loki-mode 11.17.16 → 11.17.19

package/docs/v10/BOARD.md

@@ -404,45 +404,45 @@ set is declared to avoid overlap with those and with each other.
 | M-25 | Final report and verdict (COMPLETE only if all proven), sealed | loki-ts/src/engine10/modernize/report.ts, loki-ts/tests/engine10/modernize/report.test.ts | HIGH | cd loki-ts && bun test tests/engine10/modernize/report.test.ts | released@2026-10-16T02:40Z | Source: MODERNIZE.md (D30). Depends on M-13, M-21. |
 | M-26 | End-to-end: py2 fixture repo modernized with stub provider | loki-ts/tests/engine10/modernize/e2e.test.ts, loki-ts/tests/engine10/modernize/fixtures/e2e_py2/ | MEDIUM | cd loki-ts && bun test tests/engine10/modernize/e2e.test.ts | released@2026-10-16T22:45Z | Source: MODERNIZE.md (D30). Depends on M-08, M-22, M-25. Reconciled 2026-10-16: shipped as ea6d2eef8 (ancestor of main c89555bce). |
 | M-27 | Legacy-Bench pilot harness; confirm public set; calibrate cap | eval/modernize/pilot.py, eval/modernize/test-pilot.sh | HIGH | bash eval/modernize/test-pilot.sh | parked@2026-10-16T23:05Z | Source: MODERNIZE.md (D30). Depends on M-26. D34: absorbs the D30 large-tier legacy coverage. D98 park after round 2: round 2 opus BLOCK on fc2a7e90 (F1, budget-skipped units vanish, partial run counts ok). Carried forward as M-27b on top of fc2a7e90. |
-| M-27b | M-27 carry-forward: pilot counts planned units from wave.started/estimate.printed, unrun units are not proven, missing modernize.completed or non-zero exit is not ok, cost per 1K lines labelled lower bound | eval/modernize/pilot.py, eval/modernize/test-pilot.sh | HIGH | bash eval/modernize/test-pilot.sh | merged@2026-10-16T23:30Z | Base fc2a7e90 (M-27 round 1 fixes). Source: M-27 round 2 HIGH review F1. Unblocks M-28. Round 1 BLOCK (no producer for modernize.completed, spend undercount, planned units); round 2 fix 7fc7c886 (test-pilot 32/0) in HIGH round 2 review. Round 2 APPROVE 7fc7c886 (test-pilot 32/0, structural 25/0), merged; ships in 11.17.7. |
-| M-28 | 200K scale run (Mercurial 4.x, measured first, fallback Calibre) | eval/modernize/scale.py, eval/modernize/MODERNIZE.md section 12 | HIGH | python3 eval/modernize/scale.py --target hg --dry-run-first | merged@2026-10-17T00:10Z | Merged 90f48b846 (fix ac1edf2e8, HIGH r2 APPROVE; test-pilot 48/0). 6db850558 HIGH r1 BLOCK (B1: scratch copy has no .git, so git ls-files sees 0 units); fixing for r2. Source: MODERNIZE.md (D30). Depends on M-27b (M-27 parked; M-27b merged 23:30Z). Dry-run harness only; the paid run needs --execute and --budget-usd. |
+| M-27b | M-27 carry-forward: pilot counts planned units from wave.started/estimate.printed, unrun units are not proven, missing modernize.completed or non-zero exit is not ok, cost per 1K lines labelled lower bound | eval/modernize/pilot.py, eval/modernize/test-pilot.sh | HIGH | bash eval/modernize/test-pilot.sh | released@2026-10-17T03:50Z | Base fc2a7e90 (M-27 round 1 fixes). Source: M-27 round 2 HIGH review F1. Unblocks M-28. Round 1 BLOCK (no producer for modernize.completed, spend undercount, planned units); round 2 fix 7fc7c886 (test-pilot 32/0) in HIGH round 2 review. Round 2 APPROVE 7fc7c886 (test-pilot 32/0, structural 25/0), merged; ships in 11.17.7. Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| M-28 | 200K scale run (Mercurial 4.x, measured first, fallback Calibre) | eval/modernize/scale.py, eval/modernize/MODERNIZE.md section 12 | HIGH | python3 eval/modernize/scale.py --target hg --dry-run-first | released@2026-10-17T03:50Z | Merged 90f48b846 (fix ac1edf2e8, HIGH r2 APPROVE; test-pilot 48/0). 6db850558 HIGH r1 BLOCK (B1: scratch copy has no .git, so git ls-files sees 0 units); fixing for r2. Source: MODERNIZE.md (D30). Depends on M-27b (M-27 parked; M-27b merged 23:30Z). Dry-run harness only; the paid run needs --execute and --budget-usd. Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
 | M-29 | 1M scale run (Hadoop 2.x Java 8 to 21, measured first) | eval/modernize/scale_1m.py, eval/modernize/SCALE-1M.md | HIGH | python3 eval/modernize/scale_1m.py --dry-run-first | ready@2026-09-28T02:45Z | Source: MODERNIZE.md (D30). Depends on M-28, M-11. |
-| M-25w | Modernize report and reslice event wired in production (FC-M25W): coordinator calls writeReport at run end, reslice.ts emits unit.resliced, and a guard asserts every declared modernize event has a producer | loki-ts/src/util/modernize_coordinator.ts, loki-ts/src/engine10/modernize/reslice.ts, loki-ts/tests/engine10/modernize/e2e.test.ts | HIGH | cd loki-ts && bun test tests/engine10/modernize/ | merged@2026-10-16T23:45Z | Source: M-27 HIGH review B2/B3 (FAILURE-CLASSES FC-M25W). Engine10 core is at 4999 of 5000 lines; the coordinator lives in src/util, keep engine10 edits net zero. HIGH round 1 APPROVED 8836ea62 (engine10 2600 pass 0 fail, typecheck clean, 9 Seal probes fail closed). Ships in 11.17.7. |
-| M-25w-b | M-25w follow-ups: producer guard requires the event name inside an append( call (review mutations M2-M4 fooled it); coordinator calls reslice() so unit.resliced is emitted in real runs; unit.planned and codemod.skipped get producers and leave the allowlist (FC-M25W-b); pilot.py docstring no longer says no writer emits unit.resliced | loki-ts/src/util/modernize_coordinator.ts, loki-ts/src/engine10/modernize/, loki-ts/tests/engine10/modernize/, eval/modernize/pilot.py | HIGH | cd loki-ts && bun test tests/engine10/modernize/ | merged@2026-10-17T01:00Z | HIGH APPROVE 90868d3af (modernize 527 pass 0 fail, tsc 0, pilot 32/0; guard red on all 3 producer deletions) |
-| M-25w-c | Modernize producer guard hardening: hasProducer requires a word boundary before append( and ignores strings and comments; each declared modernize event has a behavioral producer test; pilot.py:425 stale "no writer emits unit.resliced" comment fixed; a codemod tool that exits non-zero logs an event | loki-ts/tests/engine10/modernize/log.test.ts, eval/modernize/pilot.py, loki-ts/src/util/modernize_coordinator.ts | MEDIUM | cd loki-ts && bun test tests/engine10/modernize/ | merged@2026-10-17T01:04Z | merge of 46df77c54 after TL APPROVE: 565 pass rc=0, pilot 48 passed, 2 mutations red |
-| REL-GUARD-b | REL-GUARD follow-ups: guard rows run in a clean detached worktree of HEAD, fail closed on missing tsv or zero suites, timeout 300, env -u LOKI_RUN_TMP | scripts/release.sh, scripts/impacted-gate.sh, tests/test-release-sh.sh, tests/test-impacted-gate.sh | HIGH | bash tests/test-release-sh.sh | merged@2026-10-16T23:46Z | Round 1 BLOCK 729cb804 (dirty-tree refusal blocked every main-checkout release); round 2 8d28a3a47 in final HIGH review (D98). Round 2 APPROVED (release-sh 43/0, dry run against the real global-guards.tsv with a dirty red row: PASS 23 suites rc 0 in 196s). Ships in 11.17.7. |
-| REL-GUARD-c | REL-GUARD-b follow-ups: an interrupted release leaves a registered guard worktree (prune does not reclaim it while the dir exists), so remove stale loki-guard.* registrations at function start or via a scoped trap; prune after the rm; log the chmod 700 failure branch | scripts/release.sh, tests/test-release-sh.sh | LOW | bash tests/test-release-sh.sh | merged@2026-10-16T23:51Z | c78236338+7fa0b91d9, LOW approved; release-sh 49/0, no-tmp-sweep 8/0, sigpipe 4/0.  Source: REL-GUARD-b HIGH round 2 non-blocking notes 1-3. |
-| Q17-01 | Slack "Run finished" message shows the stored receipt verdict, with TAMPERED or UNVERIFIED when the integrity check says so, not only the outcome. It also says "(unattested)" when no verdict is available. | loki-ts/src/util/slack_events.ts, loki-ts/src/engine10/supervisor.ts (the finished-event call site only), loki-ts/tests/engine10/slack_events.test.ts | HIGH | `cd loki-ts && bun test tests/engine10/slack_events.test.ts tests/engine10/output.test.ts`; `cd loki-ts && bunx tsc --noEmit` | merged@2026-10-17T00:57Z | merge of e2f197d94 after TL APPROVE (47 pass rc=0, mutation red 2 fail); follow-up: supervisor-level tampered test |
+| M-25w | Modernize report and reslice event wired in production (FC-M25W): coordinator calls writeReport at run end, reslice.ts emits unit.resliced, and a guard asserts every declared modernize event has a producer | loki-ts/src/util/modernize_coordinator.ts, loki-ts/src/engine10/modernize/reslice.ts, loki-ts/tests/engine10/modernize/e2e.test.ts | HIGH | cd loki-ts && bun test tests/engine10/modernize/ | released@2026-10-17T03:50Z | Source: M-27 HIGH review B2/B3 (FAILURE-CLASSES FC-M25W). Engine10 core is at 4999 of 5000 lines; the coordinator lives in src/util, keep engine10 edits net zero. HIGH round 1 APPROVED 8836ea62 (engine10 2600 pass 0 fail, typecheck clean, 9 Seal probes fail closed). Ships in 11.17.7. Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| M-25w-b | M-25w follow-ups: producer guard requires the event name inside an append( call (review mutations M2-M4 fooled it); coordinator calls reslice() so unit.resliced is emitted in real runs; unit.planned and codemod.skipped get producers and leave the allowlist (FC-M25W-b); pilot.py docstring no longer says no writer emits unit.resliced | loki-ts/src/util/modernize_coordinator.ts, loki-ts/src/engine10/modernize/, loki-ts/tests/engine10/modernize/, eval/modernize/pilot.py | HIGH | cd loki-ts && bun test tests/engine10/modernize/ | released@2026-10-17T03:50Z | HIGH APPROVE 90868d3af (modernize 527 pass 0 fail, tsc 0, pilot 32/0; guard red on all 3 producer deletions) Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| M-25w-c | Modernize producer guard hardening: hasProducer requires a word boundary before append( and ignores strings and comments; each declared modernize event has a behavioral producer test; pilot.py:425 stale "no writer emits unit.resliced" comment fixed; a codemod tool that exits non-zero logs an event | loki-ts/tests/engine10/modernize/log.test.ts, eval/modernize/pilot.py, loki-ts/src/util/modernize_coordinator.ts | MEDIUM | cd loki-ts && bun test tests/engine10/modernize/ | released@2026-10-17T03:50Z | merge of 46df77c54 after TL APPROVE: 565 pass rc=0, pilot 48 passed, 2 mutations red Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| REL-GUARD-b | REL-GUARD follow-ups: guard rows run in a clean detached worktree of HEAD, fail closed on missing tsv or zero suites, timeout 300, env -u LOKI_RUN_TMP | scripts/release.sh, scripts/impacted-gate.sh, tests/test-release-sh.sh, tests/test-impacted-gate.sh | HIGH | bash tests/test-release-sh.sh | released@2026-10-17T03:50Z | Round 1 BLOCK 729cb804 (dirty-tree refusal blocked every main-checkout release); round 2 8d28a3a47 in final HIGH review (D98). Round 2 APPROVED (release-sh 43/0, dry run against the real global-guards.tsv with a dirty red row: PASS 23 suites rc 0 in 196s). Ships in 11.17.7. Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| REL-GUARD-c | REL-GUARD-b follow-ups: an interrupted release leaves a registered guard worktree (prune does not reclaim it while the dir exists), so remove stale loki-guard.* registrations at function start or via a scoped trap; prune after the rm; log the chmod 700 failure branch | scripts/release.sh, tests/test-release-sh.sh | LOW | bash tests/test-release-sh.sh | released@2026-10-17T03:50Z | c78236338+7fa0b91d9, LOW approved; release-sh 49/0, no-tmp-sweep 8/0, sigpipe 4/0.  Source: REL-GUARD-b HIGH round 2 non-blocking notes 1-3. Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| Q17-01 | Slack "Run finished" message shows the stored receipt verdict, with TAMPERED or UNVERIFIED when the integrity check says so, not only the outcome. It also says "(unattested)" when no verdict is available. | loki-ts/src/util/slack_events.ts, loki-ts/src/engine10/supervisor.ts (the finished-event call site only), loki-ts/tests/engine10/slack_events.test.ts | HIGH | `cd loki-ts && bun test tests/engine10/slack_events.test.ts tests/engine10/output.test.ts`; `cd loki-ts && bunx tsc --noEmit` | released@2026-10-17T03:50Z | merge of e2f197d94 after TL APPROVE (47 pass rc=0, mutation red 2 fail); follow-up: supervisor-level tampered test Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
 | Q17-02 | engine10 console `Cost` line adds "N% of cap $X" when a run cap is set (`--max-cost` or `LOKI_E10_MAX_COST_USD`), so users see how close a `loki start` run came to its cap. Without a cap the line is byte-identical to today. | loki-ts/src/engine10/output.ts (costLine only), loki-ts/src/engine10/supervisor.ts (pass the resolved cap into the summary input), loki-ts/tests/engine10/output.test.ts | MEDIUM | `cd loki-ts && bun test tests/engine10/output.test.ts tests/engine10/output_group.test.ts`; `cd loki-ts && bunx tsc --noEmit` | released@2026-10-17T02:57Z | merge 5f1cde7f2 dist 70e4a9b12; TL r2 APPROVE 11eac46fa, rebased to 5032a1912 (supervisor.ts conflict, TL APPROVE resolution). TL BLOCK ff4c80939: no supervisor-level test for the capUsd pass-through; r1 fix building. v11.17.13 npm next 11.17.13 |
-| Q17-03 | Verify's flaky list becomes a rerun signal in `decideRecovery`. A fail-then-pass check no longer burns a fix round, while a real failure still does. The fail-safe default is kept. | loki-ts/src/runner/recovery_policy.ts, loki-ts/tests/runner/harness_intelligence.test.ts | MEDIUM | `cd loki-ts && bun test tests/runner/harness_intelligence.test.ts`; `cd loki-ts && bunx tsc --noEmit` | merged@2026-10-17T00:52Z | TL APPROVE 3dec444fa (bun test runner+engine10+util 4157 pass 0 fail, 3/3 mutations red) |
+| Q17-03 | Verify's flaky list becomes a rerun signal in `decideRecovery`. A fail-then-pass check no longer burns a fix round, while a real failure still does. The fail-safe default is kept. | loki-ts/src/runner/recovery_policy.ts, loki-ts/tests/runner/harness_intelligence.test.ts | MEDIUM | `cd loki-ts && bun test tests/runner/harness_intelligence.test.ts`; `cd loki-ts && bunx tsc --noEmit` | released@2026-10-17T03:50Z | TL APPROVE 3dec444fa (bun test runner+engine10+util 4157 pass 0 fail, 3/3 mutations red) Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
 | Q17-04 | FC-68 siblings: `assert-wall-executed.sh` also fails the release smoke when an expected non-Wall check (lint, mutation proof, cross review) is missing from the receipt `checks[]` without a failing exit. | scripts/assert-wall-executed.sh, scripts/real-run.sh (SC_* knob in the existing scenario parser), tests/test-real-run-guards.sh | HIGH | `bash tests/test-real-run-guards.sh`; `bash -n scripts/assert-wall-executed.sh scripts/real-run.sh` | parked@2026-10-17T00:20Z | D98 park after HIGH r2 BLOCK on b617d3e1f: B1 fixed, B2 not; SC_EXPECT_CHECKS=node is met by the Wall check node:loki_wall_* alone (verify.ts:277, wall.ts:22), so a dropped non-Wall test still passes. Re-sliced as Q17-04b. r2 fix b617d3e1f (wall guard 36/0); HIGH r2 review running. FAILURE-CLASSES.md:643 FC-68 "Siblings: any other check a receipt could lose without a failing exit ... is not yet counted". Release gate, so HIGH. Needs red-then-green: a receipt with the lint check dropped must go red. |
-| Q17-04b | Q17-04 re-slice: real-run scenarios pin the exact non-Wall check names (trivial-sum node:sum.test.js, two-bug node:lib.test.js) on top of b617d3e1f, plus a guard test where only the Wall test is a node check and token node:sum.test.js fails | tests/real-run/scenarios/trivial-sum.sh, tests/real-run/scenarios/two-bug.sh, tests/test-wall-executed-guard.sh | MEDIUM | `bash tests/test-wall-executed-guard.sh`; `bash tests/test-sigpipe-guard.sh` | merged@2026-10-17T00:34Z | TL APPROVE e1bdde7d3 (bare-node mutation caught by structural check); merged with Q17-04 commits. Built e1bdde7d3 (wall guard 0 FAIL, shellcheck rc 0, sigpipe 4/0); TL review running. Source: Q17-04 HIGH r2 finding, fix option 1. Base b617d3e1f (branch q17-04). |
+| Q17-04b | Q17-04 re-slice: real-run scenarios pin the exact non-Wall check names (trivial-sum node:sum.test.js, two-bug node:lib.test.js) on top of b617d3e1f, plus a guard test where only the Wall test is a node check and token node:sum.test.js fails | tests/real-run/scenarios/trivial-sum.sh, tests/real-run/scenarios/two-bug.sh, tests/test-wall-executed-guard.sh | MEDIUM | `bash tests/test-wall-executed-guard.sh`; `bash tests/test-sigpipe-guard.sh` | released@2026-10-17T03:50Z | TL APPROVE e1bdde7d3 (bare-node mutation caught by structural check); merged with Q17-04 commits. Built e1bdde7d3 (wall guard 0 FAIL, shellcheck rc 0, sigpipe 4/0); TL review running. Source: Q17-04 HIGH r2 finding, fix option 1. Base b617d3e1f (branch q17-04). Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
 | Q17-05 | Shipper sends the sha256 of each event line before redaction, so the Control Plane can tell a genuine redaction from a downgrade (FAILED edited to PARTIAL plus a planted [REDACTED]). Today such a log reads only "(unattested)" or UNVERIFIED. | loki-ts/src/util/redact.ts, packages/control-plane/src/server/integrity.ts, packages/control-plane/test/integrity.test.ts | HIGH | `cd packages/control-plane && bun test test/integrity.test.ts`; `cd loki-ts && bun test tests/util/redact.test.ts` | rejected@2026-10-17T00:38Z | HIGH r1 BLOCK on 36524784d, design unsound (D12): client-supplied pre-redaction chain is trusted, so copying log.sealed events_sha256 makes a FAILED-to-VERIFIED forgery read attested and sig-checked; chain not bound to run id (cross-run replay). Not patchable in place; re-sliced as Q17-05b (engine-side redaction). Branch q17-05 kept. Built 36524784d (control-plane integrity 61/0, loki-ts util 286/0); HIGH r1 review running. FAILURE-CLASSES.md:140 deferred sibling of EL-FC08b. Delivered accuracy and Seal. A forged downgrade must read TAMPERED. Test file paths are the nearest existing ones; the engineer confirms by `ls`. |
 | Q17-05b | EL-FC08b at source: the engine redacts secrets in event data before it hashes the log and signs the seal, so an honest run holding a token ships byte-identical lines that the Control Plane hashes itself and reads VERIFIED; the shipper redaction becomes a no-op on already-redacted lines, and any later edit (including a planted [REDACTED]) reads TAMPERED. No client-supplied hash is ever trusted. | loki-ts/src/util/redact.ts, the engine event-log writer that computes events_sha256 (locate via git grep events_sha256 loki-ts/src), packages/control-plane/test/integrity.test.ts | HIGH | `cd packages/control-plane && bun test test/server/`; `cd loki-ts && bun test tests/util/ tests/engine10/` | ready@2026-10-17T00:38Z | Source: Q17-05 HIGH r1 (FAILURE-CLASSES.md:139-140). Architect pass first: confirm the writer call site and the parity with run.sh before building; forgery fixtures A-D from the Q17-05 review must read TAMPERED or UNVERIFIED, never VERIFIED. |
-| Q18-01 | FC-25c(b) remainder: control-plane shipper gitOrigin runs raw execFileSync("git") with a real-token env; convert to safeGit and make the raw-spawn guard scan packages/control-plane | packages/control-plane/src/shipper/discover.ts, loki-ts/tests/util/fc25_raw_spawn_guard.test.ts | HIGH | `cd loki-ts && bun test tests/util/fc25_raw_spawn_guard.test.ts tests/util/fc25_safe_git.test.ts`; `cd packages/control-plane && bun test`; `cd loki-ts && bunx tsc --noEmit` | merged@2026-10-17T00:50Z | HIGH APPROVE dbb93205a (bun test util 289 pass, 6/6 guard mutations caught); follow-up: comment integrations.ts:85 key-path split |
-| Q18-02 | FC-25c(a): allowToken keeps repo-local core.sshCommand, remote.*.uploadpack/receivepack and repo-scope credential.helper; pin them off while the user global helper still works | loki-ts/src/util/safe_git.ts, loki-ts/tests/util/fc25_safe_git.test.ts | HIGH | `cd loki-ts && bun test tests/util/fc25_safe_git.test.ts`; `bash tests/moat/p9-rule-of-two.sh`; `cd loki-ts && bunx tsc --noEmit` | merged@2026-10-17T00:35Z | HIGH r1 APPROVE 730f27460: tests/util 289/0 rc=0, p9 4 PASS, 2 mutations each fail 1 test; merged 38b6b4b13, dist 3a1c1255c. Reviewer ran no hostile-repo probes, so those go to Q18-02b. |
-| Q18-02b | FC-25c(b): run the hostile-repo probes against safe_git allowToken and close any that leak: credential.helper with a leading !, credential.<url>.helper (including = in the url), include.path and includeIf, insteadOf to ext:: or file::, http.proxy and TLS keys, core.askPass, GIT_CONFIG_COUNT, extensions.worktreeConfig | loki-ts/src/util/safe_git.ts, loki-ts/tests/util/fc25_safe_git.test.ts | HIGH | `cd loki-ts && bun test tests/util/`; `bash tests/moat/p9-rule-of-two.sh` | merged@2026-10-17T02:52Z | merged e0365685b (HIGH r2 APPROVE 9482dbe62) |
+| Q18-01 | FC-25c(b) remainder: control-plane shipper gitOrigin runs raw execFileSync("git") with a real-token env; convert to safeGit and make the raw-spawn guard scan packages/control-plane | packages/control-plane/src/shipper/discover.ts, loki-ts/tests/util/fc25_raw_spawn_guard.test.ts | HIGH | `cd loki-ts && bun test tests/util/fc25_raw_spawn_guard.test.ts tests/util/fc25_safe_git.test.ts`; `cd packages/control-plane && bun test`; `cd loki-ts && bunx tsc --noEmit` | released@2026-10-17T03:50Z | HIGH APPROVE dbb93205a (bun test util 289 pass, 6/6 guard mutations caught); follow-up: comment integrations.ts:85 key-path split Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| Q18-02 | FC-25c(a): allowToken keeps repo-local core.sshCommand, remote.*.uploadpack/receivepack and repo-scope credential.helper; pin them off while the user global helper still works | loki-ts/src/util/safe_git.ts, loki-ts/tests/util/fc25_safe_git.test.ts | HIGH | `cd loki-ts && bun test tests/util/fc25_safe_git.test.ts`; `bash tests/moat/p9-rule-of-two.sh`; `cd loki-ts && bunx tsc --noEmit` | released@2026-10-17T03:50Z | HIGH r1 APPROVE 730f27460: tests/util 289/0 rc=0, p9 4 PASS, 2 mutations each fail 1 test; merged 38b6b4b13, dist 3a1c1255c. Reviewer ran no hostile-repo probes, so those go to Q18-02b. Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| Q18-02b | FC-25c(b): run the hostile-repo probes against safe_git allowToken and close any that leak: credential.helper with a leading !, credential.<url>.helper (including = in the url), include.path and includeIf, insteadOf to ext:: or file::, http.proxy and TLS keys, core.askPass, GIT_CONFIG_COUNT, extensions.worktreeConfig | loki-ts/src/util/safe_git.ts, loki-ts/tests/util/fc25_safe_git.test.ts | HIGH | `cd loki-ts && bun test tests/util/`; `bash tests/moat/p9-rule-of-two.sh` | released@2026-10-17T03:50Z | merged e0365685b (HIGH r2 APPROVE 9482dbe62) Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
 | Q18-03 | FC-25c guard: moat case fails if allowToken is passed outside base_guard.ts and modernize_unit.ts (SAFEGIT-REPOCONFIG 1+2) | tests/moat/p9-rule-of-two.sh | HIGH | `bash tests/moat/p9-rule-of-two.sh`; `cd loki-ts && bunx tsc --noEmit` | parked@2026-10-17T01:03Z | D98 r2 BLOCK 9a22006f6: moat run.sh rc=0 P9 PROVEN, but fetch-only pin is a prefix match (allowToken: args[0] === "fetch" || ... passes) and positional safeGitEnv check is single-line and stops at nested parens. Re-sliced as Q18-03b. |
 | Q18-03b | Moat P9 allowToken guard closes r2 bypasses: fetch-only pin must end at the option boundary; positional safeGitEnv and safeGitArgs opt-in detected across lines and with nested-call first arguments, whole-file, outside safe_git.ts | tests/moat/p9-rule-of-two.sh | HIGH | bash tests/moat/run.sh | released@2026-10-17T01:58Z | v11.17.11 (npm next 11.17.11, Tests and Release green on df98addc8). HIGH r2 APPROVE 531ad3376; merged 31e4f4b47. Follow-up Q18-03c. || widen and same-line second allowToken pass the pin; r1 fix: whole-file pin, occurrence count, alias imports fail closed |
-| Q18-04 | Deep-stage council has no production runner (deep always records "council (not wired)"); add a default CouncilRunner running one read-only reviewer session via the existing session runner; failure or oversize stays NOT PROVEN | loki-ts/src/engine10/stages/deep.ts, loki-ts/tests/engine10/deep_wiring.test.ts | HIGH | `cd loki-ts && bun test tests/engine10/deep.test.ts tests/engine10/deep_wiring.test.ts`; `cd loki-ts && bunx tsc --noEmit` | merged@2026-10-17T02:52Z | merged 0fbe7454e (HIGH r2 APPROVE 3fa77dc4e; follow-ups: providers deny-list argv test, MCP write tools not denied, findings discarded) |
-| Q18-05 | AI-BOM writer hook (MARK-3 named in ai_bom.ts header): after seal write a CycloneDX AI-BOM next to the receipt listing only what ran | loki-ts/src/contrib/ai_bom.ts, loki-ts/src/contrib/index.ts, loki-ts/src/engine10/hooks.ts, loki-ts/tests/features/ai_bom.test.ts | HIGH | `cd loki-ts && bun test tests/features/ai_bom.test.ts tests/engine10/seal.test.ts`; `cd loki-ts && bunx tsc --noEmit` | merged@2026-10-17T01:07Z | HIGH APPROVE 3adc5461a; merged 4f7a447db, dist 4a1dc5e65. Follow-ups: leak filter misses github_pat_/glpat-/AIza/npm_/hf_ and is case-sensitive; SAFE_NAME drops provider/model ids with an interior slash; pass a frozen receipt to hooks.sealed. |
-| Q18-06 | Stalled session never killed: session.stalled has no consumer; kill after LOKI_E10_STALL_KILL_S idle (default 0, off) and emit session.ended reason stalled | loki-ts/src/engine10/session.ts, loki-ts/src/runner/watchdog.ts, loki-ts/tests/engine10/session.test.ts | MEDIUM | `cd loki-ts && bun test tests/engine10/session.test.ts tests/runner/watchdog.test.ts`; `cd loki-ts && bunx tsc --noEmit` | merged@2026-10-17T01:06Z | HIGH r2 APPROVE c612595ad; merged df0741e69, dist 538c04a41. |
+| Q18-04 | Deep-stage council has no production runner (deep always records "council (not wired)"); add a default CouncilRunner running one read-only reviewer session via the existing session runner; failure or oversize stays NOT PROVEN | loki-ts/src/engine10/stages/deep.ts, loki-ts/tests/engine10/deep_wiring.test.ts | HIGH | `cd loki-ts && bun test tests/engine10/deep.test.ts tests/engine10/deep_wiring.test.ts`; `cd loki-ts && bunx tsc --noEmit` | released@2026-10-17T03:50Z | merged 0fbe7454e (HIGH r2 APPROVE 3fa77dc4e; follow-ups: providers deny-list argv test, MCP write tools not denied, findings discarded) Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| Q18-05 | AI-BOM writer hook (MARK-3 named in ai_bom.ts header): after seal write a CycloneDX AI-BOM next to the receipt listing only what ran | loki-ts/src/contrib/ai_bom.ts, loki-ts/src/contrib/index.ts, loki-ts/src/engine10/hooks.ts, loki-ts/tests/features/ai_bom.test.ts | HIGH | `cd loki-ts && bun test tests/features/ai_bom.test.ts tests/engine10/seal.test.ts`; `cd loki-ts && bunx tsc --noEmit` | released@2026-10-17T03:50Z | HIGH APPROVE 3adc5461a; merged 4f7a447db, dist 4a1dc5e65. Follow-ups: leak filter misses github_pat_/glpat-/AIza/npm_/hf_ and is case-sensitive; SAFE_NAME drops provider/model ids with an interior slash; pass a frozen receipt to hooks.sealed. Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| Q18-06 | Stalled session never killed: session.stalled has no consumer; kill after LOKI_E10_STALL_KILL_S idle (default 0, off) and emit session.ended reason stalled | loki-ts/src/engine10/session.ts, loki-ts/src/runner/watchdog.ts, loki-ts/tests/engine10/session.test.ts | MEDIUM | `cd loki-ts && bun test tests/engine10/session.test.ts tests/runner/watchdog.test.ts`; `cd loki-ts && bunx tsc --noEmit` | released@2026-10-17T03:50Z | HIGH r2 APPROVE c612595ad; merged df0741e69, dist 538c04a41. Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
 | Q18-07 | loki start heartbeat shows no ETA: estimateEtaS has no production caller; call it from the heartbeat line and record actuals at seal | loki-ts/src/engine10/output.ts, loki-ts/src/contrib/eta.ts, loki-ts/tests/engine10/output.test.ts | MEDIUM | `cd loki-ts && bun test tests/engine10/output.test.ts tests/engine10/eta.test.ts`; `cd loki-ts && bunx tsc --noEmit` | released@2026-10-17T02:57Z | merge 8b4a94371 dist 47031e380; TL APPROVE d288e13ef. PO refill 2026-10-17, grep-checked not shipped: grep estimateEtaS only output.ts:139. Wait for Q17-01/Q17-02 (output.ts overlap). v11.17.13 npm next 11.17.13 |
-| Q18-08 | checkDecomposable (D61-09) has no production caller; call it in run_group after the DAG is written so a heavily overlapping DAG runs sequentially; invalid confirm keeps the deterministic DAG | loki-ts/src/features/speed/run_group.ts, loki-ts/tests/features/speed/group_output.test.ts | MEDIUM | `cd loki-ts && bun test tests/engine10/decompose_check.test.ts tests/engine10/route_group.test.ts`; `cd loki-ts && bunx tsc --noEmit` | merged@2026-10-17T00:36Z | TL APPROVE 5a181823a: speed+seal_group+spawn_env_guard 61/0, tsc 0 non-control-plane errors, 3 mutations each red; merged 91264c08c, dist 64923228f. Report-only warning on stderr; forced sequential execution is out of scope. |
-| Q18-09 | Budget loader test: add the never-run mutation leg (drop one cache tier in the loader, must go red) | loki-ts/test/budget_cache_pricing.test.ts | LOW | `cd loki-ts && bun test test/budget_cache_pricing.test.ts`; `cd loki-ts && bunx tsc --noEmit` | merged@2026-10-17T00:48Z | TL APPROVE ea65b07b7: real _loadPricing mutations cache_write_1h, cache_read, over_100k each red; baseline 10/0. PO refill 2026-10-17, grep-checked not shipped: FAILURE-CLASSES line 195 follow-up. |
-| Q18-10 | select-tests.sh maps dashboard/web-app shell suites to handlers only by full path; add a route needle so a suite driving an API route by URL is selected when that handler changes | scripts/select-tests.sh, tests/test-select-tests.sh | MEDIUM | `bash tests/test-select-tests.sh`; `bash tests/test-select-tests-run.sh`; `cd loki-ts && bunx tsc --noEmit` | merged@2026-10-17T00:30Z | TL APPROVE 24a708366: select-tests-run 14/0, sigpipe 4/0, route_needles mutation turns 2 new asserts red; merged ce7624e12. PO refill 2026-10-17, grep-checked not shipped: FAILURE-CLASSES line 360 still thin. |
+| Q18-08 | checkDecomposable (D61-09) has no production caller; call it in run_group after the DAG is written so a heavily overlapping DAG runs sequentially; invalid confirm keeps the deterministic DAG | loki-ts/src/features/speed/run_group.ts, loki-ts/tests/features/speed/group_output.test.ts | MEDIUM | `cd loki-ts && bun test tests/engine10/decompose_check.test.ts tests/engine10/route_group.test.ts`; `cd loki-ts && bunx tsc --noEmit` | released@2026-10-17T03:50Z | TL APPROVE 5a181823a: speed+seal_group+spawn_env_guard 61/0, tsc 0 non-control-plane errors, 3 mutations each red; merged 91264c08c, dist 64923228f. Report-only warning on stderr; forced sequential execution is out of scope. Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| Q18-09 | Budget loader test: add the never-run mutation leg (drop one cache tier in the loader, must go red) | loki-ts/test/budget_cache_pricing.test.ts | LOW | `cd loki-ts && bun test test/budget_cache_pricing.test.ts`; `cd loki-ts && bunx tsc --noEmit` | released@2026-10-17T03:50Z | TL APPROVE ea65b07b7: real _loadPricing mutations cache_write_1h, cache_read, over_100k each red; baseline 10/0. PO refill 2026-10-17, grep-checked not shipped: FAILURE-CLASSES line 195 follow-up. Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| Q18-10 | select-tests.sh maps dashboard/web-app shell suites to handlers only by full path; add a route needle so a suite driving an API route by URL is selected when that handler changes | scripts/select-tests.sh, tests/test-select-tests.sh | MEDIUM | `bash tests/test-select-tests.sh`; `bash tests/test-select-tests-run.sh`; `cd loki-ts && bunx tsc --noEmit` | released@2026-10-17T03:50Z | TL APPROVE 24a708366: select-tests-run 14/0, sigpipe 4/0, route_needles mutation turns 2 new asserts red; merged ce7624e12. PO refill 2026-10-17, grep-checked not shipped: FAILURE-CLASSES line 360 still thin. Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
 | Q18-11 | group.started/group.unit events and createGroupRenderer (D61-14) have no producer or caller; emit from backlog launcher callbacks and attach the renderer to group runs | loki-ts/src/features/speed/group_grid.ts, loki-ts/src/features/speed/group_output.ts, loki-ts/tests/engine10/output_group.test.ts | MEDIUM | `cd loki-ts && bun test tests/engine10/output_group.test.ts tests/features/speed/group_output.test.ts`; `cd loki-ts && bunx tsc --noEmit` | released@2026-10-17T02:57Z | merge 326cf3402; TL APPROVE cb3e92fca (real-spawn onOut tap untested, follow-up). PO refill 2026-10-17, grep-checked not shipped: Architect confirms file set apart from Q18-08 first; else hold until Q18-08 merges. v11.17.13 npm next 11.17.13 |
 | Q18-03c | P9 allowToken guard residuals from Q18-03b r2: named re-export with as (export { safeGitEnv as x } from safe_git), indirect calls (const f = safeGitEnv; .apply; spread args), and a shadowed args default in a pinned file all give F=0 | tests/moat/p9-rule-of-two.sh | HIGH | bash tests/moat/run.sh | parked@2026-10-17T01:55Z | Shipped via Q18-03d merge 98611351a. D98 2 rounds used: r2 head 2b3421402 closes all r1 bypasses but its comment strip misses regex literals and template nesting, a regression vs main; continued as Q18-03d on top of 2b3421402. r1 BLOCK (HIGH), r2 fix in progress. Source: Q18-03b HIGH r2 notes 1, 2 and 4. Obfuscated key escapes (unicode escapes, computed concatenation) cannot be closed by grep; record as accepted residual. |
 | Q18-03d | P9 allowToken guard: comma, import and indirect scans fail if either raw or comment-stripped text trips them (strip misses regex literals and template nesting); add regex-literal, template-nesting, barrel-of-barrel and strip-only positive controls | tests/moat/p9-rule-of-two.sh | HIGH | bash tests/moat/run.sh | released@2026-10-17T02:57Z | merge 98611351a (includes Q18-03c r2 commits); HIGH APPROVE ec6e0adfd, 4 mutations red, P9 PROVEN. Built on Q18-03c r2 head 2b3421402 (branch q18-03c). HIGH r2 repro payloads: const re = /\/*/; safeGitEnv(process.env, true); // */ and const re = /"/; then const u = "//"; safeGitEnv(...). Fresh review rounds. v11.17.13 npm next 11.17.13 |
 | Q18-03e | P9 allowToken guard: strip helper treats regex literals as opaque (or a regex-aware third pass), so a regex plus a quote inside a comment cannot hide a call from both passes | tests/moat/p9-rule-of-two.sh | HIGH | bash tests/moat/run.sh | ready@2026-10-17T02:14Z | Pre-existing gap found by Q18-03d HIGH review (also on main): after the safe_git import, const re = /\/*/; safeGitEnv(process.env /* ' */, true); is MISSED and runs under node. Add it as a positive control. |
 | Q18-05b | AI-BOM filter gaps: secret filter misses github_pat_, glpat-, AIza, npm_, hf_, ASIA, sk_live_ and is case-sensitive; SAFE_NAME drops provider/model ids with one interior slash; hooks.sealed receives the live receipt (pass a frozen clone) | loki-ts/src/engine10/ai_bom.ts, loki-ts/src/engine10/stages/seal.ts, loki-ts/tests/engine10/ai_bom.test.ts | MEDIUM | cd loki-ts && bun test tests/engine10/ai_bom.test.ts tests/engine10/seal.test.ts | released@2026-10-17T02:57Z | merge ae90c2875 dist 0eb48d905; TL APPROVE 82058ff97 (102 pass, 4 mutations red). Test file is tests/features/ai_bom.test.ts. Source: Q18-05 HIGH review notes. Keep engine10 core net zero. v11.17.13 npm next 11.17.13 |
 | COST-WALL-f | Partial cost read as complete outside benchmarks: trust_trajectory cost_per_accepted_usd ignores cost.cost_partial; check cost-summary.py and proof-generator.py the same way, routing through one partial check | autonomy/lib/trust_trajectory.py, autonomy/lib/cost-summary.py, autonomy/lib/proof-generator.py, tests/test_efficiency_cost_availability.py | HIGH | python3 -m pytest tests/test_efficiency_cost_availability.py -q | released@2026-10-17T02:57Z | merge 3d0587f4f dist 7919f31ca; HIGH r2 APPROVE ef9979ad8 (53 pytest, 11 cost-cli, 33 bun pass; 5 of 6 mutations red). Follow-ups: template costIsPartial JS harness, dashboard series partial marker, cost-summary Avg/iter label. r1 BLOCK (HIGH), r2 fix in progress. Source: COST-WALL-e HIGH r1 note 4 (FC-COST-PARTIAL-b siblings). v11.17.13 npm next 11.17.13 |
-| Q17-06 | COST-6 offline half: `attribution.py` dry-run prints a cost-per-accepted-task table with the ratio against raw Claude Code and against the 0.5x target, using existing result files, so the paid `--execute` run only has to plug in numbers. | benchmarks/bench/attribution.py, benchmarks/bench/test_attribution.py | MEDIUM | `python3 -I benchmarks/bench/attribution.py --dry-run`; `python3 -m pytest benchmarks/bench -k attribution -q` | merged@2026-10-17T00:10Z | Merged fe3a4e252 (6b9bd03d6; line-828 mutation caught: 1 failed 93 passed, restored 94 passed). COST-6 is parked as a paid eval needing a spend go. This re-slice needs no spend. Cost audit 2026-10-16: best measured run is 0.68x of raw, none reaches 0.5x. Report both floors (attribution.py:778). Confirm the test file name by `ls`. |
-| COST-HARN | C-F1 benchmark reports loki truthfully: real rc and stderr tail, origin remote for multi-unit seeds, v10 evidence readers, per-run evidence kept | benchmarks/bench/attribution.py, benchmarks/bench/adapters/loki.py, benchmarks/bench/adapters/_base.py | MEDIUM | python3 -m pytest benchmarks | merged@2026-10-16T23:42Z | Source: run3 diagnosis (PROGRESS 23:37Z). Round 1 BLOCK (fake origin let single-unit runs reach the PR stage); round 2 d1bb70593 APPROVED, pytest 86 passed rc=0. Ships in 11.17.7. |
-| COST-WALL | v10 child sessions (Wall stage and every other engine10 child spawn) append to .loki/metrics/child-sessions.jsonl so loki cost is not undercounted | loki-ts/src (shared spawn helper), autonomy/lib/efficiency_cost.py | HIGH | cd loki-ts && bun test | merged@2026-10-17T00:44Z | HIGH r1 APPROVE 10c040a70: 4 test files 180 pass 1 skip 0 fail, pytest 14 passed, ledger-write mutation red 2 tests, Wall counted once by stub test; merged, dist rebuilt. Follow-ups COST-WALL-b (reader F1) and COST-WALL-c (F2 wiring tests). F3: run3 Wall diagnosis unexplained, replay before any 2x claim. |
-| COST-WALL-b | FC-COST-PARTIAL: efficiency_cost reader marks cost_partial true when main records exist with tokens but no dollar figure, so a ledger-only total never reads as complete | autonomy/lib/efficiency_cost.py, tests/test_efficiency_cost_availability.py | HIGH | `python3 -m pytest tests/test_efficiency_cost_availability.py -q`; `bash tests/test-sigpipe-guard.sh` | merged@2026-10-17T00:50Z | HIGH APPROVE ddab3e714 (pytest 15 passed, mutation caught); follow-ups: C-F1 adapter ignores cost_partial (COST-WALL-d), unpriced count omits main records |
-| COST-WALL-c | Guard the child-ledger wiring: tests fail when quality_gates withChildLedger wrappers or the SDK ledger param are removed, and internal_sdk_judge cliLedger gets a test; record a ledger line when SDK messages.create throws after spending | loki-ts/src/commands/internal_sdk_judge.ts, loki-ts/tests/runner/quality_gates.test.ts, loki-ts/tests/runner/sdk_invoker.test.ts | MEDIUM | `cd loki-ts && bun test tests/runner/`; `cd loki-ts && bunx tsc --noEmit` | merged@2026-10-17T00:59Z | merge of e0a88304 after TL APPROVE: 219 pass rc=0, 2 mutations red |
-| COST-WALL-d | C-F1 benchmark honours cost_partial: the loki adapter passes cost_partial through and compute_metrics/row_true_spend treat it as a partial lower bound, never a complete measured cost | benchmarks/bench/adapters/loki.py, benchmarks/bench/attribution.py, its existing test file | HIGH | python3 -m pytest benchmarks -q -k attribution | merged@2026-10-17T01:02Z | merge of eef4e38b5 after HIGH r2 APPROVE: pytest 114 passed rc=0, fix revert turns test red; follow-ups in COST-WALL-e |
+| Q17-06 | COST-6 offline half: `attribution.py` dry-run prints a cost-per-accepted-task table with the ratio against raw Claude Code and against the 0.5x target, using existing result files, so the paid `--execute` run only has to plug in numbers. | benchmarks/bench/attribution.py, benchmarks/bench/test_attribution.py | MEDIUM | `python3 -I benchmarks/bench/attribution.py --dry-run`; `python3 -m pytest benchmarks/bench -k attribution -q` | released@2026-10-17T03:50Z | Merged fe3a4e252 (6b9bd03d6; line-828 mutation caught: 1 failed 93 passed, restored 94 passed). COST-6 is parked as a paid eval needing a spend go. This re-slice needs no spend. Cost audit 2026-10-16: best measured run is 0.68x of raw, none reaches 0.5x. Report both floors (attribution.py:778). Confirm the test file name by `ls`. Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| COST-HARN | C-F1 benchmark reports loki truthfully: real rc and stderr tail, origin remote for multi-unit seeds, v10 evidence readers, per-run evidence kept | benchmarks/bench/attribution.py, benchmarks/bench/adapters/loki.py, benchmarks/bench/adapters/_base.py | MEDIUM | python3 -m pytest benchmarks | released@2026-10-17T03:50Z | Source: run3 diagnosis (PROGRESS 23:37Z). Round 1 BLOCK (fake origin let single-unit runs reach the PR stage); round 2 d1bb70593 APPROVED, pytest 86 passed rc=0. Ships in 11.17.7. Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| COST-WALL | v10 child sessions (Wall stage and every other engine10 child spawn) append to .loki/metrics/child-sessions.jsonl so loki cost is not undercounted | loki-ts/src (shared spawn helper), autonomy/lib/efficiency_cost.py | HIGH | cd loki-ts && bun test | released@2026-10-17T03:50Z | HIGH r1 APPROVE 10c040a70: 4 test files 180 pass 1 skip 0 fail, pytest 14 passed, ledger-write mutation red 2 tests, Wall counted once by stub test; merged, dist rebuilt. Follow-ups COST-WALL-b (reader F1) and COST-WALL-c (F2 wiring tests). F3: run3 Wall diagnosis unexplained, replay before any 2x claim. Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| COST-WALL-b | FC-COST-PARTIAL: efficiency_cost reader marks cost_partial true when main records exist with tokens but no dollar figure, so a ledger-only total never reads as complete | autonomy/lib/efficiency_cost.py, tests/test_efficiency_cost_availability.py | HIGH | `python3 -m pytest tests/test_efficiency_cost_availability.py -q`; `bash tests/test-sigpipe-guard.sh` | released@2026-10-17T03:50Z | HIGH APPROVE ddab3e714 (pytest 15 passed, mutation caught); follow-ups: C-F1 adapter ignores cost_partial (COST-WALL-d), unpriced count omits main records Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| COST-WALL-c | Guard the child-ledger wiring: tests fail when quality_gates withChildLedger wrappers or the SDK ledger param are removed, and internal_sdk_judge cliLedger gets a test; record a ledger line when SDK messages.create throws after spending | loki-ts/src/commands/internal_sdk_judge.ts, loki-ts/tests/runner/quality_gates.test.ts, loki-ts/tests/runner/sdk_invoker.test.ts | MEDIUM | `cd loki-ts && bun test tests/runner/`; `cd loki-ts && bunx tsc --noEmit` | released@2026-10-17T03:50Z | merge of e0a88304 after TL APPROVE: 219 pass rc=0, 2 mutations red Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| COST-WALL-d | C-F1 benchmark honours cost_partial: the loki adapter passes cost_partial through and compute_metrics/row_true_spend treat it as a partial lower bound, never a complete measured cost | benchmarks/bench/adapters/loki.py, benchmarks/bench/attribution.py, its existing test file | HIGH | python3 -m pytest benchmarks -q -k attribution | released@2026-10-17T03:50Z | merge of eef4e38b5 after HIGH r2 APPROVE: pytest 114 passed rc=0, fix revert turns test red; follow-ups in COST-WALL-e Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
 | COST-WALL-e | One partial-cost helper used by every cost consumer (FC-COST-PARTIAL-b): equivalence_report.py and report.py honour cost_partial; row_spend_is_partial true for null cost with true cost set; invalid ledger lines and cost below ledger mark partial | benchmarks/bench/attribution.py, benchmarks/bench/equivalence_report.py, benchmarks/bench/report.py, autonomy/lib/efficiency_cost.py, benchmarks/bench/tests/test_attribution.py, tests/test_efficiency_cost_availability.py | HIGH | python3 -m pytest benchmarks/bench/tests/ tests/test_efficiency_cost_availability.py -q | released@2026-10-17T01:58Z | v11.17.11 (npm next 11.17.11, Tests and Release green on df98addc8). HIGH r2 APPROVE 439ed90e3 (132 passed); merged into v11.17.11. Follow-ups in COST-WALL-f. |
 | M-30 | User docs for loki modernize, no dashes, commands match USAGE | docs/v10/GUIDE-MODERNIZE.md, tests/test-modernize-docs.sh | LOW | bash tests/test-modernize-docs.sh | released@2026-09-28T21:01Z | Source: MODERNIZE.md (D30). Depends on M-07. Dispatched 18:58Z, sonnet engineer. Tech Lead REJECT r1 (--resume id failed MID_RE), APPROVE r2 5035984d; merged 8d568c66; test-modernize-docs.sh 25/0, shard coverage 19/0, durations drift 6/0. Released in v10.5.0 (merge 8d568c66 is an ancestor of v10.5.0). |
 | E-66 | "Already implemented" outcome: evidence search in code, tests, docs, CHANGELOG; no change needed verdict, receipt, issue comment, no PR | loki-ts/src/engine10 (intake or plan, implement marker path, seal, pr) | HIGH | fixture with the feature ends no change needed, no implement session; fixture without proceeds | released@2026-09-28T16:03Z | Source: D32 (augmentiq #52). Opus REJECT (reproduced): no test that ALREADY_SATISFIED opens no PR; evidence search matched 652 hits for an unrelated task on this repo; confirmation need not cite files. Rework dispatched. Rework 1c7e1b09 (branch worktree-wf_b707f4ab-24f-1): all 3 blockers fixed (no-PR test F5, 0 hits for both review sentences on this repo, citation must name an existing code or test hit; evidence in receipt). Opus CONCERN: the real-repo test uses listRepoFiles capped at 2000 of 4784 files, so removing STOP_WORDS still passes; the existsSync branch of the citation check is untested. Next: small fix (full file list in that test, one existsSync test). Wave E18 small fix (uncapped file list, existsSync test), branch slice-E-66-test-fixes. Opus APPROVE of 0a64ea98 (uncapped list, existsSync test). Merge onto main conflicts in seal.ts, supervisor.ts, types.ts, rule_of_two.test.ts after E-68/E-69; rebase dispatched (wave E19). D33: states its net core line delta; core must stay under 5,000 (92 lines of headroom shared by E-67, E-66, E-61, M-14, merge order E-67, E-66, E-61); offset any excess by deleting dead core code. Rework 135ba06b Opus APPROVE, but merged it takes core to 5,189 (D33 cap 5,000; `bun test tests/engine10/budget.test.ts`). Not merged. Next: offset about 190 core lines in the same slice (dead or duplicated core code), then merge. Wave E21 (wf_39ab3f7d-8f3). r3: D33 offset. Rework r3 605f33b0 Opus APPROVE (core under 5,000 after offset); merged into train E22 (9042e964): `bun test tests/engine10/` 547 pass 0 fail, tsc 0, `bash tests/test-v10-pulse.sh` 107 passed, `bash eval/loki10/test-harness.sh` 108 passed. Released in v10.2.1 (npm publish 2026-09-28T16:03Z; every cited commit is an ancestor of the v10.2.1 tag; `git merge-base --is-ancestor`). |
@@ -547,7 +547,7 @@ set is declared to avoid overlap with those and with each other.
