loki-mode 11.17.30 → 11.17.32

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: An autonomous software factory that knows what it is supposed to deliver, and proves it did. Use when the user says Loki Mode or asks to build, fix or verify software autonomously.
 ---
 
-# Loki Mode v11.17.30
+# Loki Mode v11.17.32
 
 **Current entry points (Loki 10 engine):** `loki "<task>"`, `loki owner/repo#N` and `loki quick "<task>"` run the Loki 10 engine and end with a signed receipt (`loki verify`). `loki backlog owner/repo --all` runs many issues in parallel. Guide: `docs/v10/GUIDE.md`. The skill instructions below, and `loki start`, describe the previous bash loop. PRD-file starts (`loki start ./prd.md`) and the opencode provider still run on it until FC38-SWEEP ports them; the legacy-engine command and the LOKI_ENGINE switch remain removed. Prefer `loki owner/repo#N` for issues.
 
@@ -483,4 +483,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v11.17.30 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**
+**v11.17.32 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**

package/VERSION

@@ -1 +1 @@
-11.17.30
+11.17.32

package/autonomy/loki

@@ -1895,7 +1895,7 @@ show_help_all() {
     echo "  --no-dashboard   Disable web dashboard"
     echo "  --isolation LVL  Per-run isolation dial: none (default) | worktree | docker"
     echo "  --skip-memory    Skip loading memory context at startup"
-    echo "  --cost PROFILE   Opt-in cost profile: lean sets LOKI_ROUTER=1 and LOKI_E10_TRIM=1 unless already set (also LOKI_COST_PROFILE)"
+    echo "  --cost PROFILE   Opt-in cost profile: lean sets LOKI_IMPLEMENT_HAIKU_FIRST=1, LOKI_E10_TRIM=1, LOKI_E10_SMALL_NO_RUNNER=1 and LOKI_E10_SMALL_MAX_CHARS=1200 unless already set (also LOKI_COST_PROFILE)"
     echo "  --spec FILE      Run against an edited spec (written by 'loki plan <task> --spec'; see also --spec-first)"
     echo "  --fresh-prd      Regenerate the PRD from the codebase (no-PRD runs; ignores the reusable generated PRD)"
     echo "  --compliance PRESET  Enable compliance mode (default|healthcare|fintech|government)"
@@ -2170,6 +2170,8 @@ _loki_control_ui() {
     else
         echo "$url"
     fi
+    echo "Give it work:   loki start \"<brief>\""
+    echo "Stop the UI:    loki control stop"
     return 0
 }
 
@@ -2820,7 +2822,7 @@ cmd_start() {
                 echo "                        --regenerate-prd, --regen, or LOKI_PRD_REGEN=1)"
                 echo "  --compliance PRESET   Enable compliance mode (default|healthcare|fintech|government)"
                 echo "  --budget USD          Per-run cost cap (default $(loki_budget_default_usd); auto-pause when exceeded)"
-                echo "  --cost PROFILE        Opt-in cost profile: lean (LOKI_ROUTER=1, LOKI_E10_TRIM=1 unless already set) or off"
+                echo "  --cost PROFILE        Opt-in cost profile: lean (LOKI_IMPLEMENT_HAIKU_FIRST=1, LOKI_E10_TRIM=1, LOKI_E10_SMALL_NO_RUNNER=1, LOKI_E10_SMALL_MAX_CHARS=1200 unless already set) or off"
                 echo "  --bmad-project PATH   Use BMAD Method project artifacts as input"
                 echo "  --openspec PATH       Use OpenSpec change directory as input"
                 echo "  --mirofish [URL]      Enable MiroFish market validation (default: localhost:5001)"
@@ -3288,8 +3290,9 @@ cmd_start() {
             --cost|--cost=*)
                 if [[ "$1" == --cost=* ]]; then _cost_val="${1#*=}"; _cost_n=1; else _cost_val="${2:-}"; _cost_n=2; fi
                 case "$_cost_val" in
-                    lean) : "${LOKI_ROUTER:=1}" "${LOKI_E10_TRIM:=1}"; export LOKI_ROUTER LOKI_E10_TRIM LOKI_COST_PROFILE=lean
-                          echo "cost profile lean: LOKI_ROUTER=$LOKI_ROUTER LOKI_E10_TRIM=$LOKI_E10_TRIM" ;;
+                    lean) : "${LOKI_IMPLEMENT_HAIKU_FIRST:=1}" "${LOKI_E10_TRIM:=1}" "${LOKI_E10_SMALL_NO_RUNNER:=1}" "${LOKI_E10_SMALL_MAX_CHARS:=1200}"
+                          export LOKI_IMPLEMENT_HAIKU_FIRST LOKI_E10_TRIM LOKI_E10_SMALL_NO_RUNNER LOKI_E10_SMALL_MAX_CHARS LOKI_COST_PROFILE=lean
+                          echo "cost profile lean: LOKI_IMPLEMENT_HAIKU_FIRST=$LOKI_IMPLEMENT_HAIKU_FIRST LOKI_E10_TRIM=$LOKI_E10_TRIM LOKI_E10_SMALL_NO_RUNNER=$LOKI_E10_SMALL_NO_RUNNER LOKI_E10_SMALL_MAX_CHARS=$LOKI_E10_SMALL_MAX_CHARS" ;;
                     off) ;;
                     *) echo -e "${RED}--cost must be lean or off${NC}" >&2; exit 2 ;;
                 esac

package/dashboard/__init__.py

@@ -7,6 +7,6 @@ Modules:
     control: Session control helpers (status, atomic writes, origin check)
 """
 
