loki-mode 11.17.21 → 11.17.22

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: An autonomous software factory that knows what it is supposed to deliver, and proves it did. Use when the user says Loki Mode or asks to build, fix or verify software autonomously.
 ---
 
-# Loki Mode v11.17.21
+# Loki Mode v11.17.22
 
 **Current entry points (Loki 10 engine):** `loki "<task>"`, `loki owner/repo#N` and `loki quick "<task>"` run the Loki 10 engine and end with a signed receipt (`loki verify`). `loki backlog owner/repo --all` runs many issues in parallel. Guide: `docs/v10/GUIDE.md`. The skill instructions below, and `loki start`, describe the previous bash loop. PRD-file starts (`loki start ./prd.md`) and the opencode provider still run on it until FC38-SWEEP ports them; the legacy-engine command and the LOKI_ENGINE switch remain removed. Prefer `loki owner/repo#N` for issues.
 
@@ -483,4 +483,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v11.17.21 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**
+**v11.17.22 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**

package/VERSION

@@ -1 +1 @@
-11.17.21
+11.17.22

package/dashboard/__init__.py

@@ -7,6 +7,6 @@ Modules:
     control: Session control helpers (status, atomic writes, origin check)
 """
 
-__version__ = "11.17.21"
+__version__ = "11.17.22"
 
 __all__ = ["__version__"]

package/docs/CLI-REFERENCE.md

@@ -1,6 +1,6 @@
 # CLI reference
 
-Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.17.21. Do not edit by hand.
+Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.17.22. Do not edit by hand.
 Hidden and legacy-only commands are omitted; see `docs/v10/CLI-MODERN.md` for the full inventory.
 
 | Command | Description |

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 Loki Mode, by [Autonomi](https://www.autonomi.dev/), turns a spec or an issue into a verified pull request with a receipt you can check. This page covers installing it, a first run, and the options around it.
 
-**Version:** v11.17.21
+**Version:** v11.17.22
 
 **Engine note:** `loki start` is the primary command. `loki start`, `loki "<task>"`, `loki owner/repo#N` and `loki quick` all run the Loki 10 engine, whatever the flag order or input form (PRD file, issue ref, task or one-word brief). The previous loop runs only on `--engine legacy`, `LOKI_ENGINE=legacy`, or for one call when a flag Loki 10 cannot honor is present. See the [user guide](v10/GUIDE.md) and the [5-minute quickstart](QUICKSTART.md).
 