 | S41-20h | Medium-task MINING pass (no task building): shortlist 12 candidate merged PRs whose shape survives the one-file probe (a semantic or signature change in file A that an independently tested caller in file B must match; not helper extraction, parameter threading, moved classes or typing-only files), each with a written one-file-fix attempt run against the upstream tests and its result | eval/loki10/tasks/CANDIDATES.md (new) | MEDIUM | every shortlisted PR has a failing one-file attempt recorded with command and rc | released@2026-10-16T00:49Z | Source: S41-20b/c/d/e/f: 11 of 16 candidates fell to a reviewer one-file fix; S41-20f built 0. |
 | D44-A | Green main by construction: scripts/train-promote.sh fast-forwards main only to a train SHA with green Tests, Bun Parity and Coverage; pre-push refuses a push to main unless it is Tier B green, a VERSION-only bump on a green parent, or docs-only (LOKI_D44_EMERGENCY override logged) | scripts/train-promote.sh, .githooks/pre-push, tests/test-train-promote.sh, docs/v10/TRAINS.md | HIGH | bash tests/test-train-promote.sh | parked@2026-09-30T20:04Z | Source: D44 item 1. PARKED 20:05Z by the adoption directive (docs/v10/PROGRESS.md 20:05Z); resumes after Tier 0 is green. |
 | D44-B | Pulse RELEASE_CADENCE (green unreleased main commit older than 20 min) and MAIN_RED_BY_MERGE; hourly releases per hour into METRICS.md | scripts/v10-pulse.sh, scripts/metrics-releases-append.py, pulse tests | MEDIUM | the pulse test file plus the metrics script self-test | parked@2026-10-03T09:21Z | drift audit 09:22Z: building since 2026-09-30 with no live builder or commit; parked, re-slice if still wanted |
-| D44-C | Structural checks under 10 s each (shard rows, hardcoded paths, registration, doc drift, line budgets) as scripts/structural-checks.sh, run first in Tier A (also on train/** push) and in the local-ci fast tier | scripts/structural-checks.sh, .github/workflows/tier-a.yml, scripts/local-ci.sh, tests/test-structural-checks.sh | MEDIUM | bash tests/test-structural-checks.sh | merged@2026-09-30T18:27Z | Source: D44 item 3; four red mains on 2026-09-30. |
+| D44-C | Structural checks under 10 s each (shard rows, hardcoded paths, registration, doc drift, line budgets) as scripts/structural-checks.sh, run first in Tier A (also on train/** push) and in the local-ci fast tier | scripts/structural-checks.sh, .github/workflows/tier-a.yml, scripts/local-ci.sh, tests/test-structural-checks.sh | MEDIUM | bash tests/test-structural-checks.sh | released@2026-10-17T03:50Z | Source: D44 item 3; four red mains on 2026-09-30. Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
 | S41-20d | Medium tier growth batch d: 4 new tasks from unused repos under the 2026-09-30 opus criteria (2 behavioral files, not fixed at ref, wrong-fix rejected, solvable from issue, refdiff, provenance) | eval/loki10/tasks/pub-* (new), refdiff, INDEX.md | HIGH | measure-size rc 0 and validate rc 0 on the new tasks | rejected@2026-09-30T18:49Z | Source: D43 item 2 (medium at 12 of 20). |
 | S41-20e | Medium tier growth batch e: 4 more tasks, repos disjoint from S41-20d | eval/loki10/tasks/pub-* (new), refdiff, INDEX.md | HIGH | as S41-20d | released@2026-09-30T19:22Z | Source: D43 item 2. Released in v10.5.8 (merge 5cdbdc7b is an ancestor of v10.5.8). |
 | S41-16 | P0: Wall red-on-base is vacuous without python (launch error counted as failed on base) | see docs/v10/SCORECARD-PLAN.md | HIGH | per SCORECARD-PLAN.md card | released@2026-09-28T23:18Z | Source: D41, Architect plan 7f671f5c. Depends on D42. D42 (3) confirmed P0; merges before any wave-1 card touching wall, verify or Seal. Dispatched 21:42Z. r1 55e427ab opus REJECT: not_run never reaches seal (seal.ts:117 ignores not_run, so pass 1 fail 0 not_run 1 seals ALREADY_SATISFIED: a new false verdict); jest/vitest/bun non-zero exit without a parsed count read as red; AttributeError/NameError anywhere counted as repo red; system-interpreter results must be not_run. r2 dispatched 21:58Z. r2 d5bb05bd (seal refuses not_run; per-runner red rules; traceback path under repo; system interpreter not_run); core 4997; opus re-review 22:10Z. opus APPROVE r2 d5bb05bd (seal refuses not_run: real-seal test; receipts byte-stable when not_run 0; per-runner red rules; system interpreter not_run). Merged, dist rebuilt. Follow-up E-125. Released in v10.5.5 (merge 8788d54d is an ancestor of v10.5.5). |
@@ -676,41 +676,41 @@ Source: ~/git/autonomi-dev/research/2026-09-30-adoption/SWARM-PROMPT-ADOPTION.md
 | A-104 | Commit only the fix (items 1 and 2, v10) | see plan A-104 | HIGH | first-run-gate assertion per plan card | released@2026-09-30T21:23Z | Wave per plan section 5; one writer per file. Released in v10.5.11 (merge d86a5817 is an ancestor of v10.5.11). |
 | A-104b | A-104 opus follow-ups: run the unstage reset as `git --literal-pathspecs reset` and check its rc (a path starting with `:(top)` was read as a pathspec and committed); match "manifest changed" per directory in monorepos (a stray lockfile in packages/b rode along with a packages/a manifest change); judge new lockfiles and Wall files against the run base, not HEAD, so files the agent commits during implement are also excluded | loki-ts/src/engine10/stages/seal.ts, loki-ts/tests/engine10/seal.test.ts | HIGH | fixtures for each case red first; seal-then-verify still matches | released@2026-10-16T00:49Z | Source: A-104 opus review (APPROVE with notes). seal.ts writer order: after A-121. |
 | A-104c | A-104b r2 opus follow-up (code reading, not reproduced): a FAILED run now reaches backstopCommit in supervisor.ts (around lines 93-98 and 229), which runs git add -A with hooks off, so a run whose commit stage failed could still commit Wall files, stray lockfiles and the user's pre-run dirty files, and hasDiff could push them as a draft PR (E-67 behaviour). Reproduce first; then make the backstop honor the same exclusions as the commit stage, or skip it when the commit stage itself failed | loki-ts/src/engine10/supervisor.ts, its test | failed-commit run leaves no new commit with Wall files, lockfiles or pre-run dirty files, and opens no PR | HIGH | released@2026-10-16T00:49Z | none |
-| D50-F1 | D50 lift fix 1 (aiq-52, expected no_change_needed): v10 printed ALREADY_SATISFIED but left source changes from implement (harness no_source_diff=false), so it scored not completed; raw sonnet checked first and changed nothing. On ALREADY_SATISFIED, restore source to base before commit, PR or seal; fail closed to FAILED if the restore fails | loki-ts/src/engine10 (outcome path), its tests, dist | fixture with implement edits plus ALREADY_SATISFIED ends with an empty diff, no commit, no PR; VERIFIED runs keep changes | HIGH | merged@2026-10-01T11:45Z f391ba33f (r5, opus approved, train/56) | none |
+| D50-F1 | D50 lift fix 1 (aiq-52, expected no_change_needed): v10 printed ALREADY_SATISFIED but left source changes from implement (harness no_source_diff=false), so it scored not completed; raw sonnet checked first and changed nothing. On ALREADY_SATISFIED, restore source to base before commit, PR or seal; fail closed to FAILED if the restore fails | loki-ts/src/engine10 (outcome path), its tests, dist | fixture with implement edits plus ALREADY_SATISFIED ends with an empty diff, no commit, no PR; VERIFIED runs keep changes | HIGH | released@2026-10-17T03:50Z | none Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
 | D50-F2 | D50 lift fix 2 (humanize-174): the task changes behaviour that existing tests encode; raw sonnet fixed code and updated the assertions (2/3), v10 BLOCKED as spec conflict or hit the iteration cap (0/3). Needs a design that permits spec-required assertion changes, recorded in the receipt, without opening a test-weakening loophole. Opus architect first | engine10 intake, plan, wall, verify, seal (per design) | humanize-174-shaped fixture completes with the assertion changes listed in NOT PROVEN; a weakening attack still fails | HIGH | rejected@2026-10-01T12:40Z: S1+S2 (71997e6c, a2941555) opus REJECT. Moat holds (any existing-test edit seals PARTIAL). Blocking: the per-spec label fires on any literal swap whose test calls a task word (if True to False, range(10) to range(0), tolerance 1e-3 to 1e3) and drops the weakened-test flag, a false Seal claim. No lift: context.ts:23 still makes tests append-only, so humanize-174 still ends SPEC_CONFLICT. Rework D50-F2r (honest label) building; lift fix D50-F2-S3 needs a CTO call | none |
 | D50-F2r | D50-F2 rework, honest label only: label a test value change only on the expected side of an assert comparison or a parametrize expected value, only when the old or new value appears in the task text; wording 'assertion value changed (not shown to be required by the task): file:line old -> new' and keep the 'weakened test' line beside it; exclude control flow, range, tolerances, approx kwargs, decorators | loki-ts/src/e10ext classifier, engine10 verify and seal wiring, tests, dist | probes C D E F G H K from the F2 review all keep 'weakened test'; A labelled only when 5 appears in the task; verdict PARTIAL in every case | HIGH | parked@2026-10-03T09:21Z | drift audit 09:22Z: r2 rejected, no live builder since 2026-10-01; parked per D68 drop-red; re-open as a fresh slice when D50-F2-S3 is ranked |
 | D50-F2-S3 | humanize-174 lift: let the implement brief edit an existing assertion only when the task text states the new expected value; verdict stays PARTIAL, never VERIFIED (moat). CTO call needed first: does a PARTIAL spec-required test edit count as the right outcome, and does the brief license weaken the append-only rule (context.ts:23) | loki-ts/src/e10ext/context.ts, verify and wall policy, eval fixture through implement | humanize-174 fixture through implement ends with code fixed and the spec value assertion changed, PARTIAL with an honest note | HIGH | ready (D53 ruled 12:39Z: VERIFIED allowed when the new literal is verbatim in the issue, the edit changes only that literal in an existing assert, and Wall plus other tests pass; PARTIAL never scores completed; red bypass tests for tolerance, if True to False, deleted assert, literal not in issue) | needs D50-F2r |
 | D50-F4b | D50-F4 hardening from the opus review (non-blocking): validate base from the worker-written event log as ^[0-9a-f]{40,64}$ before any git call, and skip the backstop when log.verify() fails | loki-ts/src/engine10/supervisor.ts or e10ext/commit_filter.ts, tests | a base of --output=x is refused with no git call; a tampered log runs no backstop | merged@2026-10-03T05:14Z | TL APPROVE (3 mutations red, engine10 net 0); cherry-picked cff3d4ab8, dist 159abf6d6, e10ext+supervisor 122/0. Follow-up (non-blocking): invalid raw base records no notProven reason in the supervisor path | none |
-| NPM-LAG | CORRECTED 16:14Z: v10.5.34 (ceb6942a) was accepted by npm at 15:37Z with the notice that it was being processed, and appeared in the registry only at 16:05:58Z (about 29 min; gitHead ceb6942a correct). Not a lost publish, a long npm processing delay, while the Release run already showed success. Guard: publish-npm, post-release-smoke and promote wait up to 45 min for the version (registry, no cache) before declaring it missing, and promote re-triggers when it appears, so a delay is never read as a failure or a pass (10.5.34 smoke failed ETARGET during the lag and skipped promote; rerun 16:30Z); train-cycle merges origin/main back into local main after each release (it stalled at 16:20Z with local main behind its own release) and waits on previous version visible; the release captain (train-cycle.sh) refuses the next release while the previous version is missing from npm | .github/workflows/release.yml publish-npm, scripts/train-cycle.sh, tests | a stubbed npm that never lists the version fails the step; train-cycle logs PREV_NOT_ON_NPM and waits | MEDIUM | merged@2026-10-03T08:30Z | opus APPROVE both halves (fail-open probes all fail-closed); b=release.yml npm wait, a=train-cycle PREV_NOT_ON_NPM + sync_local_main; suites 68/0, 67/0, 31/0, 63/0 on main. Note: a failed pre-publish Release now halts later releases until acted on (STALE after 45 min) |
+| NPM-LAG | CORRECTED 16:14Z: v10.5.34 (ceb6942a) was accepted by npm at 15:37Z with the notice that it was being processed, and appeared in the registry only at 16:05:58Z (about 29 min; gitHead ceb6942a correct). Not a lost publish, a long npm processing delay, while the Release run already showed success. Guard: publish-npm, post-release-smoke and promote wait up to 45 min for the version (registry, no cache) before declaring it missing, and promote re-triggers when it appears, so a delay is never read as a failure or a pass (10.5.34 smoke failed ETARGET during the lag and skipped promote; rerun 16:30Z); train-cycle merges origin/main back into local main after each release (it stalled at 16:20Z with local main behind its own release) and waits on previous version visible; the release captain (train-cycle.sh) refuses the next release while the previous version is missing from npm | .github/workflows/release.yml publish-npm, scripts/train-cycle.sh, tests | a stubbed npm that never lists the version fails the step; train-cycle logs PREV_NOT_ON_NPM and waits | MEDIUM | released@2026-10-17T03:50Z | opus APPROVE both halves (fail-open probes all fail-closed); b=release.yml npm wait, a=train-cycle PREV_NOT_ON_NPM + sync_local_main; suites 68/0, 67/0, 31/0, 63/0 on main. Note: a failed pre-publish Release now halts later releases until acted on (STALE after 45 min) Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
 | D53-Q1 | CTO call before D50-F2-S3: under D53(a) a bug-report task ('Expected 200, got 404') lets a test change to the buggy value pass the literal-only gate; only Wall coverage of that behaviour stops it. Options: require the new literal to sit on the expected side of an expected/should phrase in the task, or require Wall coverage of the edited assertion | docs/v10/DECISIONS.md D53 | ruling recorded | HIGH | released@2026-10-01T14:20Z (ruled in DECISIONS D53 amendment: literal must be the EXPECTED value in the acceptance criteria with a source span; Wall must cover the behaviour; unclassifiable stays PARTIAL) | none |
-| D50-F4 | aiq-52 diagnosis: on FAILED, backstopCommit runs git add -A and re-stages the commit stage's exclusions (pre-existing dirt, Wall files, stray lockfiles), so a PR with only setup dirt is pushed. Backstop applies the same exclusions; nothing left means no commit and no PR | loki-ts/src/engine10/supervisor.ts, e10ext helper, tests, dist | preexisting-dirty fixture with FAILED: HEAD equals base and no PR; with a run edit the backstop commit holds only that edit; Wall and stray lockfile never committed | HIGH | merged@2026-10-01T13:50Z 8364a03e (ed8caedf, opus APPROVE r2: filter fixture shows no token, hooks, fsmonitor, textconv or ext-diff with the supervisor env; train/61) | none |
+| D50-F4 | aiq-52 diagnosis: on FAILED, backstopCommit runs git add -A and re-stages the commit stage's exclusions (pre-existing dirt, Wall files, stray lockfiles), so a PR with only setup dirt is pushed. Backstop applies the same exclusions; nothing left means no commit and no PR | loki-ts/src/engine10/supervisor.ts, e10ext helper, tests, dist | preexisting-dirty fixture with FAILED: HEAD equals base and no PR; with a run edit the backstop commit holds only that edit; Wall and stray lockfile never committed | HIGH | released@2026-10-17T03:50Z | none Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
 | D50-F5 | aiq-52 lift: already_done.ts findEvidence misses compound task keywords (searchbar vs search-command); add deterministic compound-token matching and a same-stem source plus referencing-test category pair; confirmation still must cite a real hit | loki-ts/src/e10ext/already_done.ts, tests, dist | aiq-52-shaped fixture yields a candidate; unrelated keyword, source without referencing test and short prefix yield none | HIGH | parked@2026-10-03T09:21Z | drift audit 09:22Z: r2 rejected, no live builder since 2026-10-01; parked per D68 drop-red |
-| D50-W1 | CTO call (aiq-52 diagnosis): Wall runs in an empty temp cwd (wall.ts:156-169) with a 90s cap, so on brownfield tasks it writes blind tests and was killed twice; options are read-only repo access for Wall, or a longer cap, each weighed against Wall's from-spec independence (moat) | loki-ts/src/engine10/stages/wall.ts | decision recorded in DECISIONS | HIGH | merged@2026-10-03T08:52Z (decided: D77) | none |
-| W1-S1 | D77 manifest builder: pure buildWallManifest returning signatures-only text from the base tree | loki-ts/src/engine10/wall_manifest.ts (new), loki-ts/tests/engine10/wall_manifest.test.ts | TS and Python fixtures: every exported signature present, body canary absent; style example never imports a named module; output 400 lines or fewer; byte-identical for the same tree | HIGH | merged@2026-10-03T10:50Z | d7285daa3..9da5c123f on main (opus APPROVE r7, 51/0, tsc 0); library only, flag not wired; advisory: invalid-TS keyword after decorator leaks, fold into W1-S2 |
-| W1-S2 | D77 wire manifest into Wall cwd and brief; manifest_sha256 on wall.sealed | loki-ts/src/engine10/stages/wall.ts, loki-ts/tests/engine10/wall.test.ts | cwd holds only task.md, repomap.txt, wall_manifest.txt; body and implement-diff canaries never reach cwd or brief; E-54 and D42(3) tests green | HIGH | merged@2026-10-03T12:58Z | r1-r15 cherry-picked (6acdb8476..f9dc7d67b), opus HIGH r15 APPROVE (211/0, tsc 0). Combined with D61-11 it breaks the e10ext/features size budgets; P0-SIZE-BUDGET trim in flight, train held. Advisory: add a johab cookie test row. |
-| P0-SIZE-BUDGET | Trim e10ext (1505/1500) and features (3041/3000) under budget with no behaviour change after D61-11 + W1-S2 merged | loki-ts/src/engine10/stages/wall.ts, loki-ts/tests/engine10/wall.test.ts | cwd holds only task.md, repomap.txt, wall_manifest.txt; body and implement-diff canaries never reach cwd or brief; E-54 and D42(3) tests green | HIGH | merged@2026-10-03T13:05Z | Merged 87f256642: e10ext 1433/1500, features 2931/3000; budget.test.ts 27/0, dist guard 13/0. Whitespace/comment only. |
-| P0-T99-ROUTING | train/99 Tests red on shards 3/4/7 twice (run 37124003039 + full rerun): test-issue-to-pr acceptance import includes heading lines, test_start_run_unified URL start says no provider CLI, test-start-repo-directory (PO4) fails in 1s; all pass locally with provider CLIs | tests/cli/test-issue-to-pr.sh, tests/cli/test_start_run_unified.sh, tests/cli/test-start-repo-directory.sh, cause TBD | MEDIUM | three suites green under a CI-like PATH with no provider CLI, red before the fix | merged@2026-10-03T13:21Z | Root cause: train/99 af6b616fa+2db6d1358 registered 4 orphan tests/cli suites; GNU sed range in issue-parser.sh extract_acceptance_criteria keeps heading lines (BSD falls back, so green on macOS); 2 suites silently needed a claude CLI. Fix 060a5794c red/green under env -i and ubuntu:24.04. Tier corrected HIGH->MEDIUM (parser, not moat). TL review running. TL APPROVE (5 suites green macOS+ubuntu docker). Merged ec5cc3398. Advisory carded: switch sed \s to [[:space:]] at the root. |
-| P0-P9-DEFAULT-PUSH | train/100 Tests red only on moat P9.injection-cannot-reach-token [default] leg: Loki post-session push never ran on the CI runner (push log: provider rejected x2). Intermittent on 8+ CI runs since 10-01. | tests/moat/p9-rule-of-two.sh, post-session push path (autonomy/run.sh or loki-ts) | HIGH | Root cause found and fixed, red before green under CI-like docker repro (M>=5); full moat run clean; pending.txt untouched | merged@2026-10-03T14:29Z | Sonnet engineer in a worktree. Opus HIGH review follows (moat). One full rerun of run 37125941522 started per D68. Root cause: printf piped to grep -q under pipefail SIGPIPE 141 refused the post-session push under load (docker 5/18 -> 0/10). opus HIGH APPROVE (equivalence 18/20, the 2 diffs are literal-correct; P2/P7 FAILs pre-existing, missing typescript prereq). On main as 84e2b585e, engine10-push 40/0, P9 4/4 PASS. Advisory: add a "drops one function, keeps anchors" rc-3 case to test-engine10-push.sh. |
-| ADV-PUSH-RC3 | engine10-push guard testable alone: run.sh keeps its anchors but drops one of the four trusted-push functions; assert rc 3, 'region lacks', no gh, no push | tests/test-engine10-push.sh | MEDIUM | new case red when the guard is forced to pass, green on main; suite 41/0 under /bin/bash | merged@14:34Z | TL sonnet APPROVE (43/0; mutations true-match and loop-delete each 41/2; no-push via pre-receive log with positive control); main 511937aec |
-| ADV-T99-SED | issue-parser root fix: GNU-only `\s` in sed and grep patterns becomes `[[:space:]]` so BSD and GNU agree | autonomy/issue-parser.sh, issue-parser tests | MEDIUM | a case with an indented list item and a heading parses the same on macOS and ubuntu docker; existing issue-parser suites green | merged@14:36Z | TL sonnet APPROVE (22/0 macOS; ubuntu docker commit vs parent logs identical; one-extractor BRE revert goes red 21/1; scope grew to sed -E for BSD alternation); main 4eb538b27 |
-| ADV-SEAL-JEST-E2E | loki-seal: E2E proof that a jest or vitest red still counts while coverage is NOT VERIFIED, via a stub runner bin | packages/loki-seal/test/seal.test.js | MEDIUM | stub jest exits 1: result is red with the specific reason; a mutant that ignores the exit code goes red; suite 135+/0 | merged@14:58Z | merged 036a05281 (TL APPROVE 138/138) |
-| T101-G04-DUPROW | train/101 shard 3 R2-3 red on GNU: test hook appended a file to itself, GNU grep refuses, so no duplicate row existed | tests/test-cloud-dispatch.sh, CHANGELOG.md | MEDIUM | R2-3 red on Linux and macOS when the writer uniqueness check is weakened | merged@14:46Z | D81; test-only; TL sonnet APPROVE (mutation len(hits)<1 gives 83/2 on ubuntu docker and macOS; 85/0 green both); main 8b314af87 |
-| T101-SEAL-NODEFLAG | train/101 shard 2: seal.test.js:1031 fixture uses node --test-isolation=none, rejected by CI Node | packages/loki-seal/test/seal.test.js (product only if it passes the flag), CHANGELOG.md | MEDIUM | the r7 no-newline honest-run test green on the CI Node and local Node, fail-closed unchanged | merged@14:58Z | merged def612303 (TL APPROVE: node:22 127/0/7skip env-only, parent fails r7; mutation red) |
-| W1-S3 | D77 size-tied Wall cap: 90s small, 180s normal, env override clamped to 300s | loki-ts/src/engine10/sizing.ts, loki-ts/src/engine10/stages/wall.ts, loki-ts/tests/engine10/sizing.test.ts | small 90, normal 180, 999 clamps to 300, garbage falls back; killed session copies no file; timeout never already_satisfied | MEDIUM | merged@2026-10-03T13:21Z | TL MEDIUM BLOCK: wiring test uses a small task so limitS 90 equals old value; wall.ts:168 mutation survived. r2 test-only fix requested (normal task -> 180, env 240 reaches session). Code itself passed: 300 stage ceiling safe, env parse ok. Merged 916f2d99d..615fd4745 + dist f0ece075d; engine10 1199/0, tsc 0, dist guard 13/0. |
+| D50-W1 | CTO call (aiq-52 diagnosis): Wall runs in an empty temp cwd (wall.ts:156-169) with a 90s cap, so on brownfield tasks it writes blind tests and was killed twice; options are read-only repo access for Wall, or a longer cap, each weighed against Wall's from-spec independence (moat) | loki-ts/src/engine10/stages/wall.ts | decision recorded in DECISIONS | HIGH | released@2026-10-17T03:50Z | none Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| W1-S1 | D77 manifest builder: pure buildWallManifest returning signatures-only text from the base tree | loki-ts/src/engine10/wall_manifest.ts (new), loki-ts/tests/engine10/wall_manifest.test.ts | TS and Python fixtures: every exported signature present, body canary absent; style example never imports a named module; output 400 lines or fewer; byte-identical for the same tree | HIGH | released@2026-10-17T03:50Z | d7285daa3..9da5c123f on main (opus APPROVE r7, 51/0, tsc 0); library only, flag not wired; advisory: invalid-TS keyword after decorator leaks, fold into W1-S2 Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| W1-S2 | D77 wire manifest into Wall cwd and brief; manifest_sha256 on wall.sealed | loki-ts/src/engine10/stages/wall.ts, loki-ts/tests/engine10/wall.test.ts | cwd holds only task.md, repomap.txt, wall_manifest.txt; body and implement-diff canaries never reach cwd or brief; E-54 and D42(3) tests green | HIGH | released@2026-10-17T03:50Z | r1-r15 cherry-picked (6acdb8476..f9dc7d67b), opus HIGH r15 APPROVE (211/0, tsc 0). Combined with D61-11 it breaks the e10ext/features size budgets; P0-SIZE-BUDGET trim in flight, train held. Advisory: add a johab cookie test row. Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| P0-SIZE-BUDGET | Trim e10ext (1505/1500) and features (3041/3000) under budget with no behaviour change after D61-11 + W1-S2 merged | loki-ts/src/engine10/stages/wall.ts, loki-ts/tests/engine10/wall.test.ts | cwd holds only task.md, repomap.txt, wall_manifest.txt; body and implement-diff canaries never reach cwd or brief; E-54 and D42(3) tests green | HIGH | released@2026-10-17T03:50Z | Merged 87f256642: e10ext 1433/1500, features 2931/3000; budget.test.ts 27/0, dist guard 13/0. Whitespace/comment only. Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| P0-T99-ROUTING | train/99 Tests red on shards 3/4/7 twice (run 37124003039 + full rerun): test-issue-to-pr acceptance import includes heading lines, test_start_run_unified URL start says no provider CLI, test-start-repo-directory (PO4) fails in 1s; all pass locally with provider CLIs | tests/cli/test-issue-to-pr.sh, tests/cli/test_start_run_unified.sh, tests/cli/test-start-repo-directory.sh, cause TBD | MEDIUM | three suites green under a CI-like PATH with no provider CLI, red before the fix | released@2026-10-17T03:50Z | Root cause: train/99 af6b616fa+2db6d1358 registered 4 orphan tests/cli suites; GNU sed range in issue-parser.sh extract_acceptance_criteria keeps heading lines (BSD falls back, so green on macOS); 2 suites silently needed a claude CLI. Fix 060a5794c red/green under env -i and ubuntu:24.04. Tier corrected HIGH->MEDIUM (parser, not moat). TL review running. TL APPROVE (5 suites green macOS+ubuntu docker). Merged ec5cc3398. Advisory carded: switch sed \s to [[:space:]] at the root. Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| P0-P9-DEFAULT-PUSH | train/100 Tests red only on moat P9.injection-cannot-reach-token [default] leg: Loki post-session push never ran on the CI runner (push log: provider rejected x2). Intermittent on 8+ CI runs since 10-01. | tests/moat/p9-rule-of-two.sh, post-session push path (autonomy/run.sh or loki-ts) | HIGH | Root cause found and fixed, red before green under CI-like docker repro (M>=5); full moat run clean; pending.txt untouched | released@2026-10-17T03:50Z | Sonnet engineer in a worktree. Opus HIGH review follows (moat). One full rerun of run 37125941522 started per D68. Root cause: printf piped to grep -q under pipefail SIGPIPE 141 refused the post-session push under load (docker 5/18 -> 0/10). opus HIGH APPROVE (equivalence 18/20, the 2 diffs are literal-correct; P2/P7 FAILs pre-existing, missing typescript prereq). On main as 84e2b585e, engine10-push 40/0, P9 4/4 PASS. Advisory: add a "drops one function, keeps anchors" rc-3 case to test-engine10-push.sh. Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| ADV-PUSH-RC3 | engine10-push guard testable alone: run.sh keeps its anchors but drops one of the four trusted-push functions; assert rc 3, 'region lacks', no gh, no push | tests/test-engine10-push.sh | MEDIUM | new case red when the guard is forced to pass, green on main; suite 41/0 under /bin/bash | released@2026-10-17T03:50Z | TL sonnet APPROVE (43/0; mutations true-match and loop-delete each 41/2; no-push via pre-receive log with positive control); main 511937aec Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| ADV-T99-SED | issue-parser root fix: GNU-only `\s` in sed and grep patterns becomes `[[:space:]]` so BSD and GNU agree | autonomy/issue-parser.sh, issue-parser tests | MEDIUM | a case with an indented list item and a heading parses the same on macOS and ubuntu docker; existing issue-parser suites green | released@2026-10-17T03:50Z | TL sonnet APPROVE (22/0 macOS; ubuntu docker commit vs parent logs identical; one-extractor BRE revert goes red 21/1; scope grew to sed -E for BSD alternation); main 4eb538b27 Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| ADV-SEAL-JEST-E2E | loki-seal: E2E proof that a jest or vitest red still counts while coverage is NOT VERIFIED, via a stub runner bin | packages/loki-seal/test/seal.test.js | MEDIUM | stub jest exits 1: result is red with the specific reason; a mutant that ignores the exit code goes red; suite 135+/0 | released@2026-10-17T03:50Z | merged 036a05281 (TL APPROVE 138/138) Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| T101-G04-DUPROW | train/101 shard 3 R2-3 red on GNU: test hook appended a file to itself, GNU grep refuses, so no duplicate row existed | tests/test-cloud-dispatch.sh, CHANGELOG.md | MEDIUM | R2-3 red on Linux and macOS when the writer uniqueness check is weakened | released@2026-10-17T03:50Z | D81; test-only; TL sonnet APPROVE (mutation len(hits)<1 gives 83/2 on ubuntu docker and macOS; 85/0 green both); main 8b314af87 Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| T101-SEAL-NODEFLAG | train/101 shard 2: seal.test.js:1031 fixture uses node --test-isolation=none, rejected by CI Node | packages/loki-seal/test/seal.test.js (product only if it passes the flag), CHANGELOG.md | MEDIUM | the r7 no-newline honest-run test green on the CI Node and local Node, fail-closed unchanged | released@2026-10-17T03:50Z | merged def612303 (TL APPROVE: node:22 127/0/7skip env-only, parent fails r7; mutation red) Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| W1-S3 | D77 size-tied Wall cap: 90s small, 180s normal, env override clamped to 300s | loki-ts/src/engine10/sizing.ts, loki-ts/src/engine10/stages/wall.ts, loki-ts/tests/engine10/sizing.test.ts | small 90, normal 180, 999 clamps to 300, garbage falls back; killed session copies no file; timeout never already_satisfied | MEDIUM | released@2026-10-17T03:50Z | TL MEDIUM BLOCK: wiring test uses a small task so limitS 90 equals old value; wall.ts:168 mutation survived. r2 test-only fix requested (normal task -> 180, env 240 reaches session). Code itself passed: 300 stage ceiling safe, env parse ok. Merged 916f2d99d..615fd4745 + dist f0ece075d; engine10 1199/0, tsc 0, dist guard 13/0. Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
 | W1-S4 | D77 lift row: manifest off versus on | docs/v10/METRICS.md | augmentiq#52 plus 2 brownfield tasks, both arms; Wall timeouts, red-on-base count, completion, cost; logs under ~/loki-ci-logs | MEDIUM | ready@2026-10-03T08:52Z | Source: D77. Depends on W1-S2, W1-S3. Real-model leg: parked until Loki confirms key use. |
-| P0-backstop-refused | A run refused at intake (dirty tracked tree) still runs backstopCommit (git add -A plus commit) on the user's own branch, landing their dirty and untracked files on main; found by the D50-F1b opus review on base 151aa563 | loki-ts/src/engine10/supervisor.ts, its tests, dist | dirty-README fixture: refusal exit, no new commit on main, README still dirty byte-identical, notes.txt untracked | HIGH | merged@2026-10-01T12:25Z 3c46a2b6 (a70f0980; red 22/1, green 953/0; train/57) | none |
-| D50-F1c | Re-decision 12:35Z: D50-F1 stays in place (r5, released 10.5.30); B (worktree per run, D50-F1b) stays parked until a dependency strategy exists, because a worktree without node_modules or .venv lost a VERIFIED fixture. This slice fixes the in-place gap the F1b review reproduced: SIGINT or SIGTERM leaves the user's checkout on the loki/e10 run branch and can orphan the worker | loki-ts/src/engine10 supervisor (signal path), e10ext helper if needed, tests, dist | SIGINT and SIGTERM mid-run: original branch checked out, worker PID gone, run branch kept; never reset or discard user files | MEDIUM | merged@2026-10-01T12:55Z 027be0eb (e3773291; signal tests red then green, clean-tree guard added on lead review, engine10 956/0; train/58) | none |
-| D51-B01 | D51 Phase B B01 (flag LOKI_WORKSPACES, docs/v10/D51-PHASE-B.md): Test harness: register `tests/test-workspace.sh`, which sources `tests/workspace/*.sh` parts (each later slice adds only its own part) | tests/test-workspace.sh, tests/run-all-tests.sh, scripts/local-ci.sh, tests/workspace/00-smoke.sh | runner lists the suite; an empty part dir passes 1/0; shellcheck clean | LOW | merged@2026-10-01T12:46Z 12c4a6d3 (28566052, haiku; workspace, registration, shard, drift, v10-ops, shellcheck all rc 0) | none |
+| P0-backstop-refused | A run refused at intake (dirty tracked tree) still runs backstopCommit (git add -A plus commit) on the user's own branch, landing their dirty and untracked files on main; found by the D50-F1b opus review on base 151aa563 | loki-ts/src/engine10/supervisor.ts, its tests, dist | dirty-README fixture: refusal exit, no new commit on main, README still dirty byte-identical, notes.txt untracked | HIGH | released@2026-10-17T03:50Z | none Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| D50-F1c | Re-decision 12:35Z: D50-F1 stays in place (r5, released 10.5.30); B (worktree per run, D50-F1b) stays parked until a dependency strategy exists, because a worktree without node_modules or .venv lost a VERIFIED fixture. This slice fixes the in-place gap the F1b review reproduced: SIGINT or SIGTERM leaves the user's checkout on the loki/e10 run branch and can orphan the worker | loki-ts/src/engine10 supervisor (signal path), e10ext helper if needed, tests, dist | SIGINT and SIGTERM mid-run: original branch checked out, worker PID gone, run branch kept; never reset or discard user files | MEDIUM | released@2026-10-17T03:50Z | none Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| D51-B01 | D51 Phase B B01 (flag LOKI_WORKSPACES, docs/v10/D51-PHASE-B.md): Test harness: register `tests/test-workspace.sh`, which sources `tests/workspace/*.sh` parts (each later slice adds only its own part) | tests/test-workspace.sh, tests/run-all-tests.sh, scripts/local-ci.sh, tests/workspace/00-smoke.sh | runner lists the suite; an empty part dir passes 1/0; shellcheck clean | LOW | released@2026-10-17T03:50Z | none Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
 | D51-B02 | D51 Phase B B02 (flag LOKI_WORKSPACES, docs/v10/D51-PHASE-B.md): Schema plus validator for `workspaces` (repos, path, setup, after, integration, integration_files); `after` cycle and unknown-repo rejection | schemas/loki-yaml.schema.json, autonomy/lib/loki_yaml.py, tests/workspace/10-schema.sh | a valid sample passes; a cycle, an unknown `after` and a non-ignored integration file are each rejected with a named error | MEDIUM | parked | needs B01 Superseded 04:45Z: delivered by D65-MULTI 5d9e6b341, C8 089ca0e9e, D61-07 6bf2c7799 (workspace.py runner/after/SKIPPED/killpg/integration.json/task_for, worktree_prep lock+deps, cmd_workspace). |
 | D51-B03 | D51 Phase B B03 (flag LOKI_WORKSPACES, docs/v10/D51-PHASE-B.md): worktree_prep core: start ref, per-base lock, left-out-edits line, stamped dirs, never delete a kept tree | autonomy/lib/worktree_prep.py, tests/workspace/20-prep.sh | a dirty source fixture yields a worktree tree equal to base; 4 parallel preps on one base all succeed; a relaunch keeps the old dir | HIGH | parked | needs B01 Superseded 04:45Z: delivered by D65-MULTI 5d9e6b341, C8 089ca0e9e, D61-07 6bf2c7799 (workspace.py runner/after/SKIPPED/killpg/integration.json/task_for, worktree_prep lock+deps, cmd_workspace). |
 | D51-B04 | D51 Phase B B04 (flag LOKI_WORKSPACES, docs/v10/D51-PHASE-B.md): Dependency strategy: setup, CoW copy, ignore check, escape detection | autonomy/lib/worktree_deps.py, tests/workspace/30-deps.sh | editable-install venv fixture: copy refused, setup path imports worktree code; absolute-symlink node_modules refused; a non-ignored dir is never copied | HIGH | parked | needs B02/B03 Superseded 04:45Z: delivered by D65-MULTI 5d9e6b341, C8 089ca0e9e, D61-07 6bf2c7799 (workspace.py runner/after/SKIPPED/killpg/integration.json/task_for, worktree_prep lock+deps, cmd_workspace). |
-| D51-B05 | D51 Phase B B05 (flag LOKI_WORKSPACES, docs/v10/D51-PHASE-B.md): Adopt worktree_prep in backlog.py behind the flag (also closes A3b relaunch) | autonomy/lib/backlog.py, tests/test-backlog.sh | flag off: backlog 47/0 unchanged; flag on: a JS fixture issue reaches VERIFIED with node_modules present | MEDIUM | merged@2026-10-03T04:51Z | needs B04 04:45Z: deps met by worktree_prep.py (D61-07) and workspace.py (D65-MULTI); still unbuilt. c1095889f; TL APPROVE; backlog 49/0 on and off, api_start_prep 2/0. |
-| D51-B06 | D51 Phase B B06 (flag LOKI_WORKSPACES, docs/v10/D51-PHASE-B.md): Adopt worktree_prep in api_start._prepare_workdir behind the flag | dashboard/api_start.py, tests/dashboard/test_api_start_prep.py | flag on: the UI path uses the same lock and deps; flag off: byte-identical behavior | MEDIUM | merged@2026-10-03T04:51Z | needs B04 04:45Z: deps met by worktree_prep.py (D61-07) and workspace.py (D65-MULTI); still unbuilt. c1095889f; TL APPROVE; backlog 49/0 on and off, api_start_prep 2/0. |