-__version__ = "11.17.30"
+__version__ = "11.17.32"
 
 __all__ = ["__version__"]

package/docs/CLI-REFERENCE.md

@@ -1,6 +1,6 @@
 # CLI reference
 
-Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.17.30. Do not edit by hand.
+Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.17.32. Do not edit by hand.
 Hidden and legacy-only commands are omitted; see `docs/v10/CLI-MODERN.md` for the full inventory.
 
 | Command | Description |

package/docs/EVALUATING.md

@@ -209,6 +209,8 @@ Metrics, per arm and per task class, computed by `compute_metrics`; failures, ti
 
 Not measured: human effort, recovery success, review quality. Output: `--out-dir` (default `benchmarks/attribution/results/`) receives `attribution-<UTC stamp>.json` and the matching `.md`. Publish failures, timeouts and exclusions with the report; do not drop rows. Do not claim superiority from overlapping intervals on a handful of runs; use the pilot to size a larger run with `--repeats` above 1. Tests: `python3 benchmarks/bench/tests/test_attribution.py` (no model call).
 
+Cost proof run: the exact command, the five arms (`raw-configured`, `raw-lean`, `raw-bare`, `loki`, `loki-lean`), the verdict rule, the report-against-every-floor requirement and the loki-version validity rule are in the "Cost proof (C-F1)" section of [docs/v10/METRICS.md](v10/METRICS.md).
+
 ---
 
 ## 9. Factory-vs-Loki task set (reproducible, partly unmeasured)

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 Loki Mode, by [Autonomi](https://www.autonomi.dev/), turns a spec or an issue into a verified pull request with a receipt you can check. This page covers installing it, a first run, and the options around it.
 
-**Version:** v11.17.30
+**Version:** v11.17.32
 
 **Engine note:** `loki start` is the primary command. `loki start`, `loki "<task>"`, `loki owner/repo#N` and `loki quick` all run the Loki 10 engine, whatever the flag order or input form (PRD file, issue ref, task or one-word brief). The previous loop runs only on `--engine legacy`, `LOKI_ENGINE=legacy`, or for one call when a flag Loki 10 cannot honor is present. See the [user guide](v10/GUIDE.md) and the [5-minute quickstart](QUICKSTART.md).
 

