option boundary; positional safeGitEnv and safeGitArgs opt-in detected across lines and with nested-call first arguments, whole-file, outside safe_git.ts | tests/moat/p9-rule-of-two.sh | HIGH | bash tests/moat/run.sh | merged@2026-10-17T01:16Z | HIGH r2 APPROVE 531ad3376; merged 31e4f4b47. Follow-up Q18-03c. || widen and same-line second allowToken pass the pin; r1 fix: whole-file pin, occurrence count, alias imports fail closed |
-| Q18-04 | Deep-stage council has no production runner (deep always records "council (not wired)"); add a default CouncilRunner running one read-only reviewer session via the existing session runner; failure or oversize stays NOT PROVEN | loki-ts/src/engine10/stages/deep.ts, loki-ts/tests/engine10/deep_wiring.test.ts | HIGH | `cd loki-ts && bun test tests/engine10/deep.test.ts tests/engine10/deep_wiring.test.ts`; `cd loki-ts && bunx tsc --noEmit` | building@2026-10-17T01:17Z | PO refill 2026-10-17, grep-checked not shipped: deep.ts:34-35, :139-140. Architect cut if over 30 min; engine10 line budget applies. |
+| Q18-03b | Moat P9 allowToken guard closes r2 bypasses: fetch-only pin must end at the option boundary; positional safeGitEnv and safeGitArgs opt-in detected across lines and with nested-call first arguments, whole-file, outside safe_git.ts | tests/moat/p9-rule-of-two.sh | HIGH | bash tests/moat/run.sh | released@2026-10-17T01:58Z | v11.17.11 (npm next 11.17.11, Tests and Release green on df98addc8). HIGH r2 APPROVE 531ad3376; merged 31e4f4b47. Follow-up Q18-03c. || widen and same-line second allowToken pass the pin; r1 fix: whole-file pin, occurrence count, alias imports fail closed |
+| Q18-04 | Deep-stage council has no production runner (deep always records "council (not wired)"); add a default CouncilRunner running one read-only reviewer session via the existing session runner; failure or oversize stays NOT PROVEN | loki-ts/src/engine10/stages/deep.ts, loki-ts/tests/engine10/deep_wiring.test.ts | HIGH | `cd loki-ts && bun test tests/engine10/deep.test.ts tests/engine10/deep_wiring.test.ts`; `cd loki-ts && bunx tsc --noEmit` | building@2026-10-17T02:08Z | r1 HIGH BLOCK: empty diff counted as council pass, any text counted as review, reviewer not read-only; r2 fix in progress. PO refill 2026-10-17, grep-checked not shipped: deep.ts:34-35, :139-140. Architect cut if over 30 min; engine10 line budget applies. |
 | Q18-05 | AI-BOM writer hook (MARK-3 named in ai_bom.ts header): after seal write a CycloneDX AI-BOM next to the receipt listing only what ran | loki-ts/src/contrib/ai_bom.ts, loki-ts/src/contrib/index.ts, loki-ts/src/engine10/hooks.ts, loki-ts/tests/features/ai_bom.test.ts | HIGH | `cd loki-ts && bun test tests/features/ai_bom.test.ts tests/engine10/seal.test.ts`; `cd loki-ts && bunx tsc --noEmit` | merged@2026-10-17T01:07Z | HIGH APPROVE 3adc5461a; merged 4f7a447db, dist 4a1dc5e65. Follow-ups: leak filter misses github_pat_/glpat-/AIza/npm_/hf_ and is case-sensitive; SAFE_NAME drops provider/model ids with an interior slash; pass a frozen receipt to hooks.sealed. |
 | Q18-06 | Stalled session never killed: session.stalled has no consumer; kill after LOKI_E10_STALL_KILL_S idle (default 0, off) and emit session.ended reason stalled | loki-ts/src/engine10/session.ts, loki-ts/src/runner/watchdog.ts, loki-ts/tests/engine10/session.test.ts | MEDIUM | `cd loki-ts && bun test tests/engine10/session.test.ts tests/runner/watchdog.test.ts`; `cd loki-ts && bunx tsc --noEmit` | merged@2026-10-17T01:06Z | HIGH r2 APPROVE c612595ad; merged df0741e69, dist 538c04a41. |
-| Q18-07 | loki start heartbeat shows no ETA: estimateEtaS has no production caller; call it from the heartbeat line and record actuals at seal | loki-ts/src/engine10/output.ts, loki-ts/src/contrib/eta.ts, loki-ts/tests/engine10/output.test.ts | MEDIUM | `cd loki-ts && bun test tests/engine10/output.test.ts tests/engine10/eta.test.ts`; `cd loki-ts && bunx tsc --noEmit` | building@2026-10-17T01:17Z | PO refill 2026-10-17, grep-checked not shipped: grep estimateEtaS only output.ts:139. Wait for Q17-01/Q17-02 (output.ts overlap). |
+| Q18-07 | loki start heartbeat shows no ETA: estimateEtaS has no production caller; call it from the heartbeat line and record actuals at seal | loki-ts/src/engine10/output.ts, loki-ts/src/contrib/eta.ts, loki-ts/tests/engine10/output.test.ts | MEDIUM | `cd loki-ts && bun test tests/engine10/output.test.ts tests/engine10/eta.test.ts`; `cd loki-ts && bunx tsc --noEmit` | merged@2026-10-17T02:08Z | merge 8b4a94371 dist 47031e380; TL APPROVE d288e13ef. PO refill 2026-10-17, grep-checked not shipped: grep estimateEtaS only output.ts:139. Wait for Q17-01/Q17-02 (output.ts overlap). |
 | Q18-08 | checkDecomposable (D61-09) has no production caller; call it in run_group after the DAG is written so a heavily overlapping DAG runs sequentially; invalid confirm keeps the deterministic DAG | loki-ts/src/features/speed/run_group.ts, loki-ts/tests/features/speed/group_output.test.ts | MEDIUM | `cd loki-ts && bun test tests/engine10/decompose_check.test.ts tests/engine10/route_group.test.ts`; `cd loki-ts && bunx tsc --noEmit` | merged@2026-10-17T00:36Z | TL APPROVE 5a181823a: speed+seal_group+spawn_env_guard 61/0, tsc 0 non-control-plane errors, 3 mutations each red; merged 91264c08c, dist 64923228f. Report-only warning on stderr; forced sequential execution is out of scope. |
 | Q18-09 | Budget loader test: add the never-run mutation leg (drop one cache tier in the loader, must go red) | loki-ts/test/budget_cache_pricing.test.ts | LOW | `cd loki-ts && bun test test/budget_cache_pricing.test.ts`; `cd loki-ts && bunx tsc --noEmit` | merged@2026-10-17T00:48Z | TL APPROVE ea65b07b7: real _loadPricing mutations cache_write_1h, cache_read, over_100k each red; baseline 10/0. PO refill 2026-10-17, grep-checked not shipped: FAILURE-CLASSES line 195 follow-up. |
 | Q18-10 | select-tests.sh maps dashboard/web-app shell suites to handlers only by full path; add a route needle so a suite driving an API route by URL is selected when that handler changes | scripts/select-tests.sh, tests/test-select-tests.sh | MEDIUM | `bash tests/test-select-tests.sh`; `bash tests/test-select-tests-run.sh`; `cd loki-ts && bunx tsc --noEmit` | merged@2026-10-17T00:30Z | TL APPROVE 24a708366: select-tests-run 14/0, sigpipe 4/0, route_needles mutation turns 2 new asserts red; merged ce7624e12. PO refill 2026-10-17, grep-checked not shipped: FAILURE-CLASSES line 360 still thin. |
-| Q18-11 | group.started/group.unit events and createGroupRenderer (D61-14) have no producer or caller; emit from backlog launcher callbacks and attach the renderer to group runs | loki-ts/src/features/speed/group_grid.ts, loki-ts/src/features/speed/group_output.ts, loki-ts/tests/engine10/output_group.test.ts | MEDIUM | `cd loki-ts && bun test tests/engine10/output_group.test.ts tests/features/speed/group_output.test.ts`; `cd loki-ts && bunx tsc --noEmit` | building@2026-10-17T01:17Z | PO refill 2026-10-17, grep-checked not shipped: Architect confirms file set apart from Q18-08 first; else hold until Q18-08 merges. |
-| Q18-03c | P9 allowToken guard residuals from Q18-03b r2: named re-export with as (export { safeGitEnv as x } from safe_git), indirect calls (const f = safeGitEnv; .apply; spread args), and a shadowed args default in a pinned file all give F=0 | tests/moat/p9-rule-of-two.sh | HIGH | bash tests/moat/run.sh | building@2026-10-17T01:17Z | Source: Q18-03b HIGH r2 notes 1, 2 and 4. Obfuscated key escapes (unicode escapes, computed concatenation) cannot be closed by grep; record as accepted residual. |
-| Q18-05b | AI-BOM filter gaps: secret filter misses github_pat_, glpat-, AIza, npm_, hf_, ASIA, sk_live_ and is case-sensitive; SAFE_NAME drops provider/model ids with one interior slash; hooks.sealed receives the live receipt (pass a frozen clone) | loki-ts/src/engine10/ai_bom.ts, loki-ts/src/engine10/stages/seal.ts, loki-ts/tests/engine10/ai_bom.test.ts | MEDIUM | cd loki-ts && bun test tests/engine10/ai_bom.test.ts tests/engine10/seal.test.ts | building@2026-10-17T01:17Z | Source: Q18-05 HIGH review notes. Keep engine10 core net zero. |
-| COST-WALL-f | Partial cost read as complete outside benchmarks: trust_trajectory cost_per_accepted_usd ignores cost.cost_partial; check cost-summary.py and proof-generator.py the same way, routing through one partial check | autonomy/lib/trust_trajectory.py, autonomy/lib/cost-summary.py, autonomy/lib/proof-generator.py, tests/test_efficiency_cost_availability.py | HIGH | python3 -m pytest tests/test_efficiency_cost_availability.py -q | building@2026-10-17T01:17Z | Source: COST-WALL-e HIGH r1 note 4 (FC-COST-PARTIAL-b siblings). |
+| Q18-11 | group.started/group.unit events and createGroupRenderer (D61-14) have no producer or caller; emit from backlog launcher callbacks and attach the renderer to group runs | loki-ts/src/features/speed/group_grid.ts, loki-ts/src/features/speed/group_output.ts, loki-ts/tests/engine10/output_group.test.ts | MEDIUM | `cd loki-ts && bun test tests/engine10/output_group.test.ts tests/features/speed/group_output.test.ts`; `cd loki-ts && bunx tsc --noEmit` | merged@2026-10-17T02:08Z | merge 326cf3402; TL APPROVE cb3e92fca (real-spawn onOut tap untested, follow-up). PO refill 2026-10-17, grep-checked not shipped: Architect confirms file set apart from Q18-08 first; else hold until Q18-08 merges. |
+| Q18-03c | P9 allowToken guard residuals from Q18-03b r2: named re-export with as (export { safeGitEnv as x } from safe_git), indirect calls (const f = safeGitEnv; .apply; spread args), and a shadowed args default in a pinned file all give F=0 | tests/moat/p9-rule-of-two.sh | HIGH | bash tests/moat/run.sh | parked@2026-10-17T01:55Z | Shipped via Q18-03d merge 98611351a. D98 2 rounds used: r2 head 2b3421402 closes all r1 bypasses but its comment strip misses regex literals and template nesting, a regression vs main; continued as Q18-03d on top of 2b3421402. r1 BLOCK (HIGH), r2 fix in progress. Source: Q18-03b HIGH r2 notes 1, 2 and 4. Obfuscated key escapes (unicode escapes, computed concatenation) cannot be closed by grep; record as accepted residual. |
+| Q18-03d | P9 allowToken guard: comma, import and indirect scans fail if either raw or comment-stripped text trips them (strip misses regex literals and template nesting); add regex-literal, template-nesting, barrel-of-barrel and strip-only positive controls | tests/moat/p9-rule-of-two.sh | HIGH | bash tests/moat/run.sh | merged@2026-10-17T02:14Z | merge 98611351a (includes Q18-03c r2 commits); HIGH APPROVE ec6e0adfd, 4 mutations red, P9 PROVEN. Built on Q18-03c r2 head 2b3421402 (branch q18-03c). HIGH r2 repro payloads: const re = /\/*/; safeGitEnv(process.env, true); // */ and const re = /"/; then const u = "//"; safeGitEnv(...). Fresh review rounds. |
+| Q18-03e | P9 allowToken guard: strip helper treats regex literals as opaque (or a regex-aware third pass), so a regex plus a quote inside a comment cannot hide a call from both passes | tests/moat/p9-rule-of-two.sh | HIGH | bash tests/moat/run.sh | ready@2026-10-17T02:14Z | Pre-existing gap found by Q18-03d HIGH review (also on main): after the safe_git import, const re = /\/*/; safeGitEnv(process.env /* ' */, true); is MISSED and runs under node. Add it as a positive control. |
+| Q18-05b | AI-BOM filter gaps: secret filter misses github_pat_, glpat-, AIza, npm_, hf_, ASIA, sk_live_ and is case-sensitive; SAFE_NAME drops provider/model ids with one interior slash; hooks.sealed receives the live receipt (pass a frozen clone) | loki-ts/src/engine10/ai_bom.ts, loki-ts/src/engine10/stages/seal.ts, loki-ts/tests/engine10/ai_bom.test.ts | MEDIUM | cd loki-ts && bun test tests/engine10/ai_bom.test.ts tests/engine10/seal.test.ts | merged@2026-10-17T01:50Z | merge ae90c2875 dist 0eb48d905; TL APPROVE 82058ff97 (102 pass, 4 mutations red). Test file is tests/features/ai_bom.test.ts. Source: Q18-05 HIGH review notes. Keep engine10 core net zero. |
+| COST-WALL-f | Partial cost read as complete outside benchmarks: trust_trajectory cost_per_accepted_usd ignores cost.cost_partial; check cost-summary.py and proof-generator.py the same way, routing through one partial check | autonomy/lib/trust_trajectory.py, autonomy/lib/cost-summary.py, autonomy/lib/proof-generator.py, tests/test_efficiency_cost_availability.py | HIGH | python3 -m pytest tests/test_efficiency_cost_availability.py -q | merged@2026-10-17T01:55Z | merge 3d0587f4f dist 7919f31ca; HIGH r2 APPROVE ef9979ad8 (53 pytest, 11 cost-cli, 33 bun pass; 5 of 6 mutations red). Follow-ups: template costIsPartial JS harness, dashboard series partial marker, cost-summary Avg/iter label. r1 BLOCK (HIGH), r2 fix in progress. Source: COST-WALL-e HIGH r1 note 4 (FC-COST-PARTIAL-b siblings). |
 | Q17-06 | COST-6 offline half: `attribution.py` dry-run prints a cost-per-accepted-task table with the ratio against raw Claude Code and against the 0.5x target, using existing result files, so the paid `--execute` run only has to plug in numbers. | benchmarks/bench/attribution.py, benchmarks/bench/test_attribution.py | MEDIUM | `python3 -I benchmarks/bench/attribution.py --dry-run`; `python3 -m pytest benchmarks/bench -k attribution -q` | merged@2026-10-17T00:10Z | Merged fe3a4e252 (6b9bd03d6; line-828 mutation caught: 1 failed 93 passed, restored 94 passed). COST-6 is parked as a paid eval needing a spend go. This re-slice needs no spend. Cost audit 2026-10-16: best measured run is 0.68x of raw, none reaches 0.5x. Report both floors (attribution.py:778). Confirm the test file name by `ls`. |
 | COST-HARN | C-F1 benchmark reports loki truthfully: real rc and stderr tail, origin remote for multi-unit seeds, v10 evidence readers, per-run evidence kept | benchmarks/bench/attribution.py, benchmarks/bench/adapters/loki.py, benchmarks/bench/adapters/_base.py | MEDIUM | python3 -m pytest benchmarks | merged@2026-10-16T23:42Z | Source: run3 diagnosis (PROGRESS 23:37Z). Round 1 BLOCK (fake origin let single-unit runs reach the PR stage); round 2 d1bb70593 APPROVED, pytest 86 passed rc=0. Ships in 11.17.7. |