package/docs/v10/BOARD.md

@@ -1007,7 +1007,7 @@ Source: ~/git/autonomi-dev/research/2026-09-30-adoption/SWARM-PROMPT-ADOPTION.md
 | TEN-DEPLOY-01 | Capture the deployed public URL on every --execute path and probe it by default | autonomy/loki (_deploy_try_execute non-canary exec block and the _deploy_record arg list and JSON fields only), tests/test-deploy-receipt-gate.sh (new section after the existing 14-18 block), CHANGELOG.md | MEDIUM | see Wall in note | released@2026-10-17T02:57Z | merge 60a9bb709; TL APPROVE b14d908a4 (deploy-receipt-gate 56/0, test-deploy 6/6, shellcheck 91=91 vs main). wave 1; depends: none. Goal: After a deploy that exits 0, take the last https URL the provider CLI printed (the canary grep -Eo already does this; reuse that, do not add a second parser). Store it as deployed_url in loki.deploy/1. When no --health-url is given, probe deployed_url with _deploy_probe_health and record health_url_source=captured/flag. No URL printed: deployed_url is empty, health stays 'unchecked', and Loki never invents a URL. Print 'Live at: <url>' only when one was captured. Wall: RED: a new section stubs vercel to print 'https://app-x.vercel.app' and exit 0, and stubs curl to 200. The record lacks deployed_url, health_status is 'unchecked', and the test fails on main. GREEN: deployed_url equals the stub URL, health_status=healthy, health_url_source=captured. A second stub prints no URL: deployed_url is empty, health is 'unchecked', exit 0. A third case passes --health-url: health_url_source=flag. MUTATION: hardcode deployed_url to a constant and the no-URL case goes red. Gate: bash -n autonomy/loki && shellcheck -S warning autonomy/loki && bash tests/test-deploy-receipt-gate.sh && bash tests/test-deploy.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. v11.17.13 npm next 11.17.13 |
 | TEN-DEPLOY-02 | Signed live provenance doc (loki.provenance/1) and loki verify --url | loki-ts/src/util/receipt_signer.ts, loki-ts/tests/engine10/verify_cmd.test.ts (provenance cases; existing deploy-record tests live here), docs/SIGNED-RECEIPTS.md (one section), CHANGELOG.md. Engine10 core is not edited: verify_cmd.ts:164 already routes through deployAttestCmd, and a one-token --url passthrough there needs the budget test to stay green. | HIGH | see Wall in note | building@2026-10-17T04:38Z | SPLIT per CTO critic into (a) signProvenance plus --sign-provenance, (b) verify --url fetch and verdicts; build as two commits or two agents. wave 2; depends: none. Goal: Extend receipt_signer.ts, the owner of signed deploy attestations, with: signProvenance(head_sha, tree_sha, receipt_sha256, run_id, built_at), which signs with the same Ed25519 key as signDeployRecord; a `--sign-provenance FILE` dispatch in deployAttestCmd; and `loki verify --url https://host` plus a pubkey. The --url check fetches <url>/.well-known/loki-provenance.json with a timeout and size cap, checks the signature, and requires a 200 with JSON. The verdict is VERIFIED only when the signature verifies against the local JWKS or --pubkey AND the cited receipt (when present locally or via --receipt) is VERIFIED. The doc alone with an unknown kid is UNCHECKED rc 2. An edited doc is TAMPERED rc 1. A fetch failure is UNCHECKED and never VERIFIED. Optional --expect-sha SHA must equal head_sha. Wall: RED: tests serve a signed provenance doc from Bun.serve on 127.0.0.1. On main, `verify --url` is an unknown arg and exits 2, so the tests fail. GREEN: genuine doc with --pubkey gives VERIFIED rc 0. One edited byte of head_sha gives TAMPERED rc 1. An unknown kid gives UNCHECKED rc 2. A 404, a non-JSON body or a doc over 64KB gives UNCHECKED rc 2. A wrong --expect-sha gives TAMPERED rc 1. MUTATION: skip the signature verify and the edited-byte case goes red. Gate: cd loki-ts && bun test tests/engine10/verify_cmd.test.ts && bun test tests/engine10/ && bunx tsc --noEmit (the full engine10 suite runs the budget and spawn-env guards) Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
 | TEN-DEPLOY-03 | Ship the provenance doc with the build and prove the live URL serves the verified SHA | autonomy/loki (_deploy_try_execute pre-exec and post-health blocks, _deploy_record live_binding field only), tests/test-deploy-receipt-gate.sh (new section), docs/WORKSPACES.md, CHANGELOG.md | HIGH | see Wall in note | ready@2026-10-17T01:40Z | SPLIT per CTO critic into (a) provenance file into deploy root per project type, (b) post-deploy live-binding probe; build as two commits or two agents. wave 3; depends: TEN-DEPLOY-01, TEN-DEPLOY-02. Goal: In _deploy_try_execute, after the gate passes and before the provider runs, write a signed .well-known/loki-provenance.json into the deploy root via `verify --sign-provenance`. The deploy root is public/ for nextjs and vite, the detected dist/ or build/ for static, and is refused with a reason for docker/python where no static root exists. Write it as an untracked build artifact so the dirty-tree gate is evaluated before it. After the deploy, probe <deployed_url>/.well-known/loki-provenance.json. Set live_binding=VERIFIED only when its head_sha equals the anchor. A mismatch gives FAILED_HEALTH exit 4 (stale or wrong build served). Update docs/WORKSPACES.md and replace 'deployed-SHA binding is not implemented' with what is now bound and what is not. Wall: RED: a stubbed vercel copies dist/ into a served dir and a python http.server serves it. On main, no provenance file exists and the record has no live_binding. GREEN: the file exists in dist/.well-known, live_binding=VERIFIED, and its head_sha equals git rev-parse HEAD. A stub that serves an older provenance gives FAILED_HEALTH exit 4. A docker project prints the refusal reason and records live_binding=unsupported, never VERIFIED. The dirty-tree gate still refuses a dirty tree before the file is written. MUTATION: compare against a constant instead of the anchor and the stale-serve case goes red. Gate: bash -n autonomy/loki && shellcheck -S warning autonomy/loki && bash tests/test-deploy-receipt-gate.sh && (cd loki-ts && bun test tests/engine10/verify_cmd.test.ts) Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
-| TEN-DEPLOY-04 | Verified deploy badge from loki status --badge | loki-ts/src/commands/status.ts (renderLastDeploy plus --badge flag parse only), loki-ts/tests/commands/status.test.ts, CHANGELOG.md | MEDIUM | see Wall in note | building@2026-10-17T04:38Z | wave 4; depends: TEN-DEPLOY-01 (deployed_url field); live_binding from TEN-DEPLOY-03 is read if present, and its absence omits the badge. Goal: `loki status --badge` reads the newest loki.deploy/1 record (renderLastDeploy already loads it) and verifies it through the existing verify path. It prints a markdown shields badge linking to <deployed_url>/.well-known/loki-provenance.json. The message is 'deployed: verified' (brightgreen) ONLY when the record verifies and live_binding=VERIFIED. 'deployed: unverified' (red) is printed for TAMPERED or a failed health check. In all other cases the badge is omitted with a one-line reason. It never prints green from an unchecked field. The color mapping matches the share badge (autonomy/loki:38291), and no new vocabulary is added. Wall: RED: status.test.ts fixture with a signed healthy record, live_binding=VERIFIED and deployed_url. On main, --badge is unknown and no badge line is printed. GREEN: the badge line contains 'brightgreen' and deployed_url. A record with health FAILED_HEALTH gives a red badge. An unsigned record or a missing live_binding omits the badge and prints the reason. A record with no deployed_url omits the badge. MUTATION: drop the verify call and the unsigned case goes green, so the test goes red. Gate: cd loki-ts && bun test tests/commands/status.test.ts && bunx tsc --noEmit && bash tests/test-status-surface-agrees.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
