loki-mode 11.17.36 → 11.17.38

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: An autonomous software factory that knows what it is supposed to deliver, and proves it did. Use when the user says Loki Mode or asks to build, fix or verify software autonomously.
 ---
 
-# Loki Mode v11.17.36
+# Loki Mode v11.17.38
 
 **Current entry points (Loki 10 engine):** `loki "<task>"`, `loki owner/repo#N` and `loki quick "<task>"` run the Loki 10 engine and end with a signed receipt (`loki verify`). `loki backlog owner/repo --all` runs many issues in parallel. Guide: `docs/v10/GUIDE.md`. The skill instructions below, and `loki start`, describe the previous bash loop. PRD-file starts (`loki start ./prd.md`) and the opencode provider still run on it until FC38-SWEEP ports them; the legacy-engine command and the LOKI_ENGINE switch remain removed. Prefer `loki owner/repo#N` for issues.
 
@@ -483,4 +483,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v11.17.36 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**
+**v11.17.38 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**

package/VERSION

@@ -1 +1 @@
-11.17.36
+11.17.38

package/autonomy/lib/help-core.sh

@@ -117,7 +117,7 @@ Verification
   loki verify --json           One JSON object: command, exit_code, ok, output
   loki verify --pubkey FILE    Check a receipt against a public key
   loki receipt                 Inspect the proof-of-run receipt
-  loki undo <run> [--plan]     Plan or apply an undo of a run
+  loki undo <run> [--plan|--dry-run]  Plan or apply an undo of a run
 
 Exit codes: see loki help exit-codes.
 T

package/autonomy/lib/secret-scan.sh

@@ -43,6 +43,7 @@ _commit_scan_secret_file() {
         'github_pat_[A-Za-z0-9_]{60,}'              # GitHub fine-grained PAT
         'xox[baprs]-[A-Za-z0-9-]{10,}'              # Slack token (xoxb-/xoxp-/...)
         'sk-[A-Za-z0-9]{20,}'                       # OpenAI-style secret key
+        'sk-ant-[A-Za-z0-9_-]{20,}'                 # Anthropic API key (hyphenated body)
         'AIza[0-9A-Za-z_-]{35}'                     # Google API key
         'glpat-[A-Za-z0-9_-]{20,}'                  # GitLab personal access token
     )

package/autonomy/loki

@@ -1853,7 +1853,7 @@ show_help_all() {
     echo "  review [opts]    Standalone code review with quality gates"
     echo "  ultracode \"task\" Run a task as a native Claude Code Dynamic Workflow (opt-in, Claude-only)"
     echo "  trust [cmd]      Visible trust trajectory; 'trust detail' for metrics"
-    echo "  undo <run> [--plan]  Plan or apply (LOKI_UNDO=1) an undo of a run; verifies the receipt"
+    echo "  undo <run> [--plan|--dry-run]  Plan or apply (LOKI_UNDO=1) an undo of a run; verifies the receipt"
     echo ""
     echo "Observe:"
     echo "  dashboard [cmd]  Operations UI server (start|stop|status|url|open)"
@@ -10009,7 +10009,7 @@ _deploy_latest_receipt() {
     return 0
 }
 