+| D51-B05 | D51 Phase B B05 (flag LOKI_WORKSPACES, docs/v10/D51-PHASE-B.md): Adopt worktree_prep in backlog.py behind the flag (also closes A3b relaunch) | autonomy/lib/backlog.py, tests/test-backlog.sh | flag off: backlog 47/0 unchanged; flag on: a JS fixture issue reaches VERIFIED with node_modules present | MEDIUM | released@2026-10-17T03:50Z | needs B04 04:45Z: deps met by worktree_prep.py (D61-07) and workspace.py (D65-MULTI); still unbuilt. c1095889f; TL APPROVE; backlog 49/0 on and off, api_start_prep 2/0. Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| D51-B06 | D51 Phase B B06 (flag LOKI_WORKSPACES, docs/v10/D51-PHASE-B.md): Adopt worktree_prep in api_start._prepare_workdir behind the flag | dashboard/api_start.py, tests/dashboard/test_api_start_prep.py | flag on: the UI path uses the same lock and deps; flag off: byte-identical behavior | MEDIUM | released@2026-10-17T03:50Z | needs B04 04:45Z: deps met by worktree_prep.py (D61-07) and workspace.py (D65-MULTI); still unbuilt. c1095889f; TL APPROVE; backlog 49/0 on and off, api_start_prep 2/0. Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
 | D51-B07 | D51 Phase B B07 (flag LOKI_WORKSPACES, docs/v10/D51-PHASE-B.md): group.json store: atomic write, single writer, reader API | autonomy/lib/workspace_state.py, tests/workspace/40-state.sh | a killed writer never leaves a partial file; a second writer pid is refused | MEDIUM | parked | needs B01 Superseded 04:45Z: delivered by D65-MULTI 5d9e6b341, C8 089ca0e9e, D61-07 6bf2c7799 (workspace.py runner/after/SKIPPED/killpg/integration.json/task_for, worktree_prep lock+deps, cmd_workspace). |
 | D51-B08 | D51 Phase B B08 (flag LOKI_WORKSPACES, docs/v10/D51-PHASE-B.md): Runner: fan-out per repo, `after` ordering, SKIPPED on predecessor failure, killpg on SIGTERM, exit codes | autonomy/lib/workspace.py, tests/workspace/50-run.sh | stub launcher: parallel repos overlap, the dependent starts after the predecessor, a failing predecessor marks the dependent SKIPPED, SIGTERM leaves no child alive | HIGH | parked | needs B07/B03/B04 Superseded 04:45Z: delivered by D65-MULTI 5d9e6b341, C8 089ca0e9e, D61-07 6bf2c7799 (workspace.py runner/after/SKIPPED/killpg/integration.json/task_for, worktree_prep lock+deps, cmd_workspace). |
 | D51-B09 | D51 Phase B B09 (flag LOKI_WORKSPACES, docs/v10/D51-PHASE-B.md): Per-repo task text: section split, preamble, `LOKI_E10_TASK_TEXT` only (no issue.json in the run) | autonomy/lib/workspace_task.py, tests/workspace/60-task.sh | a 2-section issue gives each repo only its section; no issue.json exists in either run dir; untrusted text is never placed in argv | HIGH | parked | needs B08 Superseded 04:45Z: delivered by D65-MULTI 5d9e6b341, C8 089ca0e9e, D61-07 6bf2c7799 (workspace.py runner/after/SKIPPED/killpg/integration.json/task_for, worktree_prep lock+deps, cmd_workspace). |
 | D51-B10 | D51 Phase B B10 (flag LOKI_WORKSPACES, docs/v10/D51-PHASE-B.md): Integration runner plus evidence.json (not a Seal) | autonomy/lib/workspace_integration.py, tests/workspace/70-integration.sh | a passing compose stub gives exit 0 and matching SHAs; a timeout is FAILED, never passed; integration_files absent from every engine worktree | HIGH | parked | needs B08 Superseded 04:45Z: delivered by D65-MULTI 5d9e6b341, C8 089ca0e9e, D61-07 6bf2c7799 (workspace.py runner/after/SKIPPED/killpg/integration.json/task_for, worktree_prep lock+deps, cmd_workspace). |
-| D51-B11 | D51 Phase B B11 (flag LOKI_WORKSPACES, docs/v10/D51-PHASE-B.md): PR comment with the integration result, via the existing gh token path (no LLM in the step) | autonomy/lib/workspace_comment.py, tests/workspace/80-comment.sh | stub gh receives one comment per PR; the token appears in no log or argv | MEDIUM | merged@2026-10-03T04:49Z | needs B09/B10 04:45Z: deps met by worktree_prep.py (D61-07) and workspace.py (D65-MULTI); still unbuilt. Built c09dfd1eb+933ecc9fc; TL APPROVE r2 (r1 BLOCK: CHANGELOG x279, body perms); test-workspace 14/0 on main. |
+| D51-B11 | D51 Phase B B11 (flag LOKI_WORKSPACES, docs/v10/D51-PHASE-B.md): PR comment with the integration result, via the existing gh token path (no LLM in the step) | autonomy/lib/workspace_comment.py, tests/workspace/80-comment.sh | stub gh receives one comment per PR; the token appears in no log or argv | MEDIUM | released@2026-10-17T03:50Z | needs B09/B10 04:45Z: deps met by worktree_prep.py (D61-07) and workspace.py (D65-MULTI); still unbuilt. Built c09dfd1eb+933ecc9fc; TL APPROVE r2 (r1 BLOCK: CHANGELOG x279, body perms); test-workspace 14/0 on main. Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
 | D51-B12 | D51 Phase B B12 (flag LOKI_WORKSPACES, docs/v10/D51-PHASE-B.md): CLI `loki workspace` subcommand (list, show, run, status, clean) | autonomy/loki, tests/workspace/90-cli.sh | flag off: the command says it is disabled; `clean` never removes a worktree whose branch has an open PR | MEDIUM | parked | needs B08 Superseded 04:45Z: delivered by D65-MULTI 5d9e6b341, C8 089ca0e9e, D61-07 6bf2c7799 (workspace.py runner/after/SKIPPED/killpg/integration.json/task_for, worktree_prep lock+deps, cmd_workspace). |
 | D51-B13 | D51 Phase B B13 (flag LOKI_WORKSPACES, docs/v10/D51-PHASE-B.md): Dashboard endpoints reading group.json; run launches a detached runner | dashboard/api_workspaces.py, dashboard/server.py, tests/dashboard/test_api_workspaces.py | the group survives an app restart; non-loopback Host gets 403; control scope required for run | HIGH | parked@2026-10-03T09:52Z | superseded by D51-B13r (integration.json, no group.json) |
 | D51-B14 | D51 Phase B B14 (flag LOKI_WORKSPACES, docs/v10/D51-PHASE-B.md): Dashboard group card (per-repo rows, integration row, stale-evidence badge) | legacy-ui-static/start.html | Playwright: a fixture group renders 2 repo rows plus integration; a mismatched head SHA shows stale | LOW | parked@2026-10-03T09:52Z | superseded by D51-B14r |
@@ -741,16 +741,16 @@ Source: ~/git/autonomi-dev/research/2026-09-30-adoption/SWARM-PROMPT-ADOPTION.md
 | E-162 | Founder "faster" (03:05Z): slice CI runs only Tier A plus diff-selected suites (the existing Tier A selection), Bun Parity and the structural guards; the full 8-shard Tests stays on train/** and main, and the train stays the release verdict. Frees runners and targets about 2 min slice CI | .github/workflows/test.yml (slice-* job matrix only), tests | HIGH | slice-* push runs no 8-shard matrix; train/** and main still run all 8 shards; a slice touching a suite runs that suite | released@2026-10-16T00:49Z | after E-157 r4 (same file) |
 | E-165 | tests/test-mirofish-integration.sh line 413 runs `autonomy/loki start --no-mirofish` in the repo root: a live autonomous build that ran about 45 min, switched a worktree branch to loki/session-* and committed a docs change (found by DOC-02). Guard: the test must run against a run-owned fixture repo with a stub provider and LOKI_NO_BROWSER=1, never the repo root; add a structural guard that no test launches start/run against REPO_ROOT | tests/test-mirofish-integration.sh, a structural guard | HIGH | the test never runs loki start in the repo root; guard catches a planted case | released@2026-10-16T00:49Z | P0 guard (D26) |
 | E-166 | Jira auto-sync never starts: src/integrations/sync-subscriber.js builds JiraApiClient without the required email and apiToken, so LOKI_JIRA_URL plus LOKI_JIRA_TOKEN do nothing (DOC-02 added a known-issue note to the setup docs). Fix the wiring or remove the advertised auto-sync | src/integrations/sync-subscriber.js, tests | MEDIUM | with env set, the subscriber constructs a working client (mocked API) | released@2026-10-16T00:49Z | none |
-| P0-promote-bun | Auto-promote of 10.5.22 failed: promote.yml ran the first-run gate without bun, the installed CLI fell back to legacy, 7 v10 checks failed and the cost check crashed (IndexError). Install bun before the gate; cost check fails closed; explicit engine-fallback check | .github/workflows/promote.yml, scripts/first-run-gate.sh, tests/test-first-run-gate.sh | test-first-run-gate 56/0 incl. fallback fixture; gate --stub 0 failed | HIGH | merged@2026-10-01T07:09Z | opus CTO APPROVE 5bdfe2f8 |
+| P0-promote-bun | Auto-promote of 10.5.22 failed: promote.yml ran the first-run gate without bun, the installed CLI fell back to legacy, 7 v10 checks failed and the cost check crashed (IndexError). Install bun before the gate; cost check fails closed; explicit engine-fallback check | .github/workflows/promote.yml, scripts/first-run-gate.sh, tests/test-first-run-gate.sh | test-first-run-gate 56/0 incl. fallback fixture; gate --stub 0 failed | HIGH | released@2026-10-17T03:50Z | opus CTO APPROVE 5bdfe2f8 Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
 | E-167 | Gate the no-bun path end to end (CTO follow-up to P0-promote-bun): run the default entry with bun absent from PATH and assert the legacy receipt, NOT VERIFIED on a skipped target and the documented exit codes, with the legacy 15-line budget and legacy verify (the v10 leg keeps 8 lines; scripts/first-run-gate.sh:123 forces LOKI_ENGINE=v10 for verify, which is why a bun-less run failed digest, verify and signed); the promote gate currently proves only the bun path | scripts/first-run-gate.sh, tests/test-first-run-gate.sh | no-bun stub run fails closed on a skipped test; clean no-bun run reads its legacy receipt | MEDIUM | released@2026-10-16T00:49Z | none |
 | E-161b | E-161 false block: the hook judges a detaching checkout by the hook cwd (the main checkout) and ignores a preceding checked cd into a linked worktree; at 07:20Z a cd into the release worktree followed by git checkout --detach was blocked (RULE8), and the release only proceeded via git -C. Resolve the effective directory from a leading checked cd or from git -C before applying RULE8 | scripts/v10-guard.sh, tests/test-v10-guard.sh | checked cd into a linked worktree then detach: allowed; cwd main with no cd: blocked; git -C linked: allowed | HIGH | released@2026-10-16T00:49Z | none |
-| P0-nobun | D48 flip does nothing on a bun-less npm install: bin/loki falls back to legacy without bun, and loki-ts/dist/loki.js is built for target bun (node gives ReferenceError: Bun is not defined). Make the Loki 10 engine run without a preinstalled bun (node-runnable build, or bun shipped as an npm dependency) and, when neither works, say so plainly on the start line. Architect plan first | bin/loki, loki-ts/scripts/build.ts, package.json (per plan) | bun-less host runs the v10 default or prints the plain cannot-run line; promote gate no-bun leg (E-167) passes | HIGH | merged@2026-10-01T07:52Z | opus architect plan in progress |
+| P0-nobun | D48 flip does nothing on a bun-less npm install: bin/loki falls back to legacy without bun, and loki-ts/dist/loki.js is built for target bun (node gives ReferenceError: Bun is not defined). Make the Loki 10 engine run without a preinstalled bun (node-runnable build, or bun shipped as an npm dependency) and, when neither works, say so plainly on the start line. Architect plan first | bin/loki, loki-ts/scripts/build.ts, package.json (per plan) | bun-less host runs the v10 default or prints the plain cannot-run line; promote gate no-bun leg (E-167) passes | HIGH | released@2026-10-17T03:50Z | opus architect plan in progress Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
 | E-169 | Docker image and Homebrew formula use the same bun resolver as bin/loki (peer condition 3 for founder queue 17): the Docker image must contain a working bun so the default runs Loki 10; the Homebrew formula must either depend on bun or let the resolver print the plain cannot-run line | Dockerfile, Dockerfile.sandbox, the Homebrew formula (find it) | docker run of the image prints the Loki 10 start line; brew-style layout resolves bun or prints the plain line | MEDIUM | released@2026-10-16T00:49Z | none |
 | E-170 | Verify what still works after npm install --omit=optional before documenting it as a slim install: it also drops the existing @anthropic-ai optional packages (about 247MB of the measured 370MB delta). List which commands break and either document the slim path with its limits or recommend against it | package.json, docs/INSTALLATION.md | a scripted --omit=optional install runs loki --version, loki quick on the stub provider and loki verify; results recorded | LOW | released@2026-10-16T00:49Z | measured 08:33Z on 10.5.25 (haiku): slim 30,280 KB vs full 407,656 KB; omits @anthropic-ai/claude-agent-sdk, bun, @opentelemetry/*; --version, help, doctor and quick (stub claude) reported rc 0. NOT yet documented: the report omitted the stderr evidence of the plain cannot-run line on quick; re-check that before adding the slim path to docs/INSTALLATION.md |
-| D49-auto | Auto-promote to latest on Post-Release Smoke success (founder D49) | .github/workflows/promote.yml, tests/test_release_next_tag.py | HIGH | smoke-success from Release promotes; manual smoke never promotes; not-lower guard | merged@2026-10-01T03:03Z | opus APPROVE 5510b8c8. Follow-ups (D49-auto-b): not-lower guard fails OPEN on an npm error (make it fail closed); loki-mode-sdk latest has no not-lower guard; a newer queued promote can replace a pending one in a release burst |
-| D51-A3 | Headless `loki backlog owner/repo --all/--label/--issues` plus loki.yaml (schema, validator, env overrides) | autonomy/lib/backlog.py, autonomy/lib/loki_yaml.py, autonomy/loki, schemas/loki-yaml.schema.json, tests/test-backlog.sh | HIGH | backlog 47/0 | merged@2026-10-01T03:11Z | sonnet APPROVE 14ff9ae2; follow-up D51-A3b: `loki_yaml.py show` echoes a token pasted into git.token_env (redact x-secret-ref fields); no-parser test case; re-run of a failed issue discards its kept worktree |
-| D51-A4 | Slack on the v10 path (PR opened, BLOCKED, finished), webhook from the env var named by LOKI_SLACK_WEBHOOK_ENV, URL redacted, 5s bounded post | loki-ts/src/e10ext/slack_events.ts, engine10/supervisor.ts, tests | MEDIUM | slack tests 40/0 | merged@2026-10-01T03:11Z | sonnet APPROVE adb838b2; one labelled test message after it ships |
-| D48-r10 | loki-seal in the repo plugin marketplace (`/plugin marketplace add asklokesh/loki-mode`, `/plugin install loki-seal@loki-mode`), README line 4 | .claude-plugin/marketplace.json, README.md, tests/test-loki-seal-marketplace.sh | MEDIUM | clean-HOME install works; marketplace test 8/0 | merged@2026-10-01T03:11Z | sonnet APPROVE 5ecab20d; nit: blank line between README lines 3 and 4 (DOC-01 owns README) |
+| D49-auto | Auto-promote to latest on Post-Release Smoke success (founder D49) | .github/workflows/promote.yml, tests/test_release_next_tag.py | HIGH | smoke-success from Release promotes; manual smoke never promotes; not-lower guard | released@2026-10-17T03:50Z | opus APPROVE 5510b8c8. Follow-ups (D49-auto-b): not-lower guard fails OPEN on an npm error (make it fail closed); loki-mode-sdk latest has no not-lower guard; a newer queued promote can replace a pending one in a release burst Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| D51-A3 | Headless `loki backlog owner/repo --all/--label/--issues` plus loki.yaml (schema, validator, env overrides) | autonomy/lib/backlog.py, autonomy/lib/loki_yaml.py, autonomy/loki, schemas/loki-yaml.schema.json, tests/test-backlog.sh | HIGH | backlog 47/0 | released@2026-10-17T03:50Z | sonnet APPROVE 14ff9ae2; follow-up D51-A3b: `loki_yaml.py show` echoes a token pasted into git.token_env (redact x-secret-ref fields); no-parser test case; re-run of a failed issue discards its kept worktree Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| D51-A4 | Slack on the v10 path (PR opened, BLOCKED, finished), webhook from the env var named by LOKI_SLACK_WEBHOOK_ENV, URL redacted, 5s bounded post | loki-ts/src/e10ext/slack_events.ts, engine10/supervisor.ts, tests | MEDIUM | slack tests 40/0 | released@2026-10-17T03:50Z | sonnet APPROVE adb838b2; one labelled test message after it ships Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| D48-r10 | loki-seal in the repo plugin marketplace (`/plugin marketplace add asklokesh/loki-mode`, `/plugin install loki-seal@loki-mode`), README line 4 | .claude-plugin/marketplace.json, README.md, tests/test-loki-seal-marketplace.sh | MEDIUM | clean-HOME install works; marketplace test 8/0 | released@2026-10-17T03:50Z | sonnet APPROVE 5ecab20d; nit: blank line between README lines 3 and 4 (DOC-01 owns README) Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
 | P0-t15 | train/15 and train/17 red: quiet `loki quick` default output 16 lines (stderr noise: mkdir .loki/config File exists, 2 caveman bootstrap lines, echo broken pipe). Fix: caveman notices to the quiet run log, fold a sentinel-only .loki/config into the config dir (never ~/.loki), SIGPIPE reset via python3 re-exec guarded by an import probe | autonomy/run.sh, autonomy/loki, tests/test-quick-config-safety.sh | MEDIUM | default output at most 15 lines; ~/.loki/config untouched from $HOME; broken python3 still runs | released@2026-10-01T02:27Z | r1 REJECT (config clobber, python3 guard); r2 54da8960 APPROVE (config-safety 5/0, receipt-order 14/0 at 12 lines, crash-cli 57/0) Released in v10.5.16 (merge e7e39e27 is an ancestor of v10.5.16). |
 | A-113 | Stop reasons: STALLED and the fatal classifier (item 5) | see plan A-113 | HIGH | first-run-gate assertion per plan card | released@2026-10-01T01:19Z | Wave per plan section 5; one writer per file. Released in v10.5.14 (merge 0377398d is an ancestor of v10.5.14). |
 | A-114 | FALSE VERIFIED ON MAIN (found by the A-112 opus reviewer, repro m6 on 4ad430ad): bugrepo plus an unrelated red test; the agent changes only other.js; verify selects only node:other.test.js (testmap from the diff), so the task's own target test sums.test.js is never run and the run seals VERIFIED rc=0 while it is red. Fix: the relevant tests of the task-named files (hasRelevantTests / impacted(likely), the lean-path Wall stand-in) are ALWAYS selected by verify, whatever the diff touches | loki-ts/src/engine10/stages/verify.ts or testmap selection, tests | HIGH | m6 fixture seals FAILED | released@2026-10-16T00:49Z | coordinate with A-112 (verify.ts, same target notion); P0 moat |
@@ -845,93 +845,93 @@ Source: ~/git/autonomi-dev/research/2026-09-30-adoption/SWARM-PROMPT-ADOPTION.md
 | P0-CONTROL-LINUX | train/85 ubuntu red: control_default timed out because a repo-root node_modules disables bun auto-install (hono missing) | loki-ts/src/commands/control.ts, loki-ts/tests/commands/control_default.test.ts, CHANGELOG.md | HIGH | merged@2026-10-03T04:56Z | opus APPROVE (reproduced in oven/bun:1.3.13; npm tarball uses bundled dist/server.js so no runtime fetch); cherry-picked 2d6e4a77d, dist 377871c88, dist guard 13/0. Follow-up: frozen-lockfile install of packages/control-plane in CI |
 | D63-C7 | TRACKERS: Jira and Linear intake polish | features/tracker_intake.ts, docs/trackers.md, README | MEDIUM | merged@2026-10-03T03:55Z | TL APPROVE 5c002ae69; cherry-picked 6fd472e1a into train 85. Advisory: suffix/userinfo/port negative tests. |
 | P0-D66-FENCE | Fix-forward: lean_select value-imported stages/plan (train 83 Coverage red, run 37092508809) | engine10/relevant_files.ts, stages/plan.ts, features/speed/lean_select.ts | MEDIUM | merged@2026-10-03T03:21Z | TL APPROVE; 53182ff94; budget.test 27/0, typecheck rc 0. |
-| PO-CL-1 | CHANGELOG Unreleased hygiene: drop already-shipped duplicates and the stale trailing [Unreleased] heading | CHANGELOG.md | each bullet at most once across Unreleased and released sections; grep -c "^## \[Unreleased\]" is 0; dash guard passes | LOW | merged@2026-10-03T08:53Z | merged ab4dea609 (TL APPROVE); PO batch 08:53Z. Released sections untouched. |
-| PO-DOC-1 | README: document loki verify --export-dsse and loki workspace list/show/run/status | README.md | grep finds export-dsse and "workspace run"; flags match bash autonomy/loki help workspace | LOW | merged@2026-10-03T08:53Z | merged a85806aaf (TL APPROVE); PO batch 08:53Z (PO-DOC-1 and PO-DOC-2 merged into one README slice). |
-| PO-DOC-3 | release-checklist notes the PREV_NOT_ON_NPM refusal; fix the dangling PLATFORM-SUPPORT reference | docs/dev/release-checklist.md, docs/UNREACHABLE-TESTS.md | grep PREV_NOT_ON_NPM release-checklist >= 1; no missing path named | LOW | merged@2026-10-03T08:53Z | merged 739759155 (TL APPROVE); PO batch 08:53Z. |
-| PO-HELP-1 | CLI help: add loki help answer and --export-dsse to loki help verify | autonomy/loki (help functions only) | help answer exits 0 and shows --text; help verify mentions dsse; bash -n; help tests pass | MEDIUM | merged@2026-10-03T09:24Z | merged ef50958a5 (TL APPROVE; help-no-recursion 9/0 on main, red 7/2 at parent) |
-| SEC-SCAN-1 | tests/test-secret-scan.sh 5/1 on main (real AWS key -> got pass/VERIFIED/0, expected fail/BLOCKED/2) | tests/test-secret-scan.sh and the secret-scan gate it exercises | suite green on main; root cause named (host gitleaks dependence vs real gate regression); no gate weakened | MEDIUM | merged@2026-10-03T09:22Z | merged 04f62ff4e (TL APPROVE; root cause: fixture AKIAIOSFODNN7EXAMPLE is gitleaks-allowlisted; 6/0 with and without gitleaks; mutation 3/3 red) |
-| PO-AUDIT-CLI-1 | S-221 re-cut: python3 dashboard/audit.py verify exits 0 on an empty or pre-hash audit dir though it checked nothing; exit 2 with status not_verified, keep valid field and tip untouched | dashboard/audit.py (_unified_cli verify branch and docstring only), tests/dashboard/test_audit_verify_cli_nothing_checked.py (new), docs/audit-logging.md (exit codes), CHANGELOG.md | python3 -m pytest -q tests/dashboard/test_audit_verify_cli_nothing_checked.py (empty dir 2, valid chain 0, tampered 1, tip on empty dir still 0; red on current main); python3 -m pytest -q tests/dashboard/test_audit_verify_nothing_checked.py; bash tests/test-audit-chain-honesty.sh; bash tests/test-audit-js-suites.sh | MEDIUM | merged@2026-10-03T09:27Z | main db276a24e; TL APPROVE (tampered=1, empty=2 nothing_checked); pytest 11 passed |
-| PO-DASH-HONEST-1 | S-222 + S-223 re-cut: skill-session WebSocket push hardcodes running_agents 0; notification triggers panel says No triggers configured after a failed read | dashboard/server.py (skill-session payload near line 1042 and get_notification_triggers only), legacy-ui/components/loki-notification-center.js (_loadTriggers and empty branch only), tests/dashboard/test_skill_session_ws_running_agents.py (new), tests/dashboard/test_notification_triggers_unreadable.py (new), legacy-ui/tests/loki-notification-triggers-error.node.test.mjs (new), CHANGELOG.md | pytest on the two new files red then green (running_agents None when unmeasured, triggers null plus error on a corrupt file, [] on a missing one); node --test legacy-ui/tests/loki-notification-triggers-error.node.test.mjs (error text lacks No triggers configured, empty list keeps it); python3 -m pytest -q tests/dashboard -k "notification or skill_session" | LOW | merged@2026-10-03T09:30Z | main 99674923f; TL APPROVE; pytest 7 passed, node 3/0 |
-| PO-WEB-COST-1 | S-224 re-cut: web-app Evidence Receipt Cost field and Metrics cost trend show a partly priced run (cost_partial true) as a complete cost | web-app/src/components/EvidenceReceiptPanel.tsx (Cost field only), web-app/src/api/client.ts (ProofDetail cost type and cost/timeline runs type only), web-app/src/pages/MetricsPage.tsx (costTrend only), web-app/src/components/EvidenceReceiptPanel.cost.test.mjs (new), CHANGELOG.md | node --test web-app/src/components/EvidenceReceiptPanel.cost.test.mjs (cost_partial true renders at least $1.20, absent keeps $1.20, partial trend label carries (partial); red before); cd web-app && npx tsc -b rc 0 | MEDIUM | merged@2026-10-03T09:27Z | main 4a429626b; TL APPROVE; node 4/0; shard markers fixed 8106e6a72 |
-| PO-STANDALONE-COST-1 | S-225 re-cut: standalone receipts list shows a partly priced run as a complete cost | legacy-ui/scripts/build-standalone.js (loadReceipts cost cell only), tests/test-receipts-panel.sh (one new leg), CHANGELOG.md | bash tests/test-receipts-panel.sh rc 0 with the new leg asserting at least $X.XX only when cost_partial is true (red before); bash tests/test-budget-banner-dedup.sh rc 0 | LOW | merged@2026-10-03T09:27Z | main f99c8cc64; TL APPROVE; receipts-panel 21/0 |
-| PO-WEB-DEPLOY-1 | S-228 re-cut: DeployConnections connect and disconnect handlers push synthesized default not-connected statuses upward after their own fetch failed | web-app/src/components/DeployConnections.tsx (connect and disconnect handlers only, lines 395-440), web-app/src/components/DeployConnections.propagate.test.mjs (new), CHANGELOG.md | node --test web-app/src/components/DeployConnections.propagate.test.mjs (no synthesized statuses reach onStatusChange after a failed fetch; red before); node --test web-app/src/components/DeployConnections.state.test.mjs; cd web-app && npx tsc -b rc 0 | LOW | merged@2026-10-03T09:30Z | main fd92d52f0 (r2 3ade22ae1 adds runner+shard row, the sole TL finding; CoS verified shard-coverage 19/0, drift 6/0) |
-| PO-WEB-WORKSPACE-1 | S-229 + S-230 re-cut: preview header says Detecting project type forever after a failed preview-info fetch; unknown phases label building and Replay Build can never show (buildPhase returns idle when not building, so the complete branch is unreachable) | web-app/src/components/ProjectWorkspace.tsx (getPreviewInfo call and the two Detecting project type branches ~1877 and ~2093; buildPhase memo ~1401-1410 and Replay Build condition ~1488 only), web-app/src/components/ProjectWorkspace.preview.test.mjs (new), web-app/src/components/ProjectWorkspace.phase.test.mjs (new), CHANGELOG.md | node --test on both new files (rejected fetch renders Could not detect project type; unrecognized phase is not building; completed idle session shows Replay Build; red before); node --test web-app/src/components/ProjectWorkspace.panels.test.mjs; cd web-app && npx tsc -b rc 0 | LOW | merged@2026-10-03T09:30Z | main 38ae6a29c; TL APPROVE; node 16/0 with DEPLOY tests |
-| PO-WS-METRICS-1 | D51-B15 re-cut (its gate B07 was superseded and there is no group.json; runs record only integration.json): record per-repo started_at and finished_at in integration.json, add workspace_metrics.py reporting PRs per wall-clock hour and per attention minute; runs lacking timestamps are reported as unmeasured, never counted as zero | autonomy/lib/workspace.py (run loop and integration.json write only), autonomy/lib/workspace_metrics.py (new), tests/workspace/95-metrics.sh (new, register in the runner and a shard row, timeout -k, shellcheck), docs/WORKSPACES.md, CHANGELOG.md | bash tests/workspace/95-metrics.sh (fixture run gives the hand-computed rate; an old integration.json without timestamps prints unmeasured; red before); bash tests/workspace/50-run.sh and 00-smoke.sh rc 0; structural-checks.sh and shard registration guards rc 0 | MEDIUM | merged@2026-10-03T09:30Z | main 624b5d964; TL APPROVE; test-workspace 19/0 |
-| PO-SESSION-COMMIT-1 | S-219 + S-220 re-cut (legacy run.sh): a failed git add -A makes the session commit silently commit nothing; the untrack step's global git reset drops force-staged agent files from the session commit | autonomy/run.sh (commit_session_changes add block ~11065 and _loki_untrack_agent_committed_user_files ~10985 only), tests/test-session-commit-add-failure.sh (new), tests/test-untrack-keeps-force-staged.sh (new), both registered in the runner with shard rows, CHANGELOG.md | both new tests rc 0 and red when the rc check or git reset -q is restored in a scratch copy; bash tests/test-branch-lifecycle.sh rc 0; bash -n autonomy/run.sh; shellcheck on changed files; structural-checks.sh rc 0 | MEDIUM | merged@2026-10-03T09:40Z | 939e23126. TL APPROVE (exit 128 aborts the add, index restore reproduced, both mutants red). On main: new tests 7/0 and 5/0, bash -n ok, shard 19/0, drift 6/0. |
-| PO-COUNCIL-LABEL-TEST-1 | S-213 re-cut: the Council vote header in cost.html and the council prefix plus title on the proofs.html badge have no test of their own | legacy-ui/tests/static-council-vote-label.node.test.mjs (new; reads legacy-ui-static/proofs.html and cost.html, edits neither) | node --test legacy-ui/tests/static-council-vote-label.node.test.mjs passes (proofs.html line 152 prefix and title, cost.html line 308 header); renaming the header or dropping the title in a scratch copy fails it | LOW | merged@2026-10-03T09:35Z | c331cde1a (r2 23f2c4e5f: content-anchored matching, shard row). CoS verified on main: node --test 2/0, shard coverage 19/0, drift 6/0. Test-only, no CHANGELOG. |
-| PO-P7-SINKS-1 | E-138: P7 no-fabricated-data scanner misses optional-call sinks and one-hop aliases (setRows?.([...]), window[k]?.(rows), const s = setRows; s(rows), a memo that forwards a fabricator result) | tests/moat/p7-no-fabricated-data.sh (and its red and green fixtures under tests/moat/ only) | bash tests/moat/p7-no-fabricated-data.sh with a red and a green fixture per form, each red before the change; the existing fixtures keep their verdicts; moat suite 4/9 or better unchanged | HIGH | merged@2026-10-03T09:46Z | b2b592b29. Opus APPROVE: 13 added findings, 0 removed, real tree 0 findings, each arm mutation-red. On main all four P7 cases PASS. Advisory: SCALAR_READ exclusion has no pinning fixture. |
+| PO-CL-1 | CHANGELOG Unreleased hygiene: drop already-shipped duplicates and the stale trailing [Unreleased] heading | CHANGELOG.md | each bullet at most once across Unreleased and released sections; grep -c "^## \[Unreleased\]" is 0; dash guard passes | LOW | released@2026-10-17T03:50Z | merged ab4dea609 (TL APPROVE); PO batch 08:53Z. Released sections untouched. Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| PO-DOC-1 | README: document loki verify --export-dsse and loki workspace list/show/run/status | README.md | grep finds export-dsse and "workspace run"; flags match bash autonomy/loki help workspace | LOW | released@2026-10-17T03:50Z | merged a85806aaf (TL APPROVE); PO batch 08:53Z (PO-DOC-1 and PO-DOC-2 merged into one README slice). Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| PO-DOC-3 | release-checklist notes the PREV_NOT_ON_NPM refusal; fix the dangling PLATFORM-SUPPORT reference | docs/dev/release-checklist.md, docs/UNREACHABLE-TESTS.md | grep PREV_NOT_ON_NPM release-checklist >= 1; no missing path named | LOW | released@2026-10-17T03:50Z | merged 739759155 (TL APPROVE); PO batch 08:53Z. Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| PO-HELP-1 | CLI help: add loki help answer and --export-dsse to loki help verify | autonomy/loki (help functions only) | help answer exits 0 and shows --text; help verify mentions dsse; bash -n; help tests pass | MEDIUM | released@2026-10-17T03:50Z | merged ef50958a5 (TL APPROVE; help-no-recursion 9/0 on main, red 7/2 at parent) Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| SEC-SCAN-1 | tests/test-secret-scan.sh 5/1 on main (real AWS key -> got pass/VERIFIED/0, expected fail/BLOCKED/2) | tests/test-secret-scan.sh and the secret-scan gate it exercises | suite green on main; root cause named (host gitleaks dependence vs real gate regression); no gate weakened | MEDIUM | released@2026-10-17T03:50Z | merged 04f62ff4e (TL APPROVE; root cause: fixture AKIAIOSFODNN7EXAMPLE is gitleaks-allowlisted; 6/0 with and without gitleaks; mutation 3/3 red) Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| PO-AUDIT-CLI-1 | S-221 re-cut: python3 dashboard/audit.py verify exits 0 on an empty or pre-hash audit dir though it checked nothing; exit 2 with status not_verified, keep valid field and tip untouched | dashboard/audit.py (_unified_cli verify branch and docstring only), tests/dashboard/test_audit_verify_cli_nothing_checked.py (new), docs/audit-logging.md (exit codes), CHANGELOG.md | python3 -m pytest -q tests/dashboard/test_audit_verify_cli_nothing_checked.py (empty dir 2, valid chain 0, tampered 1, tip on empty dir still 0; red on current main); python3 -m pytest -q tests/dashboard/test_audit_verify_nothing_checked.py; bash tests/test-audit-chain-honesty.sh; bash tests/test-audit-js-suites.sh | MEDIUM | released@2026-10-17T03:50Z | main db276a24e; TL APPROVE (tampered=1, empty=2 nothing_checked); pytest 11 passed Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| PO-DASH-HONEST-1 | S-222 + S-223 re-cut: skill-session WebSocket push hardcodes running_agents 0; notification triggers panel says No triggers configured after a failed read | dashboard/server.py (skill-session payload near line 1042 and get_notification_triggers only), legacy-ui/components/loki-notification-center.js (_loadTriggers and empty branch only), tests/dashboard/test_skill_session_ws_running_agents.py (new), tests/dashboard/test_notification_triggers_unreadable.py (new), legacy-ui/tests/loki-notification-triggers-error.node.test.mjs (new), CHANGELOG.md | pytest on the two new files red then green (running_agents None when unmeasured, triggers null plus error on a corrupt file, [] on a missing one); node --test legacy-ui/tests/loki-notification-triggers-error.node.test.mjs (error text lacks No triggers configured, empty list keeps it); python3 -m pytest -q tests/dashboard -k "notification or skill_session" | LOW | released@2026-10-17T03:50Z | main 99674923f; TL APPROVE; pytest 7 passed, node 3/0 Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| PO-WEB-COST-1 | S-224 re-cut: web-app Evidence Receipt Cost field and Metrics cost trend show a partly priced run (cost_partial true) as a complete cost | web-app/src/components/EvidenceReceiptPanel.tsx (Cost field only), web-app/src/api/client.ts (ProofDetail cost type and cost/timeline runs type only), web-app/src/pages/MetricsPage.tsx (costTrend only), web-app/src/components/EvidenceReceiptPanel.cost.test.mjs (new), CHANGELOG.md | node --test web-app/src/components/EvidenceReceiptPanel.cost.test.mjs (cost_partial true renders at least $1.20, absent keeps $1.20, partial trend label carries (partial); red before); cd web-app && npx tsc -b rc 0 | MEDIUM | released@2026-10-17T03:50Z | main 4a429626b; TL APPROVE; node 4/0; shard markers fixed 8106e6a72 Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| PO-STANDALONE-COST-1 | S-225 re-cut: standalone receipts list shows a partly priced run as a complete cost | legacy-ui/scripts/build-standalone.js (loadReceipts cost cell only), tests/test-receipts-panel.sh (one new leg), CHANGELOG.md | bash tests/test-receipts-panel.sh rc 0 with the new leg asserting at least $X.XX only when cost_partial is true (red before); bash tests/test-budget-banner-dedup.sh rc 0 | LOW | released@2026-10-17T03:50Z | main f99c8cc64; TL APPROVE; receipts-panel 21/0 Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| PO-WEB-DEPLOY-1 | S-228 re-cut: DeployConnections connect and disconnect handlers push synthesized default not-connected statuses upward after their own fetch failed | web-app/src/components/DeployConnections.tsx (connect and disconnect handlers only, lines 395-440), web-app/src/components/DeployConnections.propagate.test.mjs (new), CHANGELOG.md | node --test web-app/src/components/DeployConnections.propagate.test.mjs (no synthesized statuses reach onStatusChange after a failed fetch; red before); node --test web-app/src/components/DeployConnections.state.test.mjs; cd web-app && npx tsc -b rc 0 | LOW | released@2026-10-17T03:50Z | main fd92d52f0 (r2 3ade22ae1 adds runner+shard row, the sole TL finding; CoS verified shard-coverage 19/0, drift 6/0) Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| PO-WEB-WORKSPACE-1 | S-229 + S-230 re-cut: preview header says Detecting project type forever after a failed preview-info fetch; unknown phases label building and Replay Build can never show (buildPhase returns idle when not building, so the complete branch is unreachable) | web-app/src/components/ProjectWorkspace.tsx (getPreviewInfo call and the two Detecting project type branches ~1877 and ~2093; buildPhase memo ~1401-1410 and Replay Build condition ~1488 only), web-app/src/components/ProjectWorkspace.preview.test.mjs (new), web-app/src/components/ProjectWorkspace.phase.test.mjs (new), CHANGELOG.md | node --test on both new files (rejected fetch renders Could not detect project type; unrecognized phase is not building; completed idle session shows Replay Build; red before); node --test web-app/src/components/ProjectWorkspace.panels.test.mjs; cd web-app && npx tsc -b rc 0 | LOW | released@2026-10-17T03:50Z | main 38ae6a29c; TL APPROVE; node 16/0 with DEPLOY tests Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| PO-WS-METRICS-1 | D51-B15 re-cut (its gate B07 was superseded and there is no group.json; runs record only integration.json): record per-repo started_at and finished_at in integration.json, add workspace_metrics.py reporting PRs per wall-clock hour and per attention minute; runs lacking timestamps are reported as unmeasured, never counted as zero | autonomy/lib/workspace.py (run loop and integration.json write only), autonomy/lib/workspace_metrics.py (new), tests/workspace/95-metrics.sh (new, register in the runner and a shard row, timeout -k, shellcheck), docs/WORKSPACES.md, CHANGELOG.md | bash tests/workspace/95-metrics.sh (fixture run gives the hand-computed rate; an old integration.json without timestamps prints unmeasured; red before); bash tests/workspace/50-run.sh and 00-smoke.sh rc 0; structural-checks.sh and shard registration guards rc 0 | MEDIUM | released@2026-10-17T03:50Z | main 624b5d964; TL APPROVE; test-workspace 19/0 Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| PO-SESSION-COMMIT-1 | S-219 + S-220 re-cut (legacy run.sh): a failed git add -A makes the session commit silently commit nothing; the untrack step's global git reset drops force-staged agent files from the session commit | autonomy/run.sh (commit_session_changes add block ~11065 and _loki_untrack_agent_committed_user_files ~10985 only), tests/test-session-commit-add-failure.sh (new), tests/test-untrack-keeps-force-staged.sh (new), both registered in the runner with shard rows, CHANGELOG.md | both new tests rc 0 and red when the rc check or git reset -q is restored in a scratch copy; bash tests/test-branch-lifecycle.sh rc 0; bash -n autonomy/run.sh; shellcheck on changed files; structural-checks.sh rc 0 | MEDIUM | released@2026-10-17T03:50Z | 939e23126. TL APPROVE (exit 128 aborts the add, index restore reproduced, both mutants red). On main: new tests 7/0 and 5/0, bash -n ok, shard 19/0, drift 6/0. Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| PO-COUNCIL-LABEL-TEST-1 | S-213 re-cut: the Council vote header in cost.html and the council prefix plus title on the proofs.html badge have no test of their own | legacy-ui/tests/static-council-vote-label.node.test.mjs (new; reads legacy-ui-static/proofs.html and cost.html, edits neither) | node --test legacy-ui/tests/static-council-vote-label.node.test.mjs passes (proofs.html line 152 prefix and title, cost.html line 308 header); renaming the header or dropping the title in a scratch copy fails it | LOW | released@2026-10-17T03:50Z | c331cde1a (r2 23f2c4e5f: content-anchored matching, shard row). CoS verified on main: node --test 2/0, shard coverage 19/0, drift 6/0. Test-only, no CHANGELOG. Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| PO-P7-SINKS-1 | E-138: P7 no-fabricated-data scanner misses optional-call sinks and one-hop aliases (setRows?.([...]), window[k]?.(rows), const s = setRows; s(rows), a memo that forwards a fabricator result) | tests/moat/p7-no-fabricated-data.sh (and its red and green fixtures under tests/moat/ only) | bash tests/moat/p7-no-fabricated-data.sh with a red and a green fixture per form, each red before the change; the existing fixtures keep their verdicts; moat suite 4/9 or better unchanged | HIGH | released@2026-10-17T03:50Z | b2b592b29. Opus APPROVE: 13 added findings, 0 removed, real tree 0 findings, each arm mutation-red. On main all four P7 cases PASS. Advisory: SCALAR_READ exclusion has no pinning fixture. Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