 | COST-WALL | v10 child sessions (Wall stage and every other engine10 child spawn) append to .loki/metrics/child-sessions.jsonl so loki cost is not undercounted | loki-ts/src (shared spawn helper), autonomy/lib/efficiency_cost.py | HIGH | cd loki-ts && bun test | merged@2026-10-17T00:44Z | HIGH r1 APPROVE 10c040a70: 4 test files 180 pass 1 skip 0 fail, pytest 14 passed, ledger-write mutation red 2 tests, Wall counted once by stub test; merged, dist rebuilt. Follow-ups COST-WALL-b (reader F1) and COST-WALL-c (F2 wiring tests). F3: run3 Wall diagnosis unexplained, replay before any 2x claim. |
 | COST-WALL-b | FC-COST-PARTIAL: efficiency_cost reader marks cost_partial true when main records exist with tokens but no dollar figure, so a ledger-only total never reads as complete | autonomy/lib/efficiency_cost.py, tests/test_efficiency_cost_availability.py | HIGH | `python3 -m pytest tests/test_efficiency_cost_availability.py -q`; `bash tests/test-sigpipe-guard.sh` | merged@2026-10-17T00:50Z | HIGH APPROVE ddab3e714 (pytest 15 passed, mutation caught); follow-ups: C-F1 adapter ignores cost_partial (COST-WALL-d), unpriced count omits main records |
 | COST-WALL-c | Guard the child-ledger wiring: tests fail when quality_gates withChildLedger wrappers or the SDK ledger param are removed, and internal_sdk_judge cliLedger gets a test; record a ledger line when SDK messages.create throws after spending | loki-ts/src/commands/internal_sdk_judge.ts, loki-ts/tests/runner/quality_gates.test.ts, loki-ts/tests/runner/sdk_invoker.test.ts | MEDIUM | `cd loki-ts && bun test tests/runner/`; `cd loki-ts && bunx tsc --noEmit` | merged@2026-10-17T00:59Z | merge of e0a88304 after TL APPROVE: 219 pass rc=0, 2 mutations red |
 | COST-WALL-d | C-F1 benchmark honours cost_partial: the loki adapter passes cost_partial through and compute_metrics/row_true_spend treat it as a partial lower bound, never a complete measured cost | benchmarks/bench/adapters/loki.py, benchmarks/bench/attribution.py, its existing test file | HIGH | python3 -m pytest benchmarks -q -k attribution | merged@2026-10-17T01:02Z | merge of eef4e38b5 after HIGH r2 APPROVE: pytest 114 passed rc=0, fix revert turns test red; follow-ups in COST-WALL-e |
-| COST-WALL-e | One partial-cost helper used by every cost consumer (FC-COST-PARTIAL-b): equivalence_report.py and report.py honour cost_partial; row_spend_is_partial true for null cost with true cost set; invalid ledger lines and cost below ledger mark partial | benchmarks/bench/attribution.py, benchmarks/bench/equivalence_report.py, benchmarks/bench/report.py, autonomy/lib/efficiency_cost.py, benchmarks/bench/tests/test_attribution.py, tests/test_efficiency_cost_availability.py | HIGH | python3 -m pytest benchmarks/bench/tests/ tests/test_efficiency_cost_availability.py -q | merged@2026-10-17T01:30Z | HIGH r2 APPROVE 439ed90e3 (132 passed); merged into v11.17.11. Follow-ups in COST-WALL-f. |
+| COST-WALL-e | One partial-cost helper used by every cost consumer (FC-COST-PARTIAL-b): equivalence_report.py and report.py honour cost_partial; row_spend_is_partial true for null cost with true cost set; invalid ledger lines and cost below ledger mark partial | benchmarks/bench/attribution.py, benchmarks/bench/equivalence_report.py, benchmarks/bench/report.py, autonomy/lib/efficiency_cost.py, benchmarks/bench/tests/test_attribution.py, tests/test_efficiency_cost_availability.py | HIGH | python3 -m pytest benchmarks/bench/tests/ tests/test_efficiency_cost_availability.py -q | released@2026-10-17T01:58Z | v11.17.11 (npm next 11.17.11, Tests and Release green on df98addc8). HIGH r2 APPROVE 439ed90e3 (132 passed); merged into v11.17.11. Follow-ups in COST-WALL-f. |
 | M-30 | User docs for loki modernize, no dashes, commands match USAGE | docs/v10/GUIDE-MODERNIZE.md, tests/test-modernize-docs.sh | LOW | bash tests/test-modernize-docs.sh | released@2026-09-28T21:01Z | Source: MODERNIZE.md (D30). Depends on M-07. Dispatched 18:58Z, sonnet engineer. Tech Lead REJECT r1 (--resume id failed MID_RE), APPROVE r2 5035984d; merged 8d568c66; test-modernize-docs.sh 25/0, shard coverage 19/0, durations drift 6/0. Released in v10.5.0 (merge 8d568c66 is an ancestor of v10.5.0). |
 | E-66 | "Already implemented" outcome: evidence search in code, tests, docs, CHANGELOG; no change needed verdict, receipt, issue comment, no PR | loki-ts/src/engine10 (intake or plan, implement marker path, seal, pr) | HIGH | fixture with the feature ends no change needed, no implement session; fixture without proceeds | released@2026-09-28T16:03Z | Source: D32 (augmentiq #52). Opus REJECT (reproduced): no test that ALREADY_SATISFIED opens no PR; evidence search matched 652 hits for an unrelated task on this repo; confirmation need not cite files. Rework dispatched. Rework 1c7e1b09 (branch worktree-wf_b707f4ab-24f-1): all 3 blockers fixed (no-PR test F5, 0 hits for both review sentences on this repo, citation must name an existing code or test hit; evidence in receipt). Opus CONCERN: the real-repo test uses listRepoFiles capped at 2000 of 4784 files, so removing STOP_WORDS still passes; the existsSync branch of the citation check is untested. Next: small fix (full file list in that test, one existsSync test). Wave E18 small fix (uncapped file list, existsSync test), branch slice-E-66-test-fixes. Opus APPROVE of 0a64ea98 (uncapped list, existsSync test). Merge onto main conflicts in seal.ts, supervisor.ts, types.ts, rule_of_two.test.ts after E-68/E-69; rebase dispatched (wave E19). D33: states its net core line delta; core must stay under 5,000 (92 lines of headroom shared by E-67, E-66, E-61, M-14, merge order E-67, E-66, E-61); offset any excess by deleting dead core code. Rework 135ba06b Opus APPROVE, but merged it takes core to 5,189 (D33 cap 5,000; `bun test tests/engine10/budget.test.ts`). Not merged. Next: offset about 190 core lines in the same slice (dead or duplicated core code), then merge. Wave E21 (wf_39ab3f7d-8f3). r3: D33 offset. Rework r3 605f33b0 Opus APPROVE (core under 5,000 after offset); merged into train E22 (9042e964): `bun test tests/engine10/` 547 pass 0 fail, tsc 0, `bash tests/test-v10-pulse.sh` 107 passed, `bash eval/loki10/test-harness.sh` 108 passed. Released in v10.2.1 (npm publish 2026-09-28T16:03Z; every cited commit is an ancestor of the v10.2.1 tag; `git merge-base --is-ancestor`). |
 | EV-13 | Eval expected_outcome no_change_needed; aiq-52 set to it | eval/loki10/harness.py, eval/loki10/tasks/aiq-52-searchbar, test-harness.sh | HIGH | bash eval/loki10/test-harness.sh | released@2026-09-28T05:00Z | Source: D32. Opus CONCERN: a correct v10 no-change run on aiq-52 is graded as a source change. Rework dispatched. Rework APPROVE (branch worktree-wf_b707f4ab-24f-5: 19224201, e0264724): v10 Wall side effect excluded from the diff check. Not merged yet. Merged c9c15f38 (trainE18); `bash eval/loki10/test-harness.sh` 103 passed 0 failed. Released in v10.1.0 (npm publish 2026-09-28T05:00Z; every cited commit is an ancestor of the v10.1.0 tag; `git merge-base --is-ancestor`). |
@@ -983,7 +985,7 @@ Source: ~/git/autonomi-dev/research/2026-09-30-adoption/SWARM-PROMPT-ADOPTION.md
 | FC-09u | FC-09 siblings: pnpm-workspace.yaml overrides/packageExtensions and .yarnrc.yml packageExtensions join RUNNER_CONFIGS | loki-ts/src/features/runner_config.ts, loki-ts/tests/engine10/runner_config.test.ts | HIGH | each probe caps | parked@2026-10-16T23:12Z | After FC-09t review. Built as 12a4c80a: runner_config.test.ts 135 pass 0 fail; typecheck clean. D98 park after round 2: opus BLOCK e07885d5, real pnpm 11.1.3 applied a link: override through a double BOM and a `? [foo]` explicit key while the check reported UNCAPPED (Bun.YAML vs js-yaml 4 divergence). Carried as FC-09v. |
 | FC-09v | FC-09u carry-forward: trust parsed YAML key comparison only when both sides are in a strict plain subset (no BOM, explicit ? keys, merge keys, anchors, aliases, tags, directives, doc markers, CR, tabs); any other byte change caps | loki-ts/src/features/runner_config.ts, loki-ts/tests/engine10/runner_config.test.ts | HIGH | both FC-09u reviewer probes print CAPPED for every bypass; plain unrelated-key edit does not cap | merged@2026-10-17T00:36Z | HIGH r2 APPROVE ea0a60c5: r1 bypass closed, 60 fuzz disagreement docs all cap, red-first 159/5 to 164/0, tsc rc=0; merged 14a6f92f0, dist bd008596d. Base e07885d5. Source: FC-09u round 2 HIGH review. Round 1 BLOCK cebe5641 (block-scalar parser differential reproduced with pnpm 11.1.3); round 2 per D101 caps on any byte change, building. |
 | FC-09w | Runner config registry matches case-insensitively, so a capitalized PNPM-Workspace.yaml or .YARNRC.yml (read by pnpm on macOS) caps trust; sweep every RUNNER_CONFIGS row; add .npmrc and patchedDependencies targets outside patches/ | loki-ts/src/features/runner_config.ts, the existing runner_config test file under loki-ts/tests/engine10 | HIGH | cd loki-ts && bun test tests/engine10/ | merged@2026-10-17T01:05Z | HIGH APPROVE 14aa30cc2 (runner_config 204 pass 0 fail, tsc 0, mutations 34 and 4 red, 11 bypass probes capped) |
-| FC-09x | Runner config trust gaps from the FC-09w review: top-level patchedDependencies (Bun form) compared by mapping like pnpm.patchedDependencies (add to PKG_KEYS); pnpm-workspace.yaml read with CRLF-safe line split; a multi-line yaml flow map for patchedDependencies is parsed or fails closed | loki-ts/src/features/runner_config.ts, loki-ts/tests/engine10/runner_config.test.ts | HIGH | cd loki-ts && bun test tests/engine10/runner_config.test.ts | merged@2026-10-17T01:16Z | TL APPROVE 437afd115; merged b97c1e635, dist 2eeec3851. |
+| FC-09x | Runner config trust gaps from the FC-09w review: top-level patchedDependencies (Bun form) compared by mapping like pnpm.patchedDependencies (add to PKG_KEYS); pnpm-workspace.yaml read with CRLF-safe line split; a multi-line yaml flow map for patchedDependencies is parsed or fails closed | loki-ts/src/features/runner_config.ts, loki-ts/tests/engine10/runner_config.test.ts | HIGH | cd loki-ts && bun test tests/engine10/runner_config.test.ts | released@2026-10-17T01:58Z | v11.17.11 (npm next 11.17.11, Tests and Release green on df98addc8). TL APPROVE 437afd115; merged b97c1e635, dist 2eeec3851. |
 | CPE24-P2a | Checkpoint rollback restores only an allowlist (session.json, dashboard-state.json, CONTINUITY.md, autonomy-state.json, state, queue) and refuses nested symlinks | packages/control-plane/src/server/routes/checkpoints.ts plus test | MEDIUM | planted audit/ in a checkpoint does not overwrite .loki/audit | released@2026-10-15T23:55Z | rv-trust3 advisory on P2. |
 | CPE24-P4a | Legacy /api/control/* callers require ctx.local (or isLoopbackHost) like /v1 | packages/control-plane/src/server/legacy/routes-control.ts plus test | MEDIUM | non-loopback Host refused on legacy control | released@2026-10-15T23:55Z | rv-trust3 advisory on P4. |
 | CP-NITS1 | CP run page nits from the 10.10.2 smoke: Wall row describes the Wall ("Wrote acceptance checks (n files)" or "skipped: no checks written"); local repo with no remote shows the folder name, not REPO UNMEASURED; receipt text read from receipt.json on disk like the derived diff; diffstat failures cached (F1); leading-dash sha fixture | packages/control-plane/src/server plus ui run page plus tests | MEDIUM | CP suite green; a signed receipt on disk renders its text; a no-remote repo shows its folder name | released@2026-10-15T23:55Z | Peer smoke 21:27Z plus CP follow-up review F1. |
@@ -1002,3 +1004,69 @@ Source: ~/git/autonomi-dev/research/2026-09-30-adoption/SWARM-PROMPT-ADOPTION.md
 | FC-16b | FC-16 follow-ups: package_suite.ts:33 detects go by first token only (make test, GOFLAGS=x go test fall to the generic path); go -json parsing; load_owner killTree process-group kill; unittest atexit forged trailer | loki-ts/src/engine10 package_suite, load_owner, test classify, plus tests | MEDIUM | make test wrapping go test classifies with runner go; a forged unittest trailer from atexit is not a pass | released@2026-10-16T00:49Z | Engineer fix-fc16b in worktree. From review-fc16-fc02-integ rounds 4-6. package_suite results never feed seal proof today. Also owed: an end-to-end test running a go Wall file through RealBaseTestRunner (the seal.test.ts case does not guard wall.ts). | 00:33Z: review-fc16b BLOCKED 1b3f594cb (forged go events, unittest multi-Ran); fix 626b46c74 in opus re-review. 
 | FC-22 | FC-22: (a) impacted-test selection is scoped by the Project Model, touched packages plus their real dependents (manifest or import edges), never every package; (b) a selected package with no installed deps gets the Project Model's own install command run once before verify, recorded as a check with its cwd, opt-out by config | loki-ts/src/e10ext/select.ts, project_model resolve and gather, engine10 verify pre-step, plus tests | HIGH | a backend-only change in the monorepo-fc01 fixture selects no frontend test; a selected package without node_modules gets one recorded install check; no guessed command; e10ext under 1500 | released@2026-10-16T00:49Z | Plan docs/v10/FC21B-FC22-PLAN.md (S1 then S2 selection and S3 install). FireLater#17 gate on 10.10.5 (run e10-20261003T233414Z-30ca) PARTIAL only from 4 over-selected frontend tests (steering 23:47Z). HIGH because selection feeds verify proof. Architect plan first; e10ext is 1 line under its cap. Next train with FC-21b and FC-23. | 00:33Z: S1 merged 88e9e43fb (review-s1 APPROVE). S2 e9e04fe1d in opus review-s2; S3 cb6486550 in opus review-s3. 01:08Z: S3 merged 736f4d436 (review-s3 APPROVE on d2e61c2ff, 3627/0, tsc 0; discard.ts L2 tension to CTO). S2 merged b4022e6fb (review-s2 APPROVE on a62aba7b2, 3624/0, tsc 0) behind LOKI_E10_SCOPE default off. Before the flag flips: F1 root-owned keep test with a non-relative import, F2 verify test.scoped_out event test. The install library is wired by S4. 
 | FC-23 | FC-23: the Wall writes tests matching the package's module system and test conventions from the Project Model; a lint or type error inside a Wall file is harness-owned, the Wall file is regenerated once or discarded with a NOT PROVEN note, and no fix round is spent on it | loki-ts/src/engine10/stages/wall.ts, the fix-round target filter, project_model conventions, plus tests | MEDIUM | a CommonJS package gets a Wall test with no import.meta; a forced type error in a Wall file yields regenerate-or-discard and zero fix rounds | released@2026-10-04T00:51Z | released@2026-10-04T00:51Z | Merged c0a1c43c2 (38c782386, review-fc23 sonnet APPROVE; nits: duplicate NOT PROVEN line for a discarded file, merged comment in verify.ts). 