-# _deploy_record <dir> <command> <exit_code> <run_id> <anchor_sha> [state] [health_status] [health_url] [rb_attempted] [rb_exit] [receipt_sha256] [started_at] [finished_at] [target] [canary] [post_rollback_health] [health_http_code] [health_match] [tree_sha] [destination] [deployed_url] [health_url_source] [env_keys_csv] [env_source]
+# _deploy_record <dir> <command> <exit_code> <run_id> <anchor_sha> [state] [health_status] [health_url] [rb_attempted] [rb_exit] [receipt_sha256] [started_at] [finished_at] [target] [canary] [post_rollback_health] [health_http_code] [health_match] [tree_sha] [destination] [deployed_url] [health_url_source] [env_keys_csv] [env_source] [domain] [domain_status] [tls_status] [tls_not_after] [domain_provenance]
 # Writes the executed deploy's own record, then signs it (loki.deploy/1, Ed25519 via the
 # receipt signer in loki-ts/src/util/receipt_signer.ts) so it is bound to the receipt that
 # authorized it; `loki verify <record>` re-checks it offline. An unsigned record is reported
@@ -10037,6 +10037,8 @@ _deploy_record() {
     # --env-file: key NAMES only (comma-joined, validated identifiers) and the file
     # path. A value is never passed here, so the signed record cannot carry one.
     local env_keys_csv="${23:-}" env_source="${24:-}"
+    # --domain: tls_status is "unchecked" unless the openssl proof ran and said otherwise.
+    local domain_rec="${25:-}" domain_status="${26:-}" tls_status="${27:-unchecked}" tls_not_after="${28:-}" domain_prov="${29:-}"
     local ddir="$dir/.loki/deploys"
     [ -d "${LOKI_DIR:-}" ] && ddir="${LOKI_DIR}/deploys"
     mkdir -p "$ddir" 2>/dev/null || return 0
@@ -10046,6 +10048,7 @@ _deploy_record() {
     DR_RBA="$rb_attempted" DR_RBX="$rb_exit" DR_RSHA="$receipt_sha" DR_T0="$started_at" \
     DR_T1="$finished_at" DR_TGT="$target" DR_CAN="$canary" DR_PRB="$post_rb" DR_HC="$hcode_rec" DR_HM="$hmatch" DR_TREE="$tree_sha" DR_DEST="$dest_rec" DR_DURL="$deployed_url" DR_HSRC="$hsrc" \
     DR_ENVK="$env_keys_csv" DR_ENVS="$env_source" \
+    DR_DOM="$domain_rec" DR_DOMS="$domain_status" DR_TLS="$tls_status" DR_TLSA="$tls_not_after" DR_DOMP="$domain_prov" \
         python3 -c '
 import json, os, datetime
 state = os.environ.get("DR_STATE") or "anchored"
@@ -10079,6 +10082,11 @@ json.dump({
     "health_url_source": os.environ.get("DR_HSRC", ""),
     "env_keys": sorted(k for k in os.environ.get("DR_ENVK", "").split(",") if k),
     "env_source": os.environ.get("DR_ENVS", ""),
+    "domain": os.environ.get("DR_DOM", ""),
+    "domain_status": os.environ.get("DR_DOMS", ""),
+    "tls_status": os.environ.get("DR_TLS") or "unchecked",
+    "tls_not_after": os.environ.get("DR_TLSA", ""),
+    "domain_provenance": os.environ.get("DR_DOMP", ""),
     "health_http_code": int(os.environ["DR_HC"]) if os.environ.get("DR_HC", "").isdigit() else None,
 }, open(os.environ["DR_OUT"], "w"), indent=2)
 ' 2>/dev/null || return 0
@@ -10300,6 +10308,80 @@ out("__LOKI_ENV_OK__")
 PYEOF
 }
 