 | A-04d | A-04c follow-up (opus r5 advisories A1, A3): loki-seal Known limits must name empty body or early return, an assertion only in a helper declared after the test, same-name or keyword collisions across files, and forged runner-format lines printed by a test; fix the README sentence the matched test body must contain an assertion | packages/loki-seal/README.md, packages/loki-seal/skills/loki-seal/SKILL.md, CHANGELOG.md | grep finds each of the four limits in README Known limits; bash packages/loki-seal/test/run.sh 72/0; no code change | LOW | released@2026-10-16T00:49Z | aa4770f57; seal suite 72/0. Plus 0b-fix: escaped U+2714/U+2716 marks in an A-04c fixture that turned structural-checks emoji scan red on main. |
-| D51-B13r | Read-only workspace runs API over integration.json (runs never produce group.json) | dashboard/api_workspaces.py (new), dashboard/api_operator.py (2 GET routes only), tests/dashboard/test_api_workspaces.py (new) | `python3 -m pytest tests/dashboard/test_api_workspaces.py -q` (red: module absent) | MEDIUM | merged@2026-10-03T10:14Z | merged 6d927b5c6 (TL approve; cherry-pick of 4fbb99b40), wall shard 19/0 drift 6/0 |
-| D51-B14r | Start page "Workspace runs" card: per-repo rows, integration row, stale badge; an unreadable run shows an error, never an empty card | legacy-ui-static/start.html, legacy-ui/tests/start-workspace-card.node.test.mjs (new), run-all-tests.sh line | `node --test legacy-ui/tests/start-workspace-card.node.test.mjs` (red: no card) | LOW | merged@2026-10-03T10:50Z | 1280b2781 + 7329ab5f1 on main (TL APPROVE r2, node 5/0, red 4/1) |
-| D51-B16r | E2E through the real CLI routes, plus the "verify a workspace run" doc | tests/workspace/99-e2e.sh (new), docs/WORKSPACES.md | `bash tests/test-workspace.sh` (red: 99-e2e asserts absent) | MEDIUM | merged@2026-10-03T10:14Z | merged 4341f84a5 (approve; cherry-pick of ef73d6c6d), test-workspace 33/0 |
-| WS-INTERRUPT | SIGTERM/SIGINT writes integration.json status=interrupted; status lists an unreadable run as "unreadable" | autonomy/lib/workspace.py (stop, _runs, status only), tests/workspace/55-interrupt.sh (new) | `bash tests/test-workspace.sh` | MEDIUM | merged@2026-10-03T10:14Z | merged 52f510d71 (approve; cherry-pick of e70cdcc6d) |
-| WS-PREP-BOUND | Bound the prep lock to 120s then FAILED; refuse relative-symlink escape and source-path shebangs | autonomy/lib/worktree_prep.py, tests/test-worktree-prep.py | `python3 tests/test-worktree-prep.py` | MEDIUM | merged@2026-10-03T10:14Z | merged 7c37faa8d (approve; cherry-pick of a2f2718d3), test-worktree-prep OK |
-| P2-FV-EXIT | fast_verify exit codes: INCONCLUSIVE=3, unknown flag=64, missing root=2; retire the overdue pending line | autonomy/lib/fast_verify.py (main only), tests/test-fast-verify.sh, tests/moat/pending.txt (1 line), docs/exit-codes.md (--fast row) | `bash tests/moat/run.sh` no rule failed, P2 passes on both routes | HIGH | merged@2026-10-03T10:22Z | merged c4afa7344 458dfdfb5 (TL r2 APPROVE): --path alias, --help 0; airgap 4/0, fast-verify 17/0, moat P2.fast-verify-inconclusive-not-zero PASS on main |
+| D51-B13r | Read-only workspace runs API over integration.json (runs never produce group.json) | dashboard/api_workspaces.py (new), dashboard/api_operator.py (2 GET routes only), tests/dashboard/test_api_workspaces.py (new) | `python3 -m pytest tests/dashboard/test_api_workspaces.py -q` (red: module absent) | MEDIUM | released@2026-10-17T03:50Z | merged 6d927b5c6 (TL approve; cherry-pick of 4fbb99b40), wall shard 19/0 drift 6/0 Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| D51-B14r | Start page "Workspace runs" card: per-repo rows, integration row, stale badge; an unreadable run shows an error, never an empty card | legacy-ui-static/start.html, legacy-ui/tests/start-workspace-card.node.test.mjs (new), run-all-tests.sh line | `node --test legacy-ui/tests/start-workspace-card.node.test.mjs` (red: no card) | LOW | released@2026-10-17T03:50Z | 1280b2781 + 7329ab5f1 on main (TL APPROVE r2, node 5/0, red 4/1) Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| D51-B16r | E2E through the real CLI routes, plus the "verify a workspace run" doc | tests/workspace/99-e2e.sh (new), docs/WORKSPACES.md | `bash tests/test-workspace.sh` (red: 99-e2e asserts absent) | MEDIUM | released@2026-10-17T03:50Z | merged 4341f84a5 (approve; cherry-pick of ef73d6c6d), test-workspace 33/0 Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| WS-INTERRUPT | SIGTERM/SIGINT writes integration.json status=interrupted; status lists an unreadable run as "unreadable" | autonomy/lib/workspace.py (stop, _runs, status only), tests/workspace/55-interrupt.sh (new) | `bash tests/test-workspace.sh` | MEDIUM | released@2026-10-17T03:50Z | merged 52f510d71 (approve; cherry-pick of e70cdcc6d) Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| WS-PREP-BOUND | Bound the prep lock to 120s then FAILED; refuse relative-symlink escape and source-path shebangs | autonomy/lib/worktree_prep.py, tests/test-worktree-prep.py | `python3 tests/test-worktree-prep.py` | MEDIUM | released@2026-10-17T03:50Z | merged 7c37faa8d (approve; cherry-pick of a2f2718d3), test-worktree-prep OK Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| P2-FV-EXIT | fast_verify exit codes: INCONCLUSIVE=3, unknown flag=64, missing root=2; retire the overdue pending line | autonomy/lib/fast_verify.py (main only), tests/test-fast-verify.sh, tests/moat/pending.txt (1 line), docs/exit-codes.md (--fast row) | `bash tests/moat/run.sh` no rule failed, P2 passes on both routes | HIGH | released@2026-10-17T03:50Z | merged c4afa7344 458dfdfb5 (TL r2 APPROVE): --path alias, --help 0; airgap 4/0, fast-verify 17/0, moat P2.fast-verify-inconclusive-not-zero PASS on main Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
 | S-215r | proof-pr.sh python cannot be shadowed by a cwd json.py | autonomy/lib/proof-pr.sh (render_evidence_receipt_md), tests/test-proof-pr-no-cwd-shadow.sh (new) | the new test (red on main) | HIGH | released@2026-10-16T00:49Z | merged c6536dfe2 (opus approve; cherry-pick of b4176f42e). On main checkout proof-pr suite 5/1 only on the .loki/state/provider leg: the gitignored file predates the slice (Sep 30 17:58), environmental; builder worktree 6/0. CoS decision 10:14Z |
 | S-216r | verify.sh python readers are isolated from cwd shadowing | autonomy/verify.sh (reader sites 190,591,1269,1271,1295,1337,1339,1441), tests/test-verify-no-cwd-shadow.sh (new) | the new test | HIGH | released@2026-10-16T00:49Z | r3 opus APPROVE; cherry-picked 100535de2 f38a93966 77b84becc; main: cwd-shadow 20/0, test-verify 25/0; test now flags only a provider file created during the run (6185c5249); CHANGELOG deduped. Advisories: label no-interpreter as inconclusive, add a dynamic leg for line 3117 |
 | S-218r | _loki_untracked_status cannot run a repo-local fsmonitor | autonomy/run.sh (_loki_untracked_status only), tests/test-untracked-status-fsmonitor.sh (new) | the new test | HIGH | released@2026-10-16T00:49Z | r5 opus APPROVE (version spoofs, nonce, B1 retry all fail closed); main 0b6604fd9 + CHANGELOG collapse 1ff144efb; fsmonitor 21/0, branch-lifecycle 83/83; advisories A1 digit-length cap, A2 two-call race; in train/95 |
-| HONEST-READ-1 | A corrupt or denied file gives 503 or an error row, never an empty list | dashboard/server.py (list_proofs, memory patterns/episodes/skills/index only), legacy-ui-static/proofs.html, tests/dashboard/test_unreadable_not_empty.py (new) | `python3 -m pytest tests/dashboard/test_unreadable_not_empty.py -q` | LOW | merged@2026-10-03T10:14Z | merged 05c0940e9 (approve; cherry-pick of a29956235), pytest 12 passed |
+| HONEST-READ-1 | A corrupt or denied file gives 503 or an error row, never an empty list | dashboard/server.py (list_proofs, memory patterns/episodes/skills/index only), legacy-ui-static/proofs.html, tests/dashboard/test_unreadable_not_empty.py (new) | `python3 -m pytest tests/dashboard/test_unreadable_not_empty.py -q` | LOW | released@2026-10-17T03:50Z | merged 05c0940e9 (approve; cherry-pick of a29956235), pytest 12 passed Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
 | S-226r | An unmeasured cost reads "unmeasured", not $0.00, in stats and status on both routes (absorbs S-227) | autonomy/loki (cmd_stats, cmd_status budget block), loki-ts/src/commands/stats.ts, loki-ts/src/commands/status.ts (readBudgetField), tests/test-stats-unmeasured-cost.sh + tests/test-status-budget-unmeasured.sh (new) | both new tests plus `cd loki-ts && bun test` | MEDIUM | released@2026-10-16T00:49Z | merged e2c283a40 (approve; cherry-pick of 72df5665e), stats 8/0 status 8/0 |
 | S-231r | Rename the CI moat job to what it proves | .github/workflows/test.yml (job name and summary echo only) | `git grep -n "name: Moat suite" -- .github` prints nothing | LOW | released@2026-10-16T00:49Z | d8cb2bc9c on main; TL APPROVE (job id kept, no display-name consumer; CoS verified no protection or ruleset context) |
-| PO-TEST-1 | Tests for scripts/metrics-usage-append.py | tests/test-metrics-usage-append.sh (new), runner and shard registration | red-then-green, shellcheck, structural guards; never writes the real METRICS.md | LOW | merged@2026-10-03T09:01Z | merged 41103e5c3 (TL APPROVE; suite + shard/registration guards green)|
-| PO-TEST-2 | Tests for scripts/check-inline-scripts.js | tests/test-check-inline-scripts.sh (new), runner and shard registration | valid exits 0, broken fixture exits 1, structural guards | LOW | merged@2026-10-03T09:01Z | merged 8b3fa5af4 (TL APPROVE; suite + shard/registration guards green)|
-| PO-TEST-3 | Tests for scripts/clean-test-branches.sh safety rules | tests/test-clean-test-branches.sh (new), runner and shard registration | refusals proven in a throwaway repo; mutation dropping main refusal goes red; structural guards | MEDIUM | merged@2026-10-03T09:01Z | merged 75953c210 (TL APPROVE; suite + shard/registration guards green)|
-| P7-SCALAR-PIN | Pin the P7 SCALAR_READ exclusion with honest fixtures, so a regression that flags `.length`, `[0]` or `.find(` reaching a sink (or a widening that lets a fabricated array through) goes red. | tests/moat/p7-no-fabricated-data.sh only | Add honest fixtures `const n = getRows(d).length; setCount(n);`, `setFirst(getRows(d)[0])`, `setHit(getRows(d).find(x=>x.ok))` with expected 0 findings. RED: temporarily change `if not SCALAR_READ.match(tail): return True` (line ~1243) to `return True` and run `bash tests/moat/p7-no-fabricated-data.sh` -> the new fixtures fail. GREEN: revert -> `bash tests/moat/p7-no-fabricated-data.sh` exit 0, and every existing fixture keeps its expected count. Also `bash tests/moat/run.sh` shows the P7 verdict unchanged. Do NOT touch pending.txt. No CHANGELOG line (test-only). | HIGH | merged@2026-10-03T11:25Z | d668a9cbc opus APPROVE (13 mutations, 11 caught by new fixtures); advisories: realistic ternary shape, Index/Find honest-label debate, .search gap |
-| SEAL-FORGED-LINES | loki-seal refuses VERIFIED when the parsed passing lines disagree with the runner's own summary counts, so a test that prints forged `ok N - name` or `--- PASS:` lines cannot fake delivery. | packages/loki-seal/bin/contract.js (passing() and its caller), packages/loki-seal/test/seal.test.js, packages/loki-seal/README.md (Known limits ~44), CHANGELOG.md | RED: new seal.test.js cases: (a) TAP output with `ok 1 - x` printed by the test body plus summary `# pass 0` / `# fail 1`; (b) pytest output with `test_x PASSED` plus `1 failed, 0 passed`; (c) an id that appears both passed and failed. Each expects NOT VERIFIED with reason "runner output inconsistent". `bash packages/loki-seal/test/run.sh` fails on the new cases before the change (baseline 72/0). GREEN: after the change, `bash packages/loki-seal/test/run.sh` passes all cases (75+/0) and the existing 72 stay green. When no summary line exists, current behavior is unchanged (document this in Known limits). CHANGELOG: "loki-seal: forged runner pass lines that contradict the runner summary now give NOT VERIFIED." | HIGH | merged@2026-10-03T14:06Z | r7 opus BLOCK: F1 unterminated write hides real summary, F2 64MB cap drops summary; r8 builder dispatched r10 8046c2b6f opus BLOCK: 4 reproduced forges (.bin/node shim, self-package reporter, node_modules reporter, npm config outside project .npmrc). D80 amendment 2 adopted (spawn process.execPath, scrubbed env, builtin reporters only, jest/vitest NOT VERIFIED). r11 building. r11 42421df35 (132/132; 10 new tests red 8 on r10). Opus re-review running. r11 opus BLOCK: env-scrub mutant survives 132/0 (no NODE_OPTIONS/NODE_PATH test). Other spec points verified, 4 of 5 mutants red. r12 building: childEnv unit test + A1/A3/A4/A5. r12 431f4bafe: childEnv exported+unit/E2E tests, scrub mutant red, 134/0; opus verify-only re-review. r12 opus APPROVE (scrub mutant 132/2 red, M2a/M2b/M3 caught). 12 commits on main, 134/0 on main. Advisories: jest/vitest red-counts E2E untested; NODE_PATH E2E only via unit test. r13 98e144f21 escapes U+2713/2714/2716 for the emoji scan, 134/0. |
-| HONEST-READ-2 | /api runs never claim "recorded no run_id" or "no per-iteration records" when the events or iteration files were unreadable or corrupt; they say unreadable, with the errno. | dashboard/api_runs.py, tests/dashboard/test_api_runs_unreadable.py (new), tests/run-all-tests.sh (run_test line), tests/shard-durations.tsv (row), CHANGELOG.md | RED: new pytest: (a) events file chmod 000 -> list_runs reason must contain "unreadable", not "no run id found"; (b) iteration dir with only corrupt JSON -> reason "unreadable or corrupt", not "no per-iteration records"; (c) missing file (ENOENT) keeps today's "no ..." wording. Skip (a) when running as root. `python3 -m pytest -q tests/dashboard/test_api_runs_unreadable.py` red before. GREEN: same command passes; `python3 -m pytest -q tests/dashboard` stays green. Register `run_test "Dashboard api_runs unreadable reads (HONEST-READ-2)" "timeout -k 10 120 python3 -m pytest -q $SCRIPT_DIR/dashboard/test_api_runs_unreadable.py"` plus the shard row `Dashboard api_runs unreadable reads (HONEST-READ-2)<TAB>5`, then run the structural guards for new test files. CHANGELOG: "Dashboard runs view reports unreadable or corrupt run records instead of claiming none were recorded." | MEDIUM | merged@2026-10-03T10:50Z | b8b30f271 on main (MEDIUM TL APPROVE) |
-| BACKLOG-LEDGER-FAILCLOSED | `loki backlog` daily budget cap fails closed: a corrupt or unreadable spend ledger stops new units with BUDGET_STOP "ledger unreadable" instead of reading $0 spent, and add_spend never overwrites a corrupt ledger (move it aside to .corrupt-<ts>). | autonomy/lib/backlog.py (spent_today, add_spend, cap check ~383), tests/test-backlog.sh, CHANGELOG.md | RED: add a case to tests/test-backlog.sh with HOME pointing at a run-owned temp dir, `~/.loki/backlog-spend.json` containing `{not json`, a daily cap of $1, and a stub loki. Expect status "BUDGET_STOP: ... ledger unreadable" and no unit started; today the cap reads 0.0 and units run. A second case checks that after add_spend the corrupt bytes survive in backlog-spend.json.corrupt-*. `bash tests/test-backlog.sh` red before. GREEN: same passes; `bash tests/test-backlog-units.sh` stays green; a missing ledger (ENOENT) still means $0 spent. No cap configured means no behavior change. CHANGELOG: "loki backlog: a corrupt spend ledger now stops new units when a daily budget is set, instead of reading as $0 spent." | MEDIUM | merged@2026-10-03T10:50Z | 4dd5faf62 on main (MEDIUM TL APPROVE) |
-| MCP-RUN-EXIT | MCP v10_run reports an early loki crash (exit code plus the last 20 log lines) instead of returning run_id None with no error. | mcp/v10_tools.py, mcp/tests/test_v10_tools.py | RED: new test: monkeypatch the loki binary to a stub that exits 2 immediately and writes "boom" to the log. Expect a result with `error` containing "exited 2" and "boom"; today it is `{"run_id": None, "pid":..., "log_path":...}`. `python3 -m pytest -q mcp/tests/test_v10_tools.py` red before. GREEN: same passes and `bash tests/test-mcp-server.sh` (test 13 at :204) stays green. A still-running process with no run id yet keeps today's shape. CHANGELOG: "MCP loki run now returns the exit code and log tail when loki exits before a run starts." | LOW | merged@2026-10-03T10:46Z | 01c8c0e6c cherry-picked (TL APPROVE; pytest 18/0, red 2 on revert, test-mcp-server 13/0) |
-| CTRL-STATUS-RUNS | `loki control status` (TS route) prints "runs: unknown (<reason>)" when /v1/runs fails or has no total, never "0 runs". | loki-ts/src/commands/control.ts, loki-ts/tests/commands/control.test.ts (new or existing), CHANGELOG.md | RED: test with a fetch stub that returns 500, and one that returns `{}` -> output must not match /\b0 runs\b/ and must contain "unknown". `cd loki-ts && bun test tests/commands/control.test.ts` red before. GREEN: same passes; a stub with total 3 prints "3 runs"; `cd loki-ts && bun run build` then `bash tests/test-release-dist-guard.sh`. The bash cmd_control in autonomy/loki is in-flight (S-226r); file a follow-up instead of editing it. CHANGELOG: "loki control status shows runs as unknown when the control plane cannot be read." | LOW | merged@2026-10-03T10:50Z | cf9da0c41 on main (TL APPROVE); bash cmd_control same default left for S-226r |
-| CP-BAD-ENCODING | The control-plane server returns 400 for malformed percent-encoding instead of a 500 from an unguarded decodeURIComponent. | packages/control-plane/src/server/app.ts, packages/control-plane/test/server/bad-encoding.test.ts (new) | RED: request `/v1/runs/%E0%A4%A` (and a path with a lone `%`) -> expect 400 and a JSON error; today it is 500. `cd packages/control-plane && bun test test/server/bad-encoding.test.ts` red before. GREEN: same passes and `bash tests/test-control-plane.sh` stays green. CHANGELOG: "control plane: malformed URL encoding returns 400." | LOW | merged@2026-10-03T10:50Z | e14b650ab on main (TL APPROVE) |
-| CP-DRIZZLE-SNAP | Add the missing drizzle 0001 snapshot so `db:generate` on an unchanged schema produces no spurious migration. | packages/control-plane/drizzle/meta/0001_snapshot.json (new) | RED: in a run-owned scratch copy (`loki_run_tmp_create`, then `cp -R packages/control-plane "$LOKI_RUN_TMP/cp"`), run `cd "$LOKI_RUN_TMP/cp" && bun run db:generate` -> a 0002_*.sql appears for the unchanged schema. GREEN: generate the snapshot, repeat in a fresh copy -> no new file, and `git diff --stat` shows only the snapshot. Then `bash tests/test-control-plane.sh` passes. Clean up with loki_run_tmp_cleanup. No CHANGELOG (internal). | LOW | merged@2026-10-03T10:50Z | 28e1556c4 on main (TL APPROVE) |
-| CP-COPY-GUARD-2 | Harden the control-plane Docker COPY guard so it also catches dynamic import(), a second import on one line, and transitive loki-ts value imports missing from Dockerfile.control-plane COPY lines. | tests/test-control-plane.sh (guard block 44-78) | RED: add self-test fixtures inside the suite (in a run-owned temp dir): a file with `await import("../../loki-ts/src/x")`, one with two imports on one line, and a chain a.ts -> b.ts (value import) where b is not copied. Each must make the guard report a missing COPY; today it passes. Run `bash tests/test-control-plane.sh` and show a fixture assertion failing before. GREEN: same passes on the real tree (type-only imports stay ignored, e.g. events.ts -> types.ts). Mutation: delete one real COPY line (Dockerfile.control-plane:16-17) in a scratch copy -> the guard goes red. No CHANGELOG. | LOW | merged@2026-10-03T10:50Z | e592482d4 on main (TL APPROVE) |
-| SPEED-TIMER-UNREF | The group-output spinner interval no longer keeps the process alive when stop() is never called. | loki-ts/src/features/speed/group_output.ts, loki-ts/tests/features/speed/group_output.test.ts | RED: test spawns `bun -e` with isTTY forced true that calls start() and never stop(), with a 5 s timeout -> today it hangs (killed by the timeout, assert exit). `cd loki-ts && bun test tests/features/speed/group_output.test.ts` red before. GREEN: `.unref?.()` on the interval; the child exits within 2 s; existing tests stay green; `bun run build` plus the dist guard pass. Must not touch features/speed/unit_mode.ts (D61-11). CHANGELOG: "Grouped speed output no longer keeps the process alive after a command finishes." | LOW | merged@2026-10-03T10:50Z | 06ac495c0 on main (TL APPROVE), dist 63c6fd667 |
-| SC-LOKI-RATCHET | Warning-level shellcheck coverage for autonomy/loki as a count ratchet (at most 89 today, may only shrink), without editing autonomy/loki. | tests/run-shellcheck.sh, tests/shellcheck-baselines.tsv (new data file, not a test script) | RED: add the ratchet, then in a scratch copy append a line producing SC2086 to autonomy/loki -> `bash tests/run-shellcheck.sh` fails "autonomy/loki warnings 90 > baseline 89". GREEN: on the real tree `bash tests/run-shellcheck.sh` passes and prints "autonomy/loki warnings 89 (baseline 89)". Lowering the file count below the baseline prints a hint to lower the baseline. Run it with `timeout -k 10 120` and record the wall time (today about 19 s for this file) in the PR, and schedule the large file first so total wall time does not grow. Not a new tests/*.sh, so no runner or shard row. No CHANGELOG. | LOW | merged@2026-10-03T10:50Z | 785423377 on main (TL APPROVE) |
-| TRACKER-SITE-1 | Jira intake refuses when JIRA_BASE_URL and the browse URL's origin differ, instead of fetching the same key from the wrong site and building the wrong issue. It also refuses suffix, userinfo and port tricks. | loki-ts/src/features/tracker_intake.ts, loki-ts/tests/engine10/tracker_intake.test.ts, CHANGELOG.md | RED: new tests: (1) JIRA_BASE_URL=https://acme.atlassian.net plus URL https://other.atlassian.net/browse/X-1 -> expect an error naming both origins (today it resolves to acme); (2) `https://acme.atlassian.net.evil.com/browse/X-1`; (3) `https://user@acme.atlassian.net/browse/X-1`; (4) `https://acme.atlassian.net:8443/browse/X-1` -> each refused. `cd loki-ts && bun test tests/engine10/tracker_intake.test.ts` red before. GREEN: same command passes, plus `cd loki-ts && bun run build` and `bash tests/test-release-dist-guard.sh` (dist rebuilt in main checkout per memory). Matching origins still work. CHANGELOG: "Jira intake: a browse URL whose site differs from JIRA_BASE_URL is refused instead of silently fetched from the configured site." | MEDIUM | merged@2026-10-03T10:50Z | 5b595ba3b on main (MEDIUM TL APPROVE) |
-| PO3-QS-MATCH | quickstart picks simple-todo-app for briefs that match no template (#217): keywords + no-match fallback | autonomy/quickstart.sh, tests/test-quickstart-bash32.sh | MEDIUM | bash tests/test-quickstart-bash32.sh (red: URL-shortener brief ranks simple-todo-app first) | merged@2026-10-03T12:48Z | ca50d28d8 TL APPROVE |
-| PO3-PAUSED-TTY | Bun PAUSED.md says Press Enter off a TTY and cites wrong run.sh lines (#212) | loki-ts/src/runner/intervention.ts, loki-ts/tests/runner/intervention.test.ts | LOW | cd loki-ts && bun test tests/runner/intervention.test.ts (red: non-TTY text still says Press Enter) | merged@2026-10-03T12:12Z | TL APPROVE (27/0, 8/0, 85/0, byte parity cmp identical 411B); merged 1ba95e986+b31cf61a7, dist rebuilt |
-| PO3-MEM-INDEX | loki memory index rebuild wipes the index and prints success on failure (#204) | autonomy/loki (24647-24662 only), tests/test-memory-cli.sh | MEDIUM | bash tests/test-memory-cli.sh (red: 2-episode fixture ends with total_memories 0 or no index.json) | merged@2026-10-03T12:12Z | TL APPROVE (test-memory-cli 25/0, 11b red on parent); merged b7b9c74bb |
-| PO3-COUNCIL-TODO | council TODO/FIXME count scans node_modules/.git/.loki and can set blocked=true (3 greps) | autonomy/completion-council.sh (3609, 3886, 4152), tests/test-council-todo-scope.sh (new) | HIGH | bash tests/test-council-todo-scope.sh (red: 6 TODO files under node_modules block the council) | merged@2026-10-03T12:12Z | opus APPROVE (32 council suites rc 0, BSD+GNU grep, red 7/9); merged d5ac03e1a; advisories A1-A3 logged |
-| PO3-HEAL-DOC | healing docs claim failure-modes.json and an enforced pairing contract that never run in production (#200) | skills/healing.md, docs/dev/architecture-reference.md, tests/test-heal-docs-honesty.sh (new) | LOW | bash tests/test-heal-docs-honesty.sh (red: docs assert the artifact is written; zero production callers) | merged@2026-10-03T12:12Z | TL APPROVE (3/0, red on parent, mutation red, structural guards green); merged a9388e9a7 |
-| PO3-SKILL-RUNTIME-DOC | SKILL.md says only read-only commands run on Bun; cli.ts now routes start, proof, report, engine10 and more | SKILL.md (line 18), tests/test-skill-md-runtime-claim.sh (new) | LOW | bash tests/test-skill-md-runtime-claim.sh (red: cli.ts case labels absent from the claim) | merged@2026-10-03T12:12Z | TL APPROVE (claims verified vs bin/loki:570, new guard 7/0, red 4/3 on parent); merged 10aab744d |
-| PO3-HELP-ALLCMDS | loki help All commands omits keys and workspace; discoverability test passes on any prose mention | autonomy/loki (help block ~1814), tests/test-help-discoverability.sh | LOW | bash tests/test-help-discoverability.sh (red after tightening the matcher to the All commands block) | merged@2026-10-03T12:12Z | TL APPROVE (4/0, 15/0, 9/0, mutation red); merged d82bf2779 |
-| PO4-COUNCIL-TEST-TMP | council TODO scope test uses raw mktemp; switch to loki_run_tmp helper | tests/test-council-todo-scope.sh | LOW | bash tests/test-council-todo-scope.sh (red: file has mktemp, no loki_run_tmp_create) | merged@2026-10-03T12:25Z | TL APPROVE (17/0, mutation red, run dir cleaned); merged 8a1b49075 |
-| PO4-ANCHOR-PRECHECK | probe-free stale-anchor precheck for trust-core probe_case strings (#214 opt 3) | tests/test-trust-core-tests-detect.sh, scripts/local-ci.sh | MEDIUM | TRUST_CORE_PROBE_MODE=anchors bash tests/test-trust-core-tests-detect.sh (red: fixture stale anchor exits 0) | merged@2026-10-03T12:30Z | TL APPROVE (semantics match probe, red real, 94 anchors 0.14s, hermetic 18/0); merged fe8456b1b |
-| PO4-HEAL-GUARD-SCOPE | heal-docs honesty guard scans only 3 dirs; widen to all tracked files | tests/test-heal-docs-honesty.sh | LOW | bash tests/test-heal-docs-honesty.sh (red: dashboard/ caller fixture counts 0) | merged@2026-10-03T12:25Z | TL APPROVE (4/0, revert-to-old-scan mutation red); merged fed6dfe2c |
-| PO4-CLI-TS-HELP | cli.ts header says 8 commands and HELP omits dispatched commands | loki-ts/src/cli.ts, loki-ts/tests/commands/cli_help_routes.test.ts, loki-ts/dist | LOW | cd loki-ts && bun test tests/commands/cli_help_routes.test.ts (red: kpis/report/trust missing from HELP) | merged@2026-10-03T12:25Z | TL APPROVE + wording fix (8/0, dist guard 13/0); merged db0ae9eea+458237fb6, dist 8fd495579 |
-| PO4-DASH-SWEEP | remove em/en dashes from 7 tracked text files incl proof-passport output | tools/proof-passport.py, 6 docs files, tests/test_proof_passport.py | LOW | python3 -m pytest tests/test_proof_passport.py (red: rendered passport contains U+2014) | merged@2026-10-03T12:25Z | TL APPROVE (passport pytest 12/0, no dashes in diff); merged 43ca907a4 |
-| PO4-START-REPO-DIR-FIX | tests/cli/test-start-repo-directory.sh fails today; diagnose and fix | tests/cli/test-start-repo-directory.sh | MEDIUM | bash tests/cli/test-start-repo-directory.sh (red: exits 1 stubbed dispatch) | merged@2026-10-03T12:25Z | TL APPROVE (root cause /var symlink confirmed, injection check intact); merged |
-| PO4-CLI-SUITES-REG | 4 tests/cli suites unregistered; guard scans only tests/test-*.sh (after START-REPO-DIR-FIX) | tests/run-all-tests.sh, tests/test-registration-coverage.sh, tests/shard-durations.tsv | MEDIUM | bash tests/test-registration-coverage.sh (red: guard extended to tests/*/ names 4 files) | merged@2026-10-03T12:33Z | TL APPROVE (mutation red, same-name masking refuted, shellcheck unchanged vs parent); merged af6b616fa |
-| PO4-TRUST-CMD-TEST | Bun runTrust has no exit-code/flag contract test | loki-ts/tests/commands/trust.test.ts | LOW | cd loki-ts && bun test tests/commands/trust.test.ts (red vs stub; mutation return 1->0) | merged@2026-10-03T12:25Z | TL APPROVE (14/0, json-branch mutation 3 red); merged |
-| PO4-TODO-PLURAL | council TODO counter misses TODOs/FIXMEs plurals (after COUNCIL-TEST-TMP) | autonomy/completion-council.sh (3 patterns), tests/test-council-todo-scope.sh | HIGH | bash tests/test-council-todo-scope.sh (red: six TODOs-only files do not trip count) | merged@2026-10-03T12:34Z | opus APPROVE (BSD and GNU grep identical on 16 cases, 3 site mutations red, 30 council suites green); merged 4c88ff15e |
-| PO5-ASSESS-HONEST | modernize heal --assess counts plural TODOs and reports the real largest file | autonomy/loki (PYASSESS heredoc only), tests/test-assess-runtime-detection.sh | LOW | bash tests/test-assess-runtime-detection.sh | merged@2026-10-03T12:48Z | 48968d0a5 |
-| PO5-REG-EXACT | registration coverage matches suites exactly, not by substring | tests/test-registration-coverage.sh | LOW | bash tests/test-registration-coverage.sh | merged@2026-10-03T12:48Z | 135dc6368 |
-| PO5-ANCHOR-EQ | trust-core anchors pre-check rejects find == repl cases | tests/test-trust-core-tests-detect.sh | LOW | TRUST_CORE_PROBE_MODE=anchors bash tests/test-trust-core-tests-detect.sh | merged@2026-10-03T12:48Z | 752e3c684 |
-| PO5-DOGFOOD-HONEST | dogfood-stats --help and labels the keyword heuristic | scripts/dogfood-stats.sh, tests/test-dogfood-stats.sh | LOW | bash tests/test-dogfood-stats.sh | merged@2026-10-03T12:48Z | 65c9232b1 |
-| PO5-ORPHAN-SUITES | register 4 orphaned non-test-*.sh suites, guard their naming | tests/test-registration-nonstandard.sh, tests/integration/run_integration_suite.sh | LOW | bash tests/test-registration-nonstandard.sh | merged@2026-10-03T12:48Z | 2db6d1358 |
-| PO5-DASH-BENCH | remove dashes from benchmarks/magic-ab/README.md, whole-tree dash guard | benchmarks/magic-ab/README.md, tests/test-no-dashes-tree.sh | LOW | bash tests/test-no-dashes-tree.sh | merged@2026-10-03T12:48Z | 6e26b46fd |
-| PO5-HELP-READONLY | measure-run.sh and guard-changed.sh treat --help as help | scripts/measure-run.sh, scripts/guard-changed.sh, tests/test-help-readonly-scripts.sh | LOW | bash tests/test-help-readonly-scripts.sh | merged@2026-10-03T12:50Z | 4eba90e3f (from de07c36a6), TL APPROVE 17/0, mutation red 6 |
-| PO5-HELP-NOTES-BRANCHES | release-notes.sh and clean-test-branches.sh real --help | scripts/release-notes.sh, scripts/clean-test-branches.sh, tests/test-release-notes.sh, tests/test-clean-test-branches.sh | LOW | bash tests/test-release-notes.sh; bash tests/test-clean-test-branches.sh | merged@2026-10-03T12:48Z | 53d295093 |
-| PO5-WORKSPACE-VACUOUS | test-workspace.sh fails when no assertions ran | tests/test-workspace.sh | LOW | bash tests/test-workspace.sh | merged@2026-10-03T12:48Z | 43e805cef |
-| PO5-HELP-INSTALL-HOOKS | install-hooks.sh --help never rewrites git config | scripts/install-hooks.sh, tests/test-install-hooks.sh | LOW | bash tests/test-install-hooks.sh | merged@2026-10-03T12:48Z | fce165e70 |
-| D82-COSTCAP | Cost cap: subscription runs no dollar cap plus one info line; API-key runs default $100; --max-cost and budgets.per_run override; BUDGET_STOP exit 3 | autonomy/ cost-cap code, docs, tests | MEDIUM | builds, own test file green, CI green | merged@15:33Z | D82 10.7.0 big train |
-| D82-FLAGS | Default-on: visual evidence, spec-to-contract, D61 parallel, Slack two-way, MCP tools, Control Plane, workspaces; env=0 opts out; listeners loopback only; senders inert without credential | flag defaults, docs, tests | MEDIUM | builds, own test file green, CI green | merged@15:33Z | D82 10.7.0 big train |
-| D82-A-E2E | Playwright browser e2e with video and trace attached to the PR | e2e/verify path | MEDIUM | builds, own test file green, CI green | merged@15:33Z | D82 10.7.0 big train |
-| D82-B-MERGE | loki merge queue | new CLI subcommand | MEDIUM | builds, own test file green, CI green | merged@15:33Z | D82 10.7.0 big train |
-| D82-C-REVIEW | loki review PR with a deterministic risk score | new CLI subcommand | MEDIUM | builds, own test file green, CI green | merged@15:33Z | D82 10.7.0 big train |
-| D82-D-MEMORY | Project memory across runs | memory path | MEDIUM | builds, own test file green, CI green | merged@15:33Z | D82 10.7.0 big train |
-| D82-E-CPMOBILE | Control Plane mobile layout (roles and sign-in to 10.7.1 under D12) | dashboard UI | LOW | builds, own test file green, CI green | merged@15:33Z | D82 10.7.0 big train |
-| D82-F-EMU | Mobile emulator tests | test harness | MEDIUM | builds, own test file green, CI green | merged@15:33Z | D82 10.7.0 big train |
-| D82-G-REST | REST API for runs (loopback) | dashboard server API | MEDIUM | builds, own test file green, CI green | merged@15:33Z | D82 10.7.0 big train |
-| D82-H-ACP | VS Code and JetBrains via ACP | acp adapter | MEDIUM | builds, own test file green, CI green | merged@15:33Z | D82 10.7.0 big train |
-| D82-I-SENTRY | Sentry intake to tasks | intake path | MEDIUM | builds, own test file green, CI green | merged@15:33Z | D82 10.7.0 big train |
-| D82-J-D50 | D50 Sonnet lift fixes | per D50 | MEDIUM | builds, own test file green, CI green | merged@15:33Z | D82 10.7.0 big train |
-| D82-GAPS | Gap research vs Devin, Factory, 8090, Vorflux, Claude Code | docs/v10 research doc | LOW | builds, own test file green, CI green | merged@15:33Z | D82 10.7.0 big train |
-| CP-INGEST | Control Plane zero-setup ingest: backfill plus tail of .loki/runs/*/events.jsonl from loki control serve | packages/control-plane shipper | MEDIUM | own tests green | merged@15:33Z 45b0e9c83 | D82 10.7.0 big train |
-| CP-LEGACY | loki dashboard, web, docker host side and run.sh auto-open route to the Control Plane; LOKI_LEGACY_DASHBOARD=1 restores | autonomy/loki, run.sh | MEDIUM | test-web-alias-consistency 7/7 | merged@15:33Z 7b701d238 | D82 10.7.0 big train |
-| CP-UI-LIVE | Control Plane live run view, overview and landing | packages/control-plane ui | LOW | live.test.tsx green | merged@15:33Z c5b9e700a | D82 10.7.0 big train |
-| CP-UI-SHELL | Control Plane shell, brand, import, loopback-only start endpoint | packages/control-plane ui and server | HIGH | opus APPROVE r2, suite 68/0 | merged@15:33Z f88c18a6b | D82 10.7.0 big train |
-| D82-WALL0 | Empty Wall seal is NOT PROVEN; nested Wall files collected | loki-ts engine10 wall and seal | HIGH | opus APPROVE r2, wall+seal 101/0 | merged@15:33Z 9b87e50c8 | D82 10.7.0 big train |