package/docs/v10/BOARD.md

@@ -1028,7 +1028,7 @@ Source: ~/git/autonomi-dev/research/2026-09-30-adoption/SWARM-PROMPT-ADOPTION.md
 | TEN-COST-05 | Per-stage cache-hit attribution in the cost breakdown | loki-ts/src/util/cost_breakdown.ts, loki-ts/tests/engine10/cost.test.ts (breakdown cases only) | MEDIUM | see Wall in note | released@2026-10-17T03:50Z | TL APPROVE 71a31207f. wave 1; depends: none. Goal: costBreakdown per_stage gains cache_read_tokens, cache_creation_tokens and cache_hit_ratio, computed as read / (read + creation), null when both are 0. This makes the cache-stable-prefix lever (CH-01/CP-01) provable per stage in every receipt and in the bench row. The usd fail-closed rules are unchanged, and the new fields are additive. Wall: Red first: - Two implement records (read 7000/creation 0 and read 0/creation 7000) give ratio 0.5. - A stage with no token keys gives null, never 0. - Existing usd and retry assertions stay green. Mutation: count cache_creation as a hit; the 0.5 case goes red. Gate: cd loki-ts && bun test tests/engine10/cost.test.ts tests/engine10/budget.test.ts && bunx tsc --noEmit Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
 | TEN-COST-06 | xreview claude judge: lean flags and child-ledger line | loki-ts/src/engine10/stages/xreview.ts, loki-ts/tests/engine10/xreview.test.ts | MEDIUM | see Wall in note | released@2026-10-17T03:50Z | TL APPROVE 2e40a4be8, merged for v11.17.14 Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
 | TEN-COST-07 | Project-model discovery on the fast tier, retry on the run model | loki-ts/src/project_model/discover.ts, loki-ts/tests/project_model/project_model.test.ts | MEDIUM | see Wall in note | released@2026-10-17T03:50Z | TL APPROVE e01e37c5e. wave 1; depends: none. Goal: Discovery attempt 1 runs on fastTierModel(env) (runner/model_downgrades.ts:8). It is sonnet unless LOKI_ALLOW_HAIKU, so it never drops below sonnet without opt-in, and it is never weaker than an explicit LOKI_MODEL_OVERRIDE. The existing validation-error retry (attempt 2) runs on the run model, so a weak answer escalates, never ships. The model used is recorded on the project_model result. The schema validation and the owner=provider fallback are unchanged. Wall: Red first, with a stub SessionRunner: - Attempt 1 opts.model equals fastTierModel. - After an invalid answer, attempt 2 opts.model is undefined (run model). - With LOKI_MODEL_OVERRIDE set, both attempts use the override. Mutation: pin attempt 2 to the fast tier; the escalation test goes red. Gate: cd loki-ts && bun test tests/project_model && bunx tsc --noEmit Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
-| TEN-COST-08 | Documented reproducible cost proof run | docs/v10/METRICS.md, docs/EVALUATING.md | LOW | see Wall in note | ready@2026-10-17T01:40Z | wave 4; depends: TEN-COST-04. Goal: docs/v10/METRICS.md gains a 'Cost proof (C-F1)' section that states: - the exact command (attribution.py --execute, arms raw-configured, raw-lean, raw-bare, loki, loki-lean, n=3, pinned model, --max-spend-usd); - the verdict rule from TEN-COST-03; - that results are reported against all three floors, never only the favorable one; - that a run is valid only when the recorded loki version equals VERSION. docs/EVALUATING.md links to it. This is an extension of existing docs, not a new doc. Wall: Red first: grep -n 'Cost proof (C-F1)' docs/v10/METRICS.md exits 1 before the edit. Green: - The documented dry-run command, copied verbatim, exits 0. - grep -n 'raw-lean' docs/EVALUATING.md prints a line. - No em or en dashes: grep -nP '[\x{2013}\x{2014}]' on both files exits 1. Gate: python3 -I benchmarks/bench/attribution.py --dry-run --arms raw-configured,raw-lean,raw-bare,loki,loki-lean && bash tests/test-help-changelog-drift.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
+| TEN-COST-08 | Documented reproducible cost proof run | docs/v10/METRICS.md, docs/EVALUATING.md | LOW | see Wall in note | released v11.17.32 | wave 4; depends: TEN-COST-04. Goal: docs/v10/METRICS.md gains a 'Cost proof (C-F1)' section that states: - the exact command (attribution.py --execute, arms raw-configured, raw-lean, raw-bare, loki, loki-lean, n=3, pinned model, --max-spend-usd); - the verdict rule from TEN-COST-03; - that results are reported against all three floors, never only the favorable one; - that a run is valid only when the recorded loki version equals VERSION. docs/EVALUATING.md links to it. This is an extension of existing docs, not a new doc. Wall: Red first: grep -n 'Cost proof (C-F1)' docs/v10/METRICS.md exits 1 before the edit. Green: - The documented dry-run command, copied verbatim, exits 0. - grep -n 'raw-lean' docs/EVALUATING.md prints a line. - No em or en dashes: grep -nP '[\x{2013}\x{2014}]' on both files exits 1. Gate: python3 -I benchmarks/bench/attribution.py --dry-run --arms raw-configured,raw-lean,raw-bare,loki,loki-lean && bash tests/test-help-changelog-drift.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
 | TEN-QUALITY-01 | Fix brief carries a bounded failure excerpt (assertion, traceback, expected/received) | loki-ts/src/util/check_result.ts (failureExcerpt), loki-ts/src/engine10/stages/verify.ts (runCheck keeps the fail output excerpt; line 315 sample; at most 3 core lines), loki-ts/tests/engine10/check_result.test.ts, loki-ts/tests/engine10/fix.test.ts, loki-ts/tests/engine10/wall_holdout.test.ts | HIGH | see Wall in note | released@2026-10-17T04:35Z | SPLIT per CTO critic into (a) pure failureExcerpt plus fixtures, (b) verify.ts wiring plus holdout test; build as two commits or two agents. wave 2; depends: none. Goal: Each failing non-holdout check's output reaches the fix session as a redacted excerpt of at most 1500 bytes, with at most 6 KB across all groups. The group format is `<rerun cmd>\n<excerpt>`. failureExcerpt() in util/check_result.ts finds the decisive block: pytest `E ` lines plus the last frame, jest/vitest Expected/Received, node AssertionError, go `--- FAIL` with the next lines, and tsc/ruff diagnostic lines. It strips ANSI, makes absolute paths repo-relative and runs util/redact.ts. The signature stays byte-identical, so stall detection at machine.ts:232 and escalation in fix.ts are unchanged. The excerpt lives in a stage-local map inside verify.ts. It is never added to VerifyCheck, never emitted in test.result, and never computed for holdout checks. Wall: Red first: fix.test.ts drives verify then fix on a fixture with a failing pytest `assert add(2,2) == 5`. Today the brief lacks `E assert 4 == 5`, so the test fails. check_result.test.ts covers one fixture each for pytest, jest, node:test, go and tsc. It also asserts the size cap and that an AKIA-style token is redacted. wall_holdout.test.ts asserts that a failing holdout's output text appears in neither failures_grouped, events.jsonl nor the fix brief. Mutations: failureExcerpt returning '' must turn fix.test red; removing the isHold filter at verify.ts:314 must turn wall_holdout red; adding the excerpt to the signature must turn the existing stall test in machine.test.ts red. Gate: cd /Users/lokesh/git/lokimode-anthropic/loki-ts && bun test tests/engine10/check_result.test.ts tests/engine10/fix.test.ts tests/engine10/wall_holdout.test.ts && bun test && npx tsc --noEmit && bun test tests/engine10/budget.test.ts; then bash scripts/local-ci.