+# _deploy_domain_step <dir> <command> <domain> <deployed_url> <head_sha>
+# --domain: attach <domain> with the provider's documented verb, then PROVE TLS with
+# openssl. Sets _DD_STATUS (attached|manual|failed), _DD_TLS (valid|expiring|invalid|
+# unchecked), _DD_NOTAFTER and _DD_PROV (match|mismatch|unchecked). Returns 6 when the
+# attach failed or the TLS handshake/cert is invalid, else 0. tls_status is "valid" ONLY
+# when the handshake gave a cert and 'openssl x509 -checkend 604800' accepted it.
+_deploy_domain_step() {
+    local dir="$1" command="$2" domain="$3" durl="$4" head="$5"
+    local arc=0 hint="" pem="" xout="" xrc=0 tmo="" na="" body="" psha=""
+    _DD_STATUS="" _DD_TLS="unchecked" _DD_NOTAFTER="" _DD_PROV="unchecked"
+    echo "Attaching domain: ${domain}"
+    case "$command" in
+        "vercel --prod")
+            hint="Vercel needs DNS for ${domain}: A 76.76.21.21 (apex) or CNAME cname.vercel-dns.com"
+            if [ -z "$durl" ]; then
+                echo "  The deploy printed no URL, so 'vercel alias set' has nothing to alias." >&2
+                _DD_STATUS=failed
+            else
+                _DD_STATUS=attached
+                ( cd "$dir" && vercel alias set "$durl" "$domain" ) || arc=$?
+                [ "$arc" -eq 0 ] || _DD_STATUS=failed
+            fi
+            ;;
+        "fly deploy")
+            hint="Fly needs DNS for ${domain}: the A/AAAA or CNAME records 'fly certs show ${domain}' prints"
+            _DD_STATUS=attached
+            ( cd "$dir" && fly certs add "$domain" ) || arc=$?
+            [ "$arc" -eq 0 ] || _DD_STATUS=failed
+            ;;
+        *)
+            _DD_STATUS=manual
+            hint="${command%% *} has no wired domain verb: add ${domain} in its dashboard, then point DNS at the record it shows"
+            echo "  Manual step: ${hint}."
+            ;;
+    esac
+    [ "$_DD_STATUS" != failed ] || echo -e "${RED}Domain attach failed (exit ${arc}).${NC}" >&2
+
+    if ! command -v openssl >/dev/null 2>&1; then
+        echo "TLS: openssl not found. tls_status=unchecked (never a claim of valid)."
+    else
+        command -v timeout >/dev/null 2>&1 && tmo="timeout 15"
+        # shellcheck disable=SC2086
+        pem="$($tmo openssl s_client -servername "$domain" -connect "${domain}:443" </dev/null 2>/dev/null)" || true
+        case "$pem" in
+            *"BEGIN CERTIFICATE"*)
+                xout="$(printf '%s\n' "$pem" | openssl x509 -noout -enddate -checkend 604800 2>/dev/null)" || xrc=$?
+                na="$(sed -n 's/^notAfter=//p' <<<"$xout" | head -n 1)"
+                if [ -z "$na" ]; then _DD_TLS=invalid
+                elif [ "$xrc" -eq 0 ]; then _DD_TLS=valid
+                else _DD_TLS=expiring; fi
+                [ -z "$na" ] || _DD_NOTAFTER="$(python3 -c 'import sys,datetime
+try: print(datetime.datetime.strptime(sys.argv[1].strip(), "%b %d %H:%M:%S %Y GMT").strftime("%Y-%m-%dT%H:%M:%SZ"))
+except Exception: print(sys.argv[1].strip())' "$na" 2>/dev/null || printf '%s' "$na")"
+                ;;
+            *) _DD_TLS=invalid ;;
+        esac
+        echo "TLS: ${domain} tls_status=${_DD_TLS}${_DD_NOTAFTER:+ (not after ${_DD_NOTAFTER})}"
+        [ "$_DD_TLS" != expiring ] || echo -e "${YELLOW}  The certificate expires within 7 days.${NC}" >&2
+    fi
+
+    if [ "$_DD_TLS" = invalid ]; then
+        echo -e "${RED}TLS invalid for ${domain}: no usable certificate was served. DNS may not point at the provider yet.${NC}" >&2
+        [ -z "$hint" ] || echo "  ${hint}." >&2
+    elif command -v curl >/dev/null 2>&1; then
+        body="$(curl -fsS --max-time 5 "https://${domain}/.well-known/loki-provenance.json" 2>/dev/null)" || body=""
+        psha="$(python3 -c 'import json,sys;print(json.loads(sys.stdin.read()).get("head_sha") or "")' <<<"$body" 2>/dev/null || true)"
+        if [ -n "$psha" ] && [ -n "$head" ] && [ "$psha" = "$head" ]; then _DD_PROV=match
+        elif [ -n "$psha" ]; then _DD_PROV=mismatch; echo -e "${YELLOW}Provenance head_sha ${psha:0:12} differs from the deployed ${head:0:12}.${NC}" >&2; fi
+        echo "Provenance: ${_DD_PROV}"
+    fi
+    if [ "$_DD_STATUS" = failed ] || [ "$_DD_TLS" = invalid ]; then return 6; fi
+    return 0
+}
+
 # _deploy_try_execute <dir> <type>
 # The ONLY place a deploy command is ever run. Evaluates the gate, and either
 # executes + records, or REFUSES naming every failed check. Returns the deploy
@@ -10592,12 +10674,21 @@ _deploy_try_execute() {
         fi
     fi
 
+    # --domain: only after a deploy that exited 0 and did not fail its health probe.
+    local domain="${_LOKI_DEPLOY_DOMAIN:-}" dom_rc=0
+    _DD_STATUS="" _DD_TLS="unchecked" _DD_NOTAFTER="" _DD_PROV=""
+    if [ -n "$domain" ] && [ "$rc" -eq 0 ] && [ "$health_status" != "FAILED_HEALTH" ]; then
+        _deploy_domain_step "$dir" "$command" "$domain" "$deployed_url" "$anchor" || dom_rc=$?
+        [ "$_DD_STATUS" != attached ] || exec_disp="${exec_disp}; domain ${domain}"
+    fi
+
     local rec rsha
     finished_at="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
     rsha="$(python3 -c 'import json,sys;print((json.load(open(sys.argv[1])).get("verification") or {}).get("hash") or "")' "$pj" 2>/dev/null || printf '')"
     rec="$(_deploy_record "$dir" "$exec_disp" "$rc" "${run_id:-unknown}" "${anchor:-unknown}" \
         "$anchor_state" "$health_status" "$health_url" "$rb_attempted" "$rb_exit" \
-        "$rsha" "$started_at" "$finished_at" "${command%% *}" "$canary" "$post_rb" "$hcode" "$health_match" "$(git -C "$dir" rev-parse 'HEAD^{tree}' 2>/dev/null || true)" "$dest" "$deployed_url" "$health_src" "$env_keys" "$env_file")"
+        "$rsha" "$started_at" "$finished_at" "${command%% *}" "$canary" "$post_rb" "$hcode" "$health_match" "$(git -C "$dir" rev-parse 'HEAD^{tree}' 2>/dev/null || true)" "$dest" "$deployed_url" "$health_src" "$env_keys" "$env_file" \
+        "$domain" "$_DD_STATUS" "$_DD_TLS" "$_DD_NOTAFTER" "$_DD_PROV")"
     echo ""
     if [ "$rc" -eq 0 ]; then
         echo -e "${GREEN}Deploy command exited 0.${NC}"
@@ -10628,6 +10719,8 @@ _deploy_try_execute() {
         [ "$post_rb" = "FAILED_HEALTH" ] && return 5
         return 4
     fi
+    # 6: the domain could not be attached or its TLS is invalid.
+    if [ "$rc" -eq 0 ] && [ "$dom_rc" -ne 0 ]; then return 6; fi
     return "$rc"
 }
 