+| PO-TEST-1 | Tests for scripts/metrics-usage-append.py | tests/test-metrics-usage-append.sh (new), runner and shard registration | red-then-green, shellcheck, structural guards; never writes the real METRICS.md | LOW | released@2026-10-17T03:50Z | merged 41103e5c3 (TL APPROVE; suite + shard/registration guards green) Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| PO-TEST-2 | Tests for scripts/check-inline-scripts.js | tests/test-check-inline-scripts.sh (new), runner and shard registration | valid exits 0, broken fixture exits 1, structural guards | LOW | released@2026-10-17T03:50Z | merged 8b3fa5af4 (TL APPROVE; suite + shard/registration guards green) Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| PO-TEST-3 | Tests for scripts/clean-test-branches.sh safety rules | tests/test-clean-test-branches.sh (new), runner and shard registration | refusals proven in a throwaway repo; mutation dropping main refusal goes red; structural guards | MEDIUM | released@2026-10-17T03:50Z | merged 75953c210 (TL APPROVE; suite + shard/registration guards green) Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| P7-SCALAR-PIN | Pin the P7 SCALAR_READ exclusion with honest fixtures, so a regression that flags `.length`, `[0]` or `.find(` reaching a sink (or a widening that lets a fabricated array through) goes red. | tests/moat/p7-no-fabricated-data.sh only | Add honest fixtures `const n = getRows(d).length; setCount(n);`, `setFirst(getRows(d)[0])`, `setHit(getRows(d).find(x=>x.ok))` with expected 0 findings. RED: temporarily change `if not SCALAR_READ.match(tail): return True` (line ~1243) to `return True` and run `bash tests/moat/p7-no-fabricated-data.sh` -> the new fixtures fail. GREEN: revert -> `bash tests/moat/p7-no-fabricated-data.sh` exit 0, and every existing fixture keeps its expected count. Also `bash tests/moat/run.sh` shows the P7 verdict unchanged. Do NOT touch pending.txt. No CHANGELOG line (test-only). | HIGH | released@2026-10-17T03:50Z | d668a9cbc opus APPROVE (13 mutations, 11 caught by new fixtures); advisories: realistic ternary shape, Index/Find honest-label debate, .search gap Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| SEAL-FORGED-LINES | loki-seal refuses VERIFIED when the parsed passing lines disagree with the runner's own summary counts, so a test that prints forged `ok N - name` or `--- PASS:` lines cannot fake delivery. | packages/loki-seal/bin/contract.js (passing() and its caller), packages/loki-seal/test/seal.test.js, packages/loki-seal/README.md (Known limits ~44), CHANGELOG.md | RED: new seal.test.js cases: (a) TAP output with `ok 1 - x` printed by the test body plus summary `# pass 0` / `# fail 1`; (b) pytest output with `test_x PASSED` plus `1 failed, 0 passed`; (c) an id that appears both passed and failed. Each expects NOT VERIFIED with reason "runner output inconsistent". `bash packages/loki-seal/test/run.sh` fails on the new cases before the change (baseline 72/0). GREEN: after the change, `bash packages/loki-seal/test/run.sh` passes all cases (75+/0) and the existing 72 stay green. When no summary line exists, current behavior is unchanged (document this in Known limits). CHANGELOG: "loki-seal: forged runner pass lines that contradict the runner summary now give NOT VERIFIED." | HIGH | released@2026-10-17T03:50Z | r7 opus BLOCK: F1 unterminated write hides real summary, F2 64MB cap drops summary; r8 builder dispatched r10 8046c2b6f opus BLOCK: 4 reproduced forges (.bin/node shim, self-package reporter, node_modules reporter, npm config outside project .npmrc). D80 amendment 2 adopted (spawn process.execPath, scrubbed env, builtin reporters only, jest/vitest NOT VERIFIED). r11 building. r11 42421df35 (132/132; 10 new tests red 8 on r10). Opus re-review running. r11 opus BLOCK: env-scrub mutant survives 132/0 (no NODE_OPTIONS/NODE_PATH test). Other spec points verified, 4 of 5 mutants red. r12 building: childEnv unit test + A1/A3/A4/A5. r12 431f4bafe: childEnv exported+unit/E2E tests, scrub mutant red, 134/0; opus verify-only re-review. r12 opus APPROVE (scrub mutant 132/2 red, M2a/M2b/M3 caught). 12 commits on main, 134/0 on main. Advisories: jest/vitest red-counts E2E untested; NODE_PATH E2E only via unit test. r13 98e144f21 escapes U+2713/2714/2716 for the emoji scan, 134/0. Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| HONEST-READ-2 | /api runs never claim "recorded no run_id" or "no per-iteration records" when the events or iteration files were unreadable or corrupt; they say unreadable, with the errno. | dashboard/api_runs.py, tests/dashboard/test_api_runs_unreadable.py (new), tests/run-all-tests.sh (run_test line), tests/shard-durations.tsv (row), CHANGELOG.md | RED: new pytest: (a) events file chmod 000 -> list_runs reason must contain "unreadable", not "no run id found"; (b) iteration dir with only corrupt JSON -> reason "unreadable or corrupt", not "no per-iteration records"; (c) missing file (ENOENT) keeps today's "no ..." wording. Skip (a) when running as root. `python3 -m pytest -q tests/dashboard/test_api_runs_unreadable.py` red before. GREEN: same command passes; `python3 -m pytest -q tests/dashboard` stays green. Register `run_test "Dashboard api_runs unreadable reads (HONEST-READ-2)" "timeout -k 10 120 python3 -m pytest -q $SCRIPT_DIR/dashboard/test_api_runs_unreadable.py"` plus the shard row `Dashboard api_runs unreadable reads (HONEST-READ-2)<TAB>5`, then run the structural guards for new test files. CHANGELOG: "Dashboard runs view reports unreadable or corrupt run records instead of claiming none were recorded." | MEDIUM | released@2026-10-17T03:50Z | b8b30f271 on main (MEDIUM TL APPROVE) Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| BACKLOG-LEDGER-FAILCLOSED | `loki backlog` daily budget cap fails closed: a corrupt or unreadable spend ledger stops new units with BUDGET_STOP "ledger unreadable" instead of reading $0 spent, and add_spend never overwrites a corrupt ledger (move it aside to .corrupt-<ts>). | autonomy/lib/backlog.py (spent_today, add_spend, cap check ~383), tests/test-backlog.sh, CHANGELOG.md | RED: add a case to tests/test-backlog.sh with HOME pointing at a run-owned temp dir, `~/.loki/backlog-spend.json` containing `{not json`, a daily cap of $1, and a stub loki. Expect status "BUDGET_STOP: ... ledger unreadable" and no unit started; today the cap reads 0.0 and units run. A second case checks that after add_spend the corrupt bytes survive in backlog-spend.json.corrupt-*. `bash tests/test-backlog.sh` red before. GREEN: same passes; `bash tests/test-backlog-units.sh` stays green; a missing ledger (ENOENT) still means $0 spent. No cap configured means no behavior change. CHANGELOG: "loki backlog: a corrupt spend ledger now stops new units when a daily budget is set, instead of reading as $0 spent." | MEDIUM | released@2026-10-17T03:50Z | 4dd5faf62 on main (MEDIUM TL APPROVE) Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| MCP-RUN-EXIT | MCP v10_run reports an early loki crash (exit code plus the last 20 log lines) instead of returning run_id None with no error. | mcp/v10_tools.py, mcp/tests/test_v10_tools.py | RED: new test: monkeypatch the loki binary to a stub that exits 2 immediately and writes "boom" to the log. Expect a result with `error` containing "exited 2" and "boom"; today it is `{"run_id": None, "pid":..., "log_path":...}`. `python3 -m pytest -q mcp/tests/test_v10_tools.py` red before. GREEN: same passes and `bash tests/test-mcp-server.sh` (test 13 at :204) stays green. A still-running process with no run id yet keeps today's shape. CHANGELOG: "MCP loki run now returns the exit code and log tail when loki exits before a run starts." | LOW | released@2026-10-17T03:50Z | 01c8c0e6c cherry-picked (TL APPROVE; pytest 18/0, red 2 on revert, test-mcp-server 13/0) Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| CTRL-STATUS-RUNS | `loki control status` (TS route) prints "runs: unknown (<reason>)" when /v1/runs fails or has no total, never "0 runs". | loki-ts/src/commands/control.ts, loki-ts/tests/commands/control.test.ts (new or existing), CHANGELOG.md | RED: test with a fetch stub that returns 500, and one that returns `{}` -> output must not match /\b0 runs\b/ and must contain "unknown". `cd loki-ts && bun test tests/commands/control.test.ts` red before. GREEN: same passes; a stub with total 3 prints "3 runs"; `cd loki-ts && bun run build` then `bash tests/test-release-dist-guard.sh`. The bash cmd_control in autonomy/loki is in-flight (S-226r); file a follow-up instead of editing it. CHANGELOG: "loki control status shows runs as unknown when the control plane cannot be read." | LOW | released@2026-10-17T03:50Z | cf9da0c41 on main (TL APPROVE); bash cmd_control same default left for S-226r Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| CP-BAD-ENCODING | The control-plane server returns 400 for malformed percent-encoding instead of a 500 from an unguarded decodeURIComponent. | packages/control-plane/src/server/app.ts, packages/control-plane/test/server/bad-encoding.test.ts (new) | RED: request `/v1/runs/%E0%A4%A` (and a path with a lone `%`) -> expect 400 and a JSON error; today it is 500. `cd packages/control-plane && bun test test/server/bad-encoding.test.ts` red before. GREEN: same passes and `bash tests/test-control-plane.sh` stays green. CHANGELOG: "control plane: malformed URL encoding returns 400." | LOW | released@2026-10-17T03:50Z | e14b650ab on main (TL APPROVE) Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| CP-DRIZZLE-SNAP | Add the missing drizzle 0001 snapshot so `db:generate` on an unchanged schema produces no spurious migration. | packages/control-plane/drizzle/meta/0001_snapshot.json (new) | RED: in a run-owned scratch copy (`loki_run_tmp_create`, then `cp -R packages/control-plane "$LOKI_RUN_TMP/cp"`), run `cd "$LOKI_RUN_TMP/cp" && bun run db:generate` -> a 0002_*.sql appears for the unchanged schema. GREEN: generate the snapshot, repeat in a fresh copy -> no new file, and `git diff --stat` shows only the snapshot. Then `bash tests/test-control-plane.sh` passes. Clean up with loki_run_tmp_cleanup. No CHANGELOG (internal). | LOW | released@2026-10-17T03:50Z | 28e1556c4 on main (TL APPROVE) Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| CP-COPY-GUARD-2 | Harden the control-plane Docker COPY guard so it also catches dynamic import(), a second import on one line, and transitive loki-ts value imports missing from Dockerfile.control-plane COPY lines. | tests/test-control-plane.sh (guard block 44-78) | RED: add self-test fixtures inside the suite (in a run-owned temp dir): a file with `await import("../../loki-ts/src/x")`, one with two imports on one line, and a chain a.ts -> b.ts (value import) where b is not copied. Each must make the guard report a missing COPY; today it passes. Run `bash tests/test-control-plane.sh` and show a fixture assertion failing before. GREEN: same passes on the real tree (type-only imports stay ignored, e.g. events.ts -> types.ts). Mutation: delete one real COPY line (Dockerfile.control-plane:16-17) in a scratch copy -> the guard goes red. No CHANGELOG. | LOW | released@2026-10-17T03:50Z | e592482d4 on main (TL APPROVE) Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| SPEED-TIMER-UNREF | The group-output spinner interval no longer keeps the process alive when stop() is never called. | loki-ts/src/features/speed/group_output.ts, loki-ts/tests/features/speed/group_output.test.ts | RED: test spawns `bun -e` with isTTY forced true that calls start() and never stop(), with a 5 s timeout -> today it hangs (killed by the timeout, assert exit). `cd loki-ts && bun test tests/features/speed/group_output.test.ts` red before. GREEN: `.unref?.()` on the interval; the child exits within 2 s; existing tests stay green; `bun run build` plus the dist guard pass. Must not touch features/speed/unit_mode.ts (D61-11). CHANGELOG: "Grouped speed output no longer keeps the process alive after a command finishes." | LOW | released@2026-10-17T03:50Z | 06ac495c0 on main (TL APPROVE), dist 63c6fd667 Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| SC-LOKI-RATCHET | Warning-level shellcheck coverage for autonomy/loki as a count ratchet (at most 89 today, may only shrink), without editing autonomy/loki. | tests/run-shellcheck.sh, tests/shellcheck-baselines.tsv (new data file, not a test script) | RED: add the ratchet, then in a scratch copy append a line producing SC2086 to autonomy/loki -> `bash tests/run-shellcheck.sh` fails "autonomy/loki warnings 90 > baseline 89". GREEN: on the real tree `bash tests/run-shellcheck.sh` passes and prints "autonomy/loki warnings 89 (baseline 89)". Lowering the file count below the baseline prints a hint to lower the baseline. Run it with `timeout -k 10 120` and record the wall time (today about 19 s for this file) in the PR, and schedule the large file first so total wall time does not grow. Not a new tests/*.sh, so no runner or shard row. No CHANGELOG. | LOW | released@2026-10-17T03:50Z | 785423377 on main (TL APPROVE) Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| TRACKER-SITE-1 | Jira intake refuses when JIRA_BASE_URL and the browse URL's origin differ, instead of fetching the same key from the wrong site and building the wrong issue. It also refuses suffix, userinfo and port tricks. | loki-ts/src/features/tracker_intake.ts, loki-ts/tests/engine10/tracker_intake.test.ts, CHANGELOG.md | RED: new tests: (1) JIRA_BASE_URL=https://acme.atlassian.net plus URL https://other.atlassian.net/browse/X-1 -> expect an error naming both origins (today it resolves to acme); (2) `https://acme.atlassian.net.evil.com/browse/X-1`; (3) `https://user@acme.atlassian.net/browse/X-1`; (4) `https://acme.atlassian.net:8443/browse/X-1` -> each refused. `cd loki-ts && bun test tests/engine10/tracker_intake.test.ts` red before. GREEN: same command passes, plus `cd loki-ts && bun run build` and `bash tests/test-release-dist-guard.sh` (dist rebuilt in main checkout per memory). Matching origins still work. CHANGELOG: "Jira intake: a browse URL whose site differs from JIRA_BASE_URL is refused instead of silently fetched from the configured site." | MEDIUM | released@2026-10-17T03:50Z | 5b595ba3b on main (MEDIUM TL APPROVE) Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| PO3-QS-MATCH | quickstart picks simple-todo-app for briefs that match no template (#217): keywords + no-match fallback | autonomy/quickstart.sh, tests/test-quickstart-bash32.sh | MEDIUM | bash tests/test-quickstart-bash32.sh (red: URL-shortener brief ranks simple-todo-app first) | released@2026-10-17T03:50Z | ca50d28d8 TL APPROVE Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| PO3-PAUSED-TTY | Bun PAUSED.md says Press Enter off a TTY and cites wrong run.sh lines (#212) | loki-ts/src/runner/intervention.ts, loki-ts/tests/runner/intervention.test.ts | LOW | cd loki-ts && bun test tests/runner/intervention.test.ts (red: non-TTY text still says Press Enter) | released@2026-10-17T03:50Z | TL APPROVE (27/0, 8/0, 85/0, byte parity cmp identical 411B); merged 1ba95e986+b31cf61a7, dist rebuilt Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| PO3-MEM-INDEX | loki memory index rebuild wipes the index and prints success on failure (#204) | autonomy/loki (24647-24662 only), tests/test-memory-cli.sh | MEDIUM | bash tests/test-memory-cli.sh (red: 2-episode fixture ends with total_memories 0 or no index.json) | released@2026-10-17T03:50Z | TL APPROVE (test-memory-cli 25/0, 11b red on parent); merged b7b9c74bb Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| PO3-COUNCIL-TODO | council TODO/FIXME count scans node_modules/.git/.loki and can set blocked=true (3 greps) | autonomy/completion-council.sh (3609, 3886, 4152), tests/test-council-todo-scope.sh (new) | HIGH | bash tests/test-council-todo-scope.sh (red: 6 TODO files under node_modules block the council) | released@2026-10-17T03:50Z | opus APPROVE (32 council suites rc 0, BSD+GNU grep, red 7/9); merged d5ac03e1a; advisories A1-A3 logged Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| PO3-HEAL-DOC | healing docs claim failure-modes.json and an enforced pairing contract that never run in production (#200) | skills/healing.md, docs/dev/architecture-reference.md, tests/test-heal-docs-honesty.sh (new) | LOW | bash tests/test-heal-docs-honesty.sh (red: docs assert the artifact is written; zero production callers) | released@2026-10-17T03:50Z | TL APPROVE (3/0, red on parent, mutation red, structural guards green); merged a9388e9a7 Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| PO3-SKILL-RUNTIME-DOC | SKILL.md says only read-only commands run on Bun; cli.ts now routes start, proof, report, engine10 and more | SKILL.md (line 18), tests/test-skill-md-runtime-claim.sh (new) | LOW | bash tests/test-skill-md-runtime-claim.sh (red: cli.ts case labels absent from the claim) | released@2026-10-17T03:50Z | TL APPROVE (claims verified vs bin/loki:570, new guard 7/0, red 4/3 on parent); merged 10aab744d Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| PO3-HELP-ALLCMDS | loki help All commands omits keys and workspace; discoverability test passes on any prose mention | autonomy/loki (help block ~1814), tests/test-help-discoverability.sh | LOW | bash tests/test-help-discoverability.sh (red after tightening the matcher to the All commands block) | released@2026-10-17T03:50Z | TL APPROVE (4/0, 15/0, 9/0, mutation red); merged d82bf2779 Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| PO4-COUNCIL-TEST-TMP | council TODO scope test uses raw mktemp; switch to loki_run_tmp helper | tests/test-council-todo-scope.sh | LOW | bash tests/test-council-todo-scope.sh (red: file has mktemp, no loki_run_tmp_create) | released@2026-10-17T03:50Z | TL APPROVE (17/0, mutation red, run dir cleaned); merged 8a1b49075 Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| PO4-ANCHOR-PRECHECK | probe-free stale-anchor precheck for trust-core probe_case strings (#214 opt 3) | tests/test-trust-core-tests-detect.sh, scripts/local-ci.sh | MEDIUM | TRUST_CORE_PROBE_MODE=anchors bash tests/test-trust-core-tests-detect.sh (red: fixture stale anchor exits 0) | released@2026-10-17T03:50Z | TL APPROVE (semantics match probe, red real, 94 anchors 0.14s, hermetic 18/0); merged fe8456b1b Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| PO4-HEAL-GUARD-SCOPE | heal-docs honesty guard scans only 3 dirs; widen to all tracked files | tests/test-heal-docs-honesty.sh | LOW | bash tests/test-heal-docs-honesty.sh (red: dashboard/ caller fixture counts 0) | released@2026-10-17T03:50Z | TL APPROVE (4/0, revert-to-old-scan mutation red); merged fed6dfe2c Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| PO4-CLI-TS-HELP | cli.ts header says 8 commands and HELP omits dispatched commands | loki-ts/src/cli.ts, loki-ts/tests/commands/cli_help_routes.test.ts, loki-ts/dist | LOW | cd loki-ts && bun test tests/commands/cli_help_routes.test.ts (red: kpis/report/trust missing from HELP) | released@2026-10-17T03:50Z | TL APPROVE + wording fix (8/0, dist guard 13/0); merged db0ae9eea+458237fb6, dist 8fd495579 Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| PO4-DASH-SWEEP | remove em/en dashes from 7 tracked text files incl proof-passport output | tools/proof-passport.py, 6 docs files, tests/test_proof_passport.py | LOW | python3 -m pytest tests/test_proof_passport.py (red: rendered passport contains U+2014) | released@2026-10-17T03:50Z | TL APPROVE (passport pytest 12/0, no dashes in diff); merged 43ca907a4 Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| PO4-START-REPO-DIR-FIX | tests/cli/test-start-repo-directory.sh fails today; diagnose and fix | tests/cli/test-start-repo-directory.sh | MEDIUM | bash tests/cli/test-start-repo-directory.sh (red: exits 1 stubbed dispatch) | released@2026-10-17T03:50Z | TL APPROVE (root cause /var symlink confirmed, injection check intact); merged Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| PO4-CLI-SUITES-REG | 4 tests/cli suites unregistered; guard scans only tests/test-*.sh (after START-REPO-DIR-FIX) | tests/run-all-tests.sh, tests/test-registration-coverage.sh, tests/shard-durations.tsv | MEDIUM | bash tests/test-registration-coverage.sh (red: guard extended to tests/*/ names 4 files) | released@2026-10-17T03:50Z | TL APPROVE (mutation red, same-name masking refuted, shellcheck unchanged vs parent); merged af6b616fa Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| PO4-TRUST-CMD-TEST | Bun runTrust has no exit-code/flag contract test | loki-ts/tests/commands/trust.test.ts | LOW | cd loki-ts && bun test tests/commands/trust.test.ts (red vs stub; mutation return 1->0) | released@2026-10-17T03:50Z | TL APPROVE (14/0, json-branch mutation 3 red); merged Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| PO4-TODO-PLURAL | council TODO counter misses TODOs/FIXMEs plurals (after COUNCIL-TEST-TMP) | autonomy/completion-council.sh (3 patterns), tests/test-council-todo-scope.sh | HIGH | bash tests/test-council-todo-scope.sh (red: six TODOs-only files do not trip count) | released@2026-10-17T03:50Z | opus APPROVE (BSD and GNU grep identical on 16 cases, 3 site mutations red, 30 council suites green); merged 4c88ff15e Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| PO5-ASSESS-HONEST | modernize heal --assess counts plural TODOs and reports the real largest file | autonomy/loki (PYASSESS heredoc only), tests/test-assess-runtime-detection.sh | LOW | bash tests/test-assess-runtime-detection.sh | released@2026-10-17T03:50Z | 48968d0a5 Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| PO5-REG-EXACT | registration coverage matches suites exactly, not by substring | tests/test-registration-coverage.sh | LOW | bash tests/test-registration-coverage.sh | released@2026-10-17T03:50Z | 135dc6368 Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| PO5-ANCHOR-EQ | trust-core anchors pre-check rejects find == repl cases | tests/test-trust-core-tests-detect.sh | LOW | TRUST_CORE_PROBE_MODE=anchors bash tests/test-trust-core-tests-detect.sh | released@2026-10-17T03:50Z | 752e3c684 Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| PO5-DOGFOOD-HONEST | dogfood-stats --help and labels the keyword heuristic | scripts/dogfood-stats.sh, tests/test-dogfood-stats.sh | LOW | bash tests/test-dogfood-stats.sh | released@2026-10-17T03:50Z | 65c9232b1 Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| PO5-ORPHAN-SUITES | register 4 orphaned non-test-*.sh suites, guard their naming | tests/test-registration-nonstandard.sh, tests/integration/run_integration_suite.sh | LOW | bash tests/test-registration-nonstandard.sh | released@2026-10-17T03:50Z | 2db6d1358 Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| PO5-DASH-BENCH | remove dashes from benchmarks/magic-ab/README.md, whole-tree dash guard | benchmarks/magic-ab/README.md, tests/test-no-dashes-tree.sh | LOW | bash tests/test-no-dashes-tree.sh | released@2026-10-17T03:50Z | 6e26b46fd Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| PO5-HELP-READONLY | measure-run.sh and guard-changed.sh treat --help as help | scripts/measure-run.sh, scripts/guard-changed.sh, tests/test-help-readonly-scripts.sh | LOW | bash tests/test-help-readonly-scripts.sh | released@2026-10-17T03:50Z | 4eba90e3f (from de07c36a6), TL APPROVE 17/0, mutation red 6 Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| PO5-HELP-NOTES-BRANCHES | release-notes.sh and clean-test-branches.sh real --help | scripts/release-notes.sh, scripts/clean-test-branches.sh, tests/test-release-notes.sh, tests/test-clean-test-branches.sh | LOW | bash tests/test-release-notes.sh; bash tests/test-clean-test-branches.sh | released@2026-10-17T03:50Z | 53d295093 Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| PO5-WORKSPACE-VACUOUS | test-workspace.sh fails when no assertions ran | tests/test-workspace.sh | LOW | bash tests/test-workspace.sh | released@2026-10-17T03:50Z | 43e805cef Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| PO5-HELP-INSTALL-HOOKS | install-hooks.sh --help never rewrites git config | scripts/install-hooks.sh, tests/test-install-hooks.sh | LOW | bash tests/test-install-hooks.sh | released@2026-10-17T03:50Z | fce165e70 Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| D82-COSTCAP | Cost cap: subscription runs no dollar cap plus one info line; API-key runs default $100; --max-cost and budgets.per_run override; BUDGET_STOP exit 3 | autonomy/ cost-cap code, docs, tests | MEDIUM | builds, own test file green, CI green | released@2026-10-17T03:50Z | D82 10.7.0 big train Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| D82-FLAGS | Default-on: visual evidence, spec-to-contract, D61 parallel, Slack two-way, MCP tools, Control Plane, workspaces; env=0 opts out; listeners loopback only; senders inert without credential | flag defaults, docs, tests | MEDIUM | builds, own test file green, CI green | released@2026-10-17T03:50Z | D82 10.7.0 big train Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| D82-A-E2E | Playwright browser e2e with video and trace attached to the PR | e2e/verify path | MEDIUM | builds, own test file green, CI green | released@2026-10-17T03:50Z | D82 10.7.0 big train Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| D82-B-MERGE | loki merge queue | new CLI subcommand | MEDIUM | builds, own test file green, CI green | released@2026-10-17T03:50Z | D82 10.7.0 big train Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| D82-C-REVIEW | loki review PR with a deterministic risk score | new CLI subcommand | MEDIUM | builds, own test file green, CI green | released@2026-10-17T03:50Z | D82 10.7.0 big train Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| D82-D-MEMORY | Project memory across runs | memory path | MEDIUM | builds, own test file green, CI green | released@2026-10-17T03:50Z | D82 10.7.0 big train Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| D82-E-CPMOBILE | Control Plane mobile layout (roles and sign-in to 10.7.1 under D12) | dashboard UI | LOW | builds, own test file green, CI green | released@2026-10-17T03:50Z | D82 10.7.0 big train Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| D82-F-EMU | Mobile emulator tests | test harness | MEDIUM | builds, own test file green, CI green | released@2026-10-17T03:50Z | D82 10.7.0 big train Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| D82-G-REST | REST API for runs (loopback) | dashboard server API | MEDIUM | builds, own test file green, CI green | released@2026-10-17T03:50Z | D82 10.7.0 big train Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| D82-H-ACP | VS Code and JetBrains via ACP | acp adapter | MEDIUM | builds, own test file green, CI green | released@2026-10-17T03:50Z | D82 10.7.0 big train Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| D82-I-SENTRY | Sentry intake to tasks | intake path | MEDIUM | builds, own test file green, CI green | released@2026-10-17T03:50Z | D82 10.7.0 big train Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| D82-J-D50 | D50 Sonnet lift fixes | per D50 | MEDIUM | builds, own test file green, CI green | released@2026-10-17T03:50Z | D82 10.7.0 big train Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| D82-GAPS | Gap research vs Devin, Factory, 8090, Vorflux, Claude Code | docs/v10 research doc | LOW | builds, own test file green, CI green | released@2026-10-17T03:50Z | D82 10.7.0 big train Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| CP-INGEST | Control Plane zero-setup ingest: backfill plus tail of .loki/runs/*/events.jsonl from loki control serve | packages/control-plane shipper | MEDIUM | own tests green | released@2026-10-17T03:50Z | D82 10.7.0 big train Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| CP-LEGACY | loki dashboard, web, docker host side and run.sh auto-open route to the Control Plane; LOKI_LEGACY_DASHBOARD=1 restores | autonomy/loki, run.sh | MEDIUM | test-web-alias-consistency 7/7 | released@2026-10-17T03:50Z | D82 10.7.0 big train Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| CP-UI-LIVE | Control Plane live run view, overview and landing | packages/control-plane ui | LOW | live.test.tsx green | released@2026-10-17T03:50Z | D82 10.7.0 big train Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| CP-UI-SHELL | Control Plane shell, brand, import, loopback-only start endpoint | packages/control-plane ui and server | HIGH | opus APPROVE r2, suite 68/0 | released@2026-10-17T03:50Z | D82 10.7.0 big train Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| D82-WALL0 | Empty Wall seal is NOT PROVEN; nested Wall files collected | loki-ts engine10 wall and seal | HIGH | opus APPROVE r2, wall+seal 101/0 | released@2026-10-17T03:50Z | D82 10.7.0 big train Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
 | D83-CPE | Enterprise Control Plane UI rebuild, slices CPE-01..26 per docs/v10/CP-ENTERPRISE-UI.md, integrating on branch cpe-base | packages/control-plane, loki-ts engine10 run_pid | HIGH | per-slice Wall checks, opus on 04/07/09/14 | building@15:33Z (01,03,05,21 on cpe-base; 04,07 in opus review; 02,09 building) | D83 10.8.0 |
 | FC-09r | FC-09 rework f4eccfeac BLOCKED by rv-trust3 (reproduced): package.json pretest/posttest/test:* edits return no runner-config note; compare the whole scripts object, and have verify compare base vs head runner sections; add go.mod replace, Cargo.toml [patch], package.json overrides/imports, tsconfig paths | loki-ts/src/features/runner_config.ts plus its tests | HIGH | bun repro: a pretest-only edit caps the verdict; runner_config tests green | released@2026-10-15T23:55Z | Do not merge f4eccfeac as is. Opus reviewer. |
 | FC-09s | FC-09 sibling sweep from the FC-09r opus review (bun probe reproduced): runner_config misses (1) Cargo.toml top-level dotted keys such as patch.crates-io.serde = { path = "fake" } before [package]; (2) go.work replace directives (go.work is not in RUNNER_CONFIGS); (3) babel.config.*, .babelrc, .pnpmfile.cjs, Cargo [[test]] harness=false and Cargo [dev-dependencies] path=; also add one verify-stage case where a package.json pretest edit caps the verdict | loki-ts/src/features/runner_config.ts, loki-ts/tests/engine10/runner_config.test.ts, loki-ts/tests/engine10/verify_weak.test.ts | HIGH | each probe above caps the verdict to NOT PROVEN; a plain version bump still does not cap | released@2026-10-16T00:49Z | FC-09 sibling (L5). No core engine10 lines (4998 of 5000). |
@@ -983,8 +983,8 @@ Source: ~/git/autonomi-dev/research/2026-09-30-adoption/SWARM-PROMPT-ADOPTION.md
 | COST-5 | Merge plan into implement via the plan chain resume (one fewer cold prefix) | loki-ts/src/engine10/stages/implement.ts | MEDIUM | conflict_resume tests | released@2026-10-16T01:20Z | Cost audit 2026-10-16: no measured run reaches 0.5x raw yet (best 0.68x lean config). |
 | COST-6 | Measure cost per accepted task vs raw Claude Code: attribution.py --execute, 8 tasks, n=3, Sonnet 5.5, receipt cost.usd vs total_cost_usd; target ratio 0.5 | benchmarks/bench/attribution.py, docs/v10/METRICS.md | MEDIUM | attribution dry-run | parked@2026-10-16T00:12Z | paid eval, needs founder go on spend. Cost audit 2026-10-16: no measured run reaches 0.5x raw yet (best 0.68x lean config). |
 | FC-09u | FC-09 siblings: pnpm-workspace.yaml overrides/packageExtensions and .yarnrc.yml packageExtensions join RUNNER_CONFIGS | loki-ts/src/features/runner_config.ts, loki-ts/tests/engine10/runner_config.test.ts | HIGH | each probe caps | parked@2026-10-16T23:12Z | After FC-09t review. Built as 12a4c80a: runner_config.test.ts 135 pass 0 fail; typecheck clean. D98 park after round 2: opus BLOCK e07885d5, real pnpm 11.1.3 applied a link: override through a double BOM and a `? [foo]` explicit key while the check reported UNCAPPED (Bun.YAML vs js-yaml 4 divergence). Carried as FC-09v. |
-| FC-09v | FC-09u carry-forward: trust parsed YAML key comparison only when both sides are in a strict plain subset (no BOM, explicit ? keys, merge keys, anchors, aliases, tags, directives, doc markers, CR, tabs); any other byte change caps | loki-ts/src/features/runner_config.ts, loki-ts/tests/engine10/runner_config.test.ts | HIGH | both FC-09u reviewer probes print CAPPED for every bypass; plain unrelated-key edit does not cap | merged@2026-10-17T00:36Z | HIGH r2 APPROVE ea0a60c5: r1 bypass closed, 60 fuzz disagreement docs all cap, red-first 159/5 to 164/0, tsc rc=0; merged 14a6f92f0, dist bd008596d. Base e07885d5. Source: FC-09u round 2 HIGH review. Round 1 BLOCK cebe5641 (block-scalar parser differential reproduced with pnpm 11.1.3); round 2 per D101 caps on any byte change, building. |
-| FC-09w | Runner config registry matches case-insensitively, so a capitalized PNPM-Workspace.yaml or .YARNRC.yml (read by pnpm on macOS) caps trust; sweep every RUNNER_CONFIGS row; add .npmrc and patchedDependencies targets outside patches/ | loki-ts/src/features/runner_config.ts, the existing runner_config test file under loki-ts/tests/engine10 | HIGH | cd loki-ts && bun test tests/engine10/ | merged@2026-10-17T01:05Z | HIGH APPROVE 14aa30cc2 (runner_config 204 pass 0 fail, tsc 0, mutations 34 and 4 red, 11 bypass probes capped) |
+| FC-09v | FC-09u carry-forward: trust parsed YAML key comparison only when both sides are in a strict plain subset (no BOM, explicit ? keys, merge keys, anchors, aliases, tags, directives, doc markers, CR, tabs); any other byte change caps | loki-ts/src/features/runner_config.ts, loki-ts/tests/engine10/runner_config.test.ts | HIGH | both FC-09u reviewer probes print CAPPED for every bypass; plain unrelated-key edit does not cap | released@2026-10-17T03:50Z | HIGH r2 APPROVE ea0a60c5: r1 bypass closed, 60 fuzz disagreement docs all cap, red-first 159/5 to 164/0, tsc rc=0; merged 14a6f92f0, dist bd008596d. Base e07885d5. Source: FC-09u round 2 HIGH review. Round 1 BLOCK cebe5641 (block-scalar parser differential reproduced with pnpm 11.1.3); round 2 per D101 caps on any byte change, building. Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| FC-09w | Runner config registry matches case-insensitively, so a capitalized PNPM-Workspace.yaml or .YARNRC.yml (read by pnpm on macOS) caps trust; sweep every RUNNER_CONFIGS row; add .npmrc and patchedDependencies targets outside patches/ | loki-ts/src/features/runner_config.ts, the existing runner_config test file under loki-ts/tests/engine10 | HIGH | cd loki-ts && bun test tests/engine10/ | released@2026-10-17T03:50Z | HIGH APPROVE 14aa30cc2 (runner_config 204 pass 0 fail, tsc 0, mutations 34 and 4 red, 11 bypass probes capped) Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
 | FC-09x | Runner config trust gaps from the FC-09w review: top-level patchedDependencies (Bun form) compared by mapping like pnpm.patchedDependencies (add to PKG_KEYS); pnpm-workspace.yaml read with CRLF-safe line split; a multi-line yaml flow map for patchedDependencies is parsed or fails closed | loki-ts/src/features/runner_config.ts, loki-ts/tests/engine10/runner_config.test.ts | HIGH | cd loki-ts && bun test tests/engine10/runner_config.test.ts | released@2026-10-17T01:58Z | v11.17.11 (npm next 11.17.11, Tests and Release green on df98addc8). TL APPROVE 437afd115; merged b97c1e635, dist 2eeec3851. |
 | CPE24-P2a | Checkpoint rollback restores only an allowlist (session.json, dashboard-state.json, CONTINUITY.md, autonomy-state.json, state, queue) and refuses nested symlinks | packages/control-plane/src/server/routes/checkpoints.ts plus test | MEDIUM | planted audit/ in a checkpoint does not overwrite .loki/audit | released@2026-10-15T23:55Z | rv-trust3 advisory on P2. |
 | CPE24-P4a | Legacy /api/control/* callers require ctx.local (or isLoopbackHost) like /v1 | packages/control-plane/src/server/legacy/routes-control.ts plus test | MEDIUM | non-loopback Host refused on legacy control | released@2026-10-15T23:55Z | rv-trust3 advisory on P4. |
@@ -992,10 +992,10 @@ Source: ~/git/autonomi-dev/research/2026-09-30-adoption/SWARM-PROMPT-ADOPTION.md
 | FC-01b | Monorepo visual-evidence skip reason: with backend/ and frontend/ package.json and no root manifest, say "no dev, preview or start script in backend/ or frontend/", not "no package.json" | visual evidence path in loki-ts/src plus test | LOW | monorepo fixture prints the per-package reason | released@2026-10-15T23:55Z | FC-01 sibling (Engine Law L5). |
 | FC-19b | Spec-conflict resume near the stage limit: skip the resume when under about 60s of the implement window remains, or keep the first conflict when the resume is aborted, so the run ends BLOCKED with its question instead of a limit failure | loki-ts/src/util/conflict_resume.ts plus machine.ts plus test | MEDIUM | a fake first session that uses the window then conflicts ends BLOCKED with its question | released@2026-10-15T23:55Z | review-fc19 non-blocking follow-up, from reading machine.ts runStage. |
 | CP-START | FC-20 (LATER list): root-cause the CP home Start "HTTP 404" (route mismatch, stale CP process serving a newer UI, or the loopback guard) and fix it at the shared layer (UI and server version match; a stale CP restarts or refuses a newer UI); never show a bare HTTP status, show a sentence with the next step; repo chip lists registered repos by name plus Browse; choosing a smaller model shows one muted line ("haiku: fastest, may be less accurate") and never blocks. The composer itself is redefined by CP-ASK (founder 22:03Z): greenfield-from-composer is dropped | packages/control-plane server and ui plus tests | MEDIUM | a forced 404 renders a sentence, a version-skewed UI gets the restart sentence | released@2026-10-15T23:55Z | Founder bug via steering 22:01Z, rescoped by founder 22:03Z. Do not displace FC-15 or FC-16. |