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
 | TEN-QUALITY-02 | Pure static-diagnostic baseline attribution (new vs pre-existing lint) | loki-ts/src/runner/repo_profile.ts, loki-ts/tests/runner/harness_intelligence.test.ts (extends its existing repo_profile describe blocks) | HIGH | see Wall in note | released@2026-10-17T03:50Z | merged 43deeafe9 (HIGH r2 APPROVE 05cafda44) Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
 | TEN-QUALITY-03 | Wire static attribution into verify so pre-existing lint never drives fix rounds | loki-ts/src/engine10/stages/verify.ts (runLintChecks only; at most 4 core lines, helper calls live in repo_profile.ts), loki-ts/tests/engine10/verify_lint.test.ts | HIGH | see Wall in note | released@2026-10-17T04:08Z | v11.17.17; TL APPROVE batch J workflow w9sw9xytw |
@@ -1087,7 +1087,7 @@ Source: ~/git/autonomi-dev/research/2026-09-30-adoption/SWARM-PROMPT-ADOPTION.md
 | TEN-COST-14 | Wall brief output budget | engine10 wall brief | LOW | see note | released@2026-10-17T04:24Z | architect cost plan |
 | TEN-COST-15 | Plan output trim | engine10 plan stage | LOW | see note | parked@2026-10-17T04:35Z | parked with TEN-COST-10 (rejected). architect cost plan |
 | TEN-COST-16 | Implement on haiku first (opt-in) | engine10 implement stage | HIGH | see note | released v11.17.26@2026-10-17T05:48Z | architect cost plan |
-| TEN-COST-19 | Group cost in loki rows of C-F1 | C-F1 harness | LOW | see note | ready@2026-10-17T03:30Z | after COST-04 |
+| TEN-COST-19 | Group cost in loki rows of C-F1 | C-F1 harness | LOW | see note | released v11.17.32 | after COST-04 |
 | TEN-COST-21 | C-F1 .venv and keep_evidence | C-F1 harness | LOW | see note | ready@2026-10-17T03:30Z | after COST-04 and COST-20 |
 | TEN-COST-22 | Cache read pricing correction | model-pricing.json | LOW | see note | rejected@2026-10-17T03:30Z | premise false: Sonnet 5.5 cache read is $0.10 (0.05x) already |
 | TEN-COST-23 | Investigate multi-unit launcher exit 1 | features/speed launcher | HIGH | see note | released@2026-10-17T04:35Z | architect cost plan |
@@ -1104,22 +1104,22 @@ Source: ~/git/autonomi-dev/research/2026-09-30-adoption/SWARM-PROMPT-ADOPTION.md
 | TEN-RELEASE-FAST | one-command ship: scripts/release.sh --ship --notes FILE bumps, writes the CHANGELOG section, rebuilds dist, commits, checks ancestry and gitleaks, waits for an in-flight Release run, pushes and verifies origin/main | scripts/release.sh, tests/test-release-sh.sh (extend; it owns release.sh) | HIGH | --ship on a fixture repo with a fake origin completes all phases and prints per-phase timings; a non-ancestor origin, a gitleaks hit, a forbidden staged file and a CHANGELOG c[7] mismatch each abort before push (red mutation per guard) | building@2026-10-17T05:43Z | D103; target under 90s wall for the whole ship |
 | TEN-SEC-PREPUSH-MERGE-WARN | pre-push .gitleaksignore-growth warning diffs merges against the first parent only, so a merge of an older slice no longer reports lines main already had | .githooks/pre-push (line ~621 diff-tree -m), tests/test-security-audit-config.sh or the existing pre-push test that owns this warning; docs/v10/FAILURE-CLASSES.md (row first) | LOW | pushing a merge of a branch based before an ignore line was added prints no warning; a commit that really adds an ignore line still warns (red mutation: put -m back) | released v11.17.28 | v11.17.25 push printed 5 false warnings for merges c6d3894f1..0a16434e1 while git diff 7d4d0ffb2 HEAD -- .gitleaksignore was empty |
 | TEN-COST-16-F1 | haiku-first downgrade row: router-override test, and the cascade override is reported only when cascadeDowngrade(run model) is non-null | loki-ts/src/runner/model_downgrades.ts, loki-ts/tests/engine10/session_l1_model.test.ts | LOW | router+haiku-first names the router override; cascade on a sonnet run reports the haiku-first row, matching implement.ts:106 precedence | released v11.17.29 | COST-16 r2 TL non-blocking N2, N3 |
-| TEN-COST-25 | fix: --cost lean stops forcing a plan session: drop LOKI_ROUTER from the lean profile (router makes plan.ts:65 plan every small task and overrides haiku-first) and add LOKI_IMPLEMENT_HAIKU_FIRST=1 plus the COST-26 sizing knobs | loki-ts/src/util/cost_profile.ts, loki-ts/tests/util/cost_profile.test.ts | MEDIUM | red: resolveCostProfile('lean') yields LOKI_ROUTER=1 and no LOKI_IMPLEMENT_HAIKU_FIRST; green: lean env has LOKI_IMPLEMENT_HAIKU_FIRST=1, no LOKI_ROUTER, and the COST-26 knobs; balanced/max unchanged | ready@2026-10-17T05:54Z | depends: TEN-COST-26, TEN-COST-16-F1. goal: cost-2x lever; C-F1 run4 small tasks were 1.415x raw from fixed plan+Wall cost (cf1-20261017T025219Z, plan_skipped=false on all 31) |
+| TEN-COST-25 | fix: --cost lean stops forcing a plan session: drop LOKI_ROUTER from the lean profile (router makes plan.ts:65 plan every small task and overrides haiku-first) and add LOKI_IMPLEMENT_HAIKU_FIRST=1 plus the COST-26 sizing knobs | loki-ts/src/util/cost_profile.ts, loki-ts/tests/util/cost_profile.test.ts | MEDIUM | red: resolveCostProfile('lean') yields LOKI_ROUTER=1 and no LOKI_IMPLEMENT_HAIKU_FIRST; green: lean env has LOKI_IMPLEMENT_HAIKU_FIRST=1, no LOKI_ROUTER, and the COST-26 knobs; balanced/max unchanged | released v11.17.32 | depends: TEN-COST-26, TEN-COST-16-F1. goal: cost-2x lever; C-F1 run4 small tasks were 1.415x raw from fixed plan+Wall cost (cf1-20261017T025219Z, plan_skipped=false on all 31) |
