loki-mode 11.17.17 → 11.17.19

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: An autonomous software factory that knows what it is supposed to deliver, and proves it did. Use when the user says Loki Mode or asks to build, fix or verify software autonomously.
 ---
 
-# Loki Mode v11.17.17
+# Loki Mode v11.17.19
 
 **Current entry points (Loki 10 engine):** `loki "<task>"`, `loki owner/repo#N` and `loki quick "<task>"` run the Loki 10 engine and end with a signed receipt (`loki verify`). `loki backlog owner/repo --all` runs many issues in parallel. Guide: `docs/v10/GUIDE.md`. The skill instructions below, and `loki start`, describe the previous bash loop. PRD-file starts (`loki start ./prd.md`) and the opencode provider still run on it until FC38-SWEEP ports them; the legacy-engine command and the LOKI_ENGINE switch remain removed. Prefer `loki owner/repo#N` for issues.
 
@@ -483,4 +483,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v11.17.17 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**
+**v11.17.19 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**

package/VERSION

@@ -1 +1 @@
-11.17.17
+11.17.19

package/dashboard/__init__.py

@@ -7,6 +7,6 @@ Modules:
     control: Session control helpers (status, atomic writes, origin check)
 """
 
-__version__ = "11.17.17"
+__version__ = "11.17.19"
 
 __all__ = ["__version__"]

package/docs/CLI-REFERENCE.md

@@ -1,6 +1,6 @@
 # CLI reference
 
-Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.17.17. Do not edit by hand.
+Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.17.19. Do not edit by hand.
 Hidden and legacy-only commands are omitted; see `docs/v10/CLI-MODERN.md` for the full inventory.
 
 | Command | Description |

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 Loki Mode, by [Autonomi](https://www.autonomi.dev/), turns a spec or an issue into a verified pull request with a receipt you can check. This page covers installing it, a first run, and the options around it.
 
-**Version:** v11.17.17
+**Version:** v11.17.19
 
 **Engine note:** `loki start` is the primary command. `loki start`, `loki "<task>"`, `loki owner/repo#N` and `loki quick` all run the Loki 10 engine, whatever the flag order or input form (PRD file, issue ref, task or one-word brief). The previous loop runs only on `--engine legacy`, `LOKI_ENGINE=legacy`, or for one call when a flag Loki 10 cannot honor is present. See the [user guide](v10/GUIDE.md) and the [5-minute quickstart](QUICKSTART.md).
 