-| R15-F1 | `loki intent show <run>`: print a past run's intent card, the answer and the NOT STATED line; unknown run exits 1 | loki-ts/src/commands/run_status.ts (extend: intent subview), loki-ts/src/cli.ts (one case line), its existing run_status test file | MEDIUM | cd loki-ts && bun test on the run_status test file and tests/commands/cli_help_routes.test.ts; read-only; registered in help and completion | merged@2026-10-15T23:30Z | Source: BACKLOG-D91 134-F1. Extend-never-duplicate: no new command file. |
-| R15-F2 | `loki quickstart --explain-match`: top 3 template scores plus confidence label; below strength 2 says no strong match | autonomy/quickstart.sh, tests/test-quickstart-explain-match.sh (new: no quickstart test owns match scoring; needs runner registration, shard row, timeout -k, shellcheck) | MEDIUM | bash tests/test-quickstart-explain-match.sh; flag-off output byte-identical; bash 3.2 | merged@2026-10-15T23:30Z | Source: BACKLOG-D91 134-F4, issue 217 visibility. |
-| R15-E1 | `loki memory learn --recent N`: learn from the last N merged PRs with a per-PR summary (N max 20) | loki-ts/src/util/pr_lessons.ts (extend), loki-ts/src/commands/memory.ts (learn case only), loki-ts/tests/util/pr_lessons.test.ts | MEDIUM | cd loki-ts && bun test tests/util/pr_lessons.test.ts; learnFromPr unchanged | merged@2026-10-15T23:30Z | Source: BACKLOG-D91 134-F3. |
-| R15-E2 | Reviewer brief names the repo tests that import each changed file (cap 3 plus +N more), from engine10/testmap.ts | loki-ts/src/util/reviewer_brief.ts (extend), loki-ts/tests/util/reviewer_brief.test.ts | MEDIUM | cd loki-ts && bun test tests/util/reviewer_brief.test.ts; LOKI_REVIEWER_BRIEF=0 byte-identical; static scan only | merged@2026-10-15T23:30Z | Source: BACKLOG-D91 134-F2. |
+| R15-F1 | `loki intent show <run>`: print a past run's intent card, the answer and the NOT STATED line; unknown run exits 1 | loki-ts/src/commands/run_status.ts (extend: intent subview), loki-ts/src/cli.ts (one case line), its existing run_status test file | MEDIUM | cd loki-ts && bun test on the run_status test file and tests/commands/cli_help_routes.test.ts; read-only; registered in help and completion | released@2026-10-17T03:50Z | Source: BACKLOG-D91 134-F1. Extend-never-duplicate: no new command file. Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| R15-F2 | `loki quickstart --explain-match`: top 3 template scores plus confidence label; below strength 2 says no strong match | autonomy/quickstart.sh, tests/test-quickstart-explain-match.sh (new: no quickstart test owns match scoring; needs runner registration, shard row, timeout -k, shellcheck) | MEDIUM | bash tests/test-quickstart-explain-match.sh; flag-off output byte-identical; bash 3.2 | released@2026-10-17T03:50Z | Source: BACKLOG-D91 134-F4, issue 217 visibility. Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| R15-E1 | `loki memory learn --recent N`: learn from the last N merged PRs with a per-PR summary (N max 20) | loki-ts/src/util/pr_lessons.ts (extend), loki-ts/src/commands/memory.ts (learn case only), loki-ts/tests/util/pr_lessons.test.ts | MEDIUM | cd loki-ts && bun test tests/util/pr_lessons.test.ts; learnFromPr unchanged | released@2026-10-17T03:50Z | Source: BACKLOG-D91 134-F3. Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| R15-E2 | Reviewer brief names the repo tests that import each changed file (cap 3 plus +N more), from engine10/testmap.ts | loki-ts/src/util/reviewer_brief.ts (extend), loki-ts/tests/util/reviewer_brief.test.ts | MEDIUM | cd loki-ts && bun test tests/util/reviewer_brief.test.ts; LOKI_REVIEWER_BRIEF=0 byte-identical; static scan only | released@2026-10-17T03:50Z | Source: BACKLOG-D91 134-F2. Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
 | R15-B1 | FC38-TIMEOUT: the two 'no bun on PATH' cases get an explicit it() timeout above their 60s spawn bound; record the failing text under 8 parallel copies first | loki-ts/tests/runner/attempts-dispatch.test.ts | LOW | 4 parallel copies, 5 of 5 green; product code untouched; stop if failure is not a timeout | rejected@2026-10-15T23:30Z | Stale premise: attempts-dispatch.test.ts already sets setDefaultTimeout(130_000); under 8 copies the only failure was the line-110 engine10 test at 130s (CPU starvation). FAILURE-CLASSES FC-38. Source: BACKLOG-D91 132-B3. |
 | R15-B2 | Issue 213: test-review-assurance-tail.sh polls child pid files with a sleep 0.01 spin that misses its window under sharded load; replace with a bounded count wait, reproduce first | tests/test-review-assurance-tail.sh | LOW | 8 of 8 parallel runs 44/0; mutation goes red; stop if not reproducible | rejected@2026-10-15T23:30Z | Failed to attribute: no pid-file failure under load; failures are wall-clock bound asserts (requirements timeout, hosted DA, semantic shard 8000ms); trial bounded wait still 43/3. FAILURE-CLASSES FC-53 (closest; add sibling line only if mechanism differs). Source: gh issue 213. |
 | CP-ASK | Founder 22:03Z: "we are not a vibe coding tool". The CP home box becomes Ask Loki: search, learn, compare runs, and ask anything about Loki Mode, past runs, receipts, repos and issues. Default provider claude (or any configured provider and model the user picks); the model gets all of that data (read-only tools or MCP over runs, receipts, events, METRICS, repos, gh issues and PRs); answers are async jobs the user can leave and come back to, listed in the CP. Read-only: Ask never edits a repo or starts a build | Architect slices first (10-40 slices, feature flag); packages/control-plane routes and ui, a read-only data layer, provider invocation | HIGH | the founder asks "compare my last two runs on FireLater" and gets a cited answer async in the CP; Ask cannot write to any repo | building@2026-10-04T00:06Z | Plan docs/v10/CP-ASK-PLAN.md (15 slices behind LOKI_CP_ASK=1, waves {1,4,6,8} {2,5,7} {3,9} 10 11 {12,13} 14 15); founder questions decided as FOUNDER-QUEUE row 20. Slice 1 (MCP read-only mode) seated. Founder direct directive 22:03Z. Architect plan first. | 00:33Z: slices 1 (9f454444a, plus fix-forward F1/F2 7bcffc70f, opus APPROVE), 4 (2a0ad3fc1) and 8 (d1b38e508) merged; flag off; next wave 2/5/6/7. 
@@ -1010,85 +1010,88 @@ Source: ~/git/autonomi-dev/research/2026-09-30-adoption/SWARM-PROMPT-ADOPTION.md
 | TEN-DEPLOY-04 | Verified deploy badge from loki status --badge | loki-ts/src/commands/status.ts (renderLastDeploy plus --badge flag parse only), loki-ts/tests/commands/status.test.ts, CHANGELOG.md | MEDIUM | see Wall in note | ready@2026-10-17T01:40Z | wave 4; depends: TEN-DEPLOY-01 (deployed_url field); live_binding from TEN-DEPLOY-03 is read if present, and its absence omits the badge. Goal: `loki status --badge` reads the newest loki.deploy/1 record (renderLastDeploy already loads it) and verifies it through the existing verify path. It prints a markdown shields badge linking to <deployed_url>/.well-known/loki-provenance.json. The message is 'deployed: verified' (brightgreen) ONLY when the record verifies and live_binding=VERIFIED. 'deployed: unverified' (red) is printed for TAMPERED or a failed health check. In all other cases the badge is omitted with a one-line reason. It never prints green from an unchecked field. The color mapping matches the share badge (autonomy/loki:38291), and no new vocabulary is added. Wall: RED: status.test.ts fixture with a signed healthy record, live_binding=VERIFIED and deployed_url. On main, --badge is unknown and no badge line is printed. GREEN: the badge line contains 'brightgreen' and deployed_url. A record with health FAILED_HEALTH gives a red badge. An unsigned record or a missing live_binding omits the badge and prints the reason. A record with no deployed_url omits the badge. MUTATION: drop the verify call and the unsigned case goes green, so the test goes red. Gate: cd loki-ts && bun test tests/commands/status.test.ts && bunx tsc --noEmit && bash tests/test-status-surface-agrees.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
 | TEN-DEPLOY-05 | loki deploy --env-file: push env to the provider with names-only records | autonomy/loki (cmd_deploy arg parse for --env-file, _deploy_try_execute env step, _deploy_record env_keys field only), tests/test-deploy-receipt-gate.sh (new section), autonomy/completions (loki deploy flag list only), CHANGELOG.md | HIGH | see Wall in note | ready@2026-10-17T01:40Z | SPLIT per CTO critic into (a) env-file parser, .env.example check, masking, env_keys record, (b) four provider verbs; build as two commits or two agents. wave 4; depends: TEN-DEPLOY-03 (same function, serialized to avoid conflicts). Goal: `--env-file FILE` (with --execute only) parses KEY=VALUE with no shell eval. It refuses when a key in .env.example is missing from FILE, naming the keys. Env is applied through documented verbs only: Vercel `vercel --prod -e K=V` per key (args built as an array, never through the shell); Fly `fly secrets set --stage K=V ...` before `fly deploy`; Netlify `netlify env:import FILE`; Cloudflare `wrangler secret bulk FILE`. An unsupported provider refuses with nothing run. The record stores env_keys (names, sorted) and env_source; it NEVER stores values. Values never appear in stdout, the record or the printed 'Running:' line, where they are masked as K=***. Wall: RED: a recording vercel stub logs argv. On main, --env-file is ignored and no -e args appear. GREEN: argv has `-e API_URL=x -e TOKEN=s3cr3t`. Grepping stdout, stderr and the record for s3cr3t finds nothing; env_keys=[API_URL,TOKEN]. When .env.example lists DB_URL and the env file lacks it, the command refuses with rc 1, no stub calls and DB_URL named. A value with $(touch pwned) leaves no file named pwned. MUTATION: write values into the record and the secret-grep goes red. Gate: bash -n autonomy/loki && shellcheck -S warning autonomy/loki && bash tests/test-deploy-receipt-gate.sh && bash tests/test-completion-drift.sh (or whichever completion drift test the CHANGELOG cites) Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
 | TEN-DEPLOY-06 | loki deploy --domain: attach a custom domain and prove TLS | autonomy/loki (cmd_deploy --domain parse and a post-health domain block in _deploy_try_execute, _deploy_record domain/tls fields only), tests/test-deploy-receipt-gate.sh (new section), CHANGELOG.md | MEDIUM | see Wall in note | ready@2026-10-17T01:40Z | wave 5; depends: TEN-DEPLOY-05 (same function, serialized). Goal: `--domain example.com` (with --execute) runs documented verbs after a healthy deploy: Vercel `vercel alias set <deployed_url> <domain>`; Fly `fly certs add <domain>`. Netlify and Cloudflare print the manual dashboard step and set domain_status=manual. Then a TLS proof runs: `openssl s_client -servername <domain> -connect <domain>:443` plus `openssl x509 -noout -enddate -checkend 604800`. It records domain, tls_status (valid/expiring/invalid/unchecked) and tls_not_after, and re-probes https://<domain>/.well-known/loki-provenance.json for the same head_sha. DNS not yet pointed gives tls_status=invalid and exit 6, with the DNS record the provider needs printed. It never claims valid without the openssl check. Wall: RED: vercel, openssl and curl are stubbed. On main, --domain is ignored. GREEN: the alias set argv is recorded, tls_status=valid and tls_not_after is set. An openssl stub that fails -checkend gives expiring. An openssl handshake failure gives invalid and exit 6. A netlify project gives domain_status=manual, no alias call, and tls still checked. No openssl on PATH gives unchecked, never valid. MUTATION: default tls_status to valid and the missing-openssl case goes red. Gate: bash -n autonomy/loki && shellcheck -S warning autonomy/loki && bash tests/test-deploy-receipt-gate.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
-| TEN-DEPLOY-07 | loki github publish: receipt-stamped GitHub export from the CLI | autonomy/loki (cmd_github publish arm and its help line only), tests/test-github-publish.sh (new: no existing test owns cmd_github repo creation; test-proven-pr-check.sh covers PR checks only) plus its run-all-tests.sh registration and shard row, CHANGELOG.md | MEDIUM | see Wall in note | merged@2026-10-17T03:05Z | merged efa201ffd (TL APPROVE 81346df2a) |
+| TEN-DEPLOY-07 | loki github publish: receipt-stamped GitHub export from the CLI | autonomy/loki (cmd_github publish arm and its help line only), tests/test-github-publish.sh (new: no existing test owns cmd_github repo creation; test-proven-pr-check.sh covers PR checks only) plus its run-all-tests.sh registration and shard row, CHANGELOG.md | MEDIUM | see Wall in note | released@2026-10-17T03:50Z | merged efa201ffd (TL APPROVE 81346df2a) Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
 | TEN-DEPLOY-08 | Web app deploy and GitHub push go through the gated CLI; no fabricated URLs | web-app/server.py (deploy_session ~5236-5336 and github_push_session ~5339-5395 only), web-app/tests/test_server.py (new cases), CHANGELOG.md | HIGH | see Wall in note | ready@2026-10-17T01:40Z | SPLIT per CTO critic into (a) deploy_session, (b) github_push_session plus web-app url:null handling; build as two commits or two agents. wave 4; depends: TEN-DEPLOY-01 (deployed_url), TEN-DEPLOY-07 (github publish). Goal: Replace the bodies of deploy_session and github_push_session in web-app/server.py. Deploy runs `loki deploy --execute --dir <session_dir>` as an argv list with a timeout, then reads the newest <session>/.loki/deploys/*.json. It returns {url: deployed_url or null, health_status, live_binding, record_path, refused_reasons} and exits non-2xx on refusal. The platform param is kept as a hint only when it matches the CLI's detected provider; otherwise it returns 409 with the reason. GitHub push calls `loki github publish` (private default). Delete the hardcoded https://vercel.app, https://netlify.app and https://github.io fallbacks and the `git add -A` / `--public` path in the same change. Wall: RED: test_server.py with monkeypatched subprocess. On main, a deploy whose output has no URL returns url='https://vercel.app' (assert url is None fails), and no receipt gate is invoked. GREEN: the subprocess argv is [loki, deploy, --execute, --dir, <dir>]. A gate refusal returns 4xx with the reasons. A no-URL deploy returns url null. A github push argv contains `github publish` and never `add -A`. `grep -n 'https://vercel.app\/https://netlify.app\/"https://github.io"' web-app/server.py` exits 1. MUTATION: restore a fallback URL and the null-URL test goes red. Gate: python3 -m pytest web-app/tests/test_server.py -q && bash tests/moat/p7-no-fabricated-data.sh && bash tests/test-web-app-no-orphan-components.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
 | TEN-DEPLOY-09 | One-click from loki start and loki chat: pass the new deploy flags through | autonomy/loki (cmd_start _ps_ deploy parse block ~2625-2690 only), loki-ts/src/commands/start.ts (help string ~148-151 only), autonomy/lib/chat.sh (help line 53, system prompt line 6, _chat_deploy echo only), tests/test-help-start-flags.sh, docs/DEPLOYMENT.md, CHANGELOG.md | LOW | see Wall in note | ready@2026-10-17T01:40Z | SPLIT per CTO critic into (a) start passthrough, (b) chat and docs text; build as two commits or two agents. wave 5; depends: TEN-DEPLOY-05, TEN-DEPLOY-06, TEN-DEPLOY-07. Goal: `loki start --deploy` passes --destination, --canary, --env-file, --domain and --github through to cmd_deploy. --github runs `loki github publish` after a successful deploy. Flag validation uses the existing _ps_ pattern (a value must not start with '-'). Bun-route start.ts help text lists them, and the PATH-slice divert keeps routing --deploy to bash. chat.sh `/deploy` help and _LOKI_CHAT_SYSTEM_PROMPT mention --domain, --env-file and `loki verify --url`, and the confirm prompt prints the full argv. docs/DEPLOYMENT.md gets one end-to-end 'brief to verified URL' section. Wall: RED: test-help-start-flags.sh asserts `loki start --help` lists --domain and --env-file, and a stubbed cmd_deploy recorder receives `--domain x.com --env-file .env` from `loki start --deploy --domain x.com --env-file .env`. It fails on main. GREEN: both pass. `--domain --env-file` (flag-shaped value) exits 2. A non-zero start exit still never deploys. MUTATION: drop the --domain forward and the recorder assertion goes red. Gate: bash -n autonomy/loki autonomy/lib/chat.sh && bash tests/test-help-start-flags.sh && (cd loki-ts && bun test tests/commands/start.test.ts && bunx tsc --noEmit) && bash tests/test-help-drift.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
 | TEN-ADOPTION-01 | Tour shows a receipt you can actually verify offline | autonomy/loki (cmd_demo offline branch only, ~15927-15965); skills/fixtures/demo-receipt/ (add receipt.json, the event log the log_seal check reads, pubkey.jwk; update README.md); tests/cli/test-tour-verify.sh (new: no test owns tour today, and test-proof-command.sh covers the legacy proof store) | MEDIUM | see Wall in note | ready@2026-10-17T01:40Z | wave 3; depends: none (the fixture must come from a real sealed run; see not_codeable). Goal: `loki tour` (and `loki demo --offline`) runs the real Bun verifier against a bundled engine10 receipt.json, its event log and a public JWK, and prints VERIFIED. It then flips one byte in a copy under a run-owned temp dir and prints TAMPERED. It stays offline, needs no key and spends nothing. When Bun is absent it prints the exact verify command instead of claiming a result. The display-only disclaimer at autonomy/loki:15953-15957 goes away (the replaced text is deleted). Wall: Red first: the new test asserts the tour stdout contains VERIFIED from the verifier, and TAMPERED for the byte-flipped copy, with rc 0. On main it fails because the stdout says 'for display only'. Mutations: (a) point the tour at a receipt with one changed field: the test must see TAMPERED, not VERIFIED; (b) remove pubkey.jwk: the tour must say UNCHECKED or the verify-command fallback, never VERIFIED; (c) hide bun from PATH: output has the command and no verdict. Gate: bash tests/cli/test-tour-verify.sh && bash tests/test-help-discoverability.sh && bash scripts/local-ci.sh. Register the new test in tests/run-all-tests.sh and its shard. Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
-| TEN-ADOPTION-02 | Portable receipt bundle builder | loki-ts/src/util/receipt_bundle.ts (new: no existing module packages a receipt for third-party verify, and engine10/verify_cmd.ts is core at its line budget); loki-ts/tests/util/receipt_bundle.test.ts (new, beside the existing util tests) | HIGH | see Wall in note | merged@2026-10-17T03:30Z | TL APPROVE bb4957e90, merged for v11.17.14 |
-| TEN-ADOPTION-03 | proof bundle/badge/share work for loki start (engine10) runs | loki-ts/src/commands/proof.ts; loki-ts/tests/commands/proof_badge.test.ts; loki-ts/tests/commands/proof.test.ts | HIGH | see Wall in note | building@2026-10-17T03:07Z | batch J workflow w9sw9xytw |
-| TEN-ADOPTION-04 | PR body lets a reviewer verify on their own machine, plus an opt-out Loki footer | loki-ts/src/e10ext/reviewer_body.ts; loki-ts/tests/engine10/reviewer_body.test.ts; loki-ts/tests/engine10/pr_body_golden.test.ts (golden update only) | MEDIUM | see Wall in note | building@2026-10-17T03:07Z | batch J workflow w9sw9xytw |
-| TEN-ADOPTION-05 | loki mcp install for Claude Code, Cursor, VS Code, Windsurf | autonomy/mcp-launch.sh; tests/cli/test-mcp-launch.sh; loki-ts/src/cli/registry.ts (the mcp row only: add the install subcommand so help-drift and completions stay true) | MEDIUM | see Wall in note | merged@2026-10-17T03:05Z | merged b7c99da72 (TL APPROVE 02fcdfa21) |
+| TEN-ADOPTION-02 | Portable receipt bundle builder | loki-ts/src/util/receipt_bundle.ts (new: no existing module packages a receipt for third-party verify, and engine10/verify_cmd.ts is core at its line budget); loki-ts/tests/util/receipt_bundle.test.ts (new, beside the existing util tests) | HIGH | see Wall in note | released@2026-10-17T03:50Z | TL APPROVE bb4957e90, merged for v11.17.14 Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| TEN-ADOPTION-03 | proof bundle/badge/share work for loki start (engine10) runs | loki-ts/src/commands/proof.ts; loki-ts/tests/commands/proof_badge.test.ts; loki-ts/tests/commands/proof.test.ts | HIGH | see Wall in note | released@2026-10-17T04:08Z | v11.17.17; TL APPROVE 260474376, merged as clean cherry-pick 029bdd1a6 |
+| TEN-ADOPTION-04 | PR body lets a reviewer verify on their own machine, plus an opt-out Loki footer | loki-ts/src/e10ext/reviewer_body.ts; loki-ts/tests/engine10/reviewer_body.test.ts; loki-ts/tests/engine10/pr_body_golden.test.ts (golden update only) | MEDIUM | see Wall in note | released@2026-10-17T04:08Z | v11.17.17; TL APPROVE batch J workflow w9sw9xytw |
+| TEN-ADOPTION-05 | loki mcp install for Claude Code, Cursor, VS Code, Windsurf | autonomy/mcp-launch.sh; tests/cli/test-mcp-launch.sh; loki-ts/src/cli/registry.ts (the mcp row only: add the install subcommand so help-drift and completions stay true) | MEDIUM | see Wall in note | released@2026-10-17T03:50Z | merged b7c99da72 (TL APPROVE 02fcdfa21) Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
 | TEN-ADOPTION-06 | One-click IDE install links and honest npm metadata | README.md; docs/INSTALLATION.md; package.json (keywords only); tests/test-server-json-current.sh (extend: decode the deeplink payloads) | LOW | see Wall in note | ready@2026-10-17T01:40Z | wave 2; depends: TEN-ADOPTION-05. Goal: The README MCP line (README.md:161) and a new IDE section in docs/INSTALLATION.md gain a Cursor deeplink (cursor://anysphere.cursor-deeplink/mcp/install?name=loki-mode&config=<base64 of {command:npx,args:[-y,loki-mode,mcp]}>), a VS Code link (vscode:mcp/install?<urlencoded json>) and the `loki mcp install --client X` commands. package.json keywords drop deprecated or false terms (gemini, gemini-cli) and keep the true ones. Wall: Red: the extended guard extracts the Cursor base64 config and the VS Code JSON from README.md and asserts they decode to a server that runs server.json's identifier with arg 'mcp'. It fails today because no deeplink exists. It also asserts that package.json keywords contain no deprecated provider name. Mutation: change the arg in the README payload to 'serve'; the guard must go red. Gate: bash tests/test-server-json-current.sh && bash tests/test-help-discoverability.sh && the help-drift and doc guards in scripts/local-ci.sh (no emojis, no em or en dashes). Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
 | TEN-ADOPTION-07 | Examples gallery of verifiable receipts | examples/README.md; examples/receipts/ (new dir: gallery data, no existing owner); tests/test-examples-gallery.sh (new: no existing test covers examples/; register in tests/run-all-tests.sh and its shard); package.json files entry only if examples/receipts must ship | MEDIUM | see Wall in note | ready@2026-10-17T01:40Z | wave 4; depends: TEN-ADOPTION-02, TEN-ADOPTION-01. Goal: examples/README.md leads with a gallery of real loki start runs. Each entry is a bundle in examples/receipts/<name>/ (format from slice 02) with task, outcome, cost and the one-line verify command. A guard verifies every gallery bundle with its own pubkey and fails on any entry that is not VERIFIED or ALREADY_SATISFIED. The six v5 HTML demos stay, under a clearly labeled 'UI demos (no receipt)' heading, so nothing implies they were verified. The tour fixture from slice 01 is the first entry. Wall: Red: the guard fails today because examples/receipts/ is missing. Green once at least one bundle verifies. Mutations: (a) a byte edit in one gallery receipt turns the guard red with TAMPERED; (b) a README entry whose directory does not exist turns it red; (c) a FAILED receipt listed in the gallery turns it red. Gate: bash tests/test-examples-gallery.sh && bash scripts/structural-checks.sh && bash scripts/local-ci.sh. Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
 | TEN-ADOPTION-08 | Install smoke covers the newcomer first-touch path | scripts/smoke-install.sh | MEDIUM | see Wall in note | ready@2026-10-17T01:40Z | wave 5; depends: TEN-ADOPTION-01, TEN-ADOPTION-05. Goal: scripts/smoke-install.sh also runs, from the packed tarball with a throwaway HOME: `loki tour` (expects the verifier's VERIFIED line from slice 01), `loki mcp install --client cursor --print` (expects valid JSON) and a stdio MCP initialize handshake returning a tools list. The packaged artifact is then proven on the exact paths the README sends a new user down. Keep it runnable by hand, and add an optional CI hook only if it stays under the 10-min command budget. Wall: Red: before slice 01 merges, the new tour assertion fails on the display-only text. Green after. Mutation: drop skills/fixtures/demo-receipt/pubkey.jwk from the packed files list in a scratch copy; the smoke must fail on the tour case, which proves it tests the shipped package and not the checkout. Gate: bash scripts/smoke-install.sh --log ~/loki-ci-logs/smoke-install-adoption.log (exit 0) && shellcheck scripts/smoke-install.sh. Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
-| TEN-COST-01 | Opt-in cost profile: loki start --cost lean / LOKI_COST_PROFILE=lean | loki-ts/src/util/cost_profile.ts (new: no existing module owns engine10 env presets; util/tier.ts is the license seam, not a cost preset), loki-ts/src/commands/start.ts (one --cost value-flag row plus one apply call), loki-ts/tests/util/cost_profile.test.ts (new, pairs with the new util), loki-ts/tests/commands/start.test.ts (one case), tests/test-help-start-flags.sh (expected flag list) | MEDIUM | see Wall in note | ready@2026-10-17T01:40Z | wave 2; depends: none. Goal: One user-facing switch that turns on the already-built, flag-gated cost levers together, with each lever named on the start line. The lean profile sets LOKI_ROUTER=1 (the router keeps its own D89 haiku-only-with-advisor rule and escalation ladder) and LOKI_E10_TRIM=1. It only fills unset variables, so explicit user env always wins: LOKI_ROUTER=0 stays 0. Profile off or unset leaves the env byte-identical. It also writes .loki/cost-profile.json listing the levers applied, so nothing is reduced silently (D89 item 3). Works for loki start and, through the env var, for loki chat unchanged. Wall: Red first: - cost_profile.test.ts asserts resolveCostProfile('lean', {}) returns {LOKI_ROUTER:'1', LOKI_E10_TRIM:'1'}. - resolveCostProfile('lean', {LOKI_ROUTER:'0'}) keeps '0'. - An unknown profile name throws a usage error. - 'off' and unset return an empty patch. - start.test.ts: --cost lean reaches the child env and prints one line naming both levers. Mutation: remove the user-wins precedence check and confirm the LOKI_ROUTER=0 case goes red; restore. Gate: cd loki-ts && bun test tests/util/cost_profile.test.ts tests/commands/start.test.ts && bunx tsc --noEmit && bun test tests/engine10/budget.test.ts && bash ../tests/test-help-start-flags.sh && bash ../tests/test-help-changelog-drift.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
+| TEN-COST-01 | Opt-in cost profile: loki start --cost lean / LOKI_COST_PROFILE=lean | loki-ts/src/util/cost_profile.ts (new: no existing module owns engine10 env presets; util/tier.ts is the license seam, not a cost preset), loki-ts/src/commands/start.ts (one --cost value-flag row plus one apply call), loki-ts/tests/util/cost_profile.test.ts (new, pairs with the new util), loki-ts/tests/commands/start.test.ts (one case), tests/test-help-start-flags.sh (expected flag list) | MEDIUM | see Wall in note | building@2026-10-17T04:15Z | wave 2; depends: none. Goal: One user-facing switch that turns on the already-built, flag-gated cost levers together, with each lever named on the start line. The lean profile sets LOKI_ROUTER=1 (the router keeps its own D89 haiku-only-with-advisor rule and escalation ladder) and LOKI_E10_TRIM=1. It only fills unset variables, so explicit user env always wins: LOKI_ROUTER=0 stays 0. Profile off or unset leaves the env byte-identical. It also writes .loki/cost-profile.json listing the levers applied, so nothing is reduced silently (D89 item 3). Works for loki start and, through the env var, for loki chat unchanged. Wall: Red first: - cost_profile.test.ts asserts resolveCostProfile('lean', {}) returns {LOKI_ROUTER:'1', LOKI_E10_TRIM:'1'}. - resolveCostProfile('lean', {LOKI_ROUTER:'0'}) keeps '0'. - An unknown profile name throws a usage error. - 'off' and unset return an empty patch. - start.test.ts: --cost lean reaches the child env and prints one line naming both levers. Mutation: remove the user-wins precedence check and confirm the LOKI_ROUTER=0 case goes red; restore. Gate: cd loki-ts && bun test tests/util/cost_profile.test.ts tests/commands/start.test.ts && bunx tsc --noEmit && bun test tests/engine10/budget.test.ts && bash ../tests/test-help-start-flags.sh && bash ../tests/test-help-changelog-drift.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
 | TEN-COST-02 | raw-lean baseline mode in the claude_code bench adapter | benchmarks/bench/adapters/claude_code.py, benchmarks/bench/tests/test_model_pin.py | LOW | see Wall in note | released@2026-10-17T02:57Z | merge 3a7942aac, dist bd6348d77; TL APPROVE 60dc6d321 (8 passed, mutation red); post-merge tsc 0 errors, 130 pass. wave 1; depends: none. Goal: An honest same-config raw Claude Code baseline that works under OAuth (no API key). run(..., lean=True) adds: --setting-sources project, --strict-mcp-config, --mcp-config '{"mcpServers":{}}', --disable-slash-commands and --tools Bash,Read,Edit,Write,Glob,Grep, the same tool set as ENGINE10_TOOLS in providers.ts:618. lean and bare together raise ValueError, never silently pick one. The row command string records lean. Wall: Red first: - test_model_pin.py asserts the exact lean argv with a stub runner. - lean=True with bare=True raises. - Default lean=False argv is byte-identical to today's. Mutation: drop --strict-mcp-config from the lean argv; the argv test goes red. Gate: python3 -I -m pytest benchmarks/bench/tests/test_model_pin.py -q Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. v11.17.13 npm next 11.17.13 |
 | TEN-COST-03 | Cost claim verdict: paired bootstrap CI and acceptance parity | benchmarks/bench/cost_claim.py (new: no bench module owns statistical claim gating; attribution.py is 1025 lines and owned by TEN-COST-04), benchmarks/bench/tests/test_cost_claim.py (new, pairs with the new module) | MEDIUM | see Wall in note | released@2026-10-17T02:57Z | merge 049a16327; TL APPROVE cab8238eb (8 passed, mutation 1 failed). wave 1; depends: none. Goal: A pure function decides whether a cost claim is PROVEN or NOT PROVEN. - Inputs: per-row results for a Loki arm and a floor arm. - Method: paired bootstrap over tasks (fixed seed) for the 95% CI of the cost-per-accepted ratio. - PROVEN_AT(target) only when all of these hold: - the CI upper bound is at most the target; - Loki's acceptance rate is at least the floor's minus 0 (no accepted-task loss); - no row is cost_partial; - engine and loki version are recorded and identical across rows; - n is at least 3 per task. - Otherwise NOT PROVEN, with every failing reason listed. - Unmeasured rows are excluded but counted in the reasons. Wall: Red first, fixtures: - Ratio about 0.4 with tight spread gives PROVEN at 0.5. - Ratio 0.45 with one cost_partial row gives NOT PROVEN, reason partial. - Loki accepts 22/24 vs floor 24/24 gives NOT PROVEN, reason acceptance. - Mixed loki versions give NOT PROVEN. - n=2 gives NOT PROVEN. - Same seed gives an identical CI. Mutation: replace the CI upper bound with the point estimate; the wide-spread fixture flips to PROVEN and goes red. Gate: python3 -I -m pytest benchmarks/bench/tests/test_cost_claim.py -q Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. v11.17.13 npm next 11.17.13 |
 | TEN-COST-04 | C-F1 arms raw-lean and loki-lean, lever ablation, verdict in the report | benchmarks/bench/attribution.py, benchmarks/bench/adapters/loki.py, benchmarks/bench/tests/test_attribution.py | MEDIUM | see Wall in note | ready@2026-10-17T01:40Z | wave 3; depends: TEN-COST-01, TEN-COST-02, TEN-COST-03, COST-WALL-e merged (it edits attribution.py). Goal: attribution.py changes: - Adds arms raw-lean (claude_code lean=True) and loki-lean (loki with LOKI_COST_PROFILE=lean). - Adds repeatable --loki-env KEY=VALUE for one-lever ablations (allowlist: LOKI_* keys only). - Adds raw-lean to COST_FLOORS. - render_cost_table prints the TEN-COST-03 verdict per Loki arm against each floor. adapters/loki.py changes: - Accepts profile and extra_env. - Records cost_profile, lever_env and cache_read/cache_creation tokens by phase in the row, so rows from different lever configs never pool. Wall: Red first in test_attribution.py: - --dry-run --arms raw-configured,raw-lean,loki,loki-lean plans all 4 arms. - loki-lean rows carry cost_profile 'lean'. - --loki-env FOO=1 (not LOKI_) exits 2. - The rendered table has a raw-lean column and a verdict line. - A loki row with a different lever_env is not pooled into the loki arm. Mutation: drop lever_env from the pooling key; the mixed-config test goes red. Gate: python3 -I -m pytest benchmarks -q -k 'attribution or model_pin or cost_claim' && python3 -I benchmarks/bench/attribution.py --dry-run --arms raw-configured,raw-lean,loki,loki-lean Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
-| TEN-COST-05 | Per-stage cache-hit attribution in the cost breakdown | loki-ts/src/util/cost_breakdown.ts, loki-ts/tests/engine10/cost.test.ts (breakdown cases only) | MEDIUM | see Wall in note | merged@2026-10-17T02:46Z | TL APPROVE 71a31207f. wave 1; depends: none. Goal: costBreakdown per_stage gains cache_read_tokens, cache_creation_tokens and cache_hit_ratio, computed as read / (read + creation), null when both are 0. This makes the cache-stable-prefix lever (CH-01/CP-01) provable per stage in every receipt and in the bench row. The usd fail-closed rules are unchanged, and the new fields are additive. Wall: Red first: - Two implement records (read 7000/creation 0 and read 0/creation 7000) give ratio 0.5. - A stage with no token keys gives null, never 0. - Existing usd and retry assertions stay green. Mutation: count cache_creation as a hit; the 0.5 case goes red. Gate: cd loki-ts && bun test tests/engine10/cost.test.ts tests/engine10/budget.test.ts && bunx tsc --noEmit Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
-| TEN-COST-06 | xreview claude judge: lean flags and child-ledger line | loki-ts/src/engine10/stages/xreview.ts, loki-ts/tests/engine10/xreview.test.ts | MEDIUM | see Wall in note | merged@2026-10-17T03:30Z | TL APPROVE 2e40a4be8, merged for v11.17.14 |
-| TEN-COST-07 | Project-model discovery on the fast tier, retry on the run model | loki-ts/src/project_model/discover.ts, loki-ts/tests/project_model/project_model.test.ts | MEDIUM | see Wall in note | merged@2026-10-17T02:46Z | TL APPROVE e01e37c5e. wave 1; depends: none. Goal: Discovery attempt 1 runs on fastTierModel(env) (runner/model_downgrades.ts:8). It is sonnet unless LOKI_ALLOW_HAIKU, so it never drops below sonnet without opt-in, and it is never weaker than an explicit LOKI_MODEL_OVERRIDE. The existing validation-error retry (attempt 2) runs on the run model, so a weak answer escalates, never ships. The model used is recorded on the project_model result. The schema validation and the owner=provider fallback are unchanged. Wall: Red first, with a stub SessionRunner: - Attempt 1 opts.model equals fastTierModel. - After an invalid answer, attempt 2 opts.model is undefined (run model). - With LOKI_MODEL_OVERRIDE set, both attempts use the override. Mutation: pin attempt 2 to the fast tier; the escalation test goes red. Gate: cd loki-ts && bun test tests/project_model && bunx tsc --noEmit Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
+| TEN-COST-05 | Per-stage cache-hit attribution in the cost breakdown | loki-ts/src/util/cost_breakdown.ts, loki-ts/tests/engine10/cost.test.ts (breakdown cases only) | MEDIUM | see Wall in note | released@2026-10-17T03:50Z | TL APPROVE 71a31207f. wave 1; depends: none. Goal: costBreakdown per_stage gains cache_read_tokens, cache_creation_tokens and cache_hit_ratio, computed as read / (read + creation), null when both are 0. This makes the cache-stable-prefix lever (CH-01/CP-01) provable per stage in every receipt and in the bench row. The usd fail-closed rules are unchanged, and the new fields are additive. Wall: Red first: - Two implement records (read 7000/creation 0 and read 0/creation 7000) give ratio 0.5. - A stage with no token keys gives null, never 0. - Existing usd and retry assertions stay green. Mutation: count cache_creation as a hit; the 0.5 case goes red. Gate: cd loki-ts && bun test tests/engine10/cost.test.ts tests/engine10/budget.test.ts && bunx tsc --noEmit Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| TEN-COST-06 | xreview claude judge: lean flags and child-ledger line | loki-ts/src/engine10/stages/xreview.ts, loki-ts/tests/engine10/xreview.test.ts | MEDIUM | see Wall in note | released@2026-10-17T03:50Z | TL APPROVE 2e40a4be8, merged for v11.17.14 Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| TEN-COST-07 | Project-model discovery on the fast tier, retry on the run model | loki-ts/src/project_model/discover.ts, loki-ts/tests/project_model/project_model.test.ts | MEDIUM | see Wall in note | released@2026-10-17T03:50Z | TL APPROVE e01e37c5e. wave 1; depends: none. Goal: Discovery attempt 1 runs on fastTierModel(env) (runner/model_downgrades.ts:8). It is sonnet unless LOKI_ALLOW_HAIKU, so it never drops below sonnet without opt-in, and it is never weaker than an explicit LOKI_MODEL_OVERRIDE. The existing validation-error retry (attempt 2) runs on the run model, so a weak answer escalates, never ships. The model used is recorded on the project_model result. The schema validation and the owner=provider fallback are unchanged. Wall: Red first, with a stub SessionRunner: - Attempt 1 opts.model equals fastTierModel. - After an invalid answer, attempt 2 opts.model is undefined (run model). - With LOKI_MODEL_OVERRIDE set, both attempts use the override. Mutation: pin attempt 2 to the fast tier; the escalation test goes red. Gate: cd loki-ts && bun test tests/project_model && bunx tsc --noEmit Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