 | TEN-COST-26 | feature: sizing knobs LOKI_E10_SMALL_MAX_CHARS (default 600, unchanged) and opt-in LOKI_E10_SMALL_NO_RUNNER=1 so a missing test runner no longer forces normal (smallTaskPath still routes it to wall) | loki-ts/src/engine10/sizing.ts (at most 3 core lines), loki-ts/tests/engine10/sizing.test.ts | MEDIUM | red: a 700-char task with LOKI_E10_SMALL_MAX_CHARS=800 sizes normal, and a no-runner task with LOKI_E10_SMALL_NO_RUNNER=1 sizes normal; green: both small, defaults byte-identical | released v11.17.29 | goal: C-F1 run4 sized all 31 tasks normal (19 'no test runner detected', 12 also >600 chars at 683/724); core budget 4937/5000 |
 | TEN-COST-27 | enhancement: loki start reads cost.profile from loki.yaml as the team default; --cost flag and LOKI_COST_PROFILE env still win | loki-ts/src/commands/start.ts (cost flag resolution near line 279 only; not the help block DEPLOY rows own), loki-ts/tests/commands/start.test.ts | LOW | red: loki.yaml cost.profile: lean with no flag resolves balanced; green: resolves lean, flag and env override it, invalid value warns and falls back | ready@2026-10-17T05:54Z | depends: TEN-COST-25. goal: teams opt in to the lean lever once; reuse util/yaml_key.ts yamlKey |
 | TEN-SPEED-01 | feature: cost_claim reports a paired elapsed_s ratio (raw/loki) with the same bootstrap CI as the cost ratio | benchmarks/bench/cost_claim.py, benchmarks/bench/tests/test_cost_claim.py | LOW | red: cost_claim JSON has no time_ratio key for paired rows carrying elapsed_s; green: time_ratio and time_ci present, rows missing elapsed_s are excluded and counted | released v11.17.29 | goal: speed has no measured number today (cost_claim has no time metric; attribution.py:351-355 already writes elapsed_s); first SPEED row |
 | TEN-SPEED-02 | enhancement: bench-suite times loki verify --fast and records p95 to migration_bench.jsonl | loki-ts/scripts/bench-suite.ts, loki-ts/tests/scripts/bench_suite_argv.test.ts | LOW | red: benchRouteArgv has no verify --fast route and no p95 field; green: argv test asserts the route and the record carries p95_ms | ready@2026-10-17T05:54Z | goal: METRICS lists verify --fast p95 as not measured; fills it with a repeatable command |
 | TEN-UX-09 | feature: loki control stop stops the detached control plane via instance.json PID plus a /health identity check, never by name | loki-ts/src/commands/control.ts, loki-ts/tests/commands/control.test.ts, loki-ts/src/cli/registry.ts (control row sub list only), completions/_loki and completions/loki.bash (control subcommands only) | MEDIUM | red: loki control stop is an unknown subcommand (control.ts:175-181 handles serve/status/prune/backfill); green: stop ends the recorded PID, refuses a PID whose /health does not match, exits 0 when nothing runs | released v11.17.29 | goal: bare loki leaves a nohup control serve with no stop (observed PID 50904 + server.js on 47821); reuse restartStaleControlPlane control.ts:52-70 |
-| TEN-UX-10 | fix: bare loki prints next steps (give work with loki start "<brief>"; stop the UI with loki control stop) after the URL instead of the URL alone | autonomy/loki (_loki_control_ui only), tests/test-control-plane.sh | LOW | red: bare loki stdout is exactly the URL line; green: the URL line is first and both next-step lines follow; --json or non-TTY output unchanged if it has a contract | ready@2026-10-17T05:54Z | depends: TEN-UX-09. goal: first-run UX; today a new user sees only http://127.0.0.1:47821 and a background daemon |
+| TEN-UX-10 | fix: bare loki prints next steps (give work with loki start "<brief>"; stop the UI with loki control stop) after the URL instead of the URL alone | autonomy/loki (_loki_control_ui only), tests/test-control-plane.sh | LOW | red: bare loki stdout is exactly the URL line; green: the URL line is first and both next-step lines follow; --json or non-TTY output unchanged if it has a contract | released v11.17.32 | depends: TEN-UX-09. goal: first-run UX; today a new user sees only http://127.0.0.1:47821 and a background daemon |
 | TEN-UX-11 | enhancement: the run summary Time line marks the first sealed PR in a repo (time to first sealed PR) so METRICS row 14 can be read from run output | loki-ts/src/engine10/output.ts (Time line input field only), loki-ts/tests/engine10/output.test.ts | LOW | red: summary with firstSealed=true renders the same Time line as any run; green: Time line appends 'first sealed PR in this repo' only when set, golden for other runs unchanged | ready@2026-10-17T05:54Z | goal: time to first sealed PR is not measured (METRICS row 14); caller wiring is a follow-up row |
 | TEN-UX-12 | fix: the preflight 'could not confirm the Claude login' warning never adds a stdout line in quiet mode (stderr only) | loki-ts/src/engine10/preflight.ts (warning emit at line ~28 only), loki-ts/tests/engine10/preflight.test.ts | LOW | red: quiet run with an unanswered auth status prints 9 stdout lines (e2e.test.ts:130 A-130 limit 8); green: warning on stderr, quiet stdout within 8 lines | ready@2026-10-17T05:54Z | depends: TEN-P9-FIX-F1 (owns preflight.test.ts). goal: quiet-mode contract and a likely cause of the red main Tests runs |
 | TEN-ADOPTION-09 | feature: engine10 pr stage routes a gitlab.com pinned origin to engine10-push-gitlab.sh push-mr and accepts the MR URL | loki-ts/src/engine10/stages/pr.ts, loki-ts/tests/engine10/pr.test.ts | HIGH | red: gitlab origin calls DEFAULT_PUSH_SH engine10-push.sh (pr.ts:42) and an MR URL fails PR_URL_RE (pr.ts:72); green: push-mr is invoked and the MR URL is recorded; github path byte-identical | ready@2026-10-17T05:54Z | goal: GitLab teams; the script and tests/test-engine10-push-gitlab.sh exist but nothing in loki-ts/src references it |
 | TEN-ADOPTION-10 | fix: reviewer instructions name the receipt-check action with a copyable uses: line pinned to the current version instead of 'adds the receipt-check action' | loki-ts/src/e10ext/reviewer_body.ts, loki-ts/tests/engine10/pr_body_golden.test.ts | LOW | red: reviewer body line 54 has no uses: reference; green: body contains uses: <repo>/.github/actions/receipt-check@v<VERSION> and the golden is updated | ready@2026-10-17T05:54Z | goal: .github/actions/receipt-check exists (tests/test-receipt-check-action.sh) but no user-facing text tells a reviewer how to add it |