package/docs/v10/BOARD.md

@@ -1021,7 +1021,7 @@ Source: ~/git/autonomi-dev/research/2026-09-30-adoption/SWARM-PROMPT-ADOPTION.md
 | TEN-ADOPTION-06 | One-click IDE install links and honest npm metadata | README.md; docs/INSTALLATION.md; package.json (keywords only); tests/test-server-json-current.sh (extend: decode the deeplink payloads) | LOW | see Wall in note | ready@2026-10-17T01:40Z | wave 2; depends: TEN-ADOPTION-05. Goal: The README MCP line (README.md:161) and a new IDE section in docs/INSTALLATION.md gain a Cursor deeplink (cursor://anysphere.cursor-deeplink/mcp/install?name=loki-mode&config=<base64 of {command:npx,args:[-y,loki-mode,mcp]}>), a VS Code link (vscode:mcp/install?<urlencoded json>) and the `loki mcp install --client X` commands. package.json keywords drop deprecated or false terms (gemini, gemini-cli) and keep the true ones. Wall: Red: the extended guard extracts the Cursor base64 config and the VS Code JSON from README.md and asserts they decode to a server that runs server.json's identifier with arg 'mcp'. It fails today because no deeplink exists. It also asserts that package.json keywords contain no deprecated provider name. Mutation: change the arg in the README payload to 'serve'; the guard must go red. Gate: bash tests/test-server-json-current.sh && bash tests/test-help-discoverability.sh && the help-drift and doc guards in scripts/local-ci.sh (no emojis, no em or en dashes). Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
 | TEN-ADOPTION-07 | Examples gallery of verifiable receipts | examples/README.md; examples/receipts/ (new dir: gallery data, no existing owner); tests/test-examples-gallery.sh (new: no existing test covers examples/; register in tests/run-all-tests.sh and its shard); package.json files entry only if examples/receipts must ship | MEDIUM | see Wall in note | ready@2026-10-17T01:40Z | wave 4; depends: TEN-ADOPTION-02, TEN-ADOPTION-01. Goal: examples/README.md leads with a gallery of real loki start runs. Each entry is a bundle in examples/receipts/<name>/ (format from slice 02) with task, outcome, cost and the one-line verify command. A guard verifies every gallery bundle with its own pubkey and fails on any entry that is not VERIFIED or ALREADY_SATISFIED. The six v5 HTML demos stay, under a clearly labeled 'UI demos (no receipt)' heading, so nothing implies they were verified. The tour fixture from slice 01 is the first entry. Wall: Red: the guard fails today because examples/receipts/ is missing. Green once at least one bundle verifies. Mutations: (a) a byte edit in one gallery receipt turns the guard red with TAMPERED; (b) a README entry whose directory does not exist turns it red; (c) a FAILED receipt listed in the gallery turns it red. Gate: bash tests/test-examples-gallery.sh && bash scripts/structural-checks.sh && bash scripts/local-ci.sh. Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
 | TEN-ADOPTION-08 | Install smoke covers the newcomer first-touch path | scripts/smoke-install.sh | MEDIUM | see Wall in note | ready@2026-10-17T01:40Z | wave 5; depends: TEN-ADOPTION-01, TEN-ADOPTION-05. Goal: scripts/smoke-install.sh also runs, from the packed tarball with a throwaway HOME: `loki tour` (expects the verifier's VERIFIED line from slice 01), `loki mcp install --client cursor --print` (expects valid JSON) and a stdio MCP initialize handshake returning a tools list. The packaged artifact is then proven on the exact paths the README sends a new user down. Keep it runnable by hand, and add an optional CI hook only if it stays under the 10-min command budget. Wall: Red: before slice 01 merges, the new tour assertion fails on the display-only text. Green after. Mutation: drop skills/fixtures/demo-receipt/pubkey.jwk from the packed files list in a scratch copy; the smoke must fail on the tour case, which proves it tests the shipped package and not the checkout. Gate: bash scripts/smoke-install.sh --log ~/loki-ci-logs/smoke-install-adoption.log (exit 0) && shellcheck scripts/smoke-install.sh. Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
-| TEN-COST-01 | Opt-in cost profile: loki start --cost lean / LOKI_COST_PROFILE=lean | loki-ts/src/util/cost_profile.ts (new: no existing module owns engine10 env presets; util/tier.ts is the license seam, not a cost preset), loki-ts/src/commands/start.ts (one --cost value-flag row plus one apply call), loki-ts/tests/util/cost_profile.test.ts (new, pairs with the new util), loki-ts/tests/commands/start.test.ts (one case), tests/test-help-start-flags.sh (expected flag list) | MEDIUM | see Wall in note | ready@2026-10-17T01:40Z | wave 2; depends: none. Goal: One user-facing switch that turns on the already-built, flag-gated cost levers together, with each lever named on the start line. The lean profile sets LOKI_ROUTER=1 (the router keeps its own D89 haiku-only-with-advisor rule and escalation ladder) and LOKI_E10_TRIM=1. It only fills unset variables, so explicit user env always wins: LOKI_ROUTER=0 stays 0. Profile off or unset leaves the env byte-identical. It also writes .loki/cost-profile.json listing the levers applied, so nothing is reduced silently (D89 item 3). Works for loki start and, through the env var, for loki chat unchanged. Wall: Red first: - cost_profile.test.ts asserts resolveCostProfile('lean', {}) returns {LOKI_ROUTER:'1', LOKI_E10_TRIM:'1'}. - resolveCostProfile('lean', {LOKI_ROUTER:'0'}) keeps '0'. - An unknown profile name throws a usage error. - 'off' and unset return an empty patch. - start.test.ts: --cost lean reaches the child env and prints one line naming both levers. Mutation: remove the user-wins precedence check and confirm the LOKI_ROUTER=0 case goes red; restore. Gate: cd loki-ts && bun test tests/util/cost_profile.test.ts tests/commands/start.test.ts && bunx tsc --noEmit && bun test tests/engine10/budget.test.ts && bash ../tests/test-help-start-flags.sh && bash ../tests/test-help-changelog-drift.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