+| TEN-DEPLOY-04 | Verified deploy badge from loki status --badge | loki-ts/src/commands/status.ts (renderLastDeploy plus --badge flag parse only), loki-ts/tests/commands/status.test.ts, CHANGELOG.md | MEDIUM | see Wall in note | released@2026-10-17T05:06Z | wave 4; depends: TEN-DEPLOY-01 (deployed_url field); live_binding from TEN-DEPLOY-03 is read if present, and its absence omits the badge. Goal: `loki status --badge` reads the newest loki.deploy/1 record (renderLastDeploy already loads it) and verifies it through the existing verify path. It prints a markdown shields badge linking to <deployed_url>/.well-known/loki-provenance.json. The message is 'deployed: verified' (brightgreen) ONLY when the record verifies and live_binding=VERIFIED. 'deployed: unverified' (red) is printed for TAMPERED or a failed health check. In all other cases the badge is omitted with a one-line reason. It never prints green from an unchecked field. The color mapping matches the share badge (autonomy/loki:38291), and no new vocabulary is added. Wall: RED: status.test.ts fixture with a signed healthy record, live_binding=VERIFIED and deployed_url. On main, --badge is unknown and no badge line is printed. GREEN: the badge line contains 'brightgreen' and deployed_url. A record with health FAILED_HEALTH gives a red badge. An unsigned record or a missing live_binding omits the badge and prints the reason. A record with no deployed_url omits the badge. MUTATION: drop the verify call and the unsigned case goes green, so the test goes red. Gate: cd loki-ts && bun test tests/commands/status.test.ts && bunx tsc --noEmit && bash tests/test-status-surface-agrees.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
 | TEN-DEPLOY-05 | loki deploy --env-file: push env to the provider with names-only records | autonomy/loki (cmd_deploy arg parse for --env-file, _deploy_try_execute env step, _deploy_record env_keys field only), tests/test-deploy-receipt-gate.sh (new section), autonomy/completions (loki deploy flag list only), CHANGELOG.md | HIGH | see Wall in note | ready@2026-10-17T01:40Z | SPLIT per CTO critic into (a) env-file parser, .env.example check, masking, env_keys record, (b) four provider verbs; build as two commits or two agents. wave 4; depends: TEN-DEPLOY-03 (same function, serialized to avoid conflicts). Goal: `--env-file FILE` (with --execute only) parses KEY=VALUE with no shell eval. It refuses when a key in .env.example is missing from FILE, naming the keys. Env is applied through documented verbs only: Vercel `vercel --prod -e K=V` per key (args built as an array, never through the shell); Fly `fly secrets set --stage K=V ...` before `fly deploy`; Netlify `netlify env:import FILE`; Cloudflare `wrangler secret bulk FILE`. An unsupported provider refuses with nothing run. The record stores env_keys (names, sorted) and env_source; it NEVER stores values. Values never appear in stdout, the record or the printed 'Running:' line, where they are masked as K=***. Wall: RED: a recording vercel stub logs argv. On main, --env-file is ignored and no -e args appear. GREEN: argv has `-e API_URL=x -e TOKEN=s3cr3t`. Grepping stdout, stderr and the record for s3cr3t finds nothing; env_keys=[API_URL,TOKEN]. When .env.example lists DB_URL and the env file lacks it, the command refuses with rc 1, no stub calls and DB_URL named. A value with $(touch pwned) leaves no file named pwned. MUTATION: write values into the record and the secret-grep goes red. Gate: bash -n autonomy/loki && shellcheck -S warning autonomy/loki && bash tests/test-deploy-receipt-gate.sh && bash tests/test-completion-drift.sh (or whichever completion drift test the CHANGELOG cites) Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
 | TEN-DEPLOY-06 | loki deploy --domain: attach a custom domain and prove TLS | autonomy/loki (cmd_deploy --domain parse and a post-health domain block in _deploy_try_execute, _deploy_record domain/tls fields only), tests/test-deploy-receipt-gate.sh (new section), CHANGELOG.md | MEDIUM | see Wall in note | ready@2026-10-17T01:40Z | wave 5; depends: TEN-DEPLOY-05 (same function, serialized). Goal: `--domain example.com` (with --execute) runs documented verbs after a healthy deploy: Vercel `vercel alias set <deployed_url> <domain>`; Fly `fly certs add <domain>`. Netlify and Cloudflare print the manual dashboard step and set domain_status=manual. Then a TLS proof runs: `openssl s_client -servername <domain> -connect <domain>:443` plus `openssl x509 -noout -enddate -checkend 604800`. It records domain, tls_status (valid/expiring/invalid/unchecked) and tls_not_after, and re-probes https://<domain>/.well-known/loki-provenance.json for the same head_sha. DNS not yet pointed gives tls_status=invalid and exit 6, with the DNS record the provider needs printed. It never claims valid without the openssl check. Wall: RED: vercel, openssl and curl are stubbed. On main, --domain is ignored. GREEN: the alias set argv is recorded, tls_status=valid and tls_not_after is set. An openssl stub that fails -checkend gives expiring. An openssl handshake failure gives invalid and exit 6. A netlify project gives domain_status=manual, no alias call, and tls still checked. No openssl on PATH gives unchecked, never valid. MUTATION: default tls_status to valid and the missing-openssl case goes red. Gate: bash -n autonomy/loki && shellcheck -S warning autonomy/loki && bash tests/test-deploy-receipt-gate.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
 | TEN-DEPLOY-07 | loki github publish: receipt-stamped GitHub export from the CLI | autonomy/loki (cmd_github publish arm and its help line only), tests/test-github-publish.sh (new: no existing test owns cmd_github repo creation; test-proven-pr-check.sh covers PR checks only) plus its run-all-tests.sh registration and shard row, CHANGELOG.md | MEDIUM | see Wall in note | released@2026-10-17T03:50Z | merged efa201ffd (TL APPROVE 81346df2a) Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
@@ -1033,12 +1033,12 @@ Source: ~/git/autonomi-dev/research/2026-09-30-adoption/SWARM-PROMPT-ADOPTION.md
 | TEN-QUALITY-02 | Pure static-diagnostic baseline attribution (new vs pre-existing lint) | loki-ts/src/runner/repo_profile.ts, loki-ts/tests/runner/harness_intelligence.test.ts (extends its existing repo_profile describe blocks) | HIGH | see Wall in note | released@2026-10-17T03:50Z | merged 43deeafe9 (HIGH r2 APPROVE 05cafda44) Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
 | TEN-QUALITY-03 | Wire static attribution into verify so pre-existing lint never drives fix rounds | loki-ts/src/engine10/stages/verify.ts (runLintChecks only; at most 4 core lines, helper calls live in repo_profile.ts), loki-ts/tests/engine10/verify_lint.test.ts | HIGH | see Wall in note | released@2026-10-17T04:08Z | v11.17.17; TL APPROVE batch J workflow w9sw9xytw |
 | TEN-QUALITY-04 | Repo map indexes methods and whole large files; cache key versioned | loki-ts/src/engine10/repomap.ts, loki-ts/src/engine10/cache.ts (one-token key rename; net core growth at most 5 lines), loki-ts/tests/engine10/repomap.test.ts, loki-ts/tests/engine10/cache.test.ts | MEDIUM | see Wall in note | released@2026-10-17T03:50Z | TL APPROVE cc1c1b67d. wave 1; depends: none. Goal: repomap.ts records indented Python def and async def under the most recent top-level class as `Class.method`. It raises the symbol-scan cap from 20 KB to 256 KB per file and caps symbols at 300 per file. cache.ts renames the cache file to repomap2-${tree}.json, so a map cached before methods existed is never read. The RepoMap shape is unchanged (symbols are still strings), so isRepoMap and every caller keep working. Wall: Red first: repomap.test.ts writes a 60 KB Python file with `class QuerySet:` and `def bulk_create(self, objs):` past byte 20,000, and asserts the map has `QuerySet.bulk_create`. A file with 1000 defs yields at most 300 symbols. cache.test.ts: a stale repomap-<tree>.json written in the old format is ignored, so a fresh build happens. Mutations: restore the 20 KB cap and the test goes red; restore the old cache filename and the stale test goes red. Gate: cd /Users/lokesh/git/lokimode-anthropic/loki-ts && bun test tests/engine10/repomap.test.ts tests/engine10/cache.test.ts tests/engine10/intake.test.ts tests/engine10/sizing.test.ts && bun test && npx tsc --noEmit && bun test tests/engine10/budget.test.ts; then bash scripts/local-ci.