 | TEN-GATES-11 | feature: build autonomy/lib/ablation.py to the tests/moat/p8-load-bearing-proof.sh contract and promote the 3 P8 ablation lines in tests/moat/pending.txt | autonomy/lib/ablation.py (new: the p8 header names this exact path and no module owns it), tests/test_ablation.py (new: the new module's own test), tests/moat/pending.txt (3 P8 lines only) | HIGH | red: bash tests/moat/p8-load-bearing-proof.sh fails, ablation.py missing; green: P8.ablation-runtime-change-load-bearing, P8.ablation-dead-code-not-sealed, P8.ablation-na-docs-only pass and leave pending.txt; restore is byte-for-byte | released v11.17.29 | goal: moat 2/9 proven; consumer already built (proof-generator.py:874 _collect_ablation, :2052 headline refusal), producer missing |
-| TEN-GATES-12 | enhancement: loki start proof path runs ablation.py before proof-generator so quality/ablation.json exists on engine10 runs | loki-ts/src/runner/proof.ts (pre-proof hook only), loki-ts/tests/runner/proof.test.ts | HIGH | red: an engine10 run with a load-bearing change leaves no quality/ablation.json; green: file present with status load_bearing, ablation failure is recorded not_applicable and never blocks the proof | ready@2026-10-17T05:54Z | depends: TEN-GATES-07, TEN-GATES-11. goal: the P8 property reaches real runs, not just the moat script |
-| TEN-GATES-13 | feature: seeded-defect corpus at benchmarks/seeded-defects/manifest.json (schema loki.seeded-defects/v2, >=100 defects, generated) and promote P4.seeded-defect-corpus-present | benchmarks/seeded-defects/ (new dir: the p4 contract names this path), tests/moat/pending.txt (1 P4 line only) | HIGH | red: P4.seeded-defect-corpus-present fails, directory absent; green: manifest validates, count >=100, generator rerun is byte-identical, pending line removed | ready@2026-10-17T05:54Z | depends: TEN-GATES-11 (shared pending.txt, one line each). goal: Seal accuracy cannot be measured without the corpus |
+| TEN-GATES-12 | enhancement: loki start proof path runs ablation.py before proof-generator so quality/ablation.json exists on engine10 runs | loki-ts/src/runner/proof.ts (pre-proof hook only), loki-ts/tests/runner/proof.test.ts | HIGH | red: an engine10 run with a load-bearing change leaves no quality/ablation.json; green: file present with status load_bearing, ablation failure is recorded not_applicable and never blocks the proof | released v11.17.32 | depends: TEN-GATES-07, TEN-GATES-11. goal: the P8 property reaches real runs, not just the moat script |
+| TEN-GATES-13 | feature: seeded-defect corpus at benchmarks/seeded-defects/manifest.json (schema loki.seeded-defects/v2, >=100 defects, generated) and promote P4.seeded-defect-corpus-present | benchmarks/seeded-defects/ (new dir: the p4 contract names this path), tests/moat/pending.txt (1 P4 line only) | HIGH | red: P4.seeded-defect-corpus-present fails, directory absent; green: manifest validates, count >=100, generator rerun is byte-identical, pending line removed | released v11.17.32 | depends: TEN-GATES-11 (shared pending.txt, one line each). goal: Seal accuracy cannot be measured without the corpus |
 | TEN-DEPLOY-10 | feature: loki status --probe re-probes the last deploy health URL and exits non-zero on regression | loki-ts/src/commands/status.ts (renderLastDeploy region only), loki-ts/tests/commands/status.test.ts | MEDIUM | red: --probe is an unknown flag; green: healthy URL exits 0, a 500 or timeout exits 1 with the URL and status, no last deploy exits 0 with a note | ready@2026-10-17T05:54Z | goal: post-deploy watch; deploy health is recorded once and never rechecked |
-| TEN-STABILITY-09 | fix: engine10 stub e2e suites answer claude auth status so the P9 login probe never stalls or warns in stub runs | loki-ts/tests/engine10/e2e.test.ts (and its stub fixture only) | MEDIUM | red: on main the A-130 quiet, Rule of Two canary, cost cap, eval PR, issue-ref and SIGINT e2e cases fail; green: all pass with the stub answering auth status | released v11.17.30 | depends: none; first confirm still red on 7d4d0ffb2/0463f084b. goal: main Tests failed 11 of 13 recent runs; e2e.test.ts untouched since TEN-UX-01 |
+| TEN-STABILITY-09 | fix: engine10 stub e2e suites answer claude auth status so the P9 login probe never stalls or warns in stub runs | loki-ts/tests/engine10/e2e.test.ts (and its stub fixture only) | MEDIUM | red: on main the A-130 quiet, Rule of Two canary, cost cap, eval PR, issue-ref and SIGINT e2e cases fail; green: all pass with the stub answering auth status | released v11.17.31 | depends: none; first confirm still red on 7d4d0ffb2/0463f084b. goal: main Tests failed 11 of 13 recent runs; e2e.test.ts untouched since TEN-UX-01 |
 | TEN-STABILITY-10 | fix: pulse merged-not-released check reads merges with one git log pass indexed by slice ID instead of one git log per row | scripts/v10-pulse.sh (lookup near line 1993 and check_merged_not_released_stale only), tests/test-v10-pulse.sh | MEDIUM | red: a board with 50 merged rows runs 50 git log calls and one timeout raises RuntimeError for row D63-C5; green: one git call, same rows flagged, git failure still reported UNKNOWN not 'nothing to flag' | released v11.17.30 | goal: pulse at 05:51Z reported 'git log --merges failed for row D63-C5: rc=None: TIMEOUT'; the anti-drift signal goes dark under load |
 | TEN-QUALITY-10 | fix: a traceback or file:line path missing from a truncated repo map (cap 2000) is still ranked when git tracks it | loki-ts/src/util/relevance.ts, loki-ts/src/engine10/relevant_files.ts (at most 2 core lines), loki-ts/tests/engine10/plan.test.ts | MEDIUM | red: repo with 2500 files and a traceback naming file 2400 never lists it as relevant; green: it ranks first; untracked or absent paths still ignored | ready@2026-10-17T05:54Z | goal: repomap.ts:19,34 MAX_FILES=2000 takes the first 2000 ls-files entries, so large repos lose explicit file hints |
 | TEN-QUALITY-11 | enhancement: a Python repo with uv.lock and no .venv runs tests and lint through uv run as the project interpreter | loki-ts/src/engine10/stages/verify.ts (resolveTool only, at most 3 core lines), loki-ts/tests/engine10/verify.test.ts | MEDIUM | red: uv.lock repo without .venv gets interpreter system and 'tests ran on the system interpreter' NOT PROVEN (verify.ts:43,339); green: interpreter project via uv run; no uv on PATH keeps today's system result | ready@2026-10-17T05:54Z | goal: avoid a false PARTIAL for uv projects; verify.ts has no uv handling today |