+| TEN-COST-01 | Opt-in cost profile: loki start --cost lean / LOKI_COST_PROFILE=lean | loki-ts/src/util/cost_profile.ts (new: no existing module owns engine10 env presets; util/tier.ts is the license seam, not a cost preset), loki-ts/src/commands/start.ts (one --cost value-flag row plus one apply call), loki-ts/tests/util/cost_profile.test.ts (new, pairs with the new util), loki-ts/tests/commands/start.test.ts (one case), tests/test-help-start-flags.sh (expected flag list) | MEDIUM | see Wall in note | building@2026-10-17T04:15Z | wave 2; depends: none. Goal: One user-facing switch that turns on the already-built, flag-gated cost levers together, with each lever named on the start line. The lean profile sets LOKI_ROUTER=1 (the router keeps its own D89 haiku-only-with-advisor rule and escalation ladder) and LOKI_E10_TRIM=1. It only fills unset variables, so explicit user env always wins: LOKI_ROUTER=0 stays 0. Profile off or unset leaves the env byte-identical. It also writes .loki/cost-profile.json listing the levers applied, so nothing is reduced silently (D89 item 3). Works for loki start and, through the env var, for loki chat unchanged. Wall: Red first: - cost_profile.test.ts asserts resolveCostProfile('lean', {}) returns {LOKI_ROUTER:'1', LOKI_E10_TRIM:'1'}. - resolveCostProfile('lean', {LOKI_ROUTER:'0'}) keeps '0'. - An unknown profile name throws a usage error. - 'off' and unset return an empty patch. - start.test.ts: --cost lean reaches the child env and prints one line naming both levers. Mutation: remove the user-wins precedence check and confirm the LOKI_ROUTER=0 case goes red; restore. Gate: cd loki-ts && bun test tests/util/cost_profile.test.ts tests/commands/start.test.ts && bunx tsc --noEmit && bun test tests/engine10/budget.test.ts && bash ../tests/test-help-start-flags.sh && bash ../tests/test-help-changelog-drift.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
 | TEN-COST-02 | raw-lean baseline mode in the claude_code bench adapter | benchmarks/bench/adapters/claude_code.py, benchmarks/bench/tests/test_model_pin.py | LOW | see Wall in note | released@2026-10-17T02:57Z | merge 3a7942aac, dist bd6348d77; TL APPROVE 60dc6d321 (8 passed, mutation red); post-merge tsc 0 errors, 130 pass. wave 1; depends: none. Goal: An honest same-config raw Claude Code baseline that works under OAuth (no API key). run(..., lean=True) adds: --setting-sources project, --strict-mcp-config, --mcp-config '{"mcpServers":{}}', --disable-slash-commands and --tools Bash,Read,Edit,Write,Glob,Grep, the same tool set as ENGINE10_TOOLS in providers.ts:618. lean and bare together raise ValueError, never silently pick one. The row command string records lean. Wall: Red first: - test_model_pin.py asserts the exact lean argv with a stub runner. - lean=True with bare=True raises. - Default lean=False argv is byte-identical to today's. Mutation: drop --strict-mcp-config from the lean argv; the argv test goes red. Gate: python3 -I -m pytest benchmarks/bench/tests/test_model_pin.py -q Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. v11.17.13 npm next 11.17.13 |
 | TEN-COST-03 | Cost claim verdict: paired bootstrap CI and acceptance parity | benchmarks/bench/cost_claim.py (new: no bench module owns statistical claim gating; attribution.py is 1025 lines and owned by TEN-COST-04), benchmarks/bench/tests/test_cost_claim.py (new, pairs with the new module) | MEDIUM | see Wall in note | released@2026-10-17T02:57Z | merge 049a16327; TL APPROVE cab8238eb (8 passed, mutation 1 failed). wave 1; depends: none. Goal: A pure function decides whether a cost claim is PROVEN or NOT PROVEN. - Inputs: per-row results for a Loki arm and a floor arm. - Method: paired bootstrap over tasks (fixed seed) for the 95% CI of the cost-per-accepted ratio. - PROVEN_AT(target) only when all of these hold: - the CI upper bound is at most the target; - Loki's acceptance rate is at least the floor's minus 0 (no accepted-task loss); - no row is cost_partial; - engine and loki version are recorded and identical across rows; - n is at least 3 per task. - Otherwise NOT PROVEN, with every failing reason listed. - Unmeasured rows are excluded but counted in the reasons. Wall: Red first, fixtures: - Ratio about 0.4 with tight spread gives PROVEN at 0.5. - Ratio 0.45 with one cost_partial row gives NOT PROVEN, reason partial. - Loki accepts 22/24 vs floor 24/24 gives NOT PROVEN, reason acceptance. - Mixed loki versions give NOT PROVEN. - n=2 gives NOT PROVEN. - Same seed gives an identical CI. Mutation: replace the CI upper bound with the point estimate; the wide-spread fixture flips to PROVEN and goes red. Gate: python3 -I -m pytest benchmarks/bench/tests/test_cost_claim.py -q Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. v11.17.13 npm next 11.17.13 |
 | TEN-COST-04 | C-F1 arms raw-lean and loki-lean, lever ablation, verdict in the report | benchmarks/bench/attribution.py, benchmarks/bench/adapters/loki.py, benchmarks/bench/tests/test_attribution.py | MEDIUM | see Wall in note | ready@2026-10-17T01:40Z | wave 3; depends: TEN-COST-01, TEN-COST-02, TEN-COST-03, COST-WALL-e merged (it edits attribution.py). Goal: attribution.py changes: - Adds arms raw-lean (claude_code lean=True) and loki-lean (loki with LOKI_COST_PROFILE=lean). - Adds repeatable --loki-env KEY=VALUE for one-lever ablations (allowlist: LOKI_* keys only). - Adds raw-lean to COST_FLOORS. - render_cost_table prints the TEN-COST-03 verdict per Loki arm against each floor. adapters/loki.py changes: - Accepts profile and extra_env. - Records cost_profile, lever_env and cache_read/cache_creation tokens by phase in the row, so rows from different lever configs never pool. Wall: Red first in test_attribution.py: - --dry-run --arms raw-configured,raw-lean,loki,loki-lean plans all 4 arms. - loki-lean rows carry cost_profile 'lean'. - --loki-env FOO=1 (not LOKI_) exits 2. - The rendered table has a raw-lean column and a verdict line. - A loki row with a different lever_env is not pooled into the loki arm. Mutation: drop lever_env from the pooling key; the mixed-config test goes red. Gate: python3 -I -m pytest benchmarks -q -k 'attribution or model_pin or cost_claim' && python3 -I benchmarks/bench/attribution.py --dry-run --arms raw-configured,raw-lean,loki,loki-lean Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
@@ -1029,7 +1029,7 @@ Source: ~/git/autonomi-dev/research/2026-09-30-adoption/SWARM-PROMPT-ADOPTION.md
 | TEN-COST-06 | xreview claude judge: lean flags and child-ledger line | loki-ts/src/engine10/stages/xreview.ts, loki-ts/tests/engine10/xreview.test.ts | MEDIUM | see Wall in note | released@2026-10-17T03:50Z | TL APPROVE 2e40a4be8, merged for v11.17.14 Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
 | TEN-COST-07 | Project-model discovery on the fast tier, retry on the run model | loki-ts/src/project_model/discover.ts, loki-ts/tests/project_model/project_model.test.ts | MEDIUM | see Wall in note | released@2026-10-17T03:50Z | TL APPROVE e01e37c5e. wave 1; depends: none. Goal: Discovery attempt 1 runs on fastTierModel(env) (runner/model_downgrades.ts:8). It is sonnet unless LOKI_ALLOW_HAIKU, so it never drops below sonnet without opt-in, and it is never weaker than an explicit LOKI_MODEL_OVERRIDE. The existing validation-error retry (attempt 2) runs on the run model, so a weak answer escalates, never ships. The model used is recorded on the project_model result. The schema validation and the owner=provider fallback are unchanged. Wall: Red first, with a stub SessionRunner: - Attempt 1 opts.model equals fastTierModel. - After an invalid answer, attempt 2 opts.model is undefined (run model). - With LOKI_MODEL_OVERRIDE set, both attempts use the override. Mutation: pin attempt 2 to the fast tier; the escalation test goes red. Gate: cd loki-ts && bun test tests/project_model && bunx tsc --noEmit Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