+| TEN-DEPLOY-01 | Capture the deployed public URL on every --execute path and probe it by default | autonomy/loki (_deploy_try_execute non-canary exec block and the _deploy_record arg list and JSON fields only), tests/test-deploy-receipt-gate.sh (new section after the existing 14-18 block), CHANGELOG.md | MEDIUM | see Wall in note | merged@2026-10-17T02:40Z | merge 60a9bb709; TL APPROVE b14d908a4 (deploy-receipt-gate 56/0, test-deploy 6/6, shellcheck 91=91 vs main). wave 1; depends: none. Goal: After a deploy that exits 0, take the last https URL the provider CLI printed (the canary grep -Eo already does this; reuse that, do not add a second parser). Store it as deployed_url in loki.deploy/1. When no --health-url is given, probe deployed_url with _deploy_probe_health and record health_url_source=captured/flag. No URL printed: deployed_url is empty, health stays 'unchecked', and Loki never invents a URL. Print 'Live at: <url>' only when one was captured. Wall: RED: a new section stubs vercel to print 'https://app-x.vercel.app' and exit 0, and stubs curl to 200. The record lacks deployed_url, health_status is 'unchecked', and the test fails on main. GREEN: deployed_url equals the stub URL, health_status=healthy, health_url_source=captured. A second stub prints no URL: deployed_url is empty, health is 'unchecked', exit 0. A third case passes --health-url: health_url_source=flag. MUTATION: hardcode deployed_url to a constant and the no-URL case goes red. Gate: bash -n autonomy/loki && shellcheck -S warning autonomy/loki && bash tests/test-deploy-receipt-gate.sh && bash tests/test-deploy.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
+| TEN-DEPLOY-02 | Signed live provenance doc (loki.provenance/1) and loki verify --url | loki-ts/src/util/receipt_signer.ts, loki-ts/tests/engine10/verify_cmd.test.ts (provenance cases; existing deploy-record tests live here), docs/SIGNED-RECEIPTS.md (one section), CHANGELOG.md. Engine10 core is not edited: verify_cmd.ts:164 already routes through deployAttestCmd, and a one-token --url passthrough there needs the budget test to stay green. | HIGH | see Wall in note | ready@2026-10-17T01:40Z | SPLIT per CTO critic into (a) signProvenance plus --sign-provenance, (b) verify --url fetch and verdicts; build as two commits or two agents. wave 2; depends: none. Goal: Extend receipt_signer.ts, the owner of signed deploy attestations, with: signProvenance(head_sha, tree_sha, receipt_sha256, run_id, built_at), which signs with the same Ed25519 key as signDeployRecord; a `--sign-provenance FILE` dispatch in deployAttestCmd; and `loki verify --url https://host` plus a pubkey. The --url check fetches <url>/.well-known/loki-provenance.json with a timeout and size cap, checks the signature, and requires a 200 with JSON. The verdict is VERIFIED only when the signature verifies against the local JWKS or --pubkey AND the cited receipt (when present locally or via --receipt) is VERIFIED. The doc alone with an unknown kid is UNCHECKED rc 2. An edited doc is TAMPERED rc 1. A fetch failure is UNCHECKED and never VERIFIED. Optional --expect-sha SHA must equal head_sha. Wall: RED: tests serve a signed provenance doc from Bun.serve on 127.0.0.1. On main, `verify --url` is an unknown arg and exits 2, so the tests fail. GREEN: genuine doc with --pubkey gives VERIFIED rc 0. One edited byte of head_sha gives TAMPERED rc 1. An unknown kid gives UNCHECKED rc 2. A 404, a non-JSON body or a doc over 64KB gives UNCHECKED rc 2. A wrong --expect-sha gives TAMPERED rc 1. MUTATION: skip the signature verify and the edited-byte case goes red. Gate: cd loki-ts && bun test tests/engine10/verify_cmd.test.ts && bun test tests/engine10/ && bunx tsc --noEmit (the full engine10 suite runs the budget and spawn-env guards) Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
+| TEN-DEPLOY-03 | Ship the provenance doc with the build and prove the live URL serves the verified SHA | autonomy/loki (_deploy_try_execute pre-exec and post-health blocks, _deploy_record live_binding field only), tests/test-deploy-receipt-gate.sh (new section), docs/WORKSPACES.md, CHANGELOG.md | HIGH | see Wall in note | ready@2026-10-17T01:40Z | SPLIT per CTO critic into (a) provenance file into deploy root per project type, (b) post-deploy live-binding probe; build as two commits or two agents. wave 3; depends: TEN-DEPLOY-01, TEN-DEPLOY-02. Goal: In _deploy_try_execute, after the gate passes and before the provider runs, write a signed .well-known/loki-provenance.json into the deploy root via `verify --sign-provenance`. The deploy root is public/ for nextjs and vite, the detected dist/ or build/ for static, and is refused with a reason for docker/python where no static root exists. Write it as an untracked build artifact so the dirty-tree gate is evaluated before it. After the deploy, probe <deployed_url>/.well-known/loki-provenance.json. Set live_binding=VERIFIED only when its head_sha equals the anchor. A mismatch gives FAILED_HEALTH exit 4 (stale or wrong build served). Update docs/WORKSPACES.md and replace 'deployed-SHA binding is not implemented' with what is now bound and what is not. Wall: RED: a stubbed vercel copies dist/ into a served dir and a python http.server serves it. On main, no provenance file exists and the record has no live_binding. GREEN: the file exists in dist/.well-known, live_binding=VERIFIED, and its head_sha equals git rev-parse HEAD. A stub that serves an older provenance gives FAILED_HEALTH exit 4. A docker project prints the refusal reason and records live_binding=unsupported, never VERIFIED. The dirty-tree gate still refuses a dirty tree before the file is written. MUTATION: compare against a constant instead of the anchor and the stale-serve case goes red. Gate: bash -n autonomy/loki && shellcheck -S warning autonomy/loki && bash tests/test-deploy-receipt-gate.sh && (cd loki-ts && bun test tests/engine10/verify_cmd.test.ts) Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
+| TEN-DEPLOY-04 | Verified deploy badge from loki status --badge | loki-ts/src/commands/status.ts (renderLastDeploy plus --badge flag parse only), loki-ts/tests/commands/status.test.ts, CHANGELOG.md | MEDIUM | see Wall in note | ready@2026-10-17T01:40Z | wave 4; depends: TEN-DEPLOY-01 (deployed_url field); live_binding from TEN-DEPLOY-03 is read if present, and its absence omits the badge. Goal: `loki status --badge` reads the newest loki.deploy/1 record (renderLastDeploy already loads it) and verifies it through the existing verify path. It prints a markdown shields badge linking to <deployed_url>/.well-known/loki-provenance.json. The message is 'deployed: verified' (brightgreen) ONLY when the record verifies and live_binding=VERIFIED. 'deployed: unverified' (red) is printed for TAMPERED or a failed health check. In all other cases the badge is omitted with a one-line reason. It never prints green from an unchecked field. The color mapping matches the share badge (autonomy/loki:38291), and no new vocabulary is added. Wall: RED: status.test.ts fixture with a signed healthy record, live_binding=VERIFIED and deployed_url. On main, --badge is unknown and no badge line is printed. GREEN: the badge line contains 'brightgreen' and deployed_url. A record with health FAILED_HEALTH gives a red badge. An unsigned record or a missing live_binding omits the badge and prints the reason. A record with no deployed_url omits the badge. MUTATION: drop the verify call and the unsigned case goes green, so the test goes red. Gate: cd loki-ts && bun test tests/commands/status.test.ts && bunx tsc --noEmit && bash tests/test-status-surface-agrees.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
+| TEN-DEPLOY-05 | loki deploy --env-file: push env to the provider with names-only records | autonomy/loki (cmd_deploy arg parse for --env-file, _deploy_try_execute env step, _deploy_record env_keys field only), tests/test-deploy-receipt-gate.sh (new section), autonomy/completions (loki deploy flag list only), CHANGELOG.md | HIGH | see Wall in note | ready@2026-10-17T01:40Z | SPLIT per CTO critic into (a) env-file parser, .env.example check, masking, env_keys record, (b) four provider verbs; build as two commits or two agents. wave 4; depends: TEN-DEPLOY-03 (same function, serialized to avoid conflicts). Goal: `--env-file FILE` (with --execute only) parses KEY=VALUE with no shell eval. It refuses when a key in .env.example is missing from FILE, naming the keys. Env is applied through documented verbs only: Vercel `vercel --prod -e K=V` per key (args built as an array, never through the shell); Fly `fly secrets set --stage K=V ...` before `fly deploy`; Netlify `netlify env:import FILE`; Cloudflare `wrangler secret bulk FILE`. An unsupported provider refuses with nothing run. The record stores env_keys (names, sorted) and env_source; it NEVER stores values. Values never appear in stdout, the record or the printed 'Running:' line, where they are masked as K=***. Wall: RED: a recording vercel stub logs argv. On main, --env-file is ignored and no -e args appear. GREEN: argv has `-e API_URL=x -e TOKEN=s3cr3t`. Grepping stdout, stderr and the record for s3cr3t finds nothing; env_keys=[API_URL,TOKEN]. When .env.example lists DB_URL and the env file lacks it, the command refuses with rc 1, no stub calls and DB_URL named. A value with $(touch pwned) leaves no file named pwned. MUTATION: write values into the record and the secret-grep goes red. Gate: bash -n autonomy/loki && shellcheck -S warning autonomy/loki && bash tests/test-deploy-receipt-gate.sh && bash tests/test-completion-drift.sh (or whichever completion drift test the CHANGELOG cites) Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
+| TEN-DEPLOY-06 | loki deploy --domain: attach a custom domain and prove TLS | autonomy/loki (cmd_deploy --domain parse and a post-health domain block in _deploy_try_execute, _deploy_record domain/tls fields only), tests/test-deploy-receipt-gate.sh (new section), CHANGELOG.md | MEDIUM | see Wall in note | ready@2026-10-17T01:40Z | wave 5; depends: TEN-DEPLOY-05 (same function, serialized). Goal: `--domain example.com` (with --execute) runs documented verbs after a healthy deploy: Vercel `vercel alias set <deployed_url> <domain>`; Fly `fly certs add <domain>`. Netlify and Cloudflare print the manual dashboard step and set domain_status=manual. Then a TLS proof runs: `openssl s_client -servername <domain> -connect <domain>:443` plus `openssl x509 -noout -enddate -checkend 604800`. It records domain, tls_status (valid/expiring/invalid/unchecked) and tls_not_after, and re-probes https://<domain>/.well-known/loki-provenance.json for the same head_sha. DNS not yet pointed gives tls_status=invalid and exit 6, with the DNS record the provider needs printed. It never claims valid without the openssl check. Wall: RED: vercel, openssl and curl are stubbed. On main, --domain is ignored. GREEN: the alias set argv is recorded, tls_status=valid and tls_not_after is set. An openssl stub that fails -checkend gives expiring. An openssl handshake failure gives invalid and exit 6. A netlify project gives domain_status=manual, no alias call, and tls still checked. No openssl on PATH gives unchecked, never valid. MUTATION: default tls_status to valid and the missing-openssl case goes red. Gate: bash -n autonomy/loki && shellcheck -S warning autonomy/loki && bash tests/test-deploy-receipt-gate.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
+| TEN-DEPLOY-07 | loki github publish: receipt-stamped GitHub export from the CLI | autonomy/loki (cmd_github publish arm and its help line only), tests/test-github-publish.sh (new: no existing test owns cmd_github repo creation; test-proven-pr-check.sh covers PR checks only) plus its run-all-tests.sh registration and shard row, CHANGELOG.md | MEDIUM | see Wall in note | ready@2026-10-17T01:40Z | wave 1; depends: none. Goal: Add a `publish` subcommand to cmd_github next to sync/export/pr/status. It refuses a dirty tree and never stages files. When no origin exists it runs `gh repo create <name> --private --source . --push`; --public is opt-in. With an origin it runs `git push origin HEAD` only after confirming that HEAD is the receipt anchor. It then sets a commit status on HEAD with `gh api repos/{o}/{r}/statuses/{sha}`, context loki/receipt, whose state comes ONLY from the existing receipt verdict (VERIFIED: success; otherwise failure or none, never success). It prints the repo URL parsed from gh output or `git remote get-url`, and never a fabricated fallback. `loki github export` (issues) keeps its meaning. Wall: RED: stub gh and git push recorders in a temp repo with a VERIFIED receipt fixture. On main, `loki github publish` prints usage with a non-zero exit. GREEN: argv contains `repo create ... --private --source . --push`, statuses state=success and context=loki/receipt. With --public the argv has --public. A dirty tree refuses with zero gh calls. An UNSIGNED receipt gives state=failure. No `git add` appears in any recorded argv. MUTATION: default to --public and the first assertion goes red. Gate: bash -n autonomy/loki && shellcheck -S warning autonomy/loki tests/test-github-publish.sh && bash tests/test-github-publish.sh && bash tests/test-new-test-registered.sh (or the runner/shard structural guards per feedback-new-test-file-structural-guards) Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
+| TEN-DEPLOY-08 | Web app deploy and GitHub push go through the gated CLI; no fabricated URLs | web-app/server.py (deploy_session ~5236-5336 and github_push_session ~5339-5395 only), web-app/tests/test_server.py (new cases), CHANGELOG.md | HIGH | see Wall in note | ready@2026-10-17T01:40Z | SPLIT per CTO critic into (a) deploy_session, (b) github_push_session plus web-app url:null handling; build as two commits or two agents. wave 4; depends: TEN-DEPLOY-01 (deployed_url), TEN-DEPLOY-07 (github publish). Goal: Replace the bodies of deploy_session and github_push_session in web-app/server.py. Deploy runs `loki deploy --execute --dir <session_dir>` as an argv list with a timeout, then reads the newest <session>/.loki/deploys/*.json. It returns {url: deployed_url or null, health_status, live_binding, record_path, refused_reasons} and exits non-2xx on refusal. The platform param is kept as a hint only when it matches the CLI's detected provider; otherwise it returns 409 with the reason. GitHub push calls `loki github publish` (private default). Delete the hardcoded https://vercel.app, https://netlify.app and https://github.io fallbacks and the `git add -A` / `--public` path in the same change. Wall: RED: test_server.py with monkeypatched subprocess. On main, a deploy whose output has no URL returns url='https://vercel.app' (assert url is None fails), and no receipt gate is invoked. GREEN: the subprocess argv is [loki, deploy, --execute, --dir, <dir>]. A gate refusal returns 4xx with the reasons. A no-URL deploy returns url null. A github push argv contains `github publish` and never `add -A`. `grep -n 'https://vercel.app\/https://netlify.app\/"https://github.io"' web-app/server.py` exits 1. MUTATION: restore a fallback URL and the null-URL test goes red. Gate: python3 -m pytest web-app/tests/test_server.py -q && bash tests/moat/p7-no-fabricated-data.sh && bash tests/test-web-app-no-orphan-components.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
+| TEN-DEPLOY-09 | One-click from loki start and loki chat: pass the new deploy flags through | autonomy/loki (cmd_start _ps_ deploy parse block ~2625-2690 only), loki-ts/src/commands/start.ts (help string ~148-151 only), autonomy/lib/chat.sh (help line 53, system prompt line 6, _chat_deploy echo only), tests/test-help-start-flags.sh, docs/DEPLOYMENT.md, CHANGELOG.md | LOW | see Wall in note | ready@2026-10-17T01:40Z | SPLIT per CTO critic into (a) start passthrough, (b) chat and docs text; build as two commits or two agents. wave 5; depends: TEN-DEPLOY-05, TEN-DEPLOY-06, TEN-DEPLOY-07. Goal: `loki start --deploy` passes --destination, --canary, --env-file, --domain and --github through to cmd_deploy. --github runs `loki github publish` after a successful deploy. Flag validation uses the existing _ps_ pattern (a value must not start with '-'). Bun-route start.ts help text lists them, and the PATH-slice divert keeps routing --deploy to bash. chat.sh `/deploy` help and _LOKI_CHAT_SYSTEM_PROMPT mention --domain, --env-file and `loki verify --url`, and the confirm prompt prints the full argv. docs/DEPLOYMENT.md gets one end-to-end 'brief to verified URL' section. Wall: RED: test-help-start-flags.sh asserts `loki start --help` lists --domain and --env-file, and a stubbed cmd_deploy recorder receives `--domain x.com --env-file .env` from `loki start --deploy --domain x.com --env-file .env`. It fails on main. GREEN: both pass. `--domain --env-file` (flag-shaped value) exits 2. A non-zero start exit still never deploys. MUTATION: drop the --domain forward and the recorder assertion goes red. Gate: bash -n autonomy/loki autonomy/lib/chat.sh && bash tests/test-help-start-flags.sh && (cd loki-ts && bun test tests/commands/start.test.ts && bunx tsc --noEmit) && bash tests/test-help-drift.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
+| TEN-ADOPTION-01 | Tour shows a receipt you can actually verify offline | autonomy/loki (cmd_demo offline branch only, ~15927-15965); skills/fixtures/demo-receipt/ (add receipt.json, the event log the log_seal check reads, pubkey.jwk; update README.md); tests/cli/test-tour-verify.sh (new: no test owns tour today, and test-proof-command.sh covers the legacy proof store) | MEDIUM | see Wall in note | ready@2026-10-17T01:40Z | wave 3; depends: none (the fixture must come from a real sealed run; see not_codeable). Goal: `loki tour` (and `loki demo --offline`) runs the real Bun verifier against a bundled engine10 receipt.json, its event log and a public JWK, and prints VERIFIED. It then flips one byte in a copy under a run-owned temp dir and prints TAMPERED. It stays offline, needs no key and spends nothing. When Bun is absent it prints the exact verify command instead of claiming a result. The display-only disclaimer at autonomy/loki:15953-15957 goes away (the replaced text is deleted). Wall: Red first: the new test asserts the tour stdout contains VERIFIED from the verifier, and TAMPERED for the byte-flipped copy, with rc 0. On main it fails because the stdout says 'for display only'. Mutations: (a) point the tour at a receipt with one changed field: the test must see TAMPERED, not VERIFIED; (b) remove pubkey.jwk: the tour must say UNCHECKED or the verify-command fallback, never VERIFIED; (c) hide bun from PATH: output has the command and no verdict. Gate: bash tests/cli/test-tour-verify.sh && bash tests/test-help-discoverability.sh && bash scripts/local-ci.sh. Register the new test in tests/run-all-tests.sh and its shard. Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