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| TEN-QUALITY-05 | Identifier-aware relevance ranking (traceback paths, exact identifier tokens, stopwords) | loki-ts/src/engine10/relevant_files.ts, loki-ts/src/util/relevance.ts (new; justified above), loki-ts/tests/engine10/plan.test.ts | MEDIUM | see Wall in note | building@2026-10-17T04:38Z | wave 2; depends: none (gains compound with TEN-QUALITY-04 Class.method symbols). Goal: selectRelevantFiles and selectRelevantFilesWithReason keep their signatures, but rank by these rules: (a) A repo path named in the task or in a traceback frame ranks first. This covers `File "a/b.py", line N`, `a/b.ts:12:3` and dotted modules `pkg.mod.Name` resolved to a mapped path. (b) Exact token matches only. Tokens come from splitting camelCase, snake_case, dots and slashes; substring matches no longer count. (c) Weights: basename stem 3, symbol 2, path segment 1. (d) A fixed stopword list. (e) Ties keep repo-map order. Reasons still name the matched tokens. New file util/relevance.ts: relevant_files.ts sits in engine10 core at 4964 of 5000 lines, so the scoring moves out and relevant_files.ts becomes a thin delegate with net negative core lines. Wall: Red first, in plan.test.ts: - The task 'add a retry flag' must not select address.py. - A task containing a pytest traceback `File "src/pkg/query.py", line 88` ranks src/pkg/query.py first, ahead of 7 keyword-noise files. - `bulk_create` selects the file whose symbol is QuerySet.bulk_create. - `parseConfig` matches the symbol parse_config. Existing callers stay green: decompose.test.ts, warm.test.ts, already_done_cleanup.test.ts and the e10ext brief tests. Mutation: restore `hay.includes(w)` and the address case goes red; drop the traceback rule and the traceback case goes red. Gate: cd /Users/lokesh/git/lokimode-anthropic/loki-ts && bun test tests/engine10/plan.test.ts tests/engine10/decompose.test.ts tests/features/warm.test.ts && bun test && npx tsc --noEmit && bun test tests/engine10/budget.test.ts; then bash scripts/local-ci.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
+| TEN-QUALITY-05 | Identifier-aware relevance ranking (traceback paths, exact identifier tokens, stopwords) | loki-ts/src/engine10/relevant_files.ts, loki-ts/src/util/relevance.ts (new; justified above), loki-ts/tests/engine10/plan.test.ts | MEDIUM | see Wall in note | released@2026-10-17T05:06Z | wave 2; depends: none (gains compound with TEN-QUALITY-04 Class.method symbols). Goal: selectRelevantFiles and selectRelevantFilesWithReason keep their signatures, but rank by these rules: (a) A repo path named in the task or in a traceback frame ranks first. This covers `File "a/b.py", line N`, `a/b.ts:12:3` and dotted modules `pkg.mod.Name` resolved to a mapped path. (b) Exact token matches only. Tokens come from splitting camelCase, snake_case, dots and slashes; substring matches no longer count. (c) Weights: basename stem 3, symbol 2, path segment 1. (d) A fixed stopword list. (e) Ties keep repo-map order. Reasons still name the matched tokens. New file util/relevance.ts: relevant_files.ts sits in engine10 core at 4964 of 5000 lines, so the scoring moves out and relevant_files.ts becomes a thin delegate with net negative core lines. Wall: Red first, in plan.test.ts: - The task 'add a retry flag' must not select address.py. - A task containing a pytest traceback `File "src/pkg/query.py", line 88` ranks src/pkg/query.py first, ahead of 7 keyword-noise files. - `bulk_create` selects the file whose symbol is QuerySet.bulk_create. - `parseConfig` matches the symbol parse_config. Existing callers stay green: decompose.test.ts, warm.test.ts, already_done_cleanup.test.ts and the e10ext brief tests. Mutation: restore `hay.includes(w)` and the address case goes red; drop the traceback rule and the traceback case goes red. Gate: cd /Users/lokesh/git/lokimode-anthropic/loki-ts && bun test tests/engine10/plan.test.ts tests/engine10/decompose.test.ts tests/features/warm.test.ts && bun test && npx tsc --noEmit && bun test tests/engine10/budget.test.ts; then bash scripts/local-ci.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
 | TEN-QUALITY-06 | Signature digest of top relevant files in the implement/fix brief | loki-ts/src/util/ts_signatures.ts, loki-ts/src/e10ext/context.ts (at most 5 lines, e10ext stays under 1500), loki-ts/tests/e10ext/full_job_brief.test.ts | MEDIUM | see Wall in note | released@2026-10-17T03:50Z | TL APPROVE d7a7eecb9. wave 1; depends: none. Goal: util/ts_signatures.ts gains signatureDigest(repoDir, files, maxBytes=4000): - TS/JS through the existing lexer. - Python def and class headers up to the colon, with methods indented under their class. - Deterministic order: the order of the files argument. - Unreadable files are skipped. briefContext (e10ext/context.ts) appends a 'Key signatures (read the files for bodies):' block for the first 5 relevant files after the Relevant files block. The block is off with LOKI_E10_SIGS=0. The unit-brief path (unitBrief) is unchanged. Placement is after FIXED_RULES and the task, so the cache-stable prefix keeps its bytes. Wall: Red first: the brief for a fixture repo with models.py `def bulk_create(self, objs, batch_size=None):` under class QuerySet contains that header under `class QuerySet`. A TS fixture shows `export function add(a: number, b: number): number`. Two calls give byte-identical output, and the 4000-byte cap holds with 40 large files. LOKI_E10_SIGS=0 gives a brief byte-identical to today's golden. The FIXED_RULES prefix is unchanged. Mutation: drop the cap and the cap test goes red; reverse the file order and the stability/order test goes red. Gate: cd /Users/lokesh/git/lokimode-anthropic/loki-ts && bun test tests/e10ext/full_job_brief.test.ts tests/e10ext/unit_mode.test.ts tests/features/wall_manifest*.test.ts && bun test && npx tsc --noEmit && bun test tests/engine10/budget.test.ts; then bash scripts/local-ci.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
 | TEN-QUALITY-07 | Fix rounds see the current diff (fix the dead diff_stat reader) | loki-ts/src/runner/session_resume.ts, loki-ts/src/engine10/stages/fix.ts (replace the dead read; at most 2 core lines), loki-ts/tests/engine10/fix.test.ts, loki-ts/tests/engine10/fix_resume.test.ts | MEDIUM | see Wall in note | released@2026-10-17T03:50Z | TL APPROVE 8f6092d77, merged for v11.17.14 Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
 | TEN-QUALITY-08 | Lean-path reproduce-first instruction (flagged until measured) | loki-ts/src/engine10/stages/implement.ts (one line), loki-ts/tests/engine10/implement.test.ts | MEDIUM | see Wall in note | ready@2026-10-17T01:40Z | wave 3; depends: none (flag flip gated on TEN-QUALITY-09 results). Goal: Only when LOKI_E10_REPRO=1 is set, buildImplementBrief's no-plan line (implement.ts:39, the lean path with no Wall) adds a fixed, task-independent sentence: 'If the task reports a bug, first add a new test function that reproduces it, run it and see it fail, then fix the code and run that test again.' This matches how Claude Code works on SWE-bench-style issues. It stays default-off: the prompt-ablation program showed that added prompt text can hurt. TEN-QUALITY-09's A/B decides the flip. If it is flipped on, the sentence moves into FIXED_RULES (the cache-stable prefix) under the harness invariant. Wall: Red first: with LOKI_E10_REPRO=1 the lean brief contains the sentence. With the flag unset, the brief is byte-identical to a golden captured before the change. A plan-present brief never contains it. Mutation: an inverted flag check turns both cases red. Gate: cd /Users/lokesh/git/lokimode-anthropic/loki-ts && bun test tests/engine10/implement.test.ts tests/engine10/lean_session.test.ts && bun test && npx tsc --noEmit && bun test tests/engine10/budget.test.ts; then bash scripts/local-ci.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