 | TEN-COST-08 | Documented reproducible cost proof run | docs/v10/METRICS.md, docs/EVALUATING.md | LOW | see Wall in note | ready@2026-10-17T01:40Z | wave 4; depends: TEN-COST-04. Goal: docs/v10/METRICS.md gains a 'Cost proof (C-F1)' section that states: - the exact command (attribution.py --execute, arms raw-configured, raw-lean, raw-bare, loki, loki-lean, n=3, pinned model, --max-spend-usd); - the verdict rule from TEN-COST-03; - that results are reported against all three floors, never only the favorable one; - that a run is valid only when the recorded loki version equals VERSION. docs/EVALUATING.md links to it. This is an extension of existing docs, not a new doc. Wall: Red first: grep -n 'Cost proof (C-F1)' docs/v10/METRICS.md exits 1 before the edit. Green: - The documented dry-run command, copied verbatim, exits 0. - grep -n 'raw-lean' docs/EVALUATING.md prints a line. - No em or en dashes: grep -nP '[\x{2013}\x{2014}]' on both files exits 1. Gate: python3 -I benchmarks/bench/attribution.py --dry-run --arms raw-configured,raw-lean,raw-bare,loki,loki-lean && bash tests/test-help-changelog-drift.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
-| TEN-QUALITY-01 | Fix brief carries a bounded failure excerpt (assertion, traceback, expected/received) | loki-ts/src/util/check_result.ts (failureExcerpt), loki-ts/src/engine10/stages/verify.ts (runCheck keeps the fail output excerpt; line 315 sample; at most 3 core lines), loki-ts/tests/engine10/check_result.test.ts, loki-ts/tests/engine10/fix.test.ts, loki-ts/tests/engine10/wall_holdout.test.ts | HIGH | see Wall in note | ready@2026-10-17T01:40Z | SPLIT per CTO critic into (a) pure failureExcerpt plus fixtures, (b) verify.ts wiring plus holdout test; build as two commits or two agents. wave 2; depends: none. Goal: Each failing non-holdout check's output reaches the fix session as a redacted excerpt of at most 1500 bytes, with at most 6 KB across all groups. The group format is `<rerun cmd>\n<excerpt>`. failureExcerpt() in util/check_result.ts finds the decisive block: pytest `E ` lines plus the last frame, jest/vitest Expected/Received, node AssertionError, go `--- FAIL` with the next lines, and tsc/ruff diagnostic lines. It strips ANSI, makes absolute paths repo-relative and runs util/redact.ts. The signature stays byte-identical, so stall detection at machine.ts:232 and escalation in fix.ts are unchanged. The excerpt lives in a stage-local map inside verify.ts. It is never added to VerifyCheck, never emitted in test.result, and never computed for holdout checks. Wall: Red first: fix.test.ts drives verify then fix on a fixture with a failing pytest `assert add(2,2) == 5`. Today the brief lacks `E assert 4 == 5`, so the test fails. check_result.test.ts covers one fixture each for pytest, jest, node:test, go and tsc. It also asserts the size cap and that an AKIA-style token is redacted. wall_holdout.test.ts asserts that a failing holdout's output text appears in neither failures_grouped, events.jsonl nor the fix brief. Mutations: failureExcerpt returning '' must turn fix.test red; removing the isHold filter at verify.ts:314 must turn wall_holdout red; adding the excerpt to the signature must turn the existing stall test in machine.test.ts red. Gate: cd /Users/lokesh/git/lokimode-anthropic/loki-ts && bun test tests/engine10/check_result.test.ts tests/engine10/fix.test.ts tests/engine10/wall_holdout.test.ts && bun test && npx tsc --noEmit && bun test tests/engine10/budget.test.ts; then bash scripts/local-ci.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
+| TEN-QUALITY-01 | Fix brief carries a bounded failure excerpt (assertion, traceback, expected/received) | loki-ts/src/util/check_result.ts (failureExcerpt), loki-ts/src/engine10/stages/verify.ts (runCheck keeps the fail output excerpt; line 315 sample; at most 3 core lines), loki-ts/tests/engine10/check_result.test.ts, loki-ts/tests/engine10/fix.test.ts, loki-ts/tests/engine10/wall_holdout.test.ts | HIGH | see Wall in note | building@2026-10-17T04:27Z | SPLIT per CTO critic into (a) pure failureExcerpt plus fixtures, (b) verify.ts wiring plus holdout test; build as two commits or two agents. wave 2; depends: none. Goal: Each failing non-holdout check's output reaches the fix session as a redacted excerpt of at most 1500 bytes, with at most 6 KB across all groups. The group format is `<rerun cmd>\n<excerpt>`. failureExcerpt() in util/check_result.ts finds the decisive block: pytest `E ` lines plus the last frame, jest/vitest Expected/Received, node AssertionError, go `--- FAIL` with the next lines, and tsc/ruff diagnostic lines. It strips ANSI, makes absolute paths repo-relative and runs util/redact.ts. The signature stays byte-identical, so stall detection at machine.ts:232 and escalation in fix.ts are unchanged. The excerpt lives in a stage-local map inside verify.ts. It is never added to VerifyCheck, never emitted in test.result, and never computed for holdout checks. Wall: Red first: fix.test.ts drives verify then fix on a fixture with a failing pytest `assert add(2,2) == 5`. Today the brief lacks `E assert 4 == 5`, so the test fails. check_result.test.ts covers one fixture each for pytest, jest, node:test, go and tsc. It also asserts the size cap and that an AKIA-style token is redacted. wall_holdout.test.ts asserts that a failing holdout's output text appears in neither failures_grouped, events.jsonl nor the fix brief. Mutations: failureExcerpt returning '' must turn fix.test red; removing the isHold filter at verify.ts:314 must turn wall_holdout red; adding the excerpt to the signature must turn the existing stall test in machine.test.ts red. Gate: cd /Users/lokesh/git/lokimode-anthropic/loki-ts && bun test tests/engine10/check_result.test.ts tests/engine10/fix.test.ts tests/engine10/wall_holdout.test.ts && bun test && npx tsc --noEmit && bun test tests/engine10/budget.test.ts; then bash scripts/local-ci.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
 | TEN-QUALITY-02 | Pure static-diagnostic baseline attribution (new vs pre-existing lint) | loki-ts/src/runner/repo_profile.ts, loki-ts/tests/runner/harness_intelligence.test.ts (extends its existing repo_profile describe blocks) | HIGH | see Wall in note | released@2026-10-17T03:50Z | merged 43deeafe9 (HIGH r2 APPROVE 05cafda44) Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
 | TEN-QUALITY-03 | Wire static attribution into verify so pre-existing lint never drives fix rounds | loki-ts/src/engine10/stages/verify.ts (runLintChecks only; at most 4 core lines, helper calls live in repo_profile.ts), loki-ts/tests/engine10/verify_lint.test.ts | HIGH | see Wall in note | released@2026-10-17T04:08Z | v11.17.17; TL APPROVE batch J workflow w9sw9xytw |