+| TEN-ADOPTION-02 | Portable receipt bundle builder | loki-ts/src/util/receipt_bundle.ts (new: no existing module packages a receipt for third-party verify, and engine10/verify_cmd.ts is core at its line budget); loki-ts/tests/util/receipt_bundle.test.ts (new, beside the existing util tests) | HIGH | see Wall in note | building@2026-10-17T02:42Z | wave 1; depends: none. Goal: A pure util buildReceiptBundle(runDir, outDir) writes a self-contained directory for verifying a run on another machine: receipt.json, the event log that verify's log_seal check needs, pubkey.jwk (public only, with kid) and VERIFY.md holding the single command `npx loki-mode verify --pubkey pubkey.jwk receipt.json`. It refuses (returns an error and writes nothing) when the receipt is UNSIGNED or does not verify locally first. Wall: Red-then-green: seal a fixture run with the existing receipt_signer test helpers, bundle it, then verifyReceipt(bundle/receipt.json, {pubkey}) returns VERIFIED. A one-byte edit to the bundled receipt returns TAMPERED. An unsigned fixture returns an error and creates no outDir. No private material: the bundled JWK has no 'd' field and no file contains the private PEM header. Mutations: copying the private JWK must turn the test red; skipping the pre-verify must let the unsigned case go red. Gate: cd loki-ts && bun test tests/util/receipt_bundle.test.ts && bun test (full suite, which includes the spawn-env and budget guards) && bunx tsc --noEmit. Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
+| TEN-ADOPTION-03 | proof bundle/badge/share work for loki start (engine10) runs | loki-ts/src/commands/proof.ts; loki-ts/tests/commands/proof_badge.test.ts; loki-ts/tests/commands/proof.test.ts | HIGH | see Wall in note | ready@2026-10-17T01:40Z | wave 2; depends: TEN-ADOPTION-02. Goal: `loki proof bundle/badge/share <run-id>` resolve .loki/runs/<id>/receipt.json when .loki/proofs/<id> is absent. bundle calls buildReceiptBundle. badge takes its verdict from verifyReceipt plus the receipt verdict, and shows a VERIFIED badge only when both are VERIFIED (ALREADY_SATISFIED gets its own label); TAMPERED, UNSIGNED or UNCHECKED gives no badge and a non-zero exit. share gists the bundle files through the existing redaction preview and opt-in confirmation. The legacy proofs path stays unchanged. Wall: Red: proof_badge test with a sealed engine10 run dir and no .loki/proofs. On main badge exits non-zero with 'not found'; after the change it prints a VERIFIED badge. A tampered receipt prints no badge and exits non-zero. share with a stubbed gh receives only bundle files, never the private key or the raw .loki tree. Mutation: make badge read the receipt verdict without verifying the signature; the tamper case must go red. Gate: cd loki-ts && bun test tests/commands/proof*.test.ts && bun test && bash tests/cli/test-proof-command.sh && bash scripts/local-ci.sh. Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
+| TEN-ADOPTION-04 | PR body lets a reviewer verify on their own machine, plus an opt-out Loki footer | loki-ts/src/e10ext/reviewer_body.ts; loki-ts/tests/engine10/reviewer_body.test.ts; loki-ts/tests/engine10/pr_body_golden.test.ts (golden update only) | MEDIUM | see Wall in note | ready@2026-10-17T01:40Z | wave 3; depends: TEN-ADOPTION-03 (the referenced command must exist). Goal: The receipt section of the PR body keeps `loki verify <runId>` for the author. It adds an 'On another machine' line: the author runs `loki proof bundle <runId>`, and the reviewer runs `npx loki-mode verify --pubkey pubkey.jwk receipt.json` or adds the receipt-check action. It also adds a one-line footer, 'Built and verified with Loki Mode' plus the repo link. LOKI_PR_FOOTER=0 removes the footer. It makes no network call and sends no telemetry. The verdict wording is unchanged. Wall: Red: the reviewer_body test asserts the bundle line and the footer are present, and that LOKI_PR_FOOTER=0 removes the footer while keeping the verify lines. A draft or non-VERIFIED body never contains the word 'verified' in the footer (it uses 'Built with Loki Mode'). Mutation: always emitting 'verified' in the footer must turn the non-VERIFIED case red. Budget: e10ext stays under 1500 (currently 1457) via loki-ts/tests/engine10/budget.test.ts. Gate: cd loki-ts && bun test tests/engine10/reviewer_body.test.ts tests/engine10/pr_body_golden.test.ts tests/engine10/budget.test.ts && bun test && bun run build in the review worktree (dist is a train step). Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
+| TEN-ADOPTION-05 | loki mcp install for Claude Code, Cursor, VS Code, Windsurf | autonomy/mcp-launch.sh; tests/cli/test-mcp-launch.sh; loki-ts/src/cli/registry.ts (the mcp row only: add the install subcommand so help-drift and completions stay true) | MEDIUM | see Wall in note | ready@2026-10-17T01:40Z | SPLIT per CTO critic into (a) claude and cursor plus JSON merge and .bak, (b) vscode and windsurf; build as two commits or two agents. wave 1; depends: none. Goal: `loki mcp install --client claude/cursor/vscode/windsurf [--project/--global] [--print]` adds the loki-mode server to the right client config. Targets: .cursor/mcp.json or ~/.cursor/mcp.json under mcpServers; .vscode/mcp.json under servers with type stdio; ~/.codeium/windsurf/mcp_config.json; for claude, `claude mcp add loki-mode -- npx -y loki-mode mcp` when the CLI is present, otherwise print. The JSON merge is idempotent and keeps every other server and key. It writes a .bak before changing an existing file, refuses to write over invalid JSON, and --print writes nothing. Wall: Red in tests/cli/test-mcp-launch.sh with a throwaway HOME under LOKI_RUN_TMP. (1) A cursor install into an existing mcp.json with another server keeps that server and adds loki-mode; a second run is byte-identical. (2) vscode writes the servers key, not mcpServers. (3) Invalid JSON is left untouched and exits non-zero. (4) --print creates no file. (5) For claude, a stub claude on PATH records the exact argv. Mutation: a merge that replaces the whole object must fail case 1. Gate: bash tests/cli/test-mcp-launch.sh && bash tests/test-mcp-registry-not-stale.sh && bash tests/cli/test-completions-coverage.sh && shellcheck autonomy/mcp-launch.sh && bash scripts/local-ci.sh. Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
+| TEN-ADOPTION-06 | One-click IDE install links and honest npm metadata | README.md; docs/INSTALLATION.md; package.json (keywords only); tests/test-server-json-current.sh (extend: decode the deeplink payloads) | LOW | see Wall in note | ready@2026-10-17T01:40Z | wave 2; depends: TEN-ADOPTION-05. Goal: The README MCP line (README.md:161) and a new IDE section in docs/INSTALLATION.md gain a Cursor deeplink (cursor://anysphere.cursor-deeplink/mcp/install?name=loki-mode&config=<base64 of {command:npx,args:[-y,loki-mode,mcp]}>), a VS Code link (vscode:mcp/install?<urlencoded json>) and the `loki mcp install --client X` commands. package.json keywords drop deprecated or false terms (gemini, gemini-cli) and keep the true ones. Wall: Red: the extended guard extracts the Cursor base64 config and the VS Code JSON from README.md and asserts they decode to a server that runs server.json's identifier with arg 'mcp'. It fails today because no deeplink exists. It also asserts that package.json keywords contain no deprecated provider name. Mutation: change the arg in the README payload to 'serve'; the guard must go red. Gate: bash tests/test-server-json-current.sh && bash tests/test-help-discoverability.sh && the help-drift and doc guards in scripts/local-ci.sh (no emojis, no em or en dashes). Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
+| TEN-ADOPTION-07 | Examples gallery of verifiable receipts | examples/README.md; examples/receipts/ (new dir: gallery data, no existing owner); tests/test-examples-gallery.sh (new: no existing test covers examples/; register in tests/run-all-tests.sh and its shard); package.json files entry only if examples/receipts must ship | MEDIUM | see Wall in note | ready@2026-10-17T01:40Z | wave 4; depends: TEN-ADOPTION-02, TEN-ADOPTION-01. Goal: examples/README.md leads with a gallery of real loki start runs. Each entry is a bundle in examples/receipts/<name>/ (format from slice 02) with task, outcome, cost and the one-line verify command. A guard verifies every gallery bundle with its own pubkey and fails on any entry that is not VERIFIED or ALREADY_SATISFIED. The six v5 HTML demos stay, under a clearly labeled 'UI demos (no receipt)' heading, so nothing implies they were verified. The tour fixture from slice 01 is the first entry. Wall: Red: the guard fails today because examples/receipts/ is missing. Green once at least one bundle verifies. Mutations: (a) a byte edit in one gallery receipt turns the guard red with TAMPERED; (b) a README entry whose directory does not exist turns it red; (c) a FAILED receipt listed in the gallery turns it red. Gate: bash tests/test-examples-gallery.sh && bash scripts/structural-checks.sh && bash scripts/local-ci.sh. Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
+| TEN-ADOPTION-08 | Install smoke covers the newcomer first-touch path | scripts/smoke-install.sh | MEDIUM | see Wall in note | ready@2026-10-17T01:40Z | wave 5; depends: TEN-ADOPTION-01, TEN-ADOPTION-05. Goal: scripts/smoke-install.sh also runs, from the packed tarball with a throwaway HOME: `loki tour` (expects the verifier's VERIFIED line from slice 01), `loki mcp install --client cursor --print` (expects valid JSON) and a stdio MCP initialize handshake returning a tools list. The packaged artifact is then proven on the exact paths the README sends a new user down. Keep it runnable by hand, and add an optional CI hook only if it stays under the 10-min command budget. Wall: Red: before slice 01 merges, the new tour assertion fails on the display-only text. Green after. Mutation: drop skills/fixtures/demo-receipt/pubkey.jwk from the packed files list in a scratch copy; the smoke must fail on the tour case, which proves it tests the shipped package and not the checkout. Gate: bash scripts/smoke-install.sh --log ~/loki-ci-logs/smoke-install-adoption.log (exit 0) && shellcheck scripts/smoke-install.sh. Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
+| TEN-COST-01 | Opt-in cost profile: loki start --cost lean / LOKI_COST_PROFILE=lean | loki-ts/src/util/cost_profile.ts (new: no existing module owns engine10 env presets; util/tier.ts is the license seam, not a cost preset), loki-ts/src/commands/start.ts (one --cost value-flag row plus one apply call), loki-ts/tests/util/cost_profile.test.ts (new, pairs with the new util), loki-ts/tests/commands/start.test.ts (one case), tests/test-help-start-flags.sh (expected flag list) | MEDIUM | see Wall in note | ready@2026-10-17T01:40Z | wave 2; depends: none. Goal: One user-facing switch that turns on the already-built, flag-gated cost levers together, with each lever named on the start line. The lean profile sets LOKI_ROUTER=1 (the router keeps its own D89 haiku-only-with-advisor rule and escalation ladder) and LOKI_E10_TRIM=1. It only fills unset variables, so explicit user env always wins: LOKI_ROUTER=0 stays 0. Profile off or unset leaves the env byte-identical. It also writes .loki/cost-profile.json listing the levers applied, so nothing is reduced silently (D89 item 3). Works for loki start and, through the env var, for loki chat unchanged. Wall: Red first: - cost_profile.test.ts asserts resolveCostProfile('lean', {}) returns {LOKI_ROUTER:'1', LOKI_E10_TRIM:'1'}. - resolveCostProfile('lean', {LOKI_ROUTER:'0'}) keeps '0'. - An unknown profile name throws a usage error. - 'off' and unset return an empty patch. - start.test.ts: --cost lean reaches the child env and prints one line naming both levers. Mutation: remove the user-wins precedence check and confirm the LOKI_ROUTER=0 case goes red; restore. Gate: cd loki-ts && bun test tests/util/cost_profile.test.ts tests/commands/start.test.ts && bunx tsc --noEmit && bun test tests/engine10/budget.test.ts && bash ../tests/test-help-start-flags.sh && bash ../tests/test-help-changelog-drift.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
+| TEN-COST-02 | raw-lean baseline mode in the claude_code bench adapter | benchmarks/bench/adapters/claude_code.py, benchmarks/bench/tests/test_model_pin.py | LOW | see Wall in note | merged@2026-10-17T02:35Z | merge 3a7942aac, dist bd6348d77; TL APPROVE 60dc6d321 (8 passed, mutation red); post-merge tsc 0 errors, 130 pass. wave 1; depends: none. Goal: An honest same-config raw Claude Code baseline that works under OAuth (no API key). run(..., lean=True) adds: --setting-sources project, --strict-mcp-config, --mcp-config '{"mcpServers":{}}', --disable-slash-commands and --tools Bash,Read,Edit,Write,Glob,Grep, the same tool set as ENGINE10_TOOLS in providers.ts:618. lean and bare together raise ValueError, never silently pick one. The row command string records lean. Wall: Red first: - test_model_pin.py asserts the exact lean argv with a stub runner. - lean=True with bare=True raises. - Default lean=False argv is byte-identical to today's. Mutation: drop --strict-mcp-config from the lean argv; the argv test goes red. Gate: python3 -I -m pytest benchmarks/bench/tests/test_model_pin.py -q Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
+| TEN-COST-03 | Cost claim verdict: paired bootstrap CI and acceptance parity | benchmarks/bench/cost_claim.py (new: no bench module owns statistical claim gating; attribution.py is 1025 lines and owned by TEN-COST-04), benchmarks/bench/tests/test_cost_claim.py (new, pairs with the new module) | MEDIUM | see Wall in note | merged@2026-10-17T02:40Z | merge 049a16327; TL APPROVE cab8238eb (8 passed, mutation 1 failed). wave 1; depends: none. Goal: A pure function decides whether a cost claim is PROVEN or NOT PROVEN. - Inputs: per-row results for a Loki arm and a floor arm. - Method: paired bootstrap over tasks (fixed seed) for the 95% CI of the cost-per-accepted ratio. - PROVEN_AT(target) only when all of these hold: - the CI upper bound is at most the target; - Loki's acceptance rate is at least the floor's minus 0 (no accepted-task loss); - no row is cost_partial; - engine and loki version are recorded and identical across rows; - n is at least 3 per task. - Otherwise NOT PROVEN, with every failing reason listed. - Unmeasured rows are excluded but counted in the reasons. Wall: Red first, fixtures: - Ratio about 0.4 with tight spread gives PROVEN at 0.5. - Ratio 0.45 with one cost_partial row gives NOT PROVEN, reason partial. - Loki accepts 22/24 vs floor 24/24 gives NOT PROVEN, reason acceptance. - Mixed loki versions give NOT PROVEN. - n=2 gives NOT PROVEN. - Same seed gives an identical CI. Mutation: replace the CI upper bound with the point estimate; the wide-spread fixture flips to PROVEN and goes red. Gate: python3 -I -m pytest benchmarks/bench/tests/test_cost_claim.py -q Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
+| TEN-COST-04 | C-F1 arms raw-lean and loki-lean, lever ablation, verdict in the report | benchmarks/bench/attribution.py, benchmarks/bench/adapters/loki.py, benchmarks/bench/tests/test_attribution.py | MEDIUM | see Wall in note | ready@2026-10-17T01:40Z | wave 3; depends: TEN-COST-01, TEN-COST-02, TEN-COST-03, COST-WALL-e merged (it edits attribution.py). Goal: attribution.py changes: - Adds arms raw-lean (claude_code lean=True) and loki-lean (loki with LOKI_COST_PROFILE=lean). - Adds repeatable --loki-env KEY=VALUE for one-lever ablations (allowlist: LOKI_* keys only). - Adds raw-lean to COST_FLOORS. - render_cost_table prints the TEN-COST-03 verdict per Loki arm against each floor. adapters/loki.py changes: - Accepts profile and extra_env. - Records cost_profile, lever_env and cache_read/cache_creation tokens by phase in the row, so rows from different lever configs never pool. Wall: Red first in test_attribution.py: - --dry-run --arms raw-configured,raw-lean,loki,loki-lean plans all 4 arms. - loki-lean rows carry cost_profile 'lean'. - --loki-env FOO=1 (not LOKI_) exits 2. - The rendered table has a raw-lean column and a verdict line. - A loki row with a different lever_env is not pooled into the loki arm. Mutation: drop lever_env from the pooling key; the mixed-config test goes red. Gate: python3 -I -m pytest benchmarks -q -k 'attribution or model_pin or cost_claim' && python3 -I benchmarks/bench/attribution.py --dry-run --arms raw-configured,raw-lean,loki,loki-lean Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
+| TEN-COST-05 | Per-stage cache-hit attribution in the cost breakdown | loki-ts/src/util/cost_breakdown.ts, loki-ts/tests/engine10/cost.test.ts (breakdown cases only) | MEDIUM | see Wall in note | building@2026-10-17T02:36Z | wave 1; depends: none. Goal: costBreakdown per_stage gains cache_read_tokens, cache_creation_tokens and cache_hit_ratio, computed as read / (read + creation), null when both are 0. This makes the cache-stable-prefix lever (CH-01/CP-01) provable per stage in every receipt and in the bench row. The usd fail-closed rules are unchanged, and the new fields are additive. Wall: Red first: - Two implement records (read 7000/creation 0 and read 0/creation 7000) give ratio 0.5. - A stage with no token keys gives null, never 0. - Existing usd and retry assertions stay green. Mutation: count cache_creation as a hit; the 0.5 case goes red. Gate: cd loki-ts && bun test tests/engine10/cost.test.ts tests/engine10/budget.test.ts && bunx tsc --noEmit Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
+| TEN-COST-06 | xreview claude judge: lean flags and child-ledger line | loki-ts/src/engine10/stages/xreview.ts, loki-ts/tests/engine10/xreview.test.ts | MEDIUM | see Wall in note | ready@2026-10-17T01:40Z | wave 2; depends: none. Goal: When cross-review is enabled with a claude judge, reviewArgv adds leanReviewerFlags() and --output-format json. Ledger: the run is wrapped with withChildLedger(run, lokiDir, 'xreview'). Parsing: parseReview reads the JSON result text. The verdict rules are unchanged: no VERDICT line or unparseable JSON is still not_run, never PASS. The codex argv is unchanged. Edit is at most 4 lines in core. Wall: Red first: - reviewArgv('claude', ...) contains --setting-sources project (or --bare with an API key) and --output-format json. - A stubbed run writes one line to .loki/metrics/child-sessions.jsonl with phase xreview. - JSON with result 'VERDICT: BLOCK\n- x' parses to block. - Non-JSON stdout gives not_run. Mutation: return 'pass' on a JSON parse failure; the not_run test goes red. Gate: cd loki-ts && bun test tests/engine10/xreview.test.ts tests/engine10/budget.test.ts && bunx tsc --noEmit && bun test tests/runner/spawn_env_guard.test.ts Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
+| TEN-COST-07 | Project-model discovery on the fast tier, retry on the run model | loki-ts/src/project_model/discover.ts, loki-ts/tests/project_model/project_model.test.ts | MEDIUM | see Wall in note | building@2026-10-17T02:36Z | wave 1; depends: none. Goal: Discovery attempt 1 runs on fastTierModel(env) (runner/model_downgrades.ts:8). It is sonnet unless LOKI_ALLOW_HAIKU, so it never drops below sonnet without opt-in, and it is never weaker than an explicit LOKI_MODEL_OVERRIDE. The existing validation-error retry (attempt 2) runs on the run model, so a weak answer escalates, never ships. The model used is recorded on the project_model result. The schema validation and the owner=provider fallback are unchanged. Wall: Red first, with a stub SessionRunner: - Attempt 1 opts.model equals fastTierModel. - After an invalid answer, attempt 2 opts.model is undefined (run model). - With LOKI_MODEL_OVERRIDE set, both attempts use the override. Mutation: pin attempt 2 to the fast tier; the escalation test goes red. Gate: cd loki-ts && bun test tests/project_model && bunx tsc --noEmit Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