 | TEN-QUALITY-09 | Offline localization-recall eval on the pinned SWE-bench subset | benchmarks/swebench/loader.py, benchmarks/bench/tests/ (extend the existing loader test file there; grep for its current name before adding) | LOW | see Wall in note | released@2026-10-17T03:50Z | TL APPROVE db3196348. wave 1; depends: none. Goal: benchmarks/swebench/loader.py gains gold_files(patch), which parses the paths in the gold patch's diff headers, and a `localization` subcommand. For each pinned instance with a checkout at $LOKI_SWEBENCH_REPOS/<repo>@<base_commit>, it runs `bun -e` importing buildRepoMap and selectRelevantFiles from loki-ts/src. It writes recall@8 and recall@20 JSON with per-instance hits. An instance without a checkout is listed as skipped with its reason, never scored 0. Offline only, with no network. This gives TEN-QUALITY-04/05 a before/after number versus E-98d's 4/7, and gives TEN-QUALITY-08's paid A/B a pre-registered harness to run through the existing claude_code and loki adapters. Wall: Red first: gold_files on a recorded 2-file patch returns both paths and ignores /dev/null. The localization command on a temp git repo fixture plus a stub instance gives recall@8 = 1.0 when the gold file is named in the problem statement. A missing checkout appears as skipped with recall None, never 0. Mutation: count skipped as 0 and the skip test goes red. Gate: cd /Users/lokesh/git/lokimode-anthropic && python3 -I -m pytest benchmarks/bench/tests -q && bash scripts/local-ci.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| TEN-UX-01 | Empty-folder first run: loki start "<brief>" sets up a repo and checks Claude login before any spend | loki-ts/src/util/first_run_repo.ts (new; justification: no existing module owns setting up an empty folder as a repo, and core has about 36 lines left so the logic cannot live in preflight.ts); loki-ts/src/engine10/preflight.ts (call the helper and the login check, net +3 lines max); loki-ts/src/commands/doctor.ts (export claudeAuthStatusLoggedIn only, and let it take an argv/env so preflight reuses it; no second parser); loki-ts/tests/engine10/preflight.test.ts; docs/v10/FAILURE-CLASSES.md (row first) | MEDIUM | see Wall in note | building@2026-10-17T04:38Z | SPLIT per CTO critic into (a) empty folder becomes a repo, (b) Claude login check in preflight plus doctor export; build as two commits or two agents. wave 2; depends: none. Goal: In an empty folder with no git repo, `loki start "<brief>"` runs git init -q, sets the default branch to main and makes an empty initial commit, then continues. It prints one line: `initialized a new git repository in <dir> (LOKI_AUTO_GIT_INIT=0 to refuse)`. A folder that is not empty and has no repo is never initialised automatically: it stays fatal, and the message gives the exact commands (git init && git add . && git commit -m init). A missing git identity stays fatal with the exact git config command; the identity is never set automatically. When the provider is claude and no ANTHROPIC_API_KEY or CLAUDE_CODE_OAUTH_TOKEN is set, preflight runs `claude auth status` (5s timeout, using the run env's PATH and LOKI_CLAUDE_CLI). A clear loggedIn:false is fatal and names the fix `claude login (or set ANTHROPIC_API_KEY)`. An unknown or empty answer is a warning only, never fatal, so a stub CLI still works. Wall: Red first: preflight.test.ts gains cases that fail on main today: (a) empty temp folder, no repo: checkPreflight returns fatal null, the folder now has .git and HEAD resolves; (b) folder holding one file, no repo: fatal contains `git init && git add . && git commit -m init`, and no .git is created; (c) LOKI_AUTO_GIT_INIT=0 on an empty folder: still fatal, no .git; (d) a fake claude on PATH printing {"loggedIn":false} gives a fatal containing `claude login`; (e) fake printing {} or exiting 1 gives fatal null plus one warning; (f) ANTHROPIC_API_KEY set: the fake claude is never called (it writes a marker file; assert the file is absent). Mutations: (1) drop the emptiness check, so case (b) must go red; (2) treat the unknown login answer as fatal, so case (e) must go red; (3) delete the export in doctor.ts, so the build/typecheck must go red. Gate: cd loki-ts && bun test tests/engine10/preflight.test.ts tests/engine10/budget.test.ts tests/commands/doctor.test.ts && bun test && bunx tsc --noEmit; then bash scripts/local-ci.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
+| TEN-UX-01 | Empty-folder first run: loki start "<brief>" sets up a repo and checks Claude login before any spend | loki-ts/src/util/first_run_repo.ts (new; justification: no existing module owns setting up an empty folder as a repo, and core has about 36 lines left so the logic cannot live in preflight.ts); loki-ts/src/engine10/preflight.ts (call the helper and the login check, net +3 lines max); loki-ts/src/commands/doctor.ts (export claudeAuthStatusLoggedIn only, and let it take an argv/env so preflight reuses it; no second parser); loki-ts/tests/engine10/preflight.test.ts; docs/v10/FAILURE-CLASSES.md (row first) | MEDIUM | see Wall in note | released@2026-10-17T05:06Z | SPLIT per CTO critic into (a) empty folder becomes a repo, (b) Claude login check in preflight plus doctor export; build as two commits or two agents. wave 2; depends: none. Goal: In an empty folder with no git repo, `loki start "<brief>"` runs git init -q, sets the default branch to main and makes an empty initial commit, then continues. It prints one line: `initialized a new git repository in <dir> (LOKI_AUTO_GIT_INIT=0 to refuse)`. A folder that is not empty and has no repo is never initialised automatically: it stays fatal, and the message gives the exact commands (git init && git add . && git commit -m init). A missing git identity stays fatal with the exact git config command; the identity is never set automatically. When the provider is claude and no ANTHROPIC_API_KEY or CLAUDE_CODE_OAUTH_TOKEN is set, preflight runs `claude auth status` (5s timeout, using the run env's PATH and LOKI_CLAUDE_CLI). A clear loggedIn:false is fatal and names the fix `claude login (or set ANTHROPIC_API_KEY)`. An unknown or empty answer is a warning only, never fatal, so a stub CLI still works. Wall: Red first: preflight.test.ts gains cases that fail on main today: (a) empty temp folder, no repo: checkPreflight returns fatal null, the folder now has .git and HEAD resolves; (b) folder holding one file, no repo: fatal contains `git init && git add . && git commit -m init`, and no .git is created; (c) LOKI_AUTO_GIT_INIT=0 on an empty folder: still fatal, no .git; (d) a fake claude on PATH printing {"loggedIn":false} gives a fatal containing `claude login`; (e) fake printing {} or exiting 1 gives fatal null plus one warning; (f) ANTHROPIC_API_KEY set: the fake claude is never called (it writes a marker file; assert the file is absent). Mutations: (1) drop the emptiness check, so case (b) must go red; (2) treat the unknown login answer as fatal, so case (e) must go red; (3) delete the export in doctor.ts, so the build/typecheck must go red. Gate: cd loki-ts && bun test tests/engine10/preflight.test.ts tests/engine10/budget.test.ts tests/commands/doctor.test.ts && bun test && bunx tsc --noEmit; then bash scripts/local-ci.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