 | TEN-QUALITY-04 | Repo map indexes methods and whole large files; cache key versioned | loki-ts/src/engine10/repomap.ts, loki-ts/src/engine10/cache.ts (one-token key rename; net core growth at most 5 lines), loki-ts/tests/engine10/repomap.test.ts, loki-ts/tests/engine10/cache.test.ts | MEDIUM | see Wall in note | released@2026-10-17T03:50Z | TL APPROVE cc1c1b67d. wave 1; depends: none. Goal: repomap.ts records indented Python def and async def under the most recent top-level class as `Class.method`. It raises the symbol-scan cap from 20 KB to 256 KB per file and caps symbols at 300 per file. cache.ts renames the cache file to repomap2-${tree}.json, so a map cached before methods existed is never read. The RepoMap shape is unchanged (symbols are still strings), so isRepoMap and every caller keep working. Wall: Red first: repomap.test.ts writes a 60 KB Python file with `class QuerySet:` and `def bulk_create(self, objs):` past byte 20,000, and asserts the map has `QuerySet.bulk_create`. A file with 1000 defs yields at most 300 symbols. cache.test.ts: a stale repomap-<tree>.json written in the old format is ignored, so a fresh build happens. Mutations: restore the 20 KB cap and the test goes red; restore the old cache filename and the stale test goes red. Gate: cd /Users/lokesh/git/lokimode-anthropic/loki-ts && bun test tests/engine10/repomap.test.ts tests/engine10/cache.test.ts tests/engine10/intake.test.ts tests/engine10/sizing.test.ts && bun test && npx tsc --noEmit && bun test tests/engine10/budget.test.ts; then bash scripts/local-ci.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
@@ -1058,7 +1058,7 @@ Source: ~/git/autonomi-dev/research/2026-09-30-adoption/SWARM-PROMPT-ADOPTION.md
 | TEN-GATES-10 | Proof headline: VERIFIED needs one agent-independent fact beside the agent's suite | autonomy/lib/proof-generator.py, tests/test_proof_generator.py, docs/v10/DECISIONS.md | HIGH | see Wall in note | ready@2026-10-17T01:40Z | wave 4; depends: COST-WALL-f (proof-generator.py in flight), TEN-GATES-07, TEN-GATES-08, TEN-GATES-09 (facts must exist before tightening, or every primary-route run downgrades). Goal: In proof-generator.py the tests_verified branch (:2045-2055) returns VERIFIED only when at least one exogenous fact also passed: build verified, healthcheck ok, functional passed, security clean that actually ran, or an exogenous quality gate passed; otherwise VERIFIED WITH GAPS with degraded item 'no agent-independent evidence (only the agent's own test suite passed)'. Gap record is additive; LOKI_PROOF_REQUIRE_EXOGENOUS=0 opt-out; decision recorded in DECISIONS.md under D99. Wall: Red first in test_proof_generator.py: facts with tests verified + nonempty diff and nothing else -> 'VERIFIED WITH GAPS' plus the degraded item (today VERIFIED); add build verified -> VERIFIED; only an advisory code_review pass -> still WITH GAPS. Mutation: count advisory gates as corroboration -> red. Gate: python3 -m pytest -q tests/test_proof_generator.py tests/test_proof_degraded_disabled_gates.py tests/test_proof_verify.py; bash tests/test-proven-pr-receipt.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
 | TEN-STABILITY-01 | bench-suite argv survives hyperfine 1.20 (unblocks v11.17.6 backstop) | loki-ts/scripts/bench-suite.ts; NEW loki-ts/tests/scripts/bench_suite_argv.test.ts (no existing test owns bench-suite.ts: grep -rl bench-suite loki-ts/tests tests returns nothing) | LOW | see Wall in note | released@2026-10-17T02:57Z | merge d67b2af14, dist bd6348d77; TL APPROVE f1bcf7679 (4 pass, typecheck rc=0); post-merge tsc 0 errors, 130 pass. wave 1; depends: none. Goal: Stop building 'VAR=1 cmd' hyperfine commands. Pass the env as 'env LOKI_LEGACY_BASH=1 <shim> <cmd>' (also 'env BUN_FROM_SOURCE=1'), which works on apt hyperfine 1.18 and brew 1.20 alike. Export a pure argv builder from the script so it can be tested. Write the --export-json files under a mkdtemp dir, not fixed /tmp/bench-*.json paths. Exit non-zero when any command is SKIPPED because hyperfine itself refused the argv, not only when every command was skipped. Wall: RED: the test puts a fake 'hyperfine' on PATH that exits 1 with the real 1.20 message when any positional command matches ^[A-Z_]+=. It runs the builder and fails today, because both benchPair (bench-suite.ts:76) and benchRoute (:108) emit LOKI_LEGACY_BASH=1 first. GREEN after the fix. MUTATION: revert one call site to the VAR= form; the test goes red. A second mutation: a partial SKIP must exit 1. GATE: cd loki-ts && bun test tests/scripts/bench_suite_argv.test.ts && bun run typecheck && bun test (full, per the slice-gate rule). Then run real hyperfine locally: cd loki-ts && bun run scripts/bench-suite.ts --runs 1 --warmup 0 (hyperfine 1.20.0 is installed on this machine) must print no 'Cannot run'. After merge: gh workflow run nightly.yml, and the macOS 1.3.13 leg must be green. Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. v11.17.13 npm next 11.17.13 |
 | TEN-STABILITY-02 | promote.yml walks back to the newest promotable next build (D96 exact-SHA rule) | .github/workflows/promote.yml (Derive and validate version, Require a green nightly, Require a green Post-Release Smoke steps); tests/test_release_next_tag.py (nightly-gate and version-derivation cases); tests/test-promote-smoke-sha.sh; docs/v10/DECISIONS.md (one D102 entry) | HIGH | see Wall in note | rejected@2026-10-17T03:30Z | superseded by TEN-RELEASE-INSTANT (D102): promote.yml deleted, every release moves latest and next |
-| TEN-STABILITY-03 | pre-push runs the R8 global guard rows on every push to main | .githooks/pre-push; tests/test-pre-push-hook.sh | MEDIUM | see Wall in note | ready@2026-10-17T01:40Z | wave 2; depends: none (TEN-STABILITY-04 adds rows; the hook reads the tsv at run time). Goal: On a push whose remote ref is refs/heads/main, run 'bash scripts/impacted-gate.sh --guards-only' against the pushed tip in a clean detached worktree. Reuse release.sh's worktree pattern: per-row timeout, run-owned tmp via loki_run_tmp_create. Place it before the PRE_PUSH_SKIP exit, next to the release-notes and gitleaks gates, so routine PRE_PUSH_SKIP=1 merge pushes cannot skip it. A red row aborts the push and names the row. LOKI_PREPUSH_SKIP_GUARDS=1 is the only bypass and prints a loud warning. Branch pushes and deletes are untouched. Target time is under 120s with IMPACTED_JOBS=4. Over 180s fails closed with a timeout message, never passes silently. Wall: RED: test-pre-push-hook.sh gains a case where a stub impacted-gate (IMPACTED_TEST_MODE=1 with an IMPACTED_SUITES_FILE listing a failing suite) is red and stdin carries refs/heads/main with LOKI_RELEASE_MANAGER=1 PRE_PUSH_SKIP=1. Today the hook exits 0; after the fix it exits 1 and names the row. GREEN cases: all rows green gives exit 0; a branch push never invokes the gate; the bypass env warns and exits 0; a gate timeout gives exit 1. MUTATION: move the block after the PRE_PUSH_SKIP check and the PRE_PUSH_SKIP case goes red. GATE: bash tests/test-pre-push-hook.sh && bash tests/test-pre-push-gitleaks.sh && shellcheck .githooks/pre-push && bash tests/test-no-tmp-sweep.sh. Then time it: time bash scripts/impacted-gate.sh --guards-only on main must stay under 180s, or re-slice. Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