+| TEN-COST-08 | Documented reproducible cost proof run | docs/v10/METRICS.md, docs/EVALUATING.md | LOW | see Wall in note | ready@2026-10-17T01:40Z | wave 4; depends: TEN-COST-04. Goal: docs/v10/METRICS.md gains a 'Cost proof (C-F1)' section that states: - the exact command (attribution.py --execute, arms raw-configured, raw-lean, raw-bare, loki, loki-lean, n=3, pinned model, --max-spend-usd); - the verdict rule from TEN-COST-03; - that results are reported against all three floors, never only the favorable one; - that a run is valid only when the recorded loki version equals VERSION. docs/EVALUATING.md links to it. This is an extension of existing docs, not a new doc. Wall: Red first: grep -n 'Cost proof (C-F1)' docs/v10/METRICS.md exits 1 before the edit. Green: - The documented dry-run command, copied verbatim, exits 0. - grep -n 'raw-lean' docs/EVALUATING.md prints a line. - No em or en dashes: grep -nP '[\x{2013}\x{2014}]' on both files exits 1. Gate: python3 -I benchmarks/bench/attribution.py --dry-run --arms raw-configured,raw-lean,raw-bare,loki,loki-lean && bash tests/test-help-changelog-drift.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
+| TEN-QUALITY-01 | Fix brief carries a bounded failure excerpt (assertion, traceback, expected/received) | loki-ts/src/util/check_result.ts (failureExcerpt), loki-ts/src/engine10/stages/verify.ts (runCheck keeps the fail output excerpt; line 315 sample; at most 3 core lines), loki-ts/tests/engine10/check_result.test.ts, loki-ts/tests/engine10/fix.test.ts, loki-ts/tests/engine10/wall_holdout.test.ts | HIGH | see Wall in note | ready@2026-10-17T01:40Z | SPLIT per CTO critic into (a) pure failureExcerpt plus fixtures, (b) verify.ts wiring plus holdout test; build as two commits or two agents. wave 2; depends: none. Goal: Each failing non-holdout check's output reaches the fix session as a redacted excerpt of at most 1500 bytes, with at most 6 KB across all groups. The group format is `<rerun cmd>\n<excerpt>`. failureExcerpt() in util/check_result.ts finds the decisive block: pytest `E ` lines plus the last frame, jest/vitest Expected/Received, node AssertionError, go `--- FAIL` with the next lines, and tsc/ruff diagnostic lines. It strips ANSI, makes absolute paths repo-relative and runs util/redact.ts. The signature stays byte-identical, so stall detection at machine.ts:232 and escalation in fix.ts are unchanged. The excerpt lives in a stage-local map inside verify.ts. It is never added to VerifyCheck, never emitted in test.result, and never computed for holdout checks. Wall: Red first: fix.test.ts drives verify then fix on a fixture with a failing pytest `assert add(2,2) == 5`. Today the brief lacks `E assert 4 == 5`, so the test fails. check_result.test.ts covers one fixture each for pytest, jest, node:test, go and tsc. It also asserts the size cap and that an AKIA-style token is redacted. wall_holdout.test.ts asserts that a failing holdout's output text appears in neither failures_grouped, events.jsonl nor the fix brief. Mutations: failureExcerpt returning '' must turn fix.test red; removing the isHold filter at verify.ts:314 must turn wall_holdout red; adding the excerpt to the signature must turn the existing stall test in machine.test.ts red. Gate: cd /Users/lokesh/git/lokimode-anthropic/loki-ts && bun test tests/engine10/check_result.test.ts tests/engine10/fix.test.ts tests/engine10/wall_holdout.test.ts && bun test && npx tsc --noEmit && bun test tests/engine10/budget.test.ts; then bash scripts/local-ci.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
+| TEN-QUALITY-02 | Pure static-diagnostic baseline attribution (new vs pre-existing lint) | loki-ts/src/runner/repo_profile.ts, loki-ts/tests/runner/harness_intelligence.test.ts (extends its existing repo_profile describe blocks) | HIGH | see Wall in note | building@2026-10-17T02:36Z | wave 1; depends: none. Goal: Add attributeStatic(tool, headOut, baseOut) to runner/repo_profile.ts, which already owns attribute() and attributeFullSuite(). It parses ruff `--output-format=concise`, shellcheck `-f gcc` and eslint `-f unix` into multisets keyed path/code/message, with line and column dropped so line shifts do not count. It returns preExisting=true only when every head diagnostic key appears in base at the same or a higher count. It fails closed in four cases, each of which counts as introduced: unparseable head output, empty parse with a non-zero exit, a missing base output (file new on head), or an unknown tool. Wall: Red first: tests import attributeStatic, which does not exist yet. Cases: same F401 on base and head gives pre-existing; an extra F401 on head gives introduced; the same code with a different message gives introduced; a shifted line number alone gives pre-existing; garbage output gives introduced; base null gives introduced; each of the 3 parsers is checked against a recorded real output sample. Mutation: compare by code only (drop message) and a test must go red; treat a parse failure as pre-existing and a test must go red. Gate: cd /Users/lokesh/git/lokimode-anthropic/loki-ts && bun test tests/runner/harness_intelligence.test.ts && bun test && npx tsc --noEmit; then bash scripts/local-ci.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
+| TEN-QUALITY-03 | Wire static attribution into verify so pre-existing lint never drives fix rounds | loki-ts/src/engine10/stages/verify.ts (runLintChecks only; at most 4 core lines, helper calls live in repo_profile.ts), loki-ts/tests/engine10/verify_lint.test.ts | HIGH | see Wall in note | ready@2026-10-17T01:40Z | wave 3; depends: TEN-QUALITY-01 (same file verify.ts; build after it merges), TEN-QUALITY-02. Goal: In runLintChecks, ruff runs with --output-format=concise. When a per-file static check (ruff, shellcheck, eslint) fails, the same tool runs on each changed file's base content. Base content comes from `git show <base>:<path>` through safeGit and is fed on stdin: `ruff check --output-format=concise --stdin-filename <p> -`, `shellcheck -f gcc -`, `eslint --stdin --stdin-filename <p> -f unix`. These runs are confined to the existing per-check timeout. When attributeStatic says pre-existing, the check name joins the same attr.preExistingChecks / preRed.names path tests already use. That path is one shared mechanism: the check is excluded from failures_grouped, and a baseline line is recorded. tsc is not touched. A file that is new on head is never excused. Wall: Red first: verify_lint.test.ts sets up a fixture git repo whose base has `import os` unused in mod.py. Head changes another line of mod.py. A stub ruff on PATH emits a deterministic concise F401. Today failures_grouped contains lint:ruff; after the change it is empty and the baseline line names it. Second case: head adds a new unused import, and failures_grouped must still contain lint:ruff. Third case: a file new on head with F401 is never excused. Mutations: skip the base run and treat everything as pre-existing, and case 2 must go red; drop the new-file guard, and case 3 must go red. Gate: cd /Users/lokesh/git/lokimode-anthropic/loki-ts && bun test tests/engine10/verify_lint.test.ts tests/engine10/verify_prered.test.ts && bun test && npx tsc --noEmit && bun test tests/engine10/budget.test.ts; then bash scripts/local-ci.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
+| TEN-QUALITY-04 | Repo map indexes methods and whole large files; cache key versioned | loki-ts/src/engine10/repomap.ts, loki-ts/src/engine10/cache.ts (one-token key rename; net core growth at most 5 lines), loki-ts/tests/engine10/repomap.test.ts, loki-ts/tests/engine10/cache.test.ts | MEDIUM | see Wall in note | building@2026-10-17T02:36Z | wave 1; depends: none. Goal: repomap.ts records indented Python def and async def under the most recent top-level class as `Class.method`. It raises the symbol-scan cap from 20 KB to 256 KB per file and caps symbols at 300 per file. cache.ts renames the cache file to repomap2-${tree}.json, so a map cached before methods existed is never read. The RepoMap shape is unchanged (symbols are still strings), so isRepoMap and every caller keep working. Wall: Red first: repomap.test.ts writes a 60 KB Python file with `class QuerySet:` and `def bulk_create(self, objs):` past byte 20,000, and asserts the map has `QuerySet.bulk_create`. A file with 1000 defs yields at most 300 symbols. cache.test.ts: a stale repomap-<tree>.json written in the old format is ignored, so a fresh build happens. Mutations: restore the 20 KB cap and the test goes red; restore the old cache filename and the stale test goes red. Gate: cd /Users/lokesh/git/lokimode-anthropic/loki-ts && bun test tests/engine10/repomap.test.ts tests/engine10/cache.test.ts tests/engine10/intake.test.ts tests/engine10/sizing.test.ts && bun test && npx tsc --noEmit && bun test tests/engine10/budget.test.ts; then bash scripts/local-ci.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
+| TEN-QUALITY-05 | Identifier-aware relevance ranking (traceback paths, exact identifier tokens, stopwords) | loki-ts/src/engine10/relevant_files.ts, loki-ts/src/util/relevance.ts (new; justified above), loki-ts/tests/engine10/plan.test.ts | MEDIUM | see Wall in note | ready@2026-10-17T01:40Z | wave 2; depends: none (gains compound with TEN-QUALITY-04 Class.method symbols). Goal: selectRelevantFiles and selectRelevantFilesWithReason keep their signatures, but rank by these rules: (a) A repo path named in the task or in a traceback frame ranks first. This covers `File "a/b.py", line N`, `a/b.ts:12:3` and dotted modules `pkg.mod.Name` resolved to a mapped path. (b) Exact token matches only. Tokens come from splitting camelCase, snake_case, dots and slashes; substring matches no longer count. (c) Weights: basename stem 3, symbol 2, path segment 1. (d) A fixed stopword list. (e) Ties keep repo-map order. Reasons still name the matched tokens. New file util/relevance.ts: relevant_files.ts sits in engine10 core at 4964 of 5000 lines, so the scoring moves out and relevant_files.ts becomes a thin delegate with net negative core lines. Wall: Red first, in plan.test.ts: - The task 'add a retry flag' must not select address.py. - A task containing a pytest traceback `File "src/pkg/query.py", line 88` ranks src/pkg/query.py first, ahead of 7 keyword-noise files. - `bulk_create` selects the file whose symbol is QuerySet.bulk_create. - `parseConfig` matches the symbol parse_config. Existing callers stay green: decompose.test.ts, warm.test.ts, already_done_cleanup.test.ts and the e10ext brief tests. Mutation: restore `hay.includes(w)` and the address case goes red; drop the traceback rule and the traceback case goes red. Gate: cd /Users/lokesh/git/lokimode-anthropic/loki-ts && bun test tests/engine10/plan.test.ts tests/engine10/decompose.test.ts tests/features/warm.test.ts && bun test && npx tsc --noEmit && bun test tests/engine10/budget.test.ts; then bash scripts/local-ci.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
+| TEN-QUALITY-06 | Signature digest of top relevant files in the implement/fix brief | loki-ts/src/util/ts_signatures.ts, loki-ts/src/e10ext/context.ts (at most 5 lines, e10ext stays under 1500), loki-ts/tests/e10ext/full_job_brief.test.ts | MEDIUM | see Wall in note | building@2026-10-17T02:42Z | wave 1; depends: none. Goal: util/ts_signatures.ts gains signatureDigest(repoDir, files, maxBytes=4000): - TS/JS through the existing lexer. - Python def and class headers up to the colon, with methods indented under their class. - Deterministic order: the order of the files argument. - Unreadable files are skipped. briefContext (e10ext/context.ts) appends a 'Key signatures (read the files for bodies):' block for the first 5 relevant files after the Relevant files block. The block is off with LOKI_E10_SIGS=0. The unit-brief path (unitBrief) is unchanged. Placement is after FIXED_RULES and the task, so the cache-stable prefix keeps its bytes. Wall: Red first: the brief for a fixture repo with models.py `def bulk_create(self, objs, batch_size=None):` under class QuerySet contains that header under `class QuerySet`. A TS fixture shows `export function add(a: number, b: number): number`. Two calls give byte-identical output, and the 4000-byte cap holds with 40 large files. LOKI_E10_SIGS=0 gives a brief byte-identical to today's golden. The FIXED_RULES prefix is unchanged. Mutation: drop the cap and the cap test goes red; reverse the file order and the stability/order test goes red. Gate: cd /Users/lokesh/git/lokimode-anthropic/loki-ts && bun test tests/e10ext/full_job_brief.test.ts tests/e10ext/unit_mode.test.ts tests/features/wall_manifest*.test.ts && bun test && npx tsc --noEmit && bun test tests/engine10/budget.test.ts; then bash scripts/local-ci.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
+| TEN-QUALITY-07 | Fix rounds see the current diff (fix the dead diff_stat reader) | loki-ts/src/runner/session_resume.ts, loki-ts/src/engine10/stages/fix.ts (replace the dead read; at most 2 core lines), loki-ts/tests/engine10/fix.test.ts, loki-ts/tests/engine10/fix_resume.test.ts | MEDIUM | see Wall in note | ready@2026-10-17T01:40Z | wave 2; depends: none. Goal: fix.ts:62 reads prior.implement.diff_stat, but no stage ever writes it, so every real fix brief says the diff is unavailable. Add currentDiff(repoDir, baseSha, maxBytes=6000) to runner/session_resume.ts, which already owns buildFixResumeBrief. It runs `git diff --stat <base>` plus `git diff -U2 <base>` of tracked files through safeGit, and lists untracked new files by name (from ls-files --others --exclude-standard, with no index mutation). It excludes .loki/ and truncates with an explicit note. fix.ts computes it fresh every round and feeds both buildFixBrief and buildFixResumeBrief. Round 1 gets the stat. Round 2 and later get the bounded hunks too, so the fixer can reflect on what the last round changed. Wall: Red first: fix.test.ts uses a temp git repo with one modified file and no implement.diff_stat. The fix brief contains '1 file changed', not '(diff stat is not available)'. Round 2's brief contains the hunk line `+ return a + b`. A file under .loki/ never appears. A 50 KB diff is cut to 6000 bytes with the truncation note. The existing tests that inject diff_stat are updated to the new source. Mutations: return null from currentDiff and the test goes red; drop the .loki exclusion and the .loki test goes red. Gate: cd /Users/lokesh/git/lokimode-anthropic/loki-ts && bun test tests/engine10/fix.test.ts tests/engine10/fix_resume.test.ts tests/engine10/warm_chain.test.ts && bun test && npx tsc --noEmit && bun test tests/engine10/budget.test.ts; then bash scripts/local-ci.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
+| TEN-QUALITY-08 | Lean-path reproduce-first instruction (flagged until measured) | loki-ts/src/engine10/stages/implement.ts (one line), loki-ts/tests/engine10/implement.test.ts | MEDIUM | see Wall in note | ready@2026-10-17T01:40Z | wave 3; depends: none (flag flip gated on TEN-QUALITY-09 results). Goal: Only when LOKI_E10_REPRO=1 is set, buildImplementBrief's no-plan line (implement.ts:39, the lean path with no Wall) adds a fixed, task-independent sentence: 'If the task reports a bug, first add a new test function that reproduces it, run it and see it fail, then fix the code and run that test again.' This matches how Claude Code works on SWE-bench-style issues. It stays default-off: the prompt-ablation program showed that added prompt text can hurt. TEN-QUALITY-09's A/B decides the flip. If it is flipped on, the sentence moves into FIXED_RULES (the cache-stable prefix) under the harness invariant. Wall: Red first: with LOKI_E10_REPRO=1 the lean brief contains the sentence. With the flag unset, the brief is byte-identical to a golden captured before the change. A plan-present brief never contains it. Mutation: an inverted flag check turns both cases red. Gate: cd /Users/lokesh/git/lokimode-anthropic/loki-ts && bun test tests/engine10/implement.test.ts tests/engine10/lean_session.test.ts && bun test && npx tsc --noEmit && bun test tests/engine10/budget.test.ts; then bash scripts/local-ci.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
+| TEN-QUALITY-09 | Offline localization-recall eval on the pinned SWE-bench subset | benchmarks/swebench/loader.py, benchmarks/bench/tests/ (extend the existing loader test file there; grep for its current name before adding) | LOW | see Wall in note | building@2026-10-17T02:42Z | wave 1; depends: none. Goal: benchmarks/swebench/loader.py gains gold_files(patch), which parses the paths in the gold patch's diff headers, and a `localization` subcommand. For each pinned instance with a checkout at $LOKI_SWEBENCH_REPOS/<repo>@<base_commit>, it runs `bun -e` importing buildRepoMap and selectRelevantFiles from loki-ts/src. It writes recall@8 and recall@20 JSON with per-instance hits. An instance without a checkout is listed as skipped with its reason, never scored 0. Offline only, with no network. This gives TEN-QUALITY-04/05 a before/after number versus E-98d's 4/7, and gives TEN-QUALITY-08's paid A/B a pre-registered harness to run through the existing claude_code and loki adapters. Wall: Red first: gold_files on a recorded 2-file patch returns both paths and ignores /dev/null. The localization command on a temp git repo fixture plus a stub instance gives recall@8 = 1.0 when the gold file is named in the problem statement. A missing checkout appears as skipped with recall None, never 0. Mutation: count skipped as 0 and the skip test goes red. Gate: cd /Users/lokesh/git/lokimode-anthropic && python3 -I -m pytest benchmarks/bench/tests -q && bash scripts/local-ci.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
+| TEN-UX-01 | Empty-folder first run: loki start "<brief>" sets up a repo and checks Claude login before any spend | loki-ts/src/util/first_run_repo.ts (new; justification: no existing module owns setting up an empty folder as a repo, and core has about 36 lines left so the logic cannot live in preflight.ts); loki-ts/src/engine10/preflight.ts (call the helper and the login check, net +3 lines max); loki-ts/src/commands/doctor.ts (export claudeAuthStatusLoggedIn only, and let it take an argv/env so preflight reuses it; no second parser); loki-ts/tests/engine10/preflight.test.ts; docs/v10/FAILURE-CLASSES.md (row first) | MEDIUM | see Wall in note | ready@2026-10-17T01:40Z | SPLIT per CTO critic into (a) empty folder becomes a repo, (b) Claude login check in preflight plus doctor export; build as two commits or two agents. wave 2; depends: none. Goal: In an empty folder with no git repo, `loki start "<brief>"` runs git init -q, sets the default branch to main and makes an empty initial commit, then continues. It prints one line: `initialized a new git repository in <dir> (LOKI_AUTO_GIT_INIT=0 to refuse)`. A folder that is not empty and has no repo is never initialised automatically: it stays fatal, and the message gives the exact commands (git init && git add . && git commit -m init). A missing git identity stays fatal with the exact git config command; the identity is never set automatically. When the provider is claude and no ANTHROPIC_API_KEY or CLAUDE_CODE_OAUTH_TOKEN is set, preflight runs `claude auth status` (5s timeout, using the run env's PATH and LOKI_CLAUDE_CLI). A clear loggedIn:false is fatal and names the fix `claude login (or set ANTHROPIC_API_KEY)`. An unknown or empty answer is a warning only, never fatal, so a stub CLI still works. Wall: Red first: preflight.test.ts gains cases that fail on main today: (a) empty temp folder, no repo: checkPreflight returns fatal null, the folder now has .git and HEAD resolves; (b) folder holding one file, no repo: fatal contains `git init && git add . && git commit -m init`, and no .git is created; (c) LOKI_AUTO_GIT_INIT=0 on an empty folder: still fatal, no .git; (d) a fake claude on PATH printing {"loggedIn":false} gives a fatal containing `claude login`; (e) fake printing {} or exiting 1 gives fatal null plus one warning; (f) ANTHROPIC_API_KEY set: the fake claude is never called (it writes a marker file; assert the file is absent). Mutations: (1) drop the emptiness check, so case (b) must go red; (2) treat the unknown login answer as fatal, so case (e) must go red; (3) delete the export in doctor.ts, so the build/typecheck must go red. Gate: cd loki-ts && bun test tests/engine10/preflight.test.ts tests/engine10/budget.test.ts tests/commands/doctor.test.ts && bun test && bunx tsc --noEmit; then bash scripts/local-ci.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