package/docs/v10/FAILURE-CLASSES.md

@@ -1026,3 +1026,10 @@ L0 review rule (ENGINE-LAWS.md L0): a fix that adds an `if` or a regex about the
 - Siblings: the .gitleaks.toml name-only and patch diff-tree calls in .githooks/pre-push (same -m, fixed here; they could even FAIL the push on a toml main already had); the eval-fixture scan diff-tree -m in the same hook (kept: scanning both parents is conservative and fail-closed); scripts/security-audit-gitleaks.sh (comment only) and scripts/train-cycle.sh (plain non-merge name list).
 - Mechanism: the per-commit drift check in .githooks/pre-push passes `--diff-merges=first-parent` instead of `-m`; a merge that adds a line itself still differs from its first parent, and each branch commit is its own entry in the pushed list.
 - Fixture: tests/test-pre-push-gitleaks.sh case 19b (older-slice merge prints no warning; merge adding a line still warns); red with `-m` restored on all three calls, and red with the flag dropped from the ignore call.
+
+## FC-TEN-STABILITY-09 Engine10 stub claude CLIs do not answer `claude auth status`, so the login probe logs a stage or stalls (STUB-AUTH-STATUS-SILENT)
+- User-visible vs raw: raw (test infrastructure). main Tests failed on 11 of the last 13 runs after TEN-UX-01 added the preflight login probe: stub runs printed the extra "could not confirm the Claude login" line (A-130 8-line quiet cap, 9 seen), the issue-ref stub logged the probe as an "other" stage, and the SIGINT stub treated the probe as the implement session (slept 5s, never recorded cost).
+- Law broken: a stub provider must honour every CLI call the engine makes before a session, not only `-p`; a probe the stub does not answer is indistinguishable from a real unknown login.
+- Siblings: tests/engine10/fixtures/e2e/bin/claude, fixtures/issue-ref/bin/claude, inline stubs in supervisor_signal.test.ts and budget_stop_e2e.test.ts (all fixed). tests/engine10/fixtures/providers/bin/* are non-claude providers and are not probed. Two verify_lint.test.ts lint:tsc cases fail only in a worktree with no loki-ts/node_modules (environmental, not this class).
+- Mechanism: every stub claude answers `auth status` with {"loggedIn":true}, no side effects.
+- Fixture: tests/engine10/e2e.test.ts "every engine10 stub claude answers claude auth status as logged in".

package/docs/v10/METRICS.md

@@ -608,6 +608,32 @@ the same hidden checks; wall_ratio = mean loki wall / mean raw wall; 95% percent
 |---|---|---|---|
 | 2026-10-08T04:58Z | b9-ab n1-plumbing (SUPERSEDED) | trivial-sum | SUPERSEDED, do not cite. Used our own clock for wall and the old receipt fields: its loki wall (43s) was not the receipt `time.wall_s`/`total_s` and `time.wall_s` is invalid as a total (it is a stage sum that excludes boot and seal). Rerun on SDK `duration_ms` and receipt `time.total_s` once RECEIPT-TRUTH ships. Former text: cost_ratio=0.92 wall_ratio=3.07 n=1/1, not significant. |
 