+| TEN-STABILITY-03 | pre-push runs the R8 global guard rows on every push to main | .githooks/pre-push; tests/test-pre-push-hook.sh | MEDIUM | see Wall in note | parked@2026-10-17T04:27Z | parked under D102 (instant releases): a 300s guards-only run on every main push delays npm; guards stay on release.sh and CI as fix-forward signals. wave 2; depends: none (TEN-STABILITY-04 adds rows; the hook reads the tsv at run time). Goal: On a push whose remote ref is refs/heads/main, run 'bash scripts/impacted-gate.sh --guards-only' against the pushed tip in a clean detached worktree. Reuse release.sh's worktree pattern: per-row timeout, run-owned tmp via loki_run_tmp_create. Place it before the PRE_PUSH_SKIP exit, next to the release-notes and gitleaks gates, so routine PRE_PUSH_SKIP=1 merge pushes cannot skip it. A red row aborts the push and names the row. LOKI_PREPUSH_SKIP_GUARDS=1 is the only bypass and prints a loud warning. Branch pushes and deletes are untouched. Target time is under 120s with IMPACTED_JOBS=4. Over 180s fails closed with a timeout message, never passes silently. Wall: RED: test-pre-push-hook.sh gains a case where a stub impacted-gate (IMPACTED_TEST_MODE=1 with an IMPACTED_SUITES_FILE listing a failing suite) is red and stdin carries refs/heads/main with LOKI_RELEASE_MANAGER=1 PRE_PUSH_SKIP=1. Today the hook exits 0; after the fix it exits 1 and names the row. GREEN cases: all rows green gives exit 0; a branch push never invokes the gate; the bypass env warns and exits 0; a gate timeout gives exit 1. MUTATION: move the block after the PRE_PUSH_SKIP check and the PRE_PUSH_SKIP case goes red. GATE: bash tests/test-pre-push-hook.sh && bash tests/test-pre-push-gitleaks.sh && shellcheck .githooks/pre-push && bash tests/test-no-tmp-sweep.sh. Then time it: time bash scripts/impacted-gate.sh --guards-only on main must stay under 180s, or re-slice. Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
 | TEN-STABILITY-04 | global-guards.tsv covers every repo-wide guard that reached main red | scripts/global-guards.tsv; tests/test-select-tests.sh | LOW | see Wall in note | released@2026-10-17T02:57Z | merge 3e542a7fc; TL APPROVE 07aa41ad1 (select-tests 117/0, fast-gate 25/0, shard-coverage 19/0). wave 1; depends: none. Goal: Add as R8 rows the repo-wide guards that turned main red on 2026-10-16 even though no slice diff selected them: - tests/cli/test-completions-coverage.sh - loki-ts/tests/engine10/budget.test.ts - loki-ts/tests/engine10/l2_destructive_registry.test.ts - loki-ts/tests/engine10/pr_body_golden.test.ts - loki-ts/tests/commands/cli_help_routes.test.ts - tests/test-select-tests.sh (FC-89 walker markers) Also add a meta-assertion to test-select-tests.sh: every loki-ts test file that carries '// select: walk-all-src' is either an R8 row or selected by R-rules for any loki-ts/src diff. A new repo-wide guard then cannot silently stay out of R8. Wall: RED: a new test-select-tests.sh case asserts that --guards-only lists each of the 6 targets. It fails today because they are absent from the 17 rows. GREEN after adding the rows. MUTATION: delete one row and its case goes red. Add a fixture walker test without an R8 row and the meta-assertion goes red. GATE: bash tests/test-select-tests.sh && bash tests/test-fast-gate.sh && bash tests/test-shard-coverage.sh. Then time bash scripts/impacted-gate.sh --guards-only and record the added seconds in tests/shard-durations.tsv only if a row is new there. The fast-gate plan for a docs-only diff must stay under 60s per shard. Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. v11.17.13 npm next 11.17.13 |
 | TEN-STABILITY-05 | WC-01b wall_concurrent stops racing the 5s bun timeout | loki-ts/tests/engine10/wall_concurrent.test.ts | LOW | see Wall in note | released@2026-10-17T02:57Z | merge 516e4a4f1; TL APPROVE 5fa97f2d5 (13/0 x3, 13/0 under 12x load at --timeout 1500). wave 1; depends: none. Goal: Make the WC-01b suite hermetic and fast. Build the git fixture once in beforeAll: copy a template repo per test instead of running git init, add and commit per test (wall_concurrent.test.ts:15-20). Give the concurrency case an explicit timeout sized from measured CI duration, and keep every assertion unchanged. Cause measured in nightly 38938949858: 5004.82ms against the 5000ms default. Wall: RED: cd loki-ts && bun test --timeout 1500 tests/engine10/wall_concurrent.test.ts fails today on this machine under 'yes > /dev/null' x4 CPU load (record the measured ms). GREEN: the same command passes after the fixture change, and plain bun test passes 20/20 in a loop: for i in $(seq 20); do bun test tests/engine10/wall_concurrent.test.ts // break; done. MUTATION: swap the expected order of implement:start and author:end and the test still fails, so the assertion is intact. GATE: cd loki-ts && bun run typecheck && bun test (full). Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. v11.17.13 npm next 11.17.13 |
 | TEN-STABILITY-06 | pulse PROMOTION_LAG violation with the blocking reason | scripts/v10-pulse.sh; tests/test-v10-pulse.sh | MEDIUM | see Wall in note | released@2026-10-17T03:50Z | TL APPROVE ce461a4d1. wave 1; depends: none. Goal: In the npm section of v10-pulse.sh (near :830-863), emit 'VIOLATION PROMOTION_LAG' when next != latest and latest's publish time is more than 6h older than next's (threshold set by LOKI_PULSE_PROMOTION_LAG_H). Include the first PROMOTE-BLOCK or FATAL line from the newest non-skipped Promote run (gh run list -w Promote, then gh run view --log-failed). Also include the failing step names of the newest measured Nightly. The CoS acts on the top violation each turn, so a red bench is triaged within one turn instead of 13h. Fail soft: an API error prints UNKNOWN and never crashes the pulse. Wall: RED: test-v10-pulse.sh gains a fixture with stubbed npm and gh: latest 11.10.1 published 2026-10-15T00:00Z, next 11.17.6 published 2026-10-16T23:40Z, and Promote log containing 'PROMOTE-BLOCK: the newest nightly at the promoted SHA ... is failure'. Expect a PROMOTION_LAG line carrying that reason; today none is printed. GREEN cases: next==latest gives no violation; lag under the threshold gives none; gh failure gives UNKNOWN with rc 0. MUTATION: invert the threshold comparison and both lag cases go red. GATE: bash tests/test-v10-pulse.sh && shellcheck scripts/v10-pulse.sh && bash scripts/v10-pulse.sh on the real repo prints the violation today (latest 11.10.1 vs next 11.17.6). Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