+| TEN-UX-02 | Failure-specific Next line: every failed start names the exact fix | loki-ts/src/util/run_summary.ts (nextOf only); loki-ts/src/engine10/supervisor.ts (line 393 argument only; rebase after Q18-07 if it lands first); loki-ts/tests/util/run_summary.test.ts | LOW | see Wall in note | merged@2026-10-17T02:35Z | merge 63cdd70ec, dist bd6348d77; TL APPROVE f450cf65f (94 pass, 2 mutations red); post-merge tsc 0 errors, 130 pass. wave 1; depends: none (rebase onto Q18-07 if supervisor.ts:313 moved). Goal: nextOf takes the run's reason and outcome and returns one concrete command per failure class: provider authentication failed -> `claude login` (or that provider's fix line from setup-requirements.json via requirementFix); provider credit exhausted -> `loki start ... --provider <other>` or check billing; '<check> failed: ...' -> `loki chat --attach` (ask why) plus `loki undo` when files changed; spec conflict (BLOCKED) -> `loki answer --text "..."`; STALLED -> `loki chat --attach`; engine ended before sealing a receipt -> `loki doctor`. The existing verified, done-unverified and budget branches stay byte-identical. The supervisor call site passes res.reason on the same line, with zero net core lines. Wall: Red first: run_summary.test.ts adds one table row per reason string that output.ts:74 reasonOf really produces (copy the literals, do not paraphrase), each asserting the exact Next command. These fail today because nextOf returns loki doctor/loki undo. A pin asserts the old outputs for verified, done-unverified, stopped and failed-without-reason, so default output does not drift. A source-scan test asserts every literal reason produced at output.ts:74 has a nextOf mapping (catches new reasons with no mapping). Mutation: make nextOf ignore the reason argument, so every new row must go red; remove the supervisor argument, so a contract test in tests/features/contract.test.ts that runs the summary with fatal:auth must go red. Gate: cd loki-ts && bun test tests/util/run_summary.test.ts tests/features/contract.test.ts tests/engine10/budget.test.ts && bun test && bunx tsc --noEmit Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
+| TEN-UX-03 | Funnel on the default engine10 route: first_run_blocked at preflight and build_verified at seal | loki-ts/src/util/funnel.ts (new; justification: telemetry.sh is the owner and this file is the only TS bridge to it, replacing the private copy in doctor.ts); loki-ts/src/commands/doctor.ts (emitFirstRunBlocked becomes a call to the helper; remove the spawn code); loki-ts/src/engine10/cli.ts (one call after main, at most +2 lines); autonomy/telemetry.sh (_loki_known_blocker keys and a loki_emit_build_verified_enum function); tests/test-first-run-funnel-coverage.sh | MEDIUM | see Wall in note | ready@2026-10-17T01:40Z | wave 3; depends: TEN-UX-01 (shares doctor.ts; also needs the not_a_repo fatal text to exist). Goal: Move the detached, opt-out-respecting telemetry.sh spawn from doctor.ts:1047-1069 into one TS helper (emitFunnel(kind, key)), and delete the copy in doctor.ts in the same change. Call it from engine10/cli.ts after the supervisor returns: preflight exit 2 sends first_run_blocked with a bounded key; a VERIFIED or ALREADY_SATISFIED exit sends build_verified carrying only headline=VERIFIED and route=engine10. No other field is sent. Add keys not_a_repo and git_identity to _loki_known_blocker (telemetry.sh:204), and add an allowlisted build_verified variant that takes enum args instead of a proof.json path. All existing opt-outs still apply because everything goes through _loki_analytics_enabled. Wall: Red first: test-first-run-funnel-coverage.sh gains (a) a wiring assertion that engine10/cli.ts reaches emitFunnel on a preflight exit 2 and on a VERIFIED exit, and (b) a run with a stub telemetry.sh in a throwaway HOME, analytics forced on, with no network: loki_telemetry is replaced by a recorder function. Assert that one first_run_blocked blocker=not_a_repo line is recorded for a start in a non-empty folder with no repo, and that a second identical run records nothing (once-per-install marker). Assert DO_NOT_TRACK=1 and LOKI_TELEMETRY_DISABLED=1 each record zero lines. Assert the recorded payload contains no path, home dir or brief text (grep the recorder file for the temp folder path and the brief: must be absent). Mutations: emit a raw blocker string instead of the enum, so the no-path assertion must go red; drop the marker write, so the second-run assertion must go red; leave doctor's old spawn copy in place, so a grep guard counting `telemetry.sh` spawns in loki-ts/src (exactly 1) must go red. Gate: bash tests/test-first-run-funnel-coverage.sh && bash tests/test-first-run-blocked-signal.sh && cd loki-ts && bun test tests/engine10/budget.test.ts tests/commands/doctor.test.ts && bun test; then bash scripts/local-ci.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
+| TEN-UX-04 | loki doctor --fix: consent-gated installs and Claude login, plus its first tests | loki-ts/src/commands/doctor_fix.ts; loki-ts/src/commands/doctor.ts (pass --yes through to runDoctorFix only; rebase after TEN-UX-01/03 if they touch the same hunk); loki-ts/tests/commands/doctor.test.ts (extend; no doctor_fix test exists today) | MEDIUM | see Wall in note | ready@2026-10-17T01:40Z | wave 4; depends: TEN-UX-03 (doctor.ts edit order only). Goal: On a TTY, `loki doctor --fix` offers each missing default-provider install as a y/N question before running it: `npm install -g @anthropic-ai/claude-code`, then `claude login` when evaluateClaudeLogin returns fail. `--fix --yes` runs the same steps without asking, for scripted onboarding. Without a TTY and without --yes, it prints the commands only, exactly as today. System package managers and sudo are never run. Every step that runs reports `fixed:` or `failed: <first stderr line>`, and the command exits non-zero when a required step still fails. Command execution is behind an injectable runner, so tests never install anything. Wall: Red first: doctor.test.ts gains applyDoctorFixes/runDoctorFix cases with an injected has() and runner: (a) claude missing, tty=false, no --yes: the runner is never called and the npm command is printed; (b) claude missing, --yes: the runner gets exactly [npm, install, -g, @anthropic-ai/claude-code]; (c) runner fails: output has `failed:` and the exit code is non-zero; (d) jq missing with --yes: the runner is never called for jq (system package, print only); (e) claude present and logged out with --yes: the runner gets [claude, login]. These fail today because doctor_fix has no runner, no --yes and no exit code. Mutations: drop the tty/--yes gate, so (a) must go red; let system packages through the runner, so (d) must go red. Gate: cd loki-ts && bun test tests/commands/doctor.test.ts tests/commands/doctor_router.test.ts && bun test && bunx tsc --noEmit; bash tests/test-doctor-ux.sh; bash tests/test-doctor-single-impl.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
+| TEN-UX-05 | loki chat startup readiness check and slash-command suggestions | autonomy/lib/chat.sh; tests/test-doctor-ux.sh (already owns the chat assertions, P12-16) | LOW | see Wall in note | ready@2026-10-17T01:40Z | wave 3; depends: none (the folder message text refers to TEN-UX-01 behaviour; write it to whichever behaviour is on main). Goal: When cmd_chat starts (after the TTY check), print at most 3 readiness lines, once, using existing helpers only. (1) The provider CLI for _CHAT_PROVIDER is missing (any provider, not only claude): print `_loki_req_fix_line <provider>` and a hint to try `/provider claude`. (2) claude is logged out: print `claude login (or set ANTHROPIC_API_KEY)`. (3) The folder is not a git repo: say that `/run` will set up an empty folder (TEN-UX-01) or needs `git init` for a non-empty one. When everything is ready, print nothing extra, so a working setup sees no new text. An unknown slash command prints `unknown command: /stat (did you mean /status?)` by unique-prefix or single-edit match against the _chat_help list. The hint for a missing non-Claude provider replaces the bare 'cannot load provider X' at chat.sh:259/:271 with the fix line. Wall: Red first: test-doctor-ux.sh adds cases that drive cmd_chat through `script`/a pty helper already used there (or calls the new _chat_readiness function directly). With PATH holding no codex and LOKI_PROVIDER=codex, the output contains the codex fix string from setup-requirements.json. With a fake claude printing {"loggedIn":false}, the output contains `claude login`. In a non-git temp folder, the output mentions git. With every check passing (fake claude logged in, inside a repo), the readiness output is empty. `/stat` suggests `/status`; `/zzzz` prints no suggestion. Mutations: print readiness lines unconditionally, so the all-ready empty assertion must go red; hardcode the claude fix for every provider, so the codex fix assertion must go red. bash -n and shellcheck on chat.sh. Gate: bash tests/test-doctor-ux.sh && bash tests/test-loki-steer.sh && bash tests/test-first-run-bash32.sh && shellcheck autonomy/lib/chat.sh; then bash scripts/local-ci.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
+| TEN-UX-06 | Dashboard page: empty state, auto-select of the live run, stage progress strip, readable timeline, theme and narrow-screen layout | loki-ts/src/util/dashboard_page.ts; loki-ts/tests/engine10/dashboard_entry.test.ts (extend; it already serves the real page from a fixture events.jsonl) | LOW | see Wall in note | ready@2026-10-17T01:40Z | SPLIT per CTO critic into (a) empty state and auto-select, (b) stage strip and readable timeline, (c) theme tokens and narrow layout; build as two commits or two agents. wave 1; depends: none. Goal: Changes to util/dashboard_page.ts: (1) Zero runs: show an empty state with the one command to start (`loki start "<brief>"`) and a link to `loki doctor`. (2) Auto-select the running run, or else the newest run, on load. Keep the user's later click. (3) Show a stage strip (intake, plan, wall, implement, verify, seal, pr), built from the SSE events: done, running (with elapsed time), failed or skipped. (4) Show timeline rows as `[mm:ss] stage status detail`, matching the formatStageLine wording, instead of raw `e.type`. Unknown event types still render raw, so nothing is hidden. (5) Define colours as CSS custom properties on :root, with prefers-color-scheme light/dark and a body background. (6) Single column under 640px, no horizontal scroll. Stays inline, with no external assets and no new endpoints. Every value is still passed through esc(), with no innerHTML of event data. Wall: Red first: dashboard_entry.test.ts adds (a) GET / with an empty .loki returns HTML containing the empty-state marker id and the `loki start` text; (b) the page source contains a stage-strip container and a selectRun call on load; (c) an XSS fixture puts a stage detail of `<img src=x onerror=alert(1)>` into events.jsonl, and the page's rendering must route it through esc or textContent: assert by a static scan that no `innerHTML` assignment takes e.data or e.detail; (d) the page contains `prefers-color-scheme` and `@media (max-width: 640px)`. All fail today. Mutations: remove the auto-select call, so (b) must go red; render detail through innerHTML without esc, so (c) must go red. Gate: cd loki-ts && bun test tests/engine10/dashboard_entry.test.ts tests/engine10/dashboard.test.ts tests/engine10/dashboard_group.test.ts && bun test && bunx tsc --noEmit; manual: loki dashboard on a finished fixture run, checked in a 375px-wide viewport (screenshot attached to the PR) Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
+| TEN-UX-07 | Dashboard server panels: Reason, Next step and current stage elapsed | loki-ts/src/runner/engine10_dashboard.ts (formatPanels and summarizeRun only); loki-ts/tests/engine10/dashboard.test.ts | LOW | see Wall in note | ready@2026-10-17T01:40Z | wave 2; depends: none (picks up TEN-UX-02's reason-aware nextOf automatically once merged). Goal: formatPanels (runner/engine10_dashboard.ts:63-79) adds panels after Verdict. Reason comes from the same reasonOf the console uses (output.ts:74), reading the run's events, never a second classifier. Next comes from nextOf/resultOf (util/run_summary.ts), so the dashboard and the terminal always say the same thing. Stage shows `implement, 1m12s` while the run is going. A finished VERIFIED run shows no Reason panel. Null stays 'not measured', never 0. Wall: Red first: dashboard.test.ts adds fixtures: (a) events ending in fatal:auth: panels include Reason `provider authentication failed` and a Next panel equal to nextOf's output for that run, compared to the function's return value and not a copied string, so console and dashboard cannot drift; (b) a verify check failure: Reason `<name> failed: <first_error>`; (c) a VERIFIED run: no Reason panel, and Next is `loki diff` or `loki status`; (d) a running run: a Stage panel with the elapsed time; a run without stage.started shows 'not measured'. All fail today (no such panels). Mutations: hardcode Next to 'loki doctor', so (a) and (c) must go red; reimplement reason locally instead of importing reasonOf, so a source-scan assertion that engine10_dashboard.ts imports reasonOf must go red. Gate: cd loki-ts && bun test tests/engine10/dashboard.test.ts tests/engine10/dashboard_entry.test.ts && bun test && bunx tsc --noEmit Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
+| TEN-UX-08 | First-run gate: empty-folder loki start scenario and the install-to-first-success time budget | scripts/first-run-gate.sh; tests/test-first-run-gate.sh; docs/v10/METRICS.md (row 14 text only, written by --real runs, not by the engineer) | MEDIUM | see Wall in note | ready@2026-10-17T01:40Z | wave 4; depends: TEN-UX-01 (empty-folder start must work), TEN-UX-02 (Next wording). Goal: Add `--entry start-empty` to scripts/first-run-gate.sh. It installs (with --installed) or uses the tree, creates an empty folder under the run-owned temp directory, sets git identity through GIT_* env vars only, and runs `loki doctor` then `loki start "<brief>"` with the existing stub claude. It asserts: the folder was set up as a repo, Outcome is VERIFIED, a receipt is sealed, Next is present, and install+doctor+start wall time on the stub is <= 120s, recorded as `install_to_first_success_s`. The stub run measures harness overhead only. With --real, it appends the measured time-to-first-sealed-result row to docs/v10/METRICS.md, replacing the 'not measured' row at METRICS.md:14 with a dated measurement and its command. In stub mode it never writes METRICS. Wall: Red first: test-first-run-gate.sh adds fake-loki modes for the new entry: (a) a fake that leaves the folder without a repo: FAIL repo-init; (b) a fake that sleeps past an injected budget FRG_BUDGET_S=1: FAIL first-success-budget; (c) a fake with no Next line: FAIL next-line; (d) a well-behaved fake: all PASS and the report has `install_to_first_success_s=<int>`. The new entry does not exist today, so these fail. Mutations: drop the budget comparison, so (b) must go red; parse the time field as a string compare, so a budget of 9 vs a measured 10 must go red. Tests use loki_run_tmp_create/cleanup only, never /tmp globs. Gate: bash tests/test-first-run-gate.sh && bash scripts/first-run-gate.sh --stub --entry start-empty; then bash scripts/local-ci.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
+| TEN-GATES-01 | FC row plus pure check-provenance classifier in check_result.ts | loki-ts/src/util/check_result.ts, loki-ts/tests/engine10/check_result.test.ts, docs/v10/FAILURE-CLASSES.md | HIGH | see Wall in note | building@2026-10-17T02:36Z | wave 1; depends: none. Goal: Add FC row 'verdict proven only by agent-authored evidence' (user-visible: VERIFIED receipt backed solely by tests the implementer wrote or an LLM judge; law broken; siblings: engine10 seal proof, proof-generator headline, deep council pass) to docs/v10/FAILURE-CLASSES.md. In util/check_result.ts (the ONE place checks are classified) add checkProvenance(name, {addedFiles, wallFiles, holdout}) -> 'exogenous' (lint:/typecheck:/static, security scan, full suite of pre-existing tests, app boot, http probe) / 'independent' (Wall file, holdout) / 'agent_authored' (runner:path where path was added in the diff) / 'llm_judge' (council, xreview, code_review, devils_advocate, magic_debate); unknown names default to exogenous (fail-closed, same direction as proof-generator.py:286-292). Add hasExogenousProof(checks, ctx) = some executed n>0 pass whose provenance is not agent_authored or llm_judge. Pure, no wiring. Wall: Red first: new cases in check_result.test.ts (added test file -> agent_authored and hasExogenousProof false; same path pre-existing -> exogenous and true; Wall path -> independent; 'council' -> llm_judge never counts; unknown name -> exogenous). Mutation: flip unknown default to llm_judge -> the fail-closed case goes red; drop the addedFiles lookup -> agent_authored case goes red. Gate: cd loki-ts && bun test tests/engine10/check_result.test.ts && bun test && bunx tsc --noEmit Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
+| TEN-GATES-02 | Seal: receipt checks carry provenance; VERIFIED requires agent-independent proof | loki-ts/src/engine10/stages/seal.ts, loki-ts/src/engine10/types.ts, loki-ts/tests/engine10/seal.test.ts, docs/v10/DECISIONS.md | HIGH | see Wall in note | ready@2026-10-17T01:40Z | wave 3; depends: TEN-GATES-01, Q18-05b (seal.ts in flight). Goal: In seal.ts replace hasExecutedProof at seal.ts:190 with hasExogenousProof (wallGreenOnBase still counts); when only agent_authored/llm_judge checks passed, verdict caps at PARTIAL and not_proven gains 'only agent-authored tests executed (no agent-independent proof)'. Each receipt check gains additive optional provenance (types.ts ReceiptCheck provenance?: ...; omitted key keeps older receipts byte-stable for verification). renderReceiptMd splits '### Agent-independent checks' and '### Agent-authored / advisory checks'. Opt-out LOKI_EXOGENOUS_PROOF=0 (record the default-on decision in DECISIONS.md under the D99 grant). Net-zero line change in engine10 core (fold into existing lines or move helpers to util). Wall: Red first in seal.test.ts: fake verify outputs with one passing check on a test file ADDED in the diff and no Wall -> expect PARTIAL plus the not_proven line (today VERIFIED); same check on a pre-existing file -> VERIFIED; receipt.json checks carry provenance; receipt.md has both sections. Mutation: revert to hasExecutedProof -> red. LOKI_EXOGENOUS_PROOF=0 restores old verdict. Gate: cd loki-ts && bun test tests/engine10/seal.test.ts tests/engine10/seal_verify_roundtrip.test.ts tests/engine10/budget.test.ts && bun test && bunx tsc --noEmit Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