 | TEN-UX-02 | Failure-specific Next line: every failed start names the exact fix | loki-ts/src/util/run_summary.ts (nextOf only); loki-ts/src/engine10/supervisor.ts (line 393 argument only; rebase after Q18-07 if it lands first); loki-ts/tests/util/run_summary.test.ts | LOW | see Wall in note | released@2026-10-17T02:57Z | merge 63cdd70ec, dist bd6348d77; TL APPROVE f450cf65f (94 pass, 2 mutations red); post-merge tsc 0 errors, 130 pass. wave 1; depends: none (rebase onto Q18-07 if supervisor.ts:313 moved). Goal: nextOf takes the run's reason and outcome and returns one concrete command per failure class: provider authentication failed -> `claude login` (or that provider's fix line from setup-requirements.json via requirementFix); provider credit exhausted -> `loki start ... --provider <other>` or check billing; '<check> failed: ...' -> `loki chat --attach` (ask why) plus `loki undo` when files changed; spec conflict (BLOCKED) -> `loki answer --text "..."`; STALLED -> `loki chat --attach`; engine ended before sealing a receipt -> `loki doctor`. The existing verified, done-unverified and budget branches stay byte-identical. The supervisor call site passes res.reason on the same line, with zero net core lines. Wall: Red first: run_summary.test.ts adds one table row per reason string that output.ts:74 reasonOf really produces (copy the literals, do not paraphrase), each asserting the exact Next command. These fail today because nextOf returns loki doctor/loki undo. A pin asserts the old outputs for verified, done-unverified, stopped and failed-without-reason, so default output does not drift. A source-scan test asserts every literal reason produced at output.ts:74 has a nextOf mapping (catches new reasons with no mapping). Mutation: make nextOf ignore the reason argument, so every new row must go red; remove the supervisor argument, so a contract test in tests/features/contract.test.ts that runs the summary with fatal:auth must go red. Gate: cd loki-ts && bun test tests/util/run_summary.test.ts tests/features/contract.test.ts tests/engine10/budget.test.ts && bun test && bunx tsc --noEmit Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. v11.17.13 npm next 11.17.13 |
 | TEN-UX-03 | Funnel on the default engine10 route: first_run_blocked at preflight and build_verified at seal | loki-ts/src/util/funnel.ts (new; justification: telemetry.sh is the owner and this file is the only TS bridge to it, replacing the private copy in doctor.ts); loki-ts/src/commands/doctor.ts (emitFirstRunBlocked becomes a call to the helper; remove the spawn code); loki-ts/src/engine10/cli.ts (one call after main, at most +2 lines); autonomy/telemetry.sh (_loki_known_blocker keys and a loki_emit_build_verified_enum function); tests/test-first-run-funnel-coverage.sh | MEDIUM | see Wall in note | ready@2026-10-17T01:40Z | wave 3; depends: TEN-UX-01 (shares doctor.ts; also needs the not_a_repo fatal text to exist). Goal: Move the detached, opt-out-respecting telemetry.sh spawn from doctor.ts:1047-1069 into one TS helper (emitFunnel(kind, key)), and delete the copy in doctor.ts in the same change. Call it from engine10/cli.ts after the supervisor returns: preflight exit 2 sends first_run_blocked with a bounded key; a VERIFIED or ALREADY_SATISFIED exit sends build_verified carrying only headline=VERIFIED and route=engine10. No other field is sent. Add keys not_a_repo and git_identity to _loki_known_blocker (telemetry.sh:204), and add an allowlisted build_verified variant that takes enum args instead of a proof.json path. All existing opt-outs still apply because everything goes through _loki_analytics_enabled. Wall: Red first: test-first-run-funnel-coverage.sh gains (a) a wiring assertion that engine10/cli.ts reaches emitFunnel on a preflight exit 2 and on a VERIFIED exit, and (b) a run with a stub telemetry.sh in a throwaway HOME, analytics forced on, with no network: loki_telemetry is replaced by a recorder function. Assert that one first_run_blocked blocker=not_a_repo line is recorded for a start in a non-empty folder with no repo, and that a second identical run records nothing (once-per-install marker). Assert DO_NOT_TRACK=1 and LOKI_TELEMETRY_DISABLED=1 each record zero lines. Assert the recorded payload contains no path, home dir or brief text (grep the recorder file for the temp folder path and the brief: must be absent). Mutations: emit a raw blocker string instead of the enum, so the no-path assertion must go red; drop the marker write, so the second-run assertion must go red; leave doctor's old spawn copy in place, so a grep guard counting `telemetry.sh` spawns in loki-ts/src (exactly 1) must go red. Gate: bash tests/test-first-run-funnel-coverage.sh && bash tests/test-first-run-blocked-signal.sh && cd loki-ts && bun test tests/engine10/budget.test.ts tests/commands/doctor.test.ts && bun test; then bash scripts/local-ci.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
 | TEN-UX-04 | loki doctor --fix: consent-gated installs and Claude login, plus its first tests | loki-ts/src/commands/doctor_fix.ts; loki-ts/src/commands/doctor.ts (pass --yes through to runDoctorFix only; rebase after TEN-UX-01/03 if they touch the same hunk); loki-ts/tests/commands/doctor.test.ts (extend; no doctor_fix test exists today) | MEDIUM | see Wall in note | ready@2026-10-17T01:40Z | wave 4; depends: TEN-UX-03 (doctor.ts edit order only). Goal: On a TTY, `loki doctor --fix` offers each missing default-provider install as a y/N question before running it: `npm install -g @anthropic-ai/claude-code`, then `claude login` when evaluateClaudeLogin returns fail. `--fix --yes` runs the same steps without asking, for scripted onboarding. Without a TTY and without --yes, it prints the commands only, exactly as today. System package managers and sudo are never run. Every step that runs reports `fixed:` or `failed: <first stderr line>`, and the command exits non-zero when a required step still fails. Command execution is behind an injectable runner, so tests never install anything. Wall: Red first: doctor.test.ts gains applyDoctorFixes/runDoctorFix cases with an injected has() and runner: (a) claude missing, tty=false, no --yes: the runner is never called and the npm command is printed; (b) claude missing, --yes: the runner gets exactly [npm, install, -g, @anthropic-ai/claude-code]; (c) runner fails: output has `failed:` and the exit code is non-zero; (d) jq missing with --yes: the runner is never called for jq (system package, print only); (e) claude present and logged out with --yes: the runner gets [claude, login]. These fail today because doctor_fix has no runner, no --yes and no exit code. Mutations: drop the tty/--yes gate, so (a) must go red; let system packages through the runner, so (d) must go red. Gate: cd loki-ts && bun test tests/commands/doctor.test.ts tests/commands/doctor_router.test.ts && bun test && bunx tsc --noEmit; bash tests/test-doctor-ux.sh; bash tests/test-doctor-single-impl.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
@@ -1062,7 +1062,7 @@ Source: ~/git/autonomi-dev/research/2026-09-30-adoption/SWARM-PROMPT-ADOPTION.md
 | TEN-STABILITY-04 | global-guards.tsv covers every repo-wide guard that reached main red | scripts/global-guards.tsv; tests/test-select-tests.sh | LOW | see Wall in note | released@2026-10-17T02:57Z | merge 3e542a7fc; TL APPROVE 07aa41ad1 (select-tests 117/0, fast-gate 25/0, shard-coverage 19/0). wave 1; depends: none. Goal: Add as R8 rows the repo-wide guards that turned main red on 2026-10-16 even though no slice diff selected them: - tests/cli/test-completions-coverage.sh - loki-ts/tests/engine10/budget.test.ts - loki-ts/tests/engine10/l2_destructive_registry.test.ts - loki-ts/tests/engine10/pr_body_golden.test.ts - loki-ts/tests/commands/cli_help_routes.test.ts - tests/test-select-tests.sh (FC-89 walker markers) Also add a meta-assertion to test-select-tests.sh: every loki-ts test file that carries '// select: walk-all-src' is either an R8 row or selected by R-rules for any loki-ts/src diff. A new repo-wide guard then cannot silently stay out of R8. Wall: RED: a new test-select-tests.sh case asserts that --guards-only lists each of the 6 targets. It fails today because they are absent from the 17 rows. GREEN after adding the rows. MUTATION: delete one row and its case goes red. Add a fixture walker test without an R8 row and the meta-assertion goes red. GATE: bash tests/test-select-tests.sh && bash tests/test-fast-gate.sh && bash tests/test-shard-coverage.sh. Then time bash scripts/impacted-gate.sh --guards-only and record the added seconds in tests/shard-durations.tsv only if a row is new there. The fast-gate plan for a docs-only diff must stay under 60s per shard. Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. v11.17.13 npm next 11.17.13 |