@@ -1075,20 +1075,23 @@ Source: ~/git/autonomi-dev/research/2026-09-30-adoption/SWARM-PROMPT-ADOPTION.md
 | TEN-COST-20 | C-F1 seeds ship tests | benchmarks C-F1 seeds | LOW | see note | released@2026-10-17T03:50Z | TL APPROVE 0d1a37eed Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
 | TEN-COST-17 | Raw token classes in the Claude Code ledger | C-F1 harness ledger, test_model_pin.py | HIGH | pytest test_model_pin.py | released@2026-10-17T03:50Z | HIGH r2 APPROVE 232f1fbec Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
 | TEN-RELEASE-INSTANT | Every release publishes npm latest and next immediately (D102) | .github/workflows/release.yml, promote.yml removed | HIGH | see note | released@2026-10-17T03:50Z | HIGH r3 APPROVE 7e0e38c77; D98 round-limit exception recorded under D99 Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| TEN-GATES-05b | Spec-derived auth probe: negation window fixes | autonomy/lib/functional-verify.py, tests/test_functional_verify.py | HIGH | pytest tests/test_functional_verify.py | building@2026-10-17T03:30Z | HIGH r2 BLOCK aaf27e569: trailing-slash redirect false green, curly apostrophe and article negation false reds; r3 under D99 |
+| TEN-GATES-05b | Spec-derived auth probe: negation window fixes | autonomy/lib/functional-verify.py, tests/test_functional_verify.py | HIGH | pytest tests/test_functional_verify.py | building@2026-10-17T04:31Z | HIGH r2 BLOCK aaf27e569: trailing-slash redirect false green, curly apostrophe and article negation false reds; r3 under D99 |
 | TEN-RELEASE-INSTANT-F1 | Empty CUR from a failed npm view fails closed; rename the stale publish step | .github/workflows/release.yml | LOW | see note | released@2026-10-17T03:50Z | TL APPROVE 29ca496f1, ships v11.17.16 Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
 | TEN-COST-18-F1 | cost_claim: a non-object JSON row is skipped, not an AttributeError | C-F1 harness cost_claim | LOW | see note | released@2026-10-17T03:50Z | TL APPROVE 924cec1c8, ships v11.17.16 Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| TEN-GROUP-AUTH-F1 | kpis iteration_count does not count group cost records | loki-ts kpis | LOW | see note | building@2026-10-17T03:40Z | follow-up |
-| TEN-COST-09 | Skip a Wall that cannot run | engine10 wall stage | HIGH | see note | building@2026-10-17T03:40Z | architect cost plan |
-| TEN-COST-10 | Plan on haiku for small and normal tasks | engine10 plan stage | MEDIUM | see note | building@2026-10-17T03:40Z | architect cost plan |
+| TEN-GROUP-AUTH-F1 | kpis iteration_count does not count group cost records | loki-ts kpis | LOW | see note | released@2026-10-17T04:31Z | r1 BLOCK 1c59103ad (writer kind unasserted); r2 adds writer-reader test and stats.ts sibling |
+| TEN-COST-09 | Skip a Wall that cannot run | engine10 wall stage | HIGH | see note | review@2026-10-17T04:31Z | architect cost plan |
+| TEN-COST-10 | Plan on haiku for small and normal tasks | engine10 plan stage | MEDIUM | see note | building@2026-10-17T04:31Z | architect cost plan |
 | TEN-COST-11 | Wall on haiku, re-authored on sonnet on failure | engine10 wall stage | HIGH | see note | ready@2026-10-17T03:30Z | architect cost plan |
-| TEN-COST-12 | 5-minute cache TTL by default | runner cache settings | MEDIUM | see note | building@2026-10-17T03:40Z | architect cost plan |
-| TEN-COST-13 | Lean prefix by default | runner prompt prefix | MEDIUM | see note | building@2026-10-17T03:40Z | architect cost plan |
-| TEN-COST-14 | Wall brief output budget | engine10 wall brief | LOW | see note | building@2026-10-17T03:40Z | architect cost plan |
+| TEN-COST-12 | 5-minute cache TTL by default | runner cache settings | MEDIUM | see note | building@2026-10-17T04:31Z | architect cost plan |
+| TEN-COST-13 | Lean prefix by default | runner prompt prefix | MEDIUM | see note | released@2026-10-17T04:31Z | architect cost plan |
+| TEN-COST-14 | Wall brief output budget | engine10 wall brief | LOW | see note | released@2026-10-17T04:24Z | architect cost plan |
 | TEN-COST-15 | Plan output trim | engine10 plan stage | LOW | see note | ready@2026-10-17T03:30Z | architect cost plan |
-| TEN-COST-16 | Implement on haiku first (opt-in) | engine10 implement stage | HIGH | see note | ready@2026-10-17T03:30Z | architect cost plan |
+| TEN-COST-16 | Implement on haiku first (opt-in) | engine10 implement stage | HIGH | see note | building@2026-10-17T04:15Z | architect cost plan |
 | TEN-COST-19 | Group cost in loki rows of C-F1 | C-F1 harness | LOW | see note | ready@2026-10-17T03:30Z | after COST-04 |
 | TEN-COST-21 | C-F1 .venv and keep_evidence | C-F1 harness | LOW | see note | ready@2026-10-17T03:30Z | after COST-04 and COST-20 |
 | TEN-COST-22 | Cache read pricing correction | model-pricing.json | LOW | see note | rejected@2026-10-17T03:30Z | premise false: Sonnet 5.5 cache read is $0.10 (0.05x) already |
-| TEN-COST-23 | Investigate multi-unit launcher exit 1 | features/speed launcher | HIGH | see note | building@2026-10-17T03:40Z | architect cost plan |
-| TEN-COST-24 | Opt-in Batch API path for single-shot judge calls under an API key | judge call sites | MEDIUM | see note | ready@2026-10-17T03:30Z | never used in loki start; subscription runs gain nothing from batch |
+| TEN-COST-23 | Investigate multi-unit launcher exit 1 | features/speed launcher | HIGH | see note | building@2026-10-17T04:31Z | architect cost plan |
+| TEN-COST-24 | Opt-in Batch API path for single-shot judge calls under an API key | judge call sites | MEDIUM | see note | building@2026-10-17T04:15Z | never used in loki start; subscription runs gain nothing from batch |
+| TEN-GATES-03-F1 | verify --require-exogenous fails closed with --allow-unsigned and ignores zero-test checks | loki-ts/src/engine10/verify_cmd.ts; loki-ts/tests/engine10/verify_cmd.test.ts | HIGH | an UNSIGNED agent-only receipt with --require-exogenous --allow-unsigned exits 4; an exogenous pass with n=0 does not count toward k | building@2026-10-17T04:15Z | from GATES-03 HIGH review non-blocking findings 1 and 2; batch O |
+| TEN-ADOPTION-03-F1 | proof share scan catches tokens (ghp_, AKIA, sk-ant) and proof registry lists badge, md, bundle | autonomy/lib/secure-scan.py or loki-ts/src/util/secure_scan.ts; loki-ts/src/commands/proof.ts; loki-ts/src/cli/registry.ts; tests | MEDIUM | a bundle with a ghp_ token in events.jsonl shows a finding in the share preview; registry proof subcommands include badge, md, bundle | building@2026-10-17T04:15Z | from ADOPTION-03 TL review notes 1 and 2; batch O |
+| TEN-QUALITY-03-F1 | lint baseline abort test proves the in-flight rerun is killed | loki-ts/tests/engine10/verify_lint.test.ts | LOW | removing signal from AbortSignal.any in verify.ts turns the test red | building@2026-10-17T04:15Z | from QUALITY-03 TL review non-blocking finding 1; batch O |