 | TEN-COST-08 | Documented reproducible cost proof run | docs/v10/METRICS.md, docs/EVALUATING.md | LOW | see Wall in note | ready@2026-10-17T01:40Z | wave 4; depends: TEN-COST-04. Goal: docs/v10/METRICS.md gains a 'Cost proof (C-F1)' section that states: - the exact command (attribution.py --execute, arms raw-configured, raw-lean, raw-bare, loki, loki-lean, n=3, pinned model, --max-spend-usd); - the verdict rule from TEN-COST-03; - that results are reported against all three floors, never only the favorable one; - that a run is valid only when the recorded loki version equals VERSION. docs/EVALUATING.md links to it. This is an extension of existing docs, not a new doc. Wall: Red first: grep -n 'Cost proof (C-F1)' docs/v10/METRICS.md exits 1 before the edit. Green: - The documented dry-run command, copied verbatim, exits 0. - grep -n 'raw-lean' docs/EVALUATING.md prints a line. - No em or en dashes: grep -nP '[\x{2013}\x{2014}]' on both files exits 1. Gate: python3 -I benchmarks/bench/attribution.py --dry-run --arms raw-configured,raw-lean,raw-bare,loki,loki-lean && bash tests/test-help-changelog-drift.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
-| TEN-QUALITY-01 | Fix brief carries a bounded failure excerpt (assertion, traceback, expected/received) | loki-ts/src/util/check_result.ts (failureExcerpt), loki-ts/src/engine10/stages/verify.ts (runCheck keeps the fail output excerpt; line 315 sample; at most 3 core lines), loki-ts/tests/engine10/check_result.test.ts, loki-ts/tests/engine10/fix.test.ts, loki-ts/tests/engine10/wall_holdout.test.ts | HIGH | see Wall in note | ready@2026-10-17T01:40Z | SPLIT per CTO critic into (a) pure failureExcerpt plus fixtures, (b) verify.ts wiring plus holdout test; build as two commits or two agents. wave 2; depends: none. Goal: Each failing non-holdout check's output reaches the fix session as a redacted excerpt of at most 1500 bytes, with at most 6 KB across all groups. The group format is `<rerun cmd>\n<excerpt>`. failureExcerpt() in util/check_result.ts finds the decisive block: pytest `E ` lines plus the last frame, jest/vitest Expected/Received, node AssertionError, go `--- FAIL` with the next lines, and tsc/ruff diagnostic lines. It strips ANSI, makes absolute paths repo-relative and runs util/redact.ts. The signature stays byte-identical, so stall detection at machine.ts:232 and escalation in fix.ts are unchanged. The excerpt lives in a stage-local map inside verify.ts. It is never added to VerifyCheck, never emitted in test.result, and never computed for holdout checks. Wall: Red first: fix.test.ts drives verify then fix on a fixture with a failing pytest `assert add(2,2) == 5`. Today the brief lacks `E assert 4 == 5`, so the test fails. check_result.test.ts covers one fixture each for pytest, jest, node:test, go and tsc. It also asserts the size cap and that an AKIA-style token is redacted. wall_holdout.test.ts asserts that a failing holdout's output text appears in neither failures_grouped, events.jsonl nor the fix brief. Mutations: failureExcerpt returning '' must turn fix.test red; removing the isHold filter at verify.ts:314 must turn wall_holdout red; adding the excerpt to the signature must turn the existing stall test in machine.test.ts red. Gate: cd /Users/lokesh/git/lokimode-anthropic/loki-ts && bun test tests/engine10/check_result.test.ts tests/engine10/fix.test.ts tests/engine10/wall_holdout.test.ts && bun test && npx tsc --noEmit && bun test tests/engine10/budget.test.ts; then bash scripts/local-ci.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
-| TEN-QUALITY-02 | Pure static-diagnostic baseline attribution (new vs pre-existing lint) | loki-ts/src/runner/repo_profile.ts, loki-ts/tests/runner/harness_intelligence.test.ts (extends its existing repo_profile describe blocks) | HIGH | see Wall in note | merged@2026-10-17T02:56Z | merged 43deeafe9 (HIGH r2 APPROVE 05cafda44) |
-| TEN-QUALITY-03 | Wire static attribution into verify so pre-existing lint never drives fix rounds | loki-ts/src/engine10/stages/verify.ts (runLintChecks only; at most 4 core lines, helper calls live in repo_profile.ts), loki-ts/tests/engine10/verify_lint.test.ts | HIGH | see Wall in note | building@2026-10-17T03:07Z | batch J workflow w9sw9xytw |
-| TEN-QUALITY-04 | Repo map indexes methods and whole large files; cache key versioned | loki-ts/src/engine10/repomap.ts, loki-ts/src/engine10/cache.ts (one-token key rename; net core growth at most 5 lines), loki-ts/tests/engine10/repomap.test.ts, loki-ts/tests/engine10/cache.test.ts | MEDIUM | see Wall in note | merged@2026-10-17T02:46Z | TL APPROVE cc1c1b67d. wave 1; depends: none. Goal: repomap.ts records indented Python def and async def under the most recent top-level class as `Class.method`. It raises the symbol-scan cap from 20 KB to 256 KB per file and caps symbols at 300 per file. cache.ts renames the cache file to repomap2-${tree}.json, so a map cached before methods existed is never read. The RepoMap shape is unchanged (symbols are still strings), so isRepoMap and every caller keep working. Wall: Red first: repomap.test.ts writes a 60 KB Python file with `class QuerySet:` and `def bulk_create(self, objs):` past byte 20,000, and asserts the map has `QuerySet.bulk_create`. A file with 1000 defs yields at most 300 symbols. cache.test.ts: a stale repomap-<tree>.json written in the old format is ignored, so a fresh build happens. Mutations: restore the 20 KB cap and the test goes red; restore the old cache filename and the stale test goes red. Gate: cd /Users/lokesh/git/lokimode-anthropic/loki-ts && bun test tests/engine10/repomap.test.ts tests/engine10/cache.test.ts tests/engine10/intake.test.ts tests/engine10/sizing.test.ts && bun test && npx tsc --noEmit && bun test tests/engine10/budget.test.ts; then bash scripts/local-ci.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
+| TEN-QUALITY-01 | Fix brief carries a bounded failure excerpt (assertion, traceback, expected/received) | loki-ts/src/util/check_result.ts (failureExcerpt), loki-ts/src/engine10/stages/verify.ts (runCheck keeps the fail output excerpt; line 315 sample; at most 3 core lines), loki-ts/tests/engine10/check_result.test.ts, loki-ts/tests/engine10/fix.test.ts, loki-ts/tests/engine10/wall_holdout.test.ts | HIGH | see Wall in note | building@2026-10-17T04:27Z | SPLIT per CTO critic into (a) pure failureExcerpt plus fixtures, (b) verify.ts wiring plus holdout test; build as two commits or two agents. wave 2; depends: none. Goal: Each failing non-holdout check's output reaches the fix session as a redacted excerpt of at most 1500 bytes, with at most 6 KB across all groups. The group format is `<rerun cmd>\n<excerpt>`. failureExcerpt() in util/check_result.ts finds the decisive block: pytest `E ` lines plus the last frame, jest/vitest Expected/Received, node AssertionError, go `--- FAIL` with the next lines, and tsc/ruff diagnostic lines. It strips ANSI, makes absolute paths repo-relative and runs util/redact.ts. The signature stays byte-identical, so stall detection at machine.ts:232 and escalation in fix.ts are unchanged. The excerpt lives in a stage-local map inside verify.ts. It is never added to VerifyCheck, never emitted in test.result, and never computed for holdout checks. Wall: Red first: fix.test.ts drives verify then fix on a fixture with a failing pytest `assert add(2,2) == 5`. Today the brief lacks `E assert 4 == 5`, so the test fails. check_result.test.ts covers one fixture each for pytest, jest, node:test, go and tsc. It also asserts the size cap and that an AKIA-style token is redacted. wall_holdout.test.ts asserts that a failing holdout's output text appears in neither failures_grouped, events.jsonl nor the fix brief. Mutations: failureExcerpt returning '' must turn fix.test red; removing the isHold filter at verify.ts:314 must turn wall_holdout red; adding the excerpt to the signature must turn the existing stall test in machine.test.ts red. Gate: cd /Users/lokesh/git/lokimode-anthropic/loki-ts && bun test tests/engine10/check_result.test.ts tests/engine10/fix.test.ts tests/engine10/wall_holdout.test.ts && bun test && npx tsc --noEmit && bun test tests/engine10/budget.test.ts; then bash scripts/local-ci.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
+| TEN-QUALITY-02 | Pure static-diagnostic baseline attribution (new vs pre-existing lint) | loki-ts/src/runner/repo_profile.ts, loki-ts/tests/runner/harness_intelligence.test.ts (extends its existing repo_profile describe blocks) | HIGH | see Wall in note | released@2026-10-17T03:50Z | merged 43deeafe9 (HIGH r2 APPROVE 05cafda44) Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| TEN-QUALITY-03 | Wire static attribution into verify so pre-existing lint never drives fix rounds | loki-ts/src/engine10/stages/verify.ts (runLintChecks only; at most 4 core lines, helper calls live in repo_profile.ts), loki-ts/tests/engine10/verify_lint.test.ts | HIGH | see Wall in note | released@2026-10-17T04:08Z | v11.17.17; TL APPROVE batch J workflow w9sw9xytw |
+| TEN-QUALITY-04 | Repo map indexes methods and whole large files; cache key versioned | loki-ts/src/engine10/repomap.ts, loki-ts/src/engine10/cache.ts (one-token key rename; net core growth at most 5 lines), loki-ts/tests/engine10/repomap.test.ts, loki-ts/tests/engine10/cache.test.ts | MEDIUM | see Wall in note | released@2026-10-17T03:50Z | TL APPROVE cc1c1b67d. wave 1; depends: none. Goal: repomap.ts records indented Python def and async def under the most recent top-level class as `Class.method`. It raises the symbol-scan cap from 20 KB to 256 KB per file and caps symbols at 300 per file. cache.ts renames the cache file to repomap2-${tree}.json, so a map cached before methods existed is never read. The RepoMap shape is unchanged (symbols are still strings), so isRepoMap and every caller keep working. Wall: Red first: repomap.test.ts writes a 60 KB Python file with `class QuerySet:` and `def bulk_create(self, objs):` past byte 20,000, and asserts the map has `QuerySet.bulk_create`. A file with 1000 defs yields at most 300 symbols. cache.test.ts: a stale repomap-<tree>.json written in the old format is ignored, so a fresh build happens. Mutations: restore the 20 KB cap and the test goes red; restore the old cache filename and the stale test goes red. Gate: cd /Users/lokesh/git/lokimode-anthropic/loki-ts && bun test tests/engine10/repomap.test.ts tests/engine10/cache.test.ts tests/engine10/intake.test.ts tests/engine10/sizing.test.ts && bun test && npx tsc --noEmit && bun test tests/engine10/budget.test.ts; then bash scripts/local-ci.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
 | TEN-QUALITY-05 | Identifier-aware relevance ranking (traceback paths, exact identifier tokens, stopwords) | loki-ts/src/engine10/relevant_files.ts, loki-ts/src/util/relevance.ts (new; justified above), loki-ts/tests/engine10/plan.test.ts | MEDIUM | see Wall in note | ready@2026-10-17T01:40Z | wave 2; depends: none (gains compound with TEN-QUALITY-04 Class.method symbols). Goal: selectRelevantFiles and selectRelevantFilesWithReason keep their signatures, but rank by these rules: (a) A repo path named in the task or in a traceback frame ranks first. This covers `File "a/b.py", line N`, `a/b.ts:12:3` and dotted modules `pkg.mod.Name` resolved to a mapped path. (b) Exact token matches only. Tokens come from splitting camelCase, snake_case, dots and slashes; substring matches no longer count. (c) Weights: basename stem 3, symbol 2, path segment 1. (d) A fixed stopword list. (e) Ties keep repo-map order. Reasons still name the matched tokens. New file util/relevance.ts: relevant_files.ts sits in engine10 core at 4964 of 5000 lines, so the scoring moves out and relevant_files.ts becomes a thin delegate with net negative core lines. Wall: Red first, in plan.test.ts: - The task 'add a retry flag' must not select address.py. - A task containing a pytest traceback `File "src/pkg/query.py", line 88` ranks src/pkg/query.py first, ahead of 7 keyword-noise files. - `bulk_create` selects the file whose symbol is QuerySet.bulk_create. - `parseConfig` matches the symbol parse_config. Existing callers stay green: decompose.test.ts, warm.test.ts, already_done_cleanup.test.ts and the e10ext brief tests. Mutation: restore `hay.includes(w)` and the address case goes red; drop the traceback rule and the traceback case goes red. Gate: cd /Users/lokesh/git/lokimode-anthropic/loki-ts && bun test tests/engine10/plan.test.ts tests/engine10/decompose.test.ts tests/features/warm.test.ts && bun test && npx tsc --noEmit && bun test tests/engine10/budget.test.ts; then bash scripts/local-ci.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
-| TEN-QUALITY-06 | Signature digest of top relevant files in the implement/fix brief | loki-ts/src/util/ts_signatures.ts, loki-ts/src/e10ext/context.ts (at most 5 lines, e10ext stays under 1500), loki-ts/tests/e10ext/full_job_brief.test.ts | MEDIUM | see Wall in note | merged@2026-10-17T02:38Z | TL APPROVE d7a7eecb9. wave 1; depends: none. Goal: util/ts_signatures.ts gains signatureDigest(repoDir, files, maxBytes=4000): - TS/JS through the existing lexer. - Python def and class headers up to the colon, with methods indented under their class. - Deterministic order: the order of the files argument. - Unreadable files are skipped. briefContext (e10ext/context.ts) appends a 'Key signatures (read the files for bodies):' block for the first 5 relevant files after the Relevant files block. The block is off with LOKI_E10_SIGS=0. The unit-brief path (unitBrief) is unchanged. Placement is after FIXED_RULES and the task, so the cache-stable prefix keeps its bytes. Wall: Red first: the brief for a fixture repo with models.py `def bulk_create(self, objs, batch_size=None):` under class QuerySet contains that header under `class QuerySet`. A TS fixture shows `export function add(a: number, b: number): number`. Two calls give byte-identical output, and the 4000-byte cap holds with 40 large files. LOKI_E10_SIGS=0 gives a brief byte-identical to today's golden. The FIXED_RULES prefix is unchanged. Mutation: drop the cap and the cap test goes red; reverse the file order and the stability/order test goes red. Gate: cd /Users/lokesh/git/lokimode-anthropic/loki-ts && bun test tests/e10ext/full_job_brief.test.ts tests/e10ext/unit_mode.test.ts tests/features/wall_manifest*.test.ts && bun test && npx tsc --noEmit && bun test tests/engine10/budget.test.ts; then bash scripts/local-ci.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
-| TEN-QUALITY-07 | Fix rounds see the current diff (fix the dead diff_stat reader) | loki-ts/src/runner/session_resume.ts, loki-ts/src/engine10/stages/fix.ts (replace the dead read; at most 2 core lines), loki-ts/tests/engine10/fix.test.ts, loki-ts/tests/engine10/fix_resume.test.ts | MEDIUM | see Wall in note | merged@2026-10-17T03:30Z | TL APPROVE 8f6092d77, merged for v11.17.14 |
+| TEN-QUALITY-06 | Signature digest of top relevant files in the implement/fix brief | loki-ts/src/util/ts_signatures.ts, loki-ts/src/e10ext/context.ts (at most 5 lines, e10ext stays under 1500), loki-ts/tests/e10ext/full_job_brief.test.ts | MEDIUM | see Wall in note | released@2026-10-17T03:50Z | TL APPROVE d7a7eecb9. wave 1; depends: none. Goal: util/ts_signatures.ts gains signatureDigest(repoDir, files, maxBytes=4000): - TS/JS through the existing lexer. - Python def and class headers up to the colon, with methods indented under their class. - Deterministic order: the order of the files argument. - Unreadable files are skipped. briefContext (e10ext/context.ts) appends a 'Key signatures (read the files for bodies):' block for the first 5 relevant files after the Relevant files block. The block is off with LOKI_E10_SIGS=0. The unit-brief path (unitBrief) is unchanged. Placement is after FIXED_RULES and the task, so the cache-stable prefix keeps its bytes. Wall: Red first: the brief for a fixture repo with models.py `def bulk_create(self, objs, batch_size=None):` under class QuerySet contains that header under `class QuerySet`. A TS fixture shows `export function add(a: number, b: number): number`. Two calls give byte-identical output, and the 4000-byte cap holds with 40 large files. LOKI_E10_SIGS=0 gives a brief byte-identical to today's golden. The FIXED_RULES prefix is unchanged. Mutation: drop the cap and the cap test goes red; reverse the file order and the stability/order test goes red. Gate: cd /Users/lokesh/git/lokimode-anthropic/loki-ts && bun test tests/e10ext/full_job_brief.test.ts tests/e10ext/unit_mode.test.ts tests/features/wall_manifest*.test.ts && bun test && npx tsc --noEmit && bun test tests/engine10/budget.test.ts; then bash scripts/local-ci.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| TEN-QUALITY-07 | Fix rounds see the current diff (fix the dead diff_stat reader) | loki-ts/src/runner/session_resume.ts, loki-ts/src/engine10/stages/fix.ts (replace the dead read; at most 2 core lines), loki-ts/tests/engine10/fix.test.ts, loki-ts/tests/engine10/fix_resume.test.ts | MEDIUM | see Wall in note | released@2026-10-17T03:50Z | TL APPROVE 8f6092d77, merged for v11.17.14 Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
 | TEN-QUALITY-08 | Lean-path reproduce-first instruction (flagged until measured) | loki-ts/src/engine10/stages/implement.ts (one line), loki-ts/tests/engine10/implement.test.ts | MEDIUM | see Wall in note | ready@2026-10-17T01:40Z | wave 3; depends: none (flag flip gated on TEN-QUALITY-09 results). Goal: Only when LOKI_E10_REPRO=1 is set, buildImplementBrief's no-plan line (implement.ts:39, the lean path with no Wall) adds a fixed, task-independent sentence: 'If the task reports a bug, first add a new test function that reproduces it, run it and see it fail, then fix the code and run that test again.' This matches how Claude Code works on SWE-bench-style issues. It stays default-off: the prompt-ablation program showed that added prompt text can hurt. TEN-QUALITY-09's A/B decides the flip. If it is flipped on, the sentence moves into FIXED_RULES (the cache-stable prefix) under the harness invariant. Wall: Red first: with LOKI_E10_REPRO=1 the lean brief contains the sentence. With the flag unset, the brief is byte-identical to a golden captured before the change. A plan-present brief never contains it. Mutation: an inverted flag check turns both cases red. Gate: cd /Users/lokesh/git/lokimode-anthropic/loki-ts && bun test tests/engine10/implement.test.ts tests/engine10/lean_session.test.ts && bun test && npx tsc --noEmit && bun test tests/engine10/budget.test.ts; then bash scripts/local-ci.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
-| TEN-QUALITY-09 | Offline localization-recall eval on the pinned SWE-bench subset | benchmarks/swebench/loader.py, benchmarks/bench/tests/ (extend the existing loader test file there; grep for its current name before adding) | LOW | see Wall in note | merged@2026-10-17T02:38Z | TL APPROVE db3196348. wave 1; depends: none. Goal: benchmarks/swebench/loader.py gains gold_files(patch), which parses the paths in the gold patch's diff headers, and a `localization` subcommand. For each pinned instance with a checkout at $LOKI_SWEBENCH_REPOS/<repo>@<base_commit>, it runs `bun -e` importing buildRepoMap and selectRelevantFiles from loki-ts/src. It writes recall@8 and recall@20 JSON with per-instance hits. An instance without a checkout is listed as skipped with its reason, never scored 0. Offline only, with no network. This gives TEN-QUALITY-04/05 a before/after number versus E-98d's 4/7, and gives TEN-QUALITY-08's paid A/B a pre-registered harness to run through the existing claude_code and loki adapters. Wall: Red first: gold_files on a recorded 2-file patch returns both paths and ignores /dev/null. The localization command on a temp git repo fixture plus a stub instance gives recall@8 = 1.0 when the gold file is named in the problem statement. A missing checkout appears as skipped with recall None, never 0. Mutation: count skipped as 0 and the skip test goes red. Gate: cd /Users/lokesh/git/lokimode-anthropic && python3 -I -m pytest benchmarks/bench/tests -q && bash scripts/local-ci.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
+| TEN-QUALITY-09 | Offline localization-recall eval on the pinned SWE-bench subset | benchmarks/swebench/loader.py, benchmarks/bench/tests/ (extend the existing loader test file there; grep for its current name before adding) | LOW | see Wall in note | released@2026-10-17T03:50Z | TL APPROVE db3196348. wave 1; depends: none. Goal: benchmarks/swebench/loader.py gains gold_files(patch), which parses the paths in the gold patch's diff headers, and a `localization` subcommand. For each pinned instance with a checkout at $LOKI_SWEBENCH_REPOS/<repo>@<base_commit>, it runs `bun -e` importing buildRepoMap and selectRelevantFiles from loki-ts/src. It writes recall@8 and recall@20 JSON with per-instance hits. An instance without a checkout is listed as skipped with its reason, never scored 0. Offline only, with no network. This gives TEN-QUALITY-04/05 a before/after number versus E-98d's 4/7, and gives TEN-QUALITY-08's paid A/B a pre-registered harness to run through the existing claude_code and loki adapters. Wall: Red first: gold_files on a recorded 2-file patch returns both paths and ignores /dev/null. The localization command on a temp git repo fixture plus a stub instance gives recall@8 = 1.0 when the gold file is named in the problem statement. A missing checkout appears as skipped with recall None, never 0. Mutation: count skipped as 0 and the skip test goes red. Gate: cd /Users/lokesh/git/lokimode-anthropic && python3 -I -m pytest benchmarks/bench/tests -q && bash scripts/local-ci.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
 | TEN-UX-01 | Empty-folder first run: loki start "<brief>" sets up a repo and checks Claude login before any spend | loki-ts/src/util/first_run_repo.ts (new; justification: no existing module owns setting up an empty folder as a repo, and core has about 36 lines left so the logic cannot live in preflight.ts); loki-ts/src/engine10/preflight.ts (call the helper and the login check, net +3 lines max); loki-ts/src/commands/doctor.ts (export claudeAuthStatusLoggedIn only, and let it take an argv/env so preflight reuses it; no second parser); loki-ts/tests/engine10/preflight.test.ts; docs/v10/FAILURE-CLASSES.md (row first) | MEDIUM | see Wall in note | ready@2026-10-17T01:40Z | SPLIT per CTO critic into (a) empty folder becomes a repo, (b) Claude login check in preflight plus doctor export; build as two commits or two agents. wave 2; depends: none. Goal: In an empty folder with no git repo, `loki start "<brief>"` runs git init -q, sets the default branch to main and makes an empty initial commit, then continues. It prints one line: `initialized a new git repository in <dir> (LOKI_AUTO_GIT_INIT=0 to refuse)`. A folder that is not empty and has no repo is never initialised automatically: it stays fatal, and the message gives the exact commands (git init && git add . && git commit -m init). A missing git identity stays fatal with the exact git config command; the identity is never set automatically. When the provider is claude and no ANTHROPIC_API_KEY or CLAUDE_CODE_OAUTH_TOKEN is set, preflight runs `claude auth status` (5s timeout, using the run env's PATH and LOKI_CLAUDE_CLI). A clear loggedIn:false is fatal and names the fix `claude login (or set ANTHROPIC_API_KEY)`. An unknown or empty answer is a warning only, never fatal, so a stub CLI still works. Wall: Red first: preflight.test.ts gains cases that fail on main today: (a) empty temp folder, no repo: checkPreflight returns fatal null, the folder now has .git and HEAD resolves; (b) folder holding one file, no repo: fatal contains `git init && git add . && git commit -m init`, and no .git is created; (c) LOKI_AUTO_GIT_INIT=0 on an empty folder: still fatal, no .git; (d) a fake claude on PATH printing {"loggedIn":false} gives a fatal containing `claude login`; (e) fake printing {} or exiting 1 gives fatal null plus one warning; (f) ANTHROPIC_API_KEY set: the fake claude is never called (it writes a marker file; assert the file is absent). Mutations: (1) drop the emptiness check, so case (b) must go red; (2) treat the unknown login answer as fatal, so case (e) must go red; (3) delete the export in doctor.ts, so the build/typecheck must go red. Gate: cd loki-ts && bun test tests/engine10/preflight.test.ts tests/engine10/budget.test.ts tests/commands/doctor.test.ts && bun test && bunx tsc --noEmit; then bash scripts/local-ci.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
 | TEN-UX-02 | Failure-specific Next line: every failed start names the exact fix | loki-ts/src/util/run_summary.ts (nextOf only); loki-ts/src/engine10/supervisor.ts (line 393 argument only; rebase after Q18-07 if it lands first); loki-ts/tests/util/run_summary.test.ts | LOW | see Wall in note | released@2026-10-17T02:57Z | merge 63cdd70ec, dist bd6348d77; TL APPROVE f450cf65f (94 pass, 2 mutations red); post-merge tsc 0 errors, 130 pass. wave 1; depends: none (rebase onto Q18-07 if supervisor.ts:313 moved). Goal: nextOf takes the run's reason and outcome and returns one concrete command per failure class: provider authentication failed -> `claude login` (or that provider's fix line from setup-requirements.json via requirementFix); provider credit exhausted -> `loki start ... --provider <other>` or check billing; '<check> failed: ...' -> `loki chat --attach` (ask why) plus `loki undo` when files changed; spec conflict (BLOCKED) -> `loki answer --text "..."`; STALLED -> `loki chat --attach`; engine ended before sealing a receipt -> `loki doctor`. The existing verified, done-unverified and budget branches stay byte-identical. The supervisor call site passes res.reason on the same line, with zero net core lines. Wall: Red first: run_summary.test.ts adds one table row per reason string that output.ts:74 reasonOf really produces (copy the literals, do not paraphrase), each asserting the exact Next command. These fail today because nextOf returns loki doctor/loki undo. A pin asserts the old outputs for verified, done-unverified, stopped and failed-without-reason, so default output does not drift. A source-scan test asserts every literal reason produced at output.ts:74 has a nextOf mapping (catches new reasons with no mapping). Mutation: make nextOf ignore the reason argument, so every new row must go red; remove the supervisor argument, so a contract test in tests/features/contract.test.ts that runs the summary with fatal:auth must go red. Gate: cd loki-ts && bun test tests/util/run_summary.test.ts tests/features/contract.test.ts tests/engine10/budget.test.ts && bun test && bunx tsc --noEmit Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. v11.17.13 npm next 11.17.13 |
 | TEN-UX-03 | Funnel on the default engine10 route: first_run_blocked at preflight and build_verified at seal | loki-ts/src/util/funnel.ts (new; justification: telemetry.sh is the owner and this file is the only TS bridge to it, replacing the private copy in doctor.ts); loki-ts/src/commands/doctor.ts (emitFirstRunBlocked becomes a call to the helper; remove the spawn code); loki-ts/src/engine10/cli.ts (one call after main, at most +2 lines); autonomy/telemetry.sh (_loki_known_blocker keys and a loki_emit_build_verified_enum function); tests/test-first-run-funnel-coverage.sh | MEDIUM | see Wall in note | ready@2026-10-17T01:40Z | wave 3; depends: TEN-UX-01 (shares doctor.ts; also needs the not_a_repo fatal text to exist). Goal: Move the detached, opt-out-respecting telemetry.sh spawn from doctor.ts:1047-1069 into one TS helper (emitFunnel(kind, key)), and delete the copy in doctor.ts in the same change. Call it from engine10/cli.ts after the supervisor returns: preflight exit 2 sends first_run_blocked with a bounded key; a VERIFIED or ALREADY_SATISFIED exit sends build_verified carrying only headline=VERIFIED and route=engine10. No other field is sent. Add keys not_a_repo and git_identity to _loki_known_blocker (telemetry.sh:204), and add an allowlisted build_verified variant that takes enum args instead of a proof.json path. All existing opt-outs still apply because everything goes through _loki_analytics_enabled. Wall: Red first: test-first-run-funnel-coverage.sh gains (a) a wiring assertion that engine10/cli.ts reaches emitFunnel on a preflight exit 2 and on a VERIFIED exit, and (b) a run with a stub telemetry.sh in a throwaway HOME, analytics forced on, with no network: loki_telemetry is replaced by a recorder function. Assert that one first_run_blocked blocker=not_a_repo line is recorded for a start in a non-empty folder with no repo, and that a second identical run records nothing (once-per-install marker). Assert DO_NOT_TRACK=1 and LOKI_TELEMETRY_DISABLED=1 each record zero lines. Assert the recorded payload contains no path, home dir or brief text (grep the recorder file for the temp folder path and the brief: must be absent). Mutations: emit a raw blocker string instead of the enum, so the no-path assertion must go red; drop the marker write, so the second-run assertion must go red; leave doctor's old spawn copy in place, so a grep guard counting `telemetry.sh` spawns in loki-ts/src (exactly 1) must go red. Gate: bash tests/test-first-run-funnel-coverage.sh && bash tests/test-first-run-blocked-signal.sh && cd loki-ts && bun test tests/engine10/budget.test.ts tests/commands/doctor.test.ts && bun test; then bash scripts/local-ci.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
 | TEN-UX-04 | loki doctor --fix: consent-gated installs and Claude login, plus its first tests | loki-ts/src/commands/doctor_fix.ts; loki-ts/src/commands/doctor.ts (pass --yes through to runDoctorFix only; rebase after TEN-UX-01/03 if they touch the same hunk); loki-ts/tests/commands/doctor.test.ts (extend; no doctor_fix test exists today) | MEDIUM | see Wall in note | ready@2026-10-17T01:40Z | wave 4; depends: TEN-UX-03 (doctor.ts edit order only). Goal: On a TTY, `loki doctor --fix` offers each missing default-provider install as a y/N question before running it: `npm install -g @anthropic-ai/claude-code`, then `claude login` when evaluateClaudeLogin returns fail. `--fix --yes` runs the same steps without asking, for scripted onboarding. Without a TTY and without --yes, it prints the commands only, exactly as today. System package managers and sudo are never run. Every step that runs reports `fixed:` or `failed: <first stderr line>`, and the command exits non-zero when a required step still fails. Command execution is behind an injectable runner, so tests never install anything. Wall: Red first: doctor.test.ts gains applyDoctorFixes/runDoctorFix cases with an injected has() and runner: (a) claude missing, tty=false, no --yes: the runner is never called and the npm command is printed; (b) claude missing, --yes: the runner gets exactly [npm, install, -g, @anthropic-ai/claude-code]; (c) runner fails: output has `failed:` and the exit code is non-zero; (d) jq missing with --yes: the runner is never called for jq (system package, print only); (e) claude present and logged out with --yes: the runner gets [claude, login]. These fail today because doctor_fix has no runner, no --yes and no exit code. Mutations: drop the tty/--yes gate, so (a) must go red; let system packages through the runner, so (d) must go red. Gate: cd loki-ts && bun test tests/commands/doctor.test.ts tests/commands/doctor_router.test.ts && bun test && bunx tsc --noEmit; bash tests/test-doctor-ux.sh; bash tests/test-doctor-single-impl.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
 | TEN-UX-05 | loki chat startup readiness check and slash-command suggestions | autonomy/lib/chat.sh; tests/test-doctor-ux.sh (already owns the chat assertions, P12-16) | LOW | see Wall in note | ready@2026-10-17T01:40Z | wave 3; depends: none (the folder message text refers to TEN-UX-01 behaviour; write it to whichever behaviour is on main). Goal: When cmd_chat starts (after the TTY check), print at most 3 readiness lines, once, using existing helpers only. (1) The provider CLI for _CHAT_PROVIDER is missing (any provider, not only claude): print `_loki_req_fix_line <provider>` and a hint to try `/provider claude`. (2) claude is logged out: print `claude login (or set ANTHROPIC_API_KEY)`. (3) The folder is not a git repo: say that `/run` will set up an empty folder (TEN-UX-01) or needs `git init` for a non-empty one. When everything is ready, print nothing extra, so a working setup sees no new text. An unknown slash command prints `unknown command: /stat (did you mean /status?)` by unique-prefix or single-edit match against the _chat_help list. The hint for a missing non-Claude provider replaces the bare 'cannot load provider X' at chat.sh:259/:271 with the fix line. Wall: Red first: test-doctor-ux.sh adds cases that drive cmd_chat through `script`/a pty helper already used there (or calls the new _chat_readiness function directly). With PATH holding no codex and LOKI_PROVIDER=codex, the output contains the codex fix string from setup-requirements.json. With a fake claude printing {"loggedIn":false}, the output contains `claude login`. In a non-git temp folder, the output mentions git. With every check passing (fake claude logged in, inside a repo), the readiness output is empty. `/stat` suggests `/status`; `/zzzz` prints no suggestion. Mutations: print readiness lines unconditionally, so the all-ready empty assertion must go red; hardcode the claude fix for every provider, so the codex fix assertion must go red. bash -n and shellcheck on chat.sh. Gate: bash tests/test-doctor-ux.sh && bash tests/test-loki-steer.sh && bash tests/test-first-run-bash32.sh && shellcheck autonomy/lib/chat.sh; then bash scripts/local-ci.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
-| TEN-UX-06 | Dashboard page: empty state, auto-select of the live run, stage progress strip, readable timeline, theme and narrow-screen layout | loki-ts/src/util/dashboard_page.ts; loki-ts/tests/engine10/dashboard_entry.test.ts (extend; it already serves the real page from a fixture events.jsonl) | LOW | see Wall in note | merged@2026-10-17T03:05Z | merged 0a45be416 (TL APPROVE d933581dc; follow-up: test that a later click survives the next poll) |
-| TEN-UX-07 | Dashboard server panels: Reason, Next step and current stage elapsed | loki-ts/src/runner/engine10_dashboard.ts (formatPanels and summarizeRun only); loki-ts/tests/engine10/dashboard.test.ts | LOW | see Wall in note | building@2026-10-17T03:07Z | batch J workflow w9sw9xytw |
+| TEN-UX-06 | Dashboard page: empty state, auto-select of the live run, stage progress strip, readable timeline, theme and narrow-screen layout | loki-ts/src/util/dashboard_page.ts; loki-ts/tests/engine10/dashboard_entry.test.ts (extend; it already serves the real page from a fixture events.jsonl) | LOW | see Wall in note | released@2026-10-17T03:50Z | merged 0a45be416 (TL APPROVE d933581dc; follow-up: test that a later click survives the next poll) Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| TEN-UX-07 | Dashboard server panels: Reason, Next step and current stage elapsed | loki-ts/src/runner/engine10_dashboard.ts (formatPanels and summarizeRun only); loki-ts/tests/engine10/dashboard.test.ts | LOW | see Wall in note | released@2026-10-17T04:08Z | v11.17.17; TL APPROVE batch J workflow w9sw9xytw |
 | TEN-UX-08 | First-run gate: empty-folder loki start scenario and the install-to-first-success time budget | scripts/first-run-gate.sh; tests/test-first-run-gate.sh; docs/v10/METRICS.md (row 14 text only, written by --real runs, not by the engineer) | MEDIUM | see Wall in note | ready@2026-10-17T01:40Z | wave 4; depends: TEN-UX-01 (empty-folder start must work), TEN-UX-02 (Next wording). Goal: Add `--entry start-empty` to scripts/first-run-gate.sh. It installs (with --installed) or uses the tree, creates an empty folder under the run-owned temp directory, sets git identity through GIT_* env vars only, and runs `loki doctor` then `loki start "<brief>"` with the existing stub claude. It asserts: the folder was set up as a repo, Outcome is VERIFIED, a receipt is sealed, Next is present, and install+doctor+start wall time on the stub is <= 120s, recorded as `install_to_first_success_s`. The stub run measures harness overhead only. With --real, it appends the measured time-to-first-sealed-result row to docs/v10/METRICS.md, replacing the 'not measured' row at METRICS.md:14 with a dated measurement and its command. In stub mode it never writes METRICS. Wall: Red first: test-first-run-gate.sh adds fake-loki modes for the new entry: (a) a fake that leaves the folder without a repo: FAIL repo-init; (b) a fake that sleeps past an injected budget FRG_BUDGET_S=1: FAIL first-success-budget; (c) a fake with no Next line: FAIL next-line; (d) a well-behaved fake: all PASS and the report has `install_to_first_success_s=<int>`. The new entry does not exist today, so these fail. Mutations: drop the budget comparison, so (b) must go red; parse the time field as a string compare, so a budget of 9 vs a measured 10 must go red. Tests use loki_run_tmp_create/cleanup only, never /tmp globs. Gate: bash tests/test-first-run-gate.sh && bash scripts/first-run-gate.sh --stub --entry start-empty; then bash scripts/local-ci.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