 | TEN-STABILITY-05 | WC-01b wall_concurrent stops racing the 5s bun timeout | loki-ts/tests/engine10/wall_concurrent.test.ts | LOW | see Wall in note | released@2026-10-17T02:57Z | merge 516e4a4f1; TL APPROVE 5fa97f2d5 (13/0 x3, 13/0 under 12x load at --timeout 1500). wave 1; depends: none. Goal: Make the WC-01b suite hermetic and fast. Build the git fixture once in beforeAll: copy a template repo per test instead of running git init, add and commit per test (wall_concurrent.test.ts:15-20). Give the concurrency case an explicit timeout sized from measured CI duration, and keep every assertion unchanged. Cause measured in nightly 38938949858: 5004.82ms against the 5000ms default. Wall: RED: cd loki-ts && bun test --timeout 1500 tests/engine10/wall_concurrent.test.ts fails today on this machine under 'yes > /dev/null' x4 CPU load (record the measured ms). GREEN: the same command passes after the fixture change, and plain bun test passes 20/20 in a loop: for i in $(seq 20); do bun test tests/engine10/wall_concurrent.test.ts // break; done. MUTATION: swap the expected order of implement:start and author:end and the test still fails, so the assertion is intact. GATE: cd loki-ts && bun run typecheck && bun test (full). Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. v11.17.13 npm next 11.17.13 |
 | TEN-STABILITY-06 | pulse PROMOTION_LAG violation with the blocking reason | scripts/v10-pulse.sh; tests/test-v10-pulse.sh | MEDIUM | see Wall in note | released@2026-10-17T03:50Z | TL APPROVE ce461a4d1. wave 1; depends: none. Goal: In the npm section of v10-pulse.sh (near :830-863), emit 'VIOLATION PROMOTION_LAG' when next != latest and latest's publish time is more than 6h older than next's (threshold set by LOKI_PULSE_PROMOTION_LAG_H). Include the first PROMOTE-BLOCK or FATAL line from the newest non-skipped Promote run (gh run list -w Promote, then gh run view --log-failed). Also include the failing step names of the newest measured Nightly. The CoS acts on the top violation each turn, so a red bench is triaged within one turn instead of 13h. Fail soft: an API error prints UNKNOWN and never crashes the pulse. Wall: RED: test-v10-pulse.sh gains a fixture with stubbed npm and gh: latest 11.10.1 published 2026-10-15T00:00Z, next 11.17.6 published 2026-10-16T23:40Z, and Promote log containing 'PROMOTE-BLOCK: the newest nightly at the promoted SHA ... is failure'. Expect a PROMOTION_LAG line carrying that reason; today none is printed. GREEN cases: next==latest gives no violation; lag under the threshold gives none; gh failure gives UNKNOWN with rc 0. MUTATION: invert the threshold comparison and both lag cases go red. GATE: bash tests/test-v10-pulse.sh && shellcheck scripts/v10-pulse.sh && bash scripts/v10-pulse.sh on the real repo prints the violation today (latest 11.10.1 vs next 11.17.6). Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| TEN-STABILITY-07 | nightly classifies flips vs stable reds across same-SHA legs | .github/workflows/nightly.yml (new flake-classify job only); scripts/nightly-flake-tracker.sh (--gh-run mode); tests/test-nightly-flake-tracker.sh | MEDIUM | see Wall in note | building@2026-10-17T04:38Z | wave 2; depends: none (TEN-STABILITY-01 only matters for a green run). Goal: Add one nightly.yml job, flake-classify (needs all test jobs, if: always(), never sets the run conclusion). It downloads the bun-test job logs of this run via gh api. The 3-4 bun legs run identical loki-ts tests at one SHA. It feeds the logs to scripts/nightly-flake-tracker.sh and writes FLIP and STABLE-FAIL lines plus the BOARD: slice lines to the step summary. Extend the tracker with a '--gh-run RUN_ID' fetch mode so the workflow holds no parsing logic. Experimental bun=latest legs are labelled so a flip there is reported as drift. Wall: RED: test-nightly-flake-tracker.sh gains a --gh-run case with a stub gh serving two job logs at one SHA. In one log WC-01b is (pass), in the other it is (fail) [5004.82ms]. Expect 'FLIP <sha7> WC-01b'. Today --gh-run is a usage error (exit 2). GREEN: FLIP printed, exit 1; with both logs failing, STABLE-FAIL is printed. MUTATION: make the tracker ignore the [ms] suffix strip, and the FLIP case goes red. GATE: bash tests/test-nightly-flake-tracker.sh && bash tests/test-workflow-no-masked-failures.sh && python3 -m pytest -q tests/test_release_next_tag.py (nightly structure cases) && actionlint .github/workflows/nightly.yml if installed. The new job name must not start with 'Full suite (backstop)' (promote.yml:185 counts that prefix). Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
+| TEN-STABILITY-07 | nightly classifies flips vs stable reds across same-SHA legs | .github/workflows/nightly.yml (new flake-classify job only); scripts/nightly-flake-tracker.sh (--gh-run mode); tests/test-nightly-flake-tracker.sh | MEDIUM | see Wall in note | released@2026-10-17T05:06Z | wave 2; depends: none (TEN-STABILITY-01 only matters for a green run). Goal: Add one nightly.yml job, flake-classify (needs all test jobs, if: always(), never sets the run conclusion). It downloads the bun-test job logs of this run via gh api. The 3-4 bun legs run identical loki-ts tests at one SHA. It feeds the logs to scripts/nightly-flake-tracker.sh and writes FLIP and STABLE-FAIL lines plus the BOARD: slice lines to the step summary. Extend the tracker with a '--gh-run RUN_ID' fetch mode so the workflow holds no parsing logic. Experimental bun=latest legs are labelled so a flip there is reported as drift. Wall: RED: test-nightly-flake-tracker.sh gains a --gh-run case with a stub gh serving two job logs at one SHA. In one log WC-01b is (pass), in the other it is (fail) [5004.82ms]. Expect 'FLIP <sha7> WC-01b'. Today --gh-run is a usage error (exit 2). GREEN: FLIP printed, exit 1; with both logs failing, STABLE-FAIL is printed. MUTATION: make the tracker ignore the [ms] suffix strip, and the FLIP case goes red. GATE: bash tests/test-nightly-flake-tracker.sh && bash tests/test-workflow-no-masked-failures.sh && python3 -m pytest -q tests/test_release_next_tag.py (nightly structure cases) && actionlint .github/workflows/nightly.yml if installed. The new job name must not start with 'Full suite (backstop)' (promote.yml:185 counts that prefix). Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
 | TEN-FC-ROWS | FAILURE-CLASSES rows for every TEN bug-fix slice lacking one (QUALITY-01/02/03/07, COST-06, DEPLOY-08, STABILITY-01/05, UX-02) | docs/v10/FAILURE-CLASSES.md | LOW | bash tests/test-structural-checks.sh | released@2026-10-17T02:57Z | merge 8cdb33633, dist bd6348d77; TL APPROVE 7e6f47482 (structural 25/0); post-merge tsc 0 errors, 130 pass. wave 1; CTO critic MISSING item. One row per class with user-visible vs raw, law broken, siblings, mechanism, fixture. Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. v11.17.13 npm next 11.17.13 |
 | TEN-CORE-TRIM | Free engine10 core headroom (4964 of 5000) by moving pure helpers out of engine10 into src/util with no behavior change | loki-ts/src/engine10/*, loki-ts/src/util/* | MEDIUM | cd loki-ts && bun test tests/engine10/ tests/runner/spawn_env_guard.test.ts && bunx tsc --noEmit | released@2026-10-17T02:57Z | merge 096174f2a, dist bd6348d77; TL APPROVE f0f82a4e8 (core 4931/5000, 143 pass); post-merge tsc 0 errors, 130 pass. wave 1; CTO critic MISSING item. Target at least 60 lines freed; budget guard must stay green; no logic change. Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. v11.17.13 npm next 11.17.13 |
 | TEN-SECURE-SCAN-UTIL | One util/secure_scan.ts wrapper over secure-scan.py shared by TEN-GATES-06 and TEN-GATES-08 | loki-ts/src/util/secure_scan.ts (new: no TS owner of secure-scan.py exists), loki-ts/tests/util/secure_scan.test.ts | MEDIUM | cd loki-ts && bun test tests/util/secure_scan.test.ts && bunx tsc --noEmit | released@2026-10-17T02:57Z | merge 47a9e4aae, dist none; TL APPROVE 3c1ce036d (9 pass, tsc rc=0). wave 1; CTO critic MISSING item. Removes the duplicate wrappers the CTO critic found. Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. v11.17.13 npm next 11.17.13 |