+| TEN-GATES-03 | loki verify reports agent-independent evidence and adds --require-exogenous | loki-ts/src/engine10/verify_cmd.ts, loki-ts/tests/engine10/verify_cmd.test.ts | HIGH | see Wall in note | ready@2026-10-17T01:40Z | wave 4; depends: TEN-GATES-02. Goal: verify_cmd.ts prints one line 'agent-independent: k of n passing checks (wall/holdout/pre-existing/static/probe); advisory: m' from receipt.checks provenance (absent provenance = older receipt, printed as 'provenance not recorded', never as zero). New flag --require-exogenous (and LOKI_VERIFY_REQUIRE_EXOGENOUS=1) exits 4 when a VERIFIED receipt has k=0 or no provenance; integrity/signature verdicts unchanged. Helper lives in util/check_result.ts? No: keep counting inline via the 01 exports to avoid touching 01's file; net-zero engine10 lines by folding into existing usage string. Wall: Red first: verify_cmd.test.ts fixture receipt signed with a test key, VERIFIED, all checks agent_authored -> --require-exogenous exits 4 (today flag unknown, exit 2); one exogenous pass -> exit 0; tampered receipt still exits 1 with the flag. Mutation: make missing provenance count as exogenous -> red. Gate: cd loki-ts && bun test tests/engine10/verify_cmd.test.ts tests/engine10/budget.test.ts && bun test && bunx tsc --noEmit; also run the help-drift guard since usage text changes Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
+| TEN-GATES-04 | TS-callable app boot and HTTP health probe over app-runner.sh | loki-ts/src/util/app_probe.ts (new), loki-ts/tests/util/app_probe.test.ts (new) | MEDIUM | see Wall in note | ready@2026-10-17T01:40Z | SPLIT per CTO critic into (a) app boot and health, (b) functional-verify run and artifact write; build as two commits or two agents. wave 2; depends: none. Goal: New loki-ts/src/util/app_probe.ts (justification: no TS module owns app boot; app-runner.sh is bash-only and deep.ts:121-122 names this missing surface). appProbe(repoDir, lokiDir, {specText?, timeoutMs}) sources autonomy/app-runner.sh in a bash child (token-free env via plainTestEnv), runs app_runner_init, app_runner_start, app_runner_health_check, reads .loki/app-runner/health.json, then (when specText given) runs autonomy/lib/functional-verify.py against the URL and writes .loki/quality/functional-results.json in the shape proof-generator.py:841-870 reads. ALWAYS calls app_runner_stop in finally (stops only the PID app-runner recorded). Returns ReceiptCheck-shaped results: 'app boot' and 'http probe' with result pass/fail/not_run and reason; missing runtime or no app detected = not_run, never fail. Wall: Red first: fixture repo with a static index.html (app-runner static-site path, as tests/test-app-runner-static-site.sh) -> app boot pass + health.json ok; fixture whose start command exits 1 -> fail; empty repo -> not_run. Assert no process left on the recorded PID after return. Mutation: drop the stop call -> leftover-PID assertion red. Gate: cd loki-ts && bun test tests/util/app_probe.test.ts && bun test && bunx tsc --noEmit; register the new test file per the structural guards (select-tests.sh --guards-only rows, shard registration) Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
+| TEN-GATES-05 | Spec-derived API auth probe in functional-verify.py | autonomy/lib/functional-verify.py, tests/test_functional_verify.py | HIGH | see Wall in note | building@2026-10-17T02:42Z | wave 1; depends: none. Goal: Extend functional-verify.py (owner of spec-derived HTTP probing) so derive_endpoint_assertions also tags endpoints the spec marks protected (requires auth/login/authenticated/admin only/protected, on the same line or section as the METHOD path). For each, probe unauthenticated: 401/403 -> passed; 2xx with body -> failed ('served without credentials'); unreachable/5xx -> inconclusive. Results go under auth_behaviors in the existing output and feed summary/functional_status (a failed auth behavior makes status failed). Does not touch playwright-verify.sh's functional-proof.json (browser routes stay there). Wall: Red first in tests/test_functional_verify.py with an in-process http.server fixture: spec says 'GET /api/admin requires auth'; server returns 200 -> failed; returns 401 -> passed; no protected wording -> no auth behavior; server down -> inconclusive, never passed. Mutation: treat 2xx as passed -> red. Gate: python3 -m pytest -q tests/test_functional_verify.py tests/test_proof_generator.py; bash tests/test-backend-floor.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
+| TEN-GATES-06 | Deep verify: real app boot and secure-scan rules on engine10 | loki-ts/src/engine10/stages/deep.ts, loki-ts/tests/engine10/deep.test.ts | HIGH | see Wall in note | ready@2026-10-17T01:40Z | wave 3; depends: TEN-GATES-04, Q18-04 (deep.ts in flight). Goal: Replace runAppBoot's hard-coded not_run (deep.ts:105-130) with a call to util/app_probe.ts, pushing its 'app boot' and 'http probe' checks; extend the existing 'security scan' check to also run autonomy/lib/secure-scan.py over changed files (HIGH active finding = fail, scanner absent = not_run). DEEP_NOT_PROVEN entries clear only for checks that actually ran. Net-zero lines in engine10 core (app boot body shrinks to the call). Wall: Red first in deep.test.ts: injected appProbe fake returning pass -> 'app boot' check result pass (today always not_run); a changed file with a committed PEM private key -> security scan fail with secure-scan rule id; secure-scan missing -> not_run. Mutation: ignore secure-scan exit -> red. Gate: cd loki-ts && bun test tests/engine10/deep.test.ts tests/engine10/deep_wiring.test.ts tests/engine10/budget.test.ts && bun test && bunx tsc --noEmit Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
+| TEN-GATES-07 | loki start route: collect app health and functional facts before the proof | loki-ts/src/runner/proof.ts, loki-ts/tests/runner/proof.test.ts | MEDIUM | see Wall in note | ready@2026-10-17T01:40Z | wave 3; depends: TEN-GATES-04. Goal: In runner/proof.ts, before spawning proof-generator.py, call util/app_probe.ts with the run's PRD text (LOKI_PROOF_APP_PROBE=0 opts out) so .loki/app-runner/health.json and .loki/quality/functional-results.json exist on the primary route; the proof's healthcheck and functional facts stop being permanently not_run. Still never throws; probe failure leaves the facts absent (not_run), never fabricated. Wall: Red first in proof.test.ts: inject a fake probe that writes both artifacts -> generator facts.healthcheck/functional ran=true; probe throwing -> generator still invoked, facts not_run. Mutation: skip probe -> red. Gate: cd loki-ts && bun test tests/runner/proof.test.ts tests/runner/proof_run_id_pointer.test.ts && bun test && bunx tsc --noEmit Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
+| TEN-GATES-08 | loki start route: secure-scan as an exogenous security_scan gate | loki-ts/src/runner/quality_gates.ts, loki-ts/tests/runner/quality_gates.test.ts | MEDIUM | see Wall in note | ready@2026-10-17T01:40Z | wave 2; depends: none. Goal: Port run.sh:13407 run_secure_scan to quality_gates.ts as gate 'security_scan' (GateName union, readToggles LOKI_GATE_SECURITY_SCAN default on, orchestrator list at :3192): runs autonomy/lib/secure-scan.py, writes .loki/quality/security-findings.json in the shape proof-generator.py:765-830 reads, fails on an active HIGH finding, inconclusive (passed true + inconclusive) when python3 or the scanner is absent. Name stays off _ADVISORY_GATES so it counts exogenous. Wall: Red first: fixture tree with a committed PEM private key -> gate fails and security-findings.json high_active>=1; clean tree -> pass with status clean; LOKI_SECURE_SCAN path to a missing file -> inconclusive true. Mutation: ignore HIGH severity -> red. Gate: cd loki-ts && bun test tests/runner/quality_gates.test.ts tests/runner/quality_gates_inconclusive.test.ts tests/gate-failures-cap-parity.test.ts && bun test && bunx tsc --noEmit; bash tests/test-secure-scan.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
+| TEN-GATES-09 | loki start route: write build-results.json (wire the dead pythonBuildCheck) | loki-ts/src/util/python_build_check.ts, loki-ts/src/runner/autonomous.ts, loki-ts/tests/util/python_build_check.test.ts | MEDIUM | see Wall in note | ready@2026-10-17T01:40Z | wave 1; depends: none. Goal: Extend util/python_build_check.ts with buildFact(tree) covering a package.json build script (npm run build --if-present, token-free env, timeout LOKI_GATE_TIMEOUT) and the existing pythonBuildCheck arm, plus writeBuildResults(lokiDir, fact) emitting {command, exit_code, ran, duration_sec, status} as proof-generator.py:547-595 reads. Call it once from autonomous.ts right before maybeGenerateProof (autonomous.ts:499). Stacks with no build -> not_applicable, never verified. Wall: Red first: fixture with package.json build script 'exit 1' -> status failed; 'exit 0' -> verified; python tree with a syntax error -> failed; empty tree -> not_applicable; written JSON parses with the keys proof-generator reads. Mutation: map exit!=0 to verified -> red. Gate: cd loki-ts && bun test tests/util/python_build_check.test.ts && bun test && bunx tsc --noEmit Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
+| TEN-GATES-10 | Proof headline: VERIFIED needs one agent-independent fact beside the agent's suite | autonomy/lib/proof-generator.py, tests/test_proof_generator.py, docs/v10/DECISIONS.md | HIGH | see Wall in note | ready@2026-10-17T01:40Z | wave 4; depends: COST-WALL-f (proof-generator.py in flight), TEN-GATES-07, TEN-GATES-08, TEN-GATES-09 (facts must exist before tightening, or every primary-route run downgrades). Goal: In proof-generator.py the tests_verified branch (:2045-2055) returns VERIFIED only when at least one exogenous fact also passed: build verified, healthcheck ok, functional passed, security clean that actually ran, or an exogenous quality gate passed; otherwise VERIFIED WITH GAPS with degraded item 'no agent-independent evidence (only the agent's own test suite passed)'. Gap record is additive; LOKI_PROOF_REQUIRE_EXOGENOUS=0 opt-out; decision recorded in DECISIONS.md under D99. Wall: Red first in test_proof_generator.py: facts with tests verified + nonempty diff and nothing else -> 'VERIFIED WITH GAPS' plus the degraded item (today VERIFIED); add build verified -> VERIFIED; only an advisory code_review pass -> still WITH GAPS. Mutation: count advisory gates as corroboration -> red. Gate: python3 -m pytest -q tests/test_proof_generator.py tests/test_proof_degraded_disabled_gates.py tests/test_proof_verify.py; bash tests/test-proven-pr-receipt.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
+| TEN-STABILITY-01 | bench-suite argv survives hyperfine 1.20 (unblocks v11.17.6 backstop) | loki-ts/scripts/bench-suite.ts; NEW loki-ts/tests/scripts/bench_suite_argv.test.ts (no existing test owns bench-suite.ts: grep -rl bench-suite loki-ts/tests tests returns nothing) | LOW | see Wall in note | merged@2026-10-17T02:35Z | merge d67b2af14, dist bd6348d77; TL APPROVE f1bcf7679 (4 pass, typecheck rc=0); post-merge tsc 0 errors, 130 pass. wave 1; depends: none. Goal: Stop building 'VAR=1 cmd' hyperfine commands. Pass the env as 'env LOKI_LEGACY_BASH=1 <shim> <cmd>' (also 'env BUN_FROM_SOURCE=1'), which works on apt hyperfine 1.18 and brew 1.20 alike. Export a pure argv builder from the script so it can be tested. Write the --export-json files under a mkdtemp dir, not fixed /tmp/bench-*.json paths. Exit non-zero when any command is SKIPPED because hyperfine itself refused the argv, not only when every command was skipped. Wall: RED: the test puts a fake 'hyperfine' on PATH that exits 1 with the real 1.20 message when any positional command matches ^[A-Z_]+=. It runs the builder and fails today, because both benchPair (bench-suite.ts:76) and benchRoute (:108) emit LOKI_LEGACY_BASH=1 first. GREEN after the fix. MUTATION: revert one call site to the VAR= form; the test goes red. A second mutation: a partial SKIP must exit 1. GATE: cd loki-ts && bun test tests/scripts/bench_suite_argv.test.ts && bun run typecheck && bun test (full, per the slice-gate rule). Then run real hyperfine locally: cd loki-ts && bun run scripts/bench-suite.ts --runs 1 --warmup 0 (hyperfine 1.20.0 is installed on this machine) must print no 'Cannot run'. After merge: gh workflow run nightly.yml, and the macOS 1.3.13 leg must be green. Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
+| TEN-STABILITY-02 | promote.yml walks back to the newest promotable next build (D96 exact-SHA rule) | .github/workflows/promote.yml (Derive and validate version, Require a green nightly, Require a green Post-Release Smoke steps); tests/test_release_next_tag.py (nightly-gate and version-derivation cases); tests/test-promote-smoke-sha.sh; docs/v10/DECISIONS.md (one D102 entry) | HIGH | see Wall in note | ready@2026-10-17T01:40Z | SPLIT per CTO critic into (a) pure candidate-enumeration script with tests, (b) promote.yml wiring plus DECISIONS entry; build as two commits or two agents. wave 2; depends: none to build; real-world promotion of 11.17.x needs TEN-STABILITY-01 merged and one green nightly. Goal: Replace the 'newest next only' choice with a candidate walk. List versions published to next that are newer than latest (from npm view loki-mode time --json plus each gitHead; cap 25, newest first). Pick the first version that meets all three: (a) its gitHead is on main, (b) the newest MEASURED nightly at exactly that SHA concluded success, (c) its Post-Release Smoke at that SHA is green. A red nightly on a descendant no longer vetoes an older green SHA, and a red at the SHA itself still does. Every existing check re-runs for the chosen version before any dist-tag moves: never-lower, annotated tag, first-run gate and channel preflights. Fail closed when no candidate qualifies, and print one PROMOTE-BLOCK line per candidate. Record the policy change as D102 under the D99 grant. The descendant-veto relaxation supersedes the CTO P1 ruling at promote.yml:193. Wall: RED: a new test_release_next_tag.py case. Fixture: next=11.17.10 (nightly red at its SHA), 11.17.6 (nightly green at its SHA, smoke green), latest=11.10.1. Today the extracted step picks 11.17.10 and blocks. GREEN: it selects 11.17.6. More cases: a red AT the candidate SHA still blocks; a dedupe-skipped run is not a measurement (keep test_skipped_dedupe_* green); an API failure fails closed; a candidate lower than latest is never chosen; a candidate whose gitHead is off main is skipped. MUTATION: drop the exact-SHA red check and the 'red at SHA blocks' case goes red. Drop the never-lower check and its case goes red. GATE: python3 -m pytest -q tests/test_release_next_tag.py tests/test_release_required_ci.py && bash tests/test-promote-smoke-sha.sh && bash tests/test-promote-head-stamp.sh && bash tests/test-workflow-no-masked-failures.sh. Then a real gh workflow run promote.yml on main after TEN-STABILITY-01 lands. Opus HIGH reviewer, unanimous (D12). Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
+| TEN-STABILITY-03 | pre-push runs the R8 global guard rows on every push to main | .githooks/pre-push; tests/test-pre-push-hook.sh | MEDIUM | see Wall in note | ready@2026-10-17T01:40Z | wave 2; depends: none (TEN-STABILITY-04 adds rows; the hook reads the tsv at run time). Goal: On a push whose remote ref is refs/heads/main, run 'bash scripts/impacted-gate.sh --guards-only' against the pushed tip in a clean detached worktree. Reuse release.sh's worktree pattern: per-row timeout, run-owned tmp via loki_run_tmp_create. Place it before the PRE_PUSH_SKIP exit, next to the release-notes and gitleaks gates, so routine PRE_PUSH_SKIP=1 merge pushes cannot skip it. A red row aborts the push and names the row. LOKI_PREPUSH_SKIP_GUARDS=1 is the only bypass and prints a loud warning. Branch pushes and deletes are untouched. Target time is under 120s with IMPACTED_JOBS=4. Over 180s fails closed with a timeout message, never passes silently. Wall: RED: test-pre-push-hook.sh gains a case where a stub impacted-gate (IMPACTED_TEST_MODE=1 with an IMPACTED_SUITES_FILE listing a failing suite) is red and stdin carries refs/heads/main with LOKI_RELEASE_MANAGER=1 PRE_PUSH_SKIP=1. Today the hook exits 0; after the fix it exits 1 and names the row. GREEN cases: all rows green gives exit 0; a branch push never invokes the gate; the bypass env warns and exits 0; a gate timeout gives exit 1. MUTATION: move the block after the PRE_PUSH_SKIP check and the PRE_PUSH_SKIP case goes red. GATE: bash tests/test-pre-push-hook.sh && bash tests/test-pre-push-gitleaks.sh && shellcheck .githooks/pre-push && bash tests/test-no-tmp-sweep.sh. Then time it: time bash scripts/impacted-gate.sh --guards-only on main must stay under 180s, or re-slice. Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
+| TEN-STABILITY-04 | global-guards.tsv covers every repo-wide guard that reached main red | scripts/global-guards.tsv; tests/test-select-tests.sh | LOW | see Wall in note | merged@2026-10-17T02:45Z | merge 3e542a7fc; TL APPROVE 07aa41ad1 (select-tests 117/0, fast-gate 25/0, shard-coverage 19/0). wave 1; depends: none. Goal: Add as R8 rows the repo-wide guards that turned main red on 2026-10-16 even though no slice diff selected them: - tests/cli/test-completions-coverage.sh - loki-ts/tests/engine10/budget.test.ts - loki-ts/tests/engine10/l2_destructive_registry.test.ts - loki-ts/tests/engine10/pr_body_golden.test.ts - loki-ts/tests/commands/cli_help_routes.test.ts - tests/test-select-tests.sh (FC-89 walker markers) Also add a meta-assertion to test-select-tests.sh: every loki-ts test file that carries '// select: walk-all-src' is either an R8 row or selected by R-rules for any loki-ts/src diff. A new repo-wide guard then cannot silently stay out of R8. Wall: RED: a new test-select-tests.sh case asserts that --guards-only lists each of the 6 targets. It fails today because they are absent from the 17 rows. GREEN after adding the rows. MUTATION: delete one row and its case goes red. Add a fixture walker test without an R8 row and the meta-assertion goes red. GATE: bash tests/test-select-tests.sh && bash tests/test-fast-gate.sh && bash tests/test-shard-coverage.sh. Then time bash scripts/impacted-gate.sh --guards-only and record the added seconds in tests/shard-durations.tsv only if a row is new there. The fast-gate plan for a docs-only diff must stay under 60s per shard. Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