-| TEN-GATES-01 | FC row plus pure check-provenance classifier in check_result.ts | loki-ts/src/util/check_result.ts, loki-ts/tests/engine10/check_result.test.ts, docs/v10/FAILURE-CLASSES.md | HIGH | see Wall in note | merged@2026-10-17T02:56Z | merged 0970d5887 (HIGH r2 APPROVE 10be1a1bd; FAILURE-CLASSES append conflict kept both sections) |
+| TEN-GATES-01 | FC row plus pure check-provenance classifier in check_result.ts | loki-ts/src/util/check_result.ts, loki-ts/tests/engine10/check_result.test.ts, docs/v10/FAILURE-CLASSES.md | HIGH | see Wall in note | released@2026-10-17T03:50Z | merged 0970d5887 (HIGH r2 APPROVE 10be1a1bd; FAILURE-CLASSES append conflict kept both sections) Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
 | TEN-GATES-02 | Seal: receipt checks carry provenance; VERIFIED requires agent-independent proof | loki-ts/src/engine10/stages/seal.ts, loki-ts/src/engine10/types.ts, loki-ts/tests/engine10/seal.test.ts, docs/v10/DECISIONS.md | HIGH | see Wall in note | ready@2026-10-17T01:40Z | wave 3; depends: TEN-GATES-01, Q18-05b (seal.ts in flight). Goal: In seal.ts replace hasExecutedProof at seal.ts:190 with hasExogenousProof (wallGreenOnBase still counts); when only agent_authored/llm_judge checks passed, verdict caps at PARTIAL and not_proven gains 'only agent-authored tests executed (no agent-independent proof)'. Each receipt check gains additive optional provenance (types.ts ReceiptCheck provenance?: ...; omitted key keeps older receipts byte-stable for verification). renderReceiptMd splits '### Agent-independent checks' and '### Agent-authored / advisory checks'. Opt-out LOKI_EXOGENOUS_PROOF=0 (record the default-on decision in DECISIONS.md under the D99 grant). Net-zero line change in engine10 core (fold into existing lines or move helpers to util). Wall: Red first in seal.test.ts: fake verify outputs with one passing check on a test file ADDED in the diff and no Wall -> expect PARTIAL plus the not_proven line (today VERIFIED); same check on a pre-existing file -> VERIFIED; receipt.json checks carry provenance; receipt.md has both sections. Mutation: revert to hasExecutedProof -> red. LOKI_EXOGENOUS_PROOF=0 restores old verdict. Gate: cd loki-ts && bun test tests/engine10/seal.test.ts tests/engine10/seal_verify_roundtrip.test.ts tests/engine10/budget.test.ts && bun test && bunx tsc --noEmit Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
-| TEN-GATES-03 | loki verify reports agent-independent evidence and adds --require-exogenous | loki-ts/src/engine10/verify_cmd.ts, loki-ts/tests/engine10/verify_cmd.test.ts | HIGH | see Wall in note | building@2026-10-17T03:07Z | batch J workflow w9sw9xytw |
+| TEN-GATES-03 | loki verify reports agent-independent evidence and adds --require-exogenous | loki-ts/src/engine10/verify_cmd.ts, loki-ts/tests/engine10/verify_cmd.test.ts | HIGH | see Wall in note | released@2026-10-17T04:08Z | v11.17.17; TL APPROVE batch J workflow w9sw9xytw |
 | TEN-GATES-04 | TS-callable app boot and HTTP health probe over app-runner.sh | loki-ts/src/util/app_probe.ts (new), loki-ts/tests/util/app_probe.test.ts (new) | MEDIUM | see Wall in note | ready@2026-10-17T01:40Z | SPLIT per CTO critic into (a) app boot and health, (b) functional-verify run and artifact write; build as two commits or two agents. wave 2; depends: none. Goal: New loki-ts/src/util/app_probe.ts (justification: no TS module owns app boot; app-runner.sh is bash-only and deep.ts:121-122 names this missing surface). appProbe(repoDir, lokiDir, {specText?, timeoutMs}) sources autonomy/app-runner.sh in a bash child (token-free env via plainTestEnv), runs app_runner_init, app_runner_start, app_runner_health_check, reads .loki/app-runner/health.json, then (when specText given) runs autonomy/lib/functional-verify.py against the URL and writes .loki/quality/functional-results.json in the shape proof-generator.py:841-870 reads. ALWAYS calls app_runner_stop in finally (stops only the PID app-runner recorded). Returns ReceiptCheck-shaped results: 'app boot' and 'http probe' with result pass/fail/not_run and reason; missing runtime or no app detected = not_run, never fail. Wall: Red first: fixture repo with a static index.html (app-runner static-site path, as tests/test-app-runner-static-site.sh) -> app boot pass + health.json ok; fixture whose start command exits 1 -> fail; empty repo -> not_run. Assert no process left on the recorded PID after return. Mutation: drop the stop call -> leftover-PID assertion red. Gate: cd loki-ts && bun test tests/util/app_probe.test.ts && bun test && bunx tsc --noEmit; register the new test file per the structural guards (select-tests.sh --guards-only rows, shard registration) Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
 | TEN-GATES-05 | Spec-derived API auth probe in functional-verify.py | autonomy/lib/functional-verify.py, tests/test_functional_verify.py | HIGH | see Wall in note | parked@2026-10-17T03:30Z | HIGH r1 BLOCK; re-sliced as TEN-GATES-05b |
 | TEN-GATES-06 | Deep verify: real app boot and secure-scan rules on engine10 | loki-ts/src/engine10/stages/deep.ts, loki-ts/tests/engine10/deep.test.ts | HIGH | see Wall in note | ready@2026-10-17T01:40Z | wave 3; depends: TEN-GATES-04, Q18-04 (deep.ts in flight). Goal: Replace runAppBoot's hard-coded not_run (deep.ts:105-130) with a call to util/app_probe.ts, pushing its 'app boot' and 'http probe' checks; extend the existing 'security scan' check to also run autonomy/lib/secure-scan.py over changed files (HIGH active finding = fail, scanner absent = not_run). DEEP_NOT_PROVEN entries clear only for checks that actually ran. Net-zero lines in engine10 core (app boot body shrinks to the call). Wall: Red first in deep.test.ts: injected appProbe fake returning pass -> 'app boot' check result pass (today always not_run); a changed file with a committed PEM private key -> security scan fail with secure-scan rule id; secure-scan missing -> not_run. Mutation: ignore secure-scan exit -> red. Gate: cd loki-ts && bun test tests/engine10/deep.test.ts tests/engine10/deep_wiring.test.ts tests/engine10/budget.test.ts && bun test && bunx tsc --noEmit Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
 | TEN-GATES-07 | loki start route: collect app health and functional facts before the proof | loki-ts/src/runner/proof.ts, loki-ts/tests/runner/proof.test.ts | MEDIUM | see Wall in note | ready@2026-10-17T01:40Z | wave 3; depends: TEN-GATES-04. Goal: In runner/proof.ts, before spawning proof-generator.py, call util/app_probe.ts with the run's PRD text (LOKI_PROOF_APP_PROBE=0 opts out) so .loki/app-runner/health.json and .loki/quality/functional-results.json exist on the primary route; the proof's healthcheck and functional facts stop being permanently not_run. Still never throws; probe failure leaves the facts absent (not_run), never fabricated. Wall: Red first in proof.test.ts: inject a fake probe that writes both artifacts -> generator facts.healthcheck/functional ran=true; probe throwing -> generator still invoked, facts not_run. Mutation: skip probe -> red. Gate: cd loki-ts && bun test tests/runner/proof.test.ts tests/runner/proof_run_id_pointer.test.ts && bun test && bunx tsc --noEmit Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
-| TEN-GATES-08 | loki start route: secure-scan as an exogenous security_scan gate | loki-ts/src/runner/quality_gates.ts, loki-ts/tests/runner/quality_gates.test.ts | MEDIUM | see Wall in note | building@2026-10-17T03:07Z | batch J workflow w9sw9xytw |
-| TEN-GATES-09 | loki start route: write build-results.json (wire the dead pythonBuildCheck) | loki-ts/src/util/python_build_check.ts, loki-ts/src/runner/autonomous.ts, loki-ts/tests/util/python_build_check.test.ts | MEDIUM | see Wall in note | merged@2026-10-17T03:05Z | merged f24496198 (TL APPROVE 09a2ae73f) |
+| TEN-GATES-08 | loki start route: secure-scan as an exogenous security_scan gate | loki-ts/src/runner/quality_gates.ts, loki-ts/tests/runner/quality_gates.test.ts | MEDIUM | see Wall in note | released@2026-10-17T04:08Z | v11.17.17; TL APPROVE batch J workflow w9sw9xytw |
+| TEN-GATES-09 | loki start route: write build-results.json (wire the dead pythonBuildCheck) | loki-ts/src/util/python_build_check.ts, loki-ts/src/runner/autonomous.ts, loki-ts/tests/util/python_build_check.test.ts | MEDIUM | see Wall in note | released@2026-10-17T03:50Z | merged f24496198 (TL APPROVE 09a2ae73f) Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
 | TEN-GATES-10 | Proof headline: VERIFIED needs one agent-independent fact beside the agent's suite | autonomy/lib/proof-generator.py, tests/test_proof_generator.py, docs/v10/DECISIONS.md | HIGH | see Wall in note | ready@2026-10-17T01:40Z | wave 4; depends: COST-WALL-f (proof-generator.py in flight), TEN-GATES-07, TEN-GATES-08, TEN-GATES-09 (facts must exist before tightening, or every primary-route run downgrades). Goal: In proof-generator.py the tests_verified branch (:2045-2055) returns VERIFIED only when at least one exogenous fact also passed: build verified, healthcheck ok, functional passed, security clean that actually ran, or an exogenous quality gate passed; otherwise VERIFIED WITH GAPS with degraded item 'no agent-independent evidence (only the agent's own test suite passed)'. Gap record is additive; LOKI_PROOF_REQUIRE_EXOGENOUS=0 opt-out; decision recorded in DECISIONS.md under D99. Wall: Red first in test_proof_generator.py: facts with tests verified + nonempty diff and nothing else -> 'VERIFIED WITH GAPS' plus the degraded item (today VERIFIED); add build verified -> VERIFIED; only an advisory code_review pass -> still WITH GAPS. Mutation: count advisory gates as corroboration -> red. Gate: python3 -m pytest -q tests/test_proof_generator.py tests/test_proof_degraded_disabled_gates.py tests/test_proof_verify.py; bash tests/test-proven-pr-receipt.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
 | TEN-STABILITY-01 | bench-suite argv survives hyperfine 1.20 (unblocks v11.17.6 backstop) | loki-ts/scripts/bench-suite.ts; NEW loki-ts/tests/scripts/bench_suite_argv.test.ts (no existing test owns bench-suite.ts: grep -rl bench-suite loki-ts/tests tests returns nothing) | LOW | see Wall in note | released@2026-10-17T02:57Z | merge d67b2af14, dist bd6348d77; TL APPROVE f1bcf7679 (4 pass, typecheck rc=0); post-merge tsc 0 errors, 130 pass. wave 1; depends: none. Goal: Stop building 'VAR=1 cmd' hyperfine commands. Pass the env as 'env LOKI_LEGACY_BASH=1 <shim> <cmd>' (also 'env BUN_FROM_SOURCE=1'), which works on apt hyperfine 1.18 and brew 1.20 alike. Export a pure argv builder from the script so it can be tested. Write the --export-json files under a mkdtemp dir, not fixed /tmp/bench-*.json paths. Exit non-zero when any command is SKIPPED because hyperfine itself refused the argv, not only when every command was skipped. Wall: RED: the test puts a fake 'hyperfine' on PATH that exits 1 with the real 1.20 message when any positional command matches ^[A-Z_]+=. It runs the builder and fails today, because both benchPair (bench-suite.ts:76) and benchRoute (:108) emit LOKI_LEGACY_BASH=1 first. GREEN after the fix. MUTATION: revert one call site to the VAR= form; the test goes red. A second mutation: a partial SKIP must exit 1. GATE: cd loki-ts && bun test tests/scripts/bench_suite_argv.test.ts && bun run typecheck && bun test (full, per the slice-gate rule). Then run real hyperfine locally: cd loki-ts && bun run scripts/bench-suite.ts --runs 1 --warmup 0 (hyperfine 1.20.0 is installed on this machine) must print no 'Cannot run'. After merge: gh workflow run nightly.yml, and the macOS 1.3.13 leg must be green. Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. v11.17.13 npm next 11.17.13 |
 | TEN-STABILITY-02 | promote.yml walks back to the newest promotable next build (D96 exact-SHA rule) | .github/workflows/promote.yml (Derive and validate version, Require a green nightly, Require a green Post-Release Smoke steps); tests/test_release_next_tag.py (nightly-gate and version-derivation cases); tests/test-promote-smoke-sha.sh; docs/v10/DECISIONS.md (one D102 entry) | HIGH | see Wall in note | rejected@2026-10-17T03:30Z | superseded by TEN-RELEASE-INSTANT (D102): promote.yml deleted, every release moves latest and next |
-| TEN-STABILITY-03 | pre-push runs the R8 global guard rows on every push to main | .githooks/pre-push; tests/test-pre-push-hook.sh | MEDIUM | see Wall in note | ready@2026-10-17T01:40Z | wave 2; depends: none (TEN-STABILITY-04 adds rows; the hook reads the tsv at run time). Goal: On a push whose remote ref is refs/heads/main, run 'bash scripts/impacted-gate.sh --guards-only' against the pushed tip in a clean detached worktree. Reuse release.sh's worktree pattern: per-row timeout, run-owned tmp via loki_run_tmp_create. Place it before the PRE_PUSH_SKIP exit, next to the release-notes and gitleaks gates, so routine PRE_PUSH_SKIP=1 merge pushes cannot skip it. A red row aborts the push and names the row. LOKI_PREPUSH_SKIP_GUARDS=1 is the only bypass and prints a loud warning. Branch pushes and deletes are untouched. Target time is under 120s with IMPACTED_JOBS=4. Over 180s fails closed with a timeout message, never passes silently. Wall: RED: test-pre-push-hook.sh gains a case where a stub impacted-gate (IMPACTED_TEST_MODE=1 with an IMPACTED_SUITES_FILE listing a failing suite) is red and stdin carries refs/heads/main with LOKI_RELEASE_MANAGER=1 PRE_PUSH_SKIP=1. Today the hook exits 0; after the fix it exits 1 and names the row. GREEN cases: all rows green gives exit 0; a branch push never invokes the gate; the bypass env warns and exits 0; a gate timeout gives exit 1. MUTATION: move the block after the PRE_PUSH_SKIP check and the PRE_PUSH_SKIP case goes red. GATE: bash tests/test-pre-push-hook.sh && bash tests/test-pre-push-gitleaks.sh && shellcheck .githooks/pre-push && bash tests/test-no-tmp-sweep.sh. Then time it: time bash scripts/impacted-gate.sh --guards-only on main must stay under 180s, or re-slice. Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
+| TEN-STABILITY-03 | pre-push runs the R8 global guard rows on every push to main | .githooks/pre-push; tests/test-pre-push-hook.sh | MEDIUM | see Wall in note | parked@2026-10-17T04:27Z | parked under D102 (instant releases): a 300s guards-only run on every main push delays npm; guards stay on release.sh and CI as fix-forward signals. wave 2; depends: none (TEN-STABILITY-04 adds rows; the hook reads the tsv at run time). Goal: On a push whose remote ref is refs/heads/main, run 'bash scripts/impacted-gate.sh --guards-only' against the pushed tip in a clean detached worktree. Reuse release.sh's worktree pattern: per-row timeout, run-owned tmp via loki_run_tmp_create. Place it before the PRE_PUSH_SKIP exit, next to the release-notes and gitleaks gates, so routine PRE_PUSH_SKIP=1 merge pushes cannot skip it. A red row aborts the push and names the row. LOKI_PREPUSH_SKIP_GUARDS=1 is the only bypass and prints a loud warning. Branch pushes and deletes are untouched. Target time is under 120s with IMPACTED_JOBS=4. Over 180s fails closed with a timeout message, never passes silently. Wall: RED: test-pre-push-hook.sh gains a case where a stub impacted-gate (IMPACTED_TEST_MODE=1 with an IMPACTED_SUITES_FILE listing a failing suite) is red and stdin carries refs/heads/main with LOKI_RELEASE_MANAGER=1 PRE_PUSH_SKIP=1. Today the hook exits 0; after the fix it exits 1 and names the row. GREEN cases: all rows green gives exit 0; a branch push never invokes the gate; the bypass env warns and exits 0; a gate timeout gives exit 1. MUTATION: move the block after the PRE_PUSH_SKIP check and the PRE_PUSH_SKIP case goes red. GATE: bash tests/test-pre-push-hook.sh && bash tests/test-pre-push-gitleaks.sh && shellcheck .githooks/pre-push && bash tests/test-no-tmp-sweep.sh. Then time it: time bash scripts/impacted-gate.sh --guards-only on main must stay under 180s, or re-slice. Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
 | TEN-STABILITY-04 | global-guards.tsv covers every repo-wide guard that reached main red | scripts/global-guards.tsv; tests/test-select-tests.sh | LOW | see Wall in note | released@2026-10-17T02:57Z | merge 3e542a7fc; TL APPROVE 07aa41ad1 (select-tests 117/0, fast-gate 25/0, shard-coverage 19/0). wave 1; depends: none. Goal: Add as R8 rows the repo-wide guards that turned main red on 2026-10-16 even though no slice diff selected them: - tests/cli/test-completions-coverage.sh - loki-ts/tests/engine10/budget.test.ts - loki-ts/tests/engine10/l2_destructive_registry.test.ts - loki-ts/tests/engine10/pr_body_golden.test.ts - loki-ts/tests/commands/cli_help_routes.test.ts - tests/test-select-tests.sh (FC-89 walker markers) Also add a meta-assertion to test-select-tests.sh: every loki-ts test file that carries '// select: walk-all-src' is either an R8 row or selected by R-rules for any loki-ts/src diff. A new repo-wide guard then cannot silently stay out of R8. Wall: RED: a new test-select-tests.sh case asserts that --guards-only lists each of the 6 targets. It fails today because they are absent from the 17 rows. GREEN after adding the rows. MUTATION: delete one row and its case goes red. Add a fixture walker test without an R8 row and the meta-assertion goes red. GATE: bash tests/test-select-tests.sh && bash tests/test-fast-gate.sh && bash tests/test-shard-coverage.sh. Then time bash scripts/impacted-gate.sh --guards-only and record the added seconds in tests/shard-durations.tsv only if a row is new there. The fast-gate plan for a docs-only diff must stay under 60s per shard. Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. v11.17.13 npm next 11.17.13 |
 | TEN-STABILITY-05 | WC-01b wall_concurrent stops racing the 5s bun timeout | loki-ts/tests/engine10/wall_concurrent.test.ts | LOW | see Wall in note | released@2026-10-17T02:57Z | merge 516e4a4f1; TL APPROVE 5fa97f2d5 (13/0 x3, 13/0 under 12x load at --timeout 1500). wave 1; depends: none. Goal: Make the WC-01b suite hermetic and fast. Build the git fixture once in beforeAll: copy a template repo per test instead of running git init, add and commit per test (wall_concurrent.test.ts:15-20). Give the concurrency case an explicit timeout sized from measured CI duration, and keep every assertion unchanged. Cause measured in nightly 38938949858: 5004.82ms against the 5000ms default. Wall: RED: cd loki-ts && bun test --timeout 1500 tests/engine10/wall_concurrent.test.ts fails today on this machine under 'yes > /dev/null' x4 CPU load (record the measured ms). GREEN: the same command passes after the fixture change, and plain bun test passes 20/20 in a loop: for i in $(seq 20); do bun test tests/engine10/wall_concurrent.test.ts // break; done. MUTATION: swap the expected order of implement:start and author:end and the test still fails, so the assertion is intact. GATE: cd loki-ts && bun run typecheck && bun test (full). Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. v11.17.13 npm next 11.17.13 |
-| TEN-STABILITY-06 | pulse PROMOTION_LAG violation with the blocking reason | scripts/v10-pulse.sh; tests/test-v10-pulse.sh | MEDIUM | see Wall in note | merged@2026-10-17T02:46Z | TL APPROVE ce461a4d1. wave 1; depends: none. Goal: In the npm section of v10-pulse.sh (near :830-863), emit 'VIOLATION PROMOTION_LAG' when next != latest and latest's publish time is more than 6h older than next's (threshold set by LOKI_PULSE_PROMOTION_LAG_H). Include the first PROMOTE-BLOCK or FATAL line from the newest non-skipped Promote run (gh run list -w Promote, then gh run view --log-failed). Also include the failing step names of the newest measured Nightly. The CoS acts on the top violation each turn, so a red bench is triaged within one turn instead of 13h. Fail soft: an API error prints UNKNOWN and never crashes the pulse. Wall: RED: test-v10-pulse.sh gains a fixture with stubbed npm and gh: latest 11.10.1 published 2026-10-15T00:00Z, next 11.17.6 published 2026-10-16T23:40Z, and Promote log containing 'PROMOTE-BLOCK: the newest nightly at the promoted SHA ... is failure'. Expect a PROMOTION_LAG line carrying that reason; today none is printed. GREEN cases: next==latest gives no violation; lag under the threshold gives none; gh failure gives UNKNOWN with rc 0. MUTATION: invert the threshold comparison and both lag cases go red. GATE: bash tests/test-v10-pulse.sh && shellcheck scripts/v10-pulse.sh && bash scripts/v10-pulse.sh on the real repo prints the violation today (latest 11.10.1 vs next 11.17.6). Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
+| TEN-STABILITY-06 | pulse PROMOTION_LAG violation with the blocking reason | scripts/v10-pulse.sh; tests/test-v10-pulse.sh | MEDIUM | see Wall in note | released@2026-10-17T03:50Z | TL APPROVE ce461a4d1. wave 1; depends: none. Goal: In the npm section of v10-pulse.sh (near :830-863), emit 'VIOLATION PROMOTION_LAG' when next != latest and latest's publish time is more than 6h older than next's (threshold set by LOKI_PULSE_PROMOTION_LAG_H). Include the first PROMOTE-BLOCK or FATAL line from the newest non-skipped Promote run (gh run list -w Promote, then gh run view --log-failed). Also include the failing step names of the newest measured Nightly. The CoS acts on the top violation each turn, so a red bench is triaged within one turn instead of 13h. Fail soft: an API error prints UNKNOWN and never crashes the pulse. Wall: RED: test-v10-pulse.sh gains a fixture with stubbed npm and gh: latest 11.10.1 published 2026-10-15T00:00Z, next 11.17.6 published 2026-10-16T23:40Z, and Promote log containing 'PROMOTE-BLOCK: the newest nightly at the promoted SHA ... is failure'. Expect a PROMOTION_LAG line carrying that reason; today none is printed. GREEN cases: next==latest gives no violation; lag under the threshold gives none; gh failure gives UNKNOWN with rc 0. MUTATION: invert the threshold comparison and both lag cases go red. GATE: bash tests/test-v10-pulse.sh && shellcheck scripts/v10-pulse.sh && bash scripts/v10-pulse.sh on the real repo prints the violation today (latest 11.10.1 vs next 11.17.6). Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
 | TEN-STABILITY-07 | nightly classifies flips vs stable reds across same-SHA legs | .github/workflows/nightly.yml (new flake-classify job only); scripts/nightly-flake-tracker.sh (--gh-run mode); tests/test-nightly-flake-tracker.sh | MEDIUM | see Wall in note | ready@2026-10-17T01:40Z | wave 2; depends: none (TEN-STABILITY-01 only matters for a green run). Goal: Add one nightly.yml job, flake-classify (needs all test jobs, if: always(), never sets the run conclusion). It downloads the bun-test job logs of this run via gh api. The 3-4 bun legs run identical loki-ts tests at one SHA. It feeds the logs to scripts/nightly-flake-tracker.sh and writes FLIP and STABLE-FAIL lines plus the BOARD: slice lines to the step summary. Extend the tracker with a '--gh-run RUN_ID' fetch mode so the workflow holds no parsing logic. Experimental bun=latest legs are labelled so a flip there is reported as drift. Wall: RED: test-nightly-flake-tracker.sh gains a --gh-run case with a stub gh serving two job logs at one SHA. In one log WC-01b is (pass), in the other it is (fail) [5004.82ms]. Expect 'FLIP <sha7> WC-01b'. Today --gh-run is a usage error (exit 2). GREEN: FLIP printed, exit 1; with both logs failing, STABLE-FAIL is printed. MUTATION: make the tracker ignore the [ms] suffix strip, and the FLIP case goes red. GATE: bash tests/test-nightly-flake-tracker.sh && bash tests/test-workflow-no-masked-failures.sh && python3 -m pytest -q tests/test_release_next_tag.py (nightly structure cases) && actionlint .github/workflows/nightly.yml if installed. The new job name must not start with 'Full suite (backstop)' (promote.yml:185 counts that prefix). Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
 | TEN-FC-ROWS | FAILURE-CLASSES rows for every TEN bug-fix slice lacking one (QUALITY-01/02/03/07, COST-06, DEPLOY-08, STABILITY-01/05, UX-02) | docs/v10/FAILURE-CLASSES.md | LOW | bash tests/test-structural-checks.sh | released@2026-10-17T02:57Z | merge 8cdb33633, dist bd6348d77; TL APPROVE 7e6f47482 (structural 25/0); post-merge tsc 0 errors, 130 pass. wave 1; CTO critic MISSING item. One row per class with user-visible vs raw, law broken, siblings, mechanism, fixture. Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. v11.17.13 npm next 11.17.13 |
 | TEN-CORE-TRIM | Free engine10 core headroom (4964 of 5000) by moving pure helpers out of engine10 into src/util with no behavior change | loki-ts/src/engine10/*, loki-ts/src/util/* | MEDIUM | cd loki-ts && bun test tests/engine10/ tests/runner/spawn_env_guard.test.ts && bunx tsc --noEmit | released@2026-10-17T02:57Z | merge 096174f2a, dist bd6348d77; TL APPROVE f0f82a4e8 (core 4931/5000, 143 pass); post-merge tsc 0 errors, 130 pass. wave 1; CTO critic MISSING item. Target at least 60 lines freed; budget guard must stay green; no logic change. Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. v11.17.13 npm next 11.17.13 |
 | TEN-SECURE-SCAN-UTIL | One util/secure_scan.ts wrapper over secure-scan.py shared by TEN-GATES-06 and TEN-GATES-08 | loki-ts/src/util/secure_scan.ts (new: no TS owner of secure-scan.py exists), loki-ts/tests/util/secure_scan.test.ts | MEDIUM | cd loki-ts && bun test tests/util/secure_scan.test.ts && bunx tsc --noEmit | released@2026-10-17T02:57Z | merge 47a9e4aae, dist none; TL APPROVE 3c1ce036d (9 pass, tsc rc=0). wave 1; CTO critic MISSING item. Removes the duplicate wrappers the CTO critic found. Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. v11.17.13 npm next 11.17.13 |
 | TEN-BADGE-UTIL | One verdict-to-shields-colour badge helper reused by status --badge, proof badge and share badge | autonomy/loki (existing share badge at about 38261-38315), tests/test-share-badge.sh or the existing badge test | LOW | bash tests/test-cli-commands.sh | released@2026-10-17T02:57Z | merge 8bdf1e7fd; TL APPROVE a7e86caa0 (test-cli-commands 37/0, test-share-command 8/0). wave 1; CTO critic MISSING item. Replaces three badge makers with one. Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. v11.17.13 npm next 11.17.13 |
 | TEN-STABILITY-08 | Pin hyperfine in nightly.yml and allow re-measuring a SHA whose nightly failed (dedupe at nightly.yml:78-82) | .github/workflows/nightly.yml | MEDIUM | actionlint .github/workflows/nightly.yml | released@2026-10-17T02:57Z | merge 488bc9771, dist bd6348d77; TL APPROVE 7a2843888 (actionlint rc=0, cache-scope 13/0, pins sha256-checked); post-merge tsc 0 errors, 130 pass. wave 1; CTO critic MISSING item. Without re-measure, one flake makes a SHA unpromotable forever. Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. v11.17.13 npm next 11.17.13 |
-| TEN-DEPLOY-01b | deploy --execute non-canary path streams provider output live (tee to a run-owned temp file) while still capturing the URL | autonomy/loki; tests/test-deploy-receipt-gate.sh | LOW | bash tests/test-deploy-receipt-gate.sh | merged@2026-10-17T03:30Z | TL APPROVE 9f4409d5c, merged for v11.17.14 |
+| TEN-DEPLOY-01b | deploy --execute non-canary path streams provider output live (tee to a run-owned temp file) while still capturing the URL | autonomy/loki; tests/test-deploy-receipt-gate.sh | LOW | bash tests/test-deploy-receipt-gate.sh | released@2026-10-17T03:50Z | TL APPROVE 9f4409d5c, merged for v11.17.14 Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
 | TEN-UX-02b | Run summary auth-failure next step uses the active provider's login or requirementFix line instead of hardcoded claude login | loki-ts/src/util/run_summary.ts; loki-ts/tests/util/run_summary.test.ts | LOW | cd loki-ts && bun test tests/util/run_summary.test.ts | released@2026-10-17T02:57Z | TL APPROVE 9a3d118d2, merge 672b74c79. Follow-up from TEN-UX-02 TL review: run_summary.ts:66 tells codex and cline users to run claude login. v11.17.13 npm next 11.17.13 |
-| TEN-GROUP-AUTH | Group runs keep USER, LOGNAME and SHELL and report per-unit cost | loki-ts/src/features/speed/run_group.ts, fix_units.ts, tests | MEDIUM | cd loki-ts && bun test tests/features | merged@2026-10-17T03:30Z | TL APPROVE 40c81fe7a |
-| TEN-COST-18 | cost_claim CLI for the C-F1 cost proof | benchmarks C-F1 harness | LOW | see note | merged@2026-10-17T03:30Z | TL APPROVE 8281fdcb8 |
-| TEN-COST-20 | C-F1 seeds ship tests | benchmarks C-F1 seeds | LOW | see note | merged@2026-10-17T03:30Z | TL APPROVE 0d1a37eed |
-| TEN-COST-17 | Raw token classes in the Claude Code ledger | C-F1 harness ledger, test_model_pin.py | HIGH | pytest test_model_pin.py | merged@2026-10-17T03:30Z | HIGH r2 APPROVE 232f1fbec |
-| TEN-RELEASE-INSTANT | Every release publishes npm latest and next immediately (D102) | .github/workflows/release.yml, promote.yml removed | HIGH | see note | merged@2026-10-17T03:30Z | HIGH r3 APPROVE 7e0e38c77; D98 round-limit exception recorded under D99 |
-| TEN-GATES-05b | Spec-derived auth probe: negation window fixes | autonomy/lib/functional-verify.py, tests/test_functional_verify.py | HIGH | pytest tests/test_functional_verify.py | building@2026-10-17T03:30Z | HIGH r2 BLOCK aaf27e569: trailing-slash redirect false green, curly apostrophe and article negation false reds; r3 under D99 |
-| TEN-RELEASE-INSTANT-F1 | Empty CUR from a failed npm view fails closed; rename the stale publish step | .github/workflows/release.yml | LOW | see note | merged@2026-10-17T03:45Z | TL APPROVE 29ca496f1, ships v11.17.16 |
-| TEN-COST-18-F1 | cost_claim: a non-object JSON row is skipped, not an AttributeError | C-F1 harness cost_claim | LOW | see note | merged@2026-10-17T03:45Z | TL APPROVE 924cec1c8, ships v11.17.16 |
-| TEN-GROUP-AUTH-F1 | kpis iteration_count does not count group cost records | loki-ts kpis | LOW | see note | ready@2026-10-17T03:30Z | follow-up |
-| TEN-COST-09 | Skip a Wall that cannot run | engine10 wall stage | HIGH | see note | ready@2026-10-17T03:30Z | architect cost plan |
-| TEN-COST-10 | Plan on haiku for small and normal tasks | engine10 plan stage | MEDIUM | see note | ready@2026-10-17T03:30Z | architect cost plan |
+| TEN-GROUP-AUTH | Group runs keep USER, LOGNAME and SHELL and report per-unit cost | loki-ts/src/features/speed/run_group.ts, fix_units.ts, tests | MEDIUM | cd loki-ts && bun test tests/features | released@2026-10-17T03:50Z | TL APPROVE 40c81fe7a Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| TEN-COST-18 | cost_claim CLI for the C-F1 cost proof | benchmarks C-F1 harness | LOW | see note | released@2026-10-17T03:50Z | TL APPROVE 8281fdcb8 Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| TEN-COST-20 | C-F1 seeds ship tests | benchmarks C-F1 seeds | LOW | see note | released@2026-10-17T03:50Z | TL APPROVE 0d1a37eed Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| TEN-COST-17 | Raw token classes in the Claude Code ledger | C-F1 harness ledger, test_model_pin.py | HIGH | pytest test_model_pin.py | released@2026-10-17T03:50Z | HIGH r2 APPROVE 232f1fbec Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| TEN-RELEASE-INSTANT | Every release publishes npm latest and next immediately (D102) | .github/workflows/release.yml, promote.yml removed | HIGH | see note | released@2026-10-17T03:50Z | HIGH r3 APPROVE 7e0e38c77; D98 round-limit exception recorded under D99 Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| TEN-GATES-05b | Spec-derived auth probe: negation window fixes | autonomy/lib/functional-verify.py, tests/test_functional_verify.py | HIGH | pytest tests/test_functional_verify.py | building@2026-10-17T04:31Z | HIGH r2 BLOCK aaf27e569: trailing-slash redirect false green, curly apostrophe and article negation false reds; r3 under D99 |
+| TEN-RELEASE-INSTANT-F1 | Empty CUR from a failed npm view fails closed; rename the stale publish step | .github/workflows/release.yml | LOW | see note | released@2026-10-17T03:50Z | TL APPROVE 29ca496f1, ships v11.17.16 Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| TEN-COST-18-F1 | cost_claim: a non-object JSON row is skipped, not an AttributeError | C-F1 harness cost_claim | LOW | see note | released@2026-10-17T03:50Z | TL APPROVE 924cec1c8, ships v11.17.16 Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
+| TEN-GROUP-AUTH-F1 | kpis iteration_count does not count group cost records | loki-ts kpis | LOW | see note | released@2026-10-17T04:31Z | r1 BLOCK 1c59103ad (writer kind unasserted); r2 adds writer-reader test and stats.ts sibling |
+| TEN-COST-09 | Skip a Wall that cannot run | engine10 wall stage | HIGH | see note | review@2026-10-17T04:31Z | architect cost plan |
+| TEN-COST-10 | Plan on haiku for small and normal tasks | engine10 plan stage | MEDIUM | see note | building@2026-10-17T04:31Z | architect cost plan |
 | TEN-COST-11 | Wall on haiku, re-authored on sonnet on failure | engine10 wall stage | HIGH | see note | ready@2026-10-17T03:30Z | architect cost plan |
-| TEN-COST-12 | 5-minute cache TTL by default | runner cache settings | MEDIUM | see note | ready@2026-10-17T03:30Z | architect cost plan |
-| TEN-COST-13 | Lean prefix by default | runner prompt prefix | MEDIUM | see note | ready@2026-10-17T03:30Z | architect cost plan |
-| TEN-COST-14 | Wall brief output budget | engine10 wall brief | LOW | see note | ready@2026-10-17T03:30Z | architect cost plan |
+| TEN-COST-12 | 5-minute cache TTL by default | runner cache settings | MEDIUM | see note | building@2026-10-17T04:31Z | architect cost plan |
+| TEN-COST-13 | Lean prefix by default | runner prompt prefix | MEDIUM | see note | released@2026-10-17T04:31Z | architect cost plan |
+| TEN-COST-14 | Wall brief output budget | engine10 wall brief | LOW | see note | released@2026-10-17T04:24Z | architect cost plan |
 | TEN-COST-15 | Plan output trim | engine10 plan stage | LOW | see note | ready@2026-10-17T03:30Z | architect cost plan |
-| TEN-COST-16 | Implement on haiku first (opt-in) | engine10 implement stage | HIGH | see note | ready@2026-10-17T03:30Z | architect cost plan |
+| TEN-COST-16 | Implement on haiku first (opt-in) | engine10 implement stage | HIGH | see note | building@2026-10-17T04:15Z | architect cost plan |
 | TEN-COST-19 | Group cost in loki rows of C-F1 | C-F1 harness | LOW | see note | ready@2026-10-17T03:30Z | after COST-04 |
 | TEN-COST-21 | C-F1 .venv and keep_evidence | C-F1 harness | LOW | see note | ready@2026-10-17T03:30Z | after COST-04 and COST-20 |
 | TEN-COST-22 | Cache read pricing correction | model-pricing.json | LOW | see note | rejected@2026-10-17T03:30Z | premise false: Sonnet 5.5 cache read is $0.10 (0.05x) already |
-| TEN-COST-23 | Investigate multi-unit launcher exit 1 | features/speed launcher | HIGH | see note | ready@2026-10-17T03:30Z | architect cost plan |
-| TEN-COST-24 | Opt-in Batch API path for single-shot judge calls under an API key | judge call sites | MEDIUM | see note | ready@2026-10-17T03:30Z | never used in loki start; subscription runs gain nothing from batch |
+| TEN-COST-23 | Investigate multi-unit launcher exit 1 | features/speed launcher | HIGH | see note | building@2026-10-17T04:31Z | architect cost plan |
+| TEN-COST-24 | Opt-in Batch API path for single-shot judge calls under an API key | judge call sites | MEDIUM | see note | building@2026-10-17T04:15Z | never used in loki start; subscription runs gain nothing from batch |
+| TEN-GATES-03-F1 | verify --require-exogenous fails closed with --allow-unsigned and ignores zero-test checks | loki-ts/src/engine10/verify_cmd.ts; loki-ts/tests/engine10/verify_cmd.test.ts | HIGH | an UNSIGNED agent-only receipt with --require-exogenous --allow-unsigned exits 4; an exogenous pass with n=0 does not count toward k | building@2026-10-17T04:15Z | from GATES-03 HIGH review non-blocking findings 1 and 2; batch O |
+| TEN-ADOPTION-03-F1 | proof share scan catches tokens (ghp_, AKIA, sk-ant) and proof registry lists badge, md, bundle | autonomy/lib/secure-scan.py or loki-ts/src/util/secure_scan.ts; loki-ts/src/commands/proof.ts; loki-ts/src/cli/registry.ts; tests | MEDIUM | a bundle with a ghp_ token in events.jsonl shows a finding in the share preview; registry proof subcommands include badge, md, bundle | building@2026-10-17T04:15Z | from ADOPTION-03 TL review notes 1 and 2; batch O |
+| TEN-QUALITY-03-F1 | lint baseline abort test proves the in-flight rerun is killed | loki-ts/tests/engine10/verify_lint.test.ts | LOW | removing signal from AbortSignal.any in verify.ts turns the test red | building@2026-10-17T04:15Z | from QUALITY-03 TL review non-blocking finding 1; batch O |