package/docs/v10/PROGRESS.md

@@ -2421,3 +2421,9 @@ The swarm is stopped: .loki/V10-STOP exists, the loop has no wake-ups, and the c
 
 ## 2026-10-17T04:08Z (CoS) v11.17.17: batch J merged
 - Batch J workflow w9sw9xytw: 6 of 6 TL APPROVE. Merged QUALITY-03 (a8d686b43), GATES-03 (d163dd812), GATES-08 (124b0cd70), ADOPTION-04 (6b5380bca), UX-07 (f3b4e9c3a). ADOPTION-03 (260474376) conflicted add/add with the merged ADOPTION-02 receipt_bundle; a clean cherry-pick onto main (029bdd1a6, same 4-file 322/20 diff, 48 pass 0 fail) merged.
+
+## 2026-10-17T04:24Z (CoS) v11.17.18: COST-14 merged
+- Batch N done: TEN-COST-14 TL APPROVE a0c626378 (fc23 wall conventions 11 pass, wall 98 pass, two mutations caught), merged f5747f1ae. TEN-GROUP-AUTH-F1 r1 BLOCK 1c59103ad: deleting kind from writeGroupCostRecord left 24/0 green; r2 (workflow wi62vcm02) adds a writer-reader test and the stats.ts sibling. v11.17.17 Release run on 1fa2b21cc in progress; this push waits for it.
+
+## 2026-10-17T04:31Z (CoS) v11.17.19: COST-13 and GROUP-AUTH-F1
+- v11.17.17 publish-npm success (Release run on 1fa2b21cc; npm-visible job pending on propagation). v11.17.18 (COST-14) held behind that run, now pushed together with v11.17.19. TEN-COST-13 TL APPROVE 0b15dc2ba (session 225 pass, runner 1293 pass, 2 mutations caught). TEN-GROUP-AUTH-F1 r2 TL APPROVE 367b4e042 (writer, stats and shared predicate mutations each fail a test). Batch L blocks: GATES-05b r3 BLOCK 7eef05bcb (base_url prefix false green, regex tail unguarded); COST-12 BLOCK b96ffb5f9 (call-site wiring untested); COST-10 BLOCK a0bd42473 (router-off goldens red); COST-09 reviewer returned no verdict; COST-23 build failed on the fixed USER/LOGNAME env drop. r2 rounds dispatched. TEN-QUALITY-01 building; TEN-STABILITY-03 parked under D102.