+| TEN-STABILITY-05 | WC-01b wall_concurrent stops racing the 5s bun timeout | loki-ts/tests/engine10/wall_concurrent.test.ts | LOW | see Wall in note | merged@2026-10-17T02:45Z | merge 516e4a4f1; TL APPROVE 5fa97f2d5 (13/0 x3, 13/0 under 12x load at --timeout 1500). wave 1; depends: none. Goal: Make the WC-01b suite hermetic and fast. Build the git fixture once in beforeAll: copy a template repo per test instead of running git init, add and commit per test (wall_concurrent.test.ts:15-20). Give the concurrency case an explicit timeout sized from measured CI duration, and keep every assertion unchanged. Cause measured in nightly 38938949858: 5004.82ms against the 5000ms default. Wall: RED: cd loki-ts && bun test --timeout 1500 tests/engine10/wall_concurrent.test.ts fails today on this machine under 'yes > /dev/null' x4 CPU load (record the measured ms). GREEN: the same command passes after the fixture change, and plain bun test passes 20/20 in a loop: for i in $(seq 20); do bun test tests/engine10/wall_concurrent.test.ts // break; done. MUTATION: swap the expected order of implement:start and author:end and the test still fails, so the assertion is intact. GATE: cd loki-ts && bun run typecheck && bun test (full). Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
+| TEN-STABILITY-06 | pulse PROMOTION_LAG violation with the blocking reason | scripts/v10-pulse.sh; tests/test-v10-pulse.sh | MEDIUM | see Wall in note | building@2026-10-17T02:36Z | wave 1; depends: none. Goal: In the npm section of v10-pulse.sh (near :830-863), emit 'VIOLATION PROMOTION_LAG' when next != latest and latest's publish time is more than 6h older than next's (threshold set by LOKI_PULSE_PROMOTION_LAG_H). Include the first PROMOTE-BLOCK or FATAL line from the newest non-skipped Promote run (gh run list -w Promote, then gh run view --log-failed). Also include the failing step names of the newest measured Nightly. The CoS acts on the top violation each turn, so a red bench is triaged within one turn instead of 13h. Fail soft: an API error prints UNKNOWN and never crashes the pulse. Wall: RED: test-v10-pulse.sh gains a fixture with stubbed npm and gh: latest 11.10.1 published 2026-10-15T00:00Z, next 11.17.6 published 2026-10-16T23:40Z, and Promote log containing 'PROMOTE-BLOCK: the newest nightly at the promoted SHA ... is failure'. Expect a PROMOTION_LAG line carrying that reason; today none is printed. GREEN cases: next==latest gives no violation; lag under the threshold gives none; gh failure gives UNKNOWN with rc 0. MUTATION: invert the threshold comparison and both lag cases go red. GATE: bash tests/test-v10-pulse.sh && shellcheck scripts/v10-pulse.sh && bash scripts/v10-pulse.sh on the real repo prints the violation today (latest 11.10.1 vs next 11.17.6). Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
+| TEN-STABILITY-07 | nightly classifies flips vs stable reds across same-SHA legs | .github/workflows/nightly.yml (new flake-classify job only); scripts/nightly-flake-tracker.sh (--gh-run mode); tests/test-nightly-flake-tracker.sh | MEDIUM | see Wall in note | ready@2026-10-17T01:40Z | wave 2; depends: none (TEN-STABILITY-01 only matters for a green run). Goal: Add one nightly.yml job, flake-classify (needs all test jobs, if: always(), never sets the run conclusion). It downloads the bun-test job logs of this run via gh api. The 3-4 bun legs run identical loki-ts tests at one SHA. It feeds the logs to scripts/nightly-flake-tracker.sh and writes FLIP and STABLE-FAIL lines plus the BOARD: slice lines to the step summary. Extend the tracker with a '--gh-run RUN_ID' fetch mode so the workflow holds no parsing logic. Experimental bun=latest legs are labelled so a flip there is reported as drift. Wall: RED: test-nightly-flake-tracker.sh gains a --gh-run case with a stub gh serving two job logs at one SHA. In one log WC-01b is (pass), in the other it is (fail) [5004.82ms]. Expect 'FLIP <sha7> WC-01b'. Today --gh-run is a usage error (exit 2). GREEN: FLIP printed, exit 1; with both logs failing, STABLE-FAIL is printed. MUTATION: make the tracker ignore the [ms] suffix strip, and the FLIP case goes red. GATE: bash tests/test-nightly-flake-tracker.sh && bash tests/test-workflow-no-masked-failures.sh && python3 -m pytest -q tests/test_release_next_tag.py (nightly structure cases) && actionlint .github/workflows/nightly.yml if installed. The new job name must not start with 'Full suite (backstop)' (promote.yml:185 counts that prefix). Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
+| TEN-FC-ROWS | FAILURE-CLASSES rows for every TEN bug-fix slice lacking one (QUALITY-01/02/03/07, COST-06, DEPLOY-08, STABILITY-01/05, UX-02) | docs/v10/FAILURE-CLASSES.md | LOW | bash tests/test-structural-checks.sh | merged@2026-10-17T02:35Z | merge 8cdb33633, dist bd6348d77; TL APPROVE 7e6f47482 (structural 25/0); post-merge tsc 0 errors, 130 pass. wave 1; CTO critic MISSING item. One row per class with user-visible vs raw, law broken, siblings, mechanism, fixture. Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
+| TEN-CORE-TRIM | Free engine10 core headroom (4964 of 5000) by moving pure helpers out of engine10 into src/util with no behavior change | loki-ts/src/engine10/*, loki-ts/src/util/* | MEDIUM | cd loki-ts && bun test tests/engine10/ tests/runner/spawn_env_guard.test.ts && bunx tsc --noEmit | merged@2026-10-17T02:35Z | merge 096174f2a, dist bd6348d77; TL APPROVE f0f82a4e8 (core 4931/5000, 143 pass); post-merge tsc 0 errors, 130 pass. wave 1; CTO critic MISSING item. Target at least 60 lines freed; budget guard must stay green; no logic change. Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
+| TEN-SECURE-SCAN-UTIL | One util/secure_scan.ts wrapper over secure-scan.py shared by TEN-GATES-06 and TEN-GATES-08 | loki-ts/src/util/secure_scan.ts (new: no TS owner of secure-scan.py exists), loki-ts/tests/util/secure_scan.test.ts | MEDIUM | cd loki-ts && bun test tests/util/secure_scan.test.ts && bunx tsc --noEmit | merged@2026-10-17T02:25Z | merge 47a9e4aae, dist none; TL APPROVE 3c1ce036d (9 pass, tsc rc=0). wave 1; CTO critic MISSING item. Removes the duplicate wrappers the CTO critic found. Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
+| TEN-BADGE-UTIL | One verdict-to-shields-colour badge helper reused by status --badge, proof badge and share badge | autonomy/loki (existing share badge at about 38261-38315), tests/test-share-badge.sh or the existing badge test | LOW | bash tests/test-cli-commands.sh | merged@2026-10-17T02:25Z | merge 8bdf1e7fd; TL APPROVE a7e86caa0 (test-cli-commands 37/0, test-share-command 8/0). wave 1; CTO critic MISSING item. Replaces three badge makers with one. Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
+| TEN-STABILITY-08 | Pin hyperfine in nightly.yml and allow re-measuring a SHA whose nightly failed (dedupe at nightly.yml:78-82) | .github/workflows/nightly.yml | MEDIUM | actionlint .github/workflows/nightly.yml | merged@2026-10-17T02:35Z | merge 488bc9771, dist bd6348d77; TL APPROVE 7a2843888 (actionlint rc=0, cache-scope 13/0, pins sha256-checked); post-merge tsc 0 errors, 130 pass. wave 1; CTO critic MISSING item. Without re-measure, one flake makes a SHA unpromotable forever. Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
+| TEN-DEPLOY-01b | deploy --execute non-canary path streams provider output live (tee to a run-owned temp file) while still capturing the URL | autonomy/loki; tests/test-deploy-receipt-gate.sh | LOW | bash tests/test-deploy-receipt-gate.sh | ready | TL APPROVE ef7aa20c8 but conflicts with TEN-DEPLOY-01 (60a9bb709) in autonomy/loki _deploy_try_execute; rebase on main and re-review. Reviewer note: mktemp should use the run-owned tmp dir. Follow-up from TEN-DEPLOY-01 TL review: autonomy/loki:10373 buffers provider output until exit, so progress no longer streams. |
+| TEN-UX-02b | Run summary auth-failure next step uses the active provider's login or requirementFix line instead of hardcoded claude login | loki-ts/src/util/run_summary.ts; loki-ts/tests/util/run_summary.test.ts | LOW | cd loki-ts && bun test tests/util/run_summary.test.ts | merged@2026-10-17T02:35Z | TL APPROVE 9a3d118d2, merge 672b74c79. Follow-up from TEN-UX-02 TL review: run_summary.ts:66 tells codex and cline users to run claude login. |

package/docs/v10/FAILURE-CLASSES.md

@@ -913,3 +913,66 @@ L0 review rule (ENGINE-LAWS.md L0): a fix that adds an `if` or a regex about the
 - Siblings to sweep: every test that asserts a repo-local git config value runs (fsmonitor, filter, ssh, credential, uploadpack).
 - Mechanism: hermeticGit wrapper in fc25_safe_git.test.ts removes GIT_SSH, GIT_SSH_COMMAND, GIT_CONFIG_PARAMETERS and GIT_CONFIG_COUNT/KEY/VALUE for the test and restores them after.
 - Fixture: the same file run with GIT_SSH_COMMAND=false GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=credential.helper GIT_CONFIG_VALUE_0= passes 14/0.
+
+## FC-TEN-QUALITY-01 The fix session gets a bare check name with no assertion text (FIX-BRIEF-BLIND)
+- User-visible vs raw: the user saw fix rounds repeat or stall on a failing test. Raw pytest printed `E assert 4 == 5`; the fix brief carried only the check name and the rerun command.
+- Law broken: L4 (the fixer must see the evidence the verifier saw).
+- Siblings: every runner whose decisive block differs: pytest `E ` lines, jest/vitest Expected/Received, node AssertionError, go `--- FAIL`, tsc/ruff diagnostics; holdout checks must stay hidden.
+- Mechanism: one failureExcerpt() in util/check_result.ts (redacted, repo-relative, at most 1500 bytes per check, 6 KB total), held in a stage-local map in verify.ts. It is never part of the check signature, never emitted in test.result, never computed for holdout checks.
+- Fixture: fix.test.ts (failing pytest `assert add(2,2) == 5`), check_result.test.ts (one fixture per runner plus size cap and AKIA redaction), wall_holdout.test.ts (holdout text absent from failures_grouped, events and brief).
+
+## FC-TEN-QUALITY-02 Pre-existing lint cannot be told apart from lint the change introduced (LINT-NO-BASELINE)
+- User-visible vs raw: the user saw a fix loop spending rounds on lint that was already in the repo. Raw base output showed the same diagnostics before the change.
+- Law broken: L4 (attribution must compare head to base, as tests already do via attribute()).
+- Siblings: ruff concise, shellcheck gcc, eslint unix parsers; tsc is out of scope; a file new on head has no base.
+- Mechanism: one pure attributeStatic(tool, headOut, baseOut) in runner/repo_profile.ts next to attribute() and attributeFullSuite(). Multiset keyed path/code/message (line and column dropped). Fails closed: unparseable head, empty parse with non-zero exit, missing base and unknown tool all count as introduced.
+- Fixture: harness_intelligence.test.ts cases for same, extra, changed-message, shifted-line, garbage and null-base inputs, plus a recorded real sample per parser.
+
+## FC-TEN-QUALITY-03 A pre-existing lint failure drives fix rounds because verify never asks the baseline (LINT-DRIVES-FIX)
+- User-visible vs raw: the user saw lint:ruff in failures_grouped for a file whose base already failed it. Raw base content run through the same tool gave the same diagnostics.
+- Law broken: L4, and the one-mechanism rule (tests already excuse pre-existing failures via attr.preExistingChecks / preRed.names).
+- Siblings: ruff, shellcheck, eslint per-file checks; tsc stays untouched; files new on head are never excused.
+- Mechanism: runLintChecks in verify.ts feeds base content on stdin to the tool and calls attributeStatic from QUALITY-02, joining the existing preExistingChecks path (at most 4 core lines).
+- Fixture: verify_lint.test.ts with a repo fixture and a stub ruff: base has the unused import (excused), head adds a new one (still reported), a new-file F401 (never excused).
+
+## FC-TEN-QUALITY-07 The fix brief says the diff is unavailable because its only reader has no writer (DEAD-DIFF-STAT)
+- User-visible vs raw: every real fix brief read "(diff stat is not available)". The working tree had the changed files.
+- Law broken: reader/writer key contract: fix.ts:62 reads prior.implement.diff_stat and no stage writes it.
+- Siblings: buildFixBrief and buildFixResumeBrief both consume the diff; any other reader of implement.diff_stat.
+- Mechanism: one currentDiff(repoDir, baseSha, maxBytes=6000) in runner/session_resume.ts via safeGit, computed fresh each fix round; excludes .loki/, names untracked files without touching the index, truncates with an explicit note.
+- Fixture: fix.test.ts and fix_resume.test.ts: temp repo with a modified file and no diff_stat shows "1 file changed"; round 2 shows the hunk; .loki/ never appears; a 50 KB diff cuts at 6000 bytes with the note.
+
+## FC-TEN-COST-06 The xreview claude judge spends tokens with lean flags off and no ledger line (XREVIEW-UNMETERED)
+- User-visible vs raw: cost totals omitted the cross-review judge. Raw claude calls ran with full settings and no child-session line.
+- Law broken: cost accounting must cover every model call (see FC-COST-PARTIAL).
+- Siblings: the codex argv (unchanged); other stages that spawn claude children and already use withChildLedger.
+- Mechanism: reviewArgv adds leanReviewerFlags() and --output-format json for claude; the run is wrapped in withChildLedger(run, lokiDir, 'xreview'). Verdict rules unchanged: no VERDICT line or bad JSON is not_run, never PASS.
+- Fixture: xreview.test.ts: argv contains the lean flags and json format; a stubbed run writes a phase xreview line to .loki/metrics/child-sessions.jsonl; JSON `VERDICT: BLOCK` parses to block; non-JSON gives not_run.
+
+## FC-TEN-DEPLOY-08 The web app reports a deployed URL it never obtained and stages everything on push (DEPLOY-FABRICATED-URL)
+- User-visible vs raw: a deploy with no URL in its output returned `https://vercel.app` as success. Raw provider output had no URL, and no receipt gate ran.
+- Law broken: a success claim must key on a parsed confirmation (fallback success is a false ack); the CLI deploy gate is the only path.
+- Siblings: deploy_session and github_push_session in web-app/server.py; hardcoded netlify.app and github.io fallbacks; the bulk-stage and `--public` push path; web-app consumers of url.
+- Mechanism: both handlers call the gated CLI (`loki deploy --execute --dir <dir>`, `loki github publish`) as argv lists and read the newest .loki/deploys record; url is deployed_url or null; refusals return 4xx with reasons.
+- Fixture: web-app/tests/test_server.py with monkeypatched subprocess; a grep for the three fallback URLs in server.py must exit 1.
+
+## FC-TEN-STABILITY-01 bench-suite builds VAR=1 hyperfine commands that hyperfine 1.20 refuses (BENCH-ARGV-ENV)
+- User-visible vs raw: the v11.17.6 backstop went red. Raw hyperfine 1.20 refused any positional command matching ^[A-Z_]+=, and the script skipped those commands without failing.
+- Law broken: a gate that skips its own work must fail, not pass quietly.
+- Siblings: benchPair and benchRoute call sites in loki-ts/scripts/bench-suite.ts; fixed /tmp/bench-*.json export paths; partial SKIP exit code.
+- Mechanism: one exported pure argv builder emits `env LOKI_LEGACY_BASH=1 <shim> <cmd>` (works on hyperfine 1.18 and 1.20); exports go under a mkdtemp dir; any SKIPPED command exits non-zero.
+- Fixture: loki-ts/tests/scripts/bench_suite_argv.test.ts with a fake hyperfine on PATH that exits 1 with the 1.20 message on a VAR= command.
+
+## FC-TEN-STABILITY-05 wall_concurrent races the 5s bun test timeout (WC-TIMEOUT-RACE)
+- User-visible vs raw: nightly 38938949858 failed. Raw duration was 5004.82ms against the 5000ms default; assertions were correct.
+- Law broken: a test must be hermetic and not depend on machine speed.
+- Siblings: other engine10 suites that init, add and commit a repo per test.
+- Mechanism: build the repo fixture once in beforeAll and copy it per test; give the concurrency case an explicit timeout sized from measured CI duration; every assertion unchanged.
+- Fixture: `bun test --timeout 1500 tests/engine10/wall_concurrent.test.ts` under CPU load, and a 20-run loop of the plain command.
+
+## FC-TEN-UX-02 Every failed start prints the same generic Next line (NEXT-NOT-SPECIFIC)
+- User-visible vs raw: auth failure, credit exhaustion, a failed check, a spec conflict and a stall all told the user `loki doctor` or `loki undo`. Raw reason strings from output.ts reasonOf name the actual cause.
+- Law broken: the failure message must name the exact fix for the cause that happened.
+- Siblings: every literal reason produced by reasonOf (output.ts:74); the supervisor call site that passes the reason.
+- Mechanism: nextOf in util/run_summary.ts takes reason and outcome and maps each failure class to one command; verified, done-unverified, budget and stopped output stays byte-identical.
+- Fixture: run_summary.test.ts table rows copied from the real reason literals, a pin of the old outputs, and a source scan that every reasonOf literal has a mapping; tests/features/contract.test.ts covers fatal:auth end to end.

package/docs/v10/PROGRESS.md

@@ -2408,3 +2408,5 @@ The swarm is stopped: .loki/V10-STOP exists, the loop has no wake-ups, and the c
 - 2026-10-17T00:50Z v11.17.9: v11.17.8 never published (Tests run 38986362613 red on 7fc08f186, only suite tests/test-real-run.sh, fixture receipt lacked the pinned node:sum.test.js check). Fixed in 500b71e85; test-real-run.sh rc=0 (13 PASS), test-wall-executed-guard.sh rc=0. Also merges Q17-03 (TL APPROVE 3dec444fa, 4157 pass 0 fail), COST-WALL-b (HIGH APPROVE ddab3e714, pytest 15 passed, mutation caught) and Q18-01 (HIGH APPROVE dbb93205a, bun test 289 pass, guard mutations 6/6 caught). Bumped with LOKI_RELEASE_ALLOW_RED=1 (HEAD had no green Tests run). C-F1 2x cost claim still unproven: benchmark adapter ignores cost_partial (follow-up COST-WALL-d).
 - 2026-10-17T01:10Z v11.17.10: v11.17.9 never published (Tests run 38988194257 red on bf3d2ae24: 2 FC-25c(a) controls failed because withholdGithubTokens callers left GIT_SSH_COMMAND=false and a GIT_CONFIG_COUNT credential.helper reset in process.env). Fixed in 3c3f2c9e0 (hermeticGit wrapper); old file under those 4 vars reproduces 2 fail, fixed file 14 pass 0 fail. Ships Q17-01, COST-WALL-c, COST-WALL-d, M-25w-b, M-25w-c, FC-09w, Q18-06 (HIGH r2 APPROVE), Q18-05 (HIGH APPROVE). Pending: Q18-03b and FC-09x approved, merge next; COST-WALL-e and Q17-02 blocked r1, fixing; 2x cost claim still unproven.
 - 2026-10-17T01:30Z v11.17.11: ships Q18-03b (merge 31e4f4b47) FC-09x (merge b97c1e635, dist 2eeec3851) and COST-WALL-e (HIGH r2 APPROVE 439ed90e3, 132 passed). Founder asked for 10/10 on every competitive axis; architect workflow wrixi4afj is slicing COST, QUALITY, DEPLOY, UX, GATES, STABILITY and ADOPTION into board rows. Q17-02 r1 fix 11eac46fa in TL r2 review.
+- 2026-10-17T02:00Z v11.17.12: v11.17.11 published (npm next 11.17.11, Tests and Release green on df98addc8). Ships Q18-05b (TL APPROVE 82058ff97, merge ae90c2875) and COST-WALL-f (HIGH r2 APPROVE ef9979ad8, merge 3d0587f4f). Q18-03c parked after 2 rounds (regex-literal strip regression), continued as Q18-03d. 64 TEN rows on BOARD; wave 1 batches A and B building.
+- 2026-10-17T02:30Z v11.17.13: v11.17.12 (42315dc52) Tests red on one stale assertion in tests/test_cost_summary.py (1 failed, 3825 passed on Python 3.10 and 3.13), so Release skipped publish; fix-forward f5b1d1681. First v11.17.13 bump refused on 2 red global guard rows (l0 allowlist after CORE-TRIM, completions coverage newly promoted by STABILITY-04), fixed 6f2355aa7. TEN-UX-02b merged 672b74c79; TEN-DEPLOY-01b conflicts with DEPLOY-01, back to ready. Ships v11.17.12 content plus Q18-07, Q18-11, Q17-02, Q18-03d and 12 TEN wave 1 rows (DEPLOY-01, UX-02, COST-02, COST-03, STABILITY-01/04/05/08, FC-ROWS, CORE-TRIM, SECURE-SCAN-UTIL, BADGE-UTIL), each with a TL or HIGH APPROVE. Batches E, F, G and Q18-04/Q18-02b r2 building.