@@ -10746,7 +10839,7 @@ cmd_deploy() {
     local LOKI_DEPLOY_ALLOW_UNANCHORED=false
     # Per-invocation like --execute; local so an ambient env var cannot set them.
     local _LOKI_DEPLOY_HEALTH_URL="" _LOKI_DEPLOY_HEALTH_MATCH="" _LOKI_DEPLOY_AUTO_ROLLBACK=false _LOKI_DEPLOY_CANARY=false _LOKI_DEPLOY_DESTINATION=""
-    local _LOKI_DEPLOY_ENV_FILE=""
+    local _LOKI_DEPLOY_ENV_FILE="" _LOKI_DEPLOY_DOMAIN=""
 
     # Arg parse (mirror cmd_preview: lenient on unknown args -> no behavior drift).
     while [ $# -gt 0 ]; do
@@ -10754,7 +10847,7 @@ cmd_deploy() {
             --help|-h|help)
                 echo -e "${BOLD}Loki Mode -- deploy command advisory (print-only by default)${NC}"
                 echo ""
-                echo "Usage: loki deploy [--dir <path>] [--no-clip] [--execute [--canary] [--env-file FILE]] [--destination preview|staging|production] [--health-url URL [--health-match STR] [--auto-rollback]]"
+                echo "Usage: loki deploy [--dir <path>] [--no-clip] [--execute [--canary] [--env-file FILE] [--domain HOST]] [--destination preview|staging|production] [--health-url URL [--health-match STR] [--auto-rollback]]"
                 echo ""
                 echo "Detects your project type and your installed cloud CLI (and any"
                 echo "CI/CD pipeline), then PRINTS the exact deploy command for YOU to run."
@@ -10854,6 +10947,15 @@ cmd_deploy() {
                 echo "                 step fails the deploy is not run. Values are masked as K=*** in"
                 echo "                 output; the deploy record stores env_keys (names) and env_source,"
                 echo "                 never values."
+                echo "  --domain HOST  With --execute, after a deploy that exited 0 and is not FAILED_HEALTH:"
+                echo "                 attach HOST (Vercel: 'vercel alias set <deployed_url> HOST'; Fly:"
+                echo "                 'fly certs add HOST'; Netlify and Cloudflare print the manual dashboard"
+                echo "                 step, domain_status=manual). Then prove TLS with openssl s_client and"
+                echo "                 'openssl x509 -checkend 604800' and re-probe"
+                echo "                 https://HOST/.well-known/loki-provenance.json. The record stores domain,"
+                echo "                 domain_status, tls_status (valid|expiring|invalid|unchecked) and"
+                echo "                 tls_not_after; no openssl means unchecked, never valid. An invalid TLS"
+                echo "                 handshake or a failed attach exits 6 and prints the DNS record needed."
                 echo "  --allow-unanchored"
                 echo "                 Proceed when the receipt records NO baseline (nothing"
                 echo "                 about this tree is proven). Never bypasses a recorded"
@@ -10914,6 +11016,16 @@ cmd_deploy() {
                 _LOKI_DEPLOY_ENV_FILE="${1#--env-file=}"
                 [ -n "$_LOKI_DEPLOY_ENV_FILE" ] || { echo "loki deploy --env-file requires a file path" >&2; return 1; }
                 ;;
+            --domain)
+                case "${2:-}" in
+                    -*|"") echo "loki deploy --domain requires a hostname" >&2; return 1 ;;
+                    *) _LOKI_DEPLOY_DOMAIN="$2"; shift ;;
+                esac
+                ;;
+            --domain=*)
+                _LOKI_DEPLOY_DOMAIN="${1#--domain=}"
+                [ -n "$_LOKI_DEPLOY_DOMAIN" ] || { echo "loki deploy