+## Cost proof (C-F1)
+
+Owner of the "Loki costs at most half of the same model without Loki" claim. Until a run below says PROVEN_AT(0.5) the claim is NOT PROVEN, and no document may state a cost ratio without the run id and the floor it was measured against.
+
+Command (spends API budget; source checkout only):
+
+`python3 -I benchmarks/bench/attribution.py --execute --arms raw-configured,raw-lean,raw-bare,loki,loki-lean --repeats 3 --model <exact-model-id> --max-spend-usd <cap>`
+
+- n=3 per task per arm (`--repeats 3`) is the minimum: the verdict needs at least 3 runs per task in both arms (MIN_N_PER_TASK in `benchmarks/bench/cost_claim.py`). Pin the model with an exact id on every run; do not rely on the default.
+- `--max-spend-usd` aborts before the next cell once cumulative true spend (the larger of the reported cost and the Loki child-session ledger) reaches the cap. Always set it. The dry run `python3 -I benchmarks/bench/attribution.py --dry-run --arms raw-configured,raw-lean,raw-bare,loki,loki-lean` validates the task set and prints the plan with no model call.
+- Floors: `raw-configured` is `claude -p` with this host's hooks, skills and CLAUDE.md; `raw-lean` is the OAuth-safe same-config floor (TEN-COST-02); `raw-bare` is `claude -p --bare`. `loki` is the default profile and `loki-lean` runs with the lean cost profile.
+
+Verdict rule (`cost_claim_verdict`, TEN-COST-03; target fraction `COST_TARGET_FRACTION` = 0.5 in `attribution.py`). The verdict is `PROVEN_AT(0.5)` only when none of the reasons below applies; otherwise it is `NOT PROVEN` with the reasons listed:
+- the ratio is cost per accepted task, arm over floor, with a 2000-iteration paired bootstrap 95% interval; the upper bound must be at or below the target;
+- Loki acceptance rate must not be below the floor's;
+- at least 3 runs per task in each arm, no `cost_partial` row, one engine and one `loki_version` across all rows;
+- unmeasured rows are excluded and counted, never treated as zero.
+
+Report against all three floors (`raw-configured`, `raw-lean`, `raw-bare`), never only the favorable one. The report prints one verdict line per Loki arm per floor; publish every line, including NOT PROVEN ones, with the failed and excluded rows.
+
+Validity: a run counts only when the `loki_version` recorded in its result JSON equals `VERSION` of the tree under test. A run recorded against any other version is stale and must not be cited for the current release (the harness also refuses to start when the installed `loki version` does not match the checkout).
+
+Measured so far (cite only these): the first C-F1 run reported a 1.81x cost ratio, but the true child-session ledger cost was about 12.3x raw (docs/v10/PROGRESS.md, 2026-10-16T21:35Z entry, v11.17.2). The reported figure understated cost, which is why the verdict rejects `cost_partial` rows and spend caps use the larger of reported and ledger cost. No run has produced PROVEN_AT(0.5). Append each paid run here with its date, `loki_version`, model id, cap, and one verdict line per floor.
+
+How to read results: [docs/EVALUATING.md section 8](../EVALUATING.md).
+
 ## Release latency metric (WF-2MIN-3)
 
 Definition: seconds from the Release run's dispatch/push event to the `+ loki-mode@<version>` line of the `npm publish` step in the `release` job. Baseline run 37869841774: 2m46s (gate/required-ci 30s, release 68s, publish-npm 64s). Target: under 2m. npm registry lag is NOT part of this metric; the non-blocking `npm-visible` job records it separately in its job summary (`npm registry lag: ... visible after Ns`, or `NPM-LAG-TIMEOUT`). Post-Release Smoke polls for visibility itself (up to 15 min).

package/docs/v10/PROGRESS.md

@@ -2470,3 +2470,9 @@ v11.17.21 published (Release success on 462fbc40a; npm latest 11.17.21, next 11.
 
 ## 2026-10-17T06:18Z (CoS) v11.17.30
 - Ships TEN-STABILITY-09 (TL APPROVE 57e3aa1f6: bun test 87 pass 0 fail, 2 stub mutations red) and TEN-STABILITY-10 (TL APPROVE f8b625ca1: tests/test-v10-pulse.sh 171 passed, 2 mutations red at T51b). v11.17.29 landed 1e4c2da03.
+
+## 2026-10-17T06:19Z (CoS) v11.17.31
+- Correction: v11.17.30 (9dcae642a) shipped only TEN-STABILITY-10; TEN-STABILITY-09 hit a FAILURE-CLASSES.md conflict in the merge loop, yet the release notes and BOARD named it. Conflict resolved as a union of both appended rows, merged, and shipped here. ship.sh notes are now written only after the merge loop reports every slice merged.
+
+## 2026-10-17T06:25Z (CoS) v11.17.32
+- Wave AA all APPROVE: COST-25 89f9108c0 (39 pass, help mutation red), GATES-12 fe1f31d46 HIGH (proof.test 15 pass, 7 mutations red), GATES-13 6553224cd HIGH (generate.py --check rc=0 401 files, moat run.sh rc=0 7 of 9, 2 mutations red), UX-10 6c7549979 (test-control-plane 33 passed, mutation 2 failed), COST-08 d86b9d40f (dry run rc=0, drift 3 passed), COST-19 822236dc5. v11.17.27 and v11.17.28 Release runs success while overlapping; npm latest=next=11.17.29 at 06:23Z.