package/docs/v10/FAILURE-CLASSES.md

@@ -1004,3 +1004,10 @@ L0 review rule (ENGINE-LAWS.md L0): a fix that adds an `if` or a regex about the
 - Siblings: decompose.ts items with no matching file (also shared-file-only items); fix_units.ts units (always carry a write set); the u1 PARTIAL exit 1 in the same evidence is the separate no-test-runner seed cause (TEN-COST-20, TEN-COST-21), not this class.
 - Mechanism: decompose() folds every item that names no write-set file into the first unit that owns files; if no item names a file all items form one unit and route.ts falls back to the sequential run (fewer than 2 units).
 - Fixture: tests/engine10/decompose.test.ts "no unit has an empty write set" and "a spec where no item names a file collapses to one unit"; repro: LOKI_UNIT_SPEC with writeSet [] and bin/loki start gives rc=2 "spec file is invalid".
+
+## FC-TEN-UX-01 First run in an empty folder dies on "not a git repository", and a logged-out Claude CLI fails only after spend starts (FIRST-RUN-DEAD-END)
+- User-visible vs raw: a new user running `loki start "<brief>"` in a fresh folder got "not a git repository ... run loki from inside a git checkout" with no next step; a logged-out claude CLI surfaced later as a failed first iteration.
+- Law broken: a first run must either work or name the exact command that fixes it, before any spend.
+- Siblings: preflight.ts git identity check (stays fatal, names the git config command, never set automatically); doctor.ts login probe (same `claude auth status` parse, now shared); non-empty folder without a repo (stays fatal, now names `git init && git add . && git commit -m init`).
+- Mechanism: util/first_run_repo.ts initialises only a truly empty folder (LOKI_AUTO_GIT_INIT=0 refuses); preflight reuses doctor claudeAuthStatusLoggedIn: loggedIn false is fatal, an unknown answer is a warning only.
+- Fixture: tests/engine10/preflight.test.ts "first run (TEN-UX-01)" cases (empty folder, one-file folder, LOKI_AUTO_GIT_INIT=0, fake claude loggedIn false / unknown / API key set).

package/docs/v10/PROGRESS.md

@@ -2434,3 +2434,7 @@ The swarm is stopped: .loki/V10-STOP exists, the loop has no wake-ups, and the c
 ## 2026-10-17T04:48Z (CoS) v11.17.21
 
 v11.17.20 published (Release run success on e2b6b77d2; npm latest 11.17.20, next 11.17.20). Security Audit red on e2b6b77d2: gitleaks found 2 leaks because the merge-commit fingerprints in .gitleaksignore were mangled by the zsh :l modifier; fixed, local gitleaks over 10eb771d8..HEAD rc=0 "no leaks found". Ships TEN-COST-09 r2 (HIGH APPROVE 660256752), TEN-GATES-05b r5 (HIGH APPROVE 8dda21a8d), TEN-COST-09-F1 (TL APPROVE 5a1a3d36c). Batch O (6), batch P (DEPLOY-02, DEPLOY-04, QUALITY-05, UX-01, GATES-04, STABILITY-07) and batch Q (UX-05, COST-11) building.
+
+## 2026-10-17T05:06Z (CoS) v11.17.22
+
+v11.17.21 published (Release success on 462fbc40a; npm latest 11.17.21, next 11.17.21). Security Audit red on 462fbc40a: 4 leaks, reproduced locally only with --diff-merges=first-parent (slice-branch merges fd027051c, bc0e97c63 re-add the QUALITY-01 fixture key); fingerprints added, rescan rc=0. Pre-push scans without first-parent merge diffs, so it passed; TEN-SEC-GITLEAKS-01 (HIGH) dispatched to make the fixture key runtime-built and align pre-push with CI. Ships batch P approvals: DEPLOY-04 (TL APPROVE 4ed77ee5b), QUALITY-05 (TL APPROVE 69f284f71), UX-01 (TL APPROVE 08a8ae052), STABILITY-07 (TL APPROVE 0261d735a); tsc on merged main clean. Round 2 dispatched: DEPLOY-02 (HIGH BLOCK, --max-age ignored on --url), GATES-04 (TL BLOCK, app leak on boot timeout), UX-05 (TL BLOCK, 4 readiness lines), COST-11 (HIGH BLOCK, haiku already-satisfied false green and stage limit cuts the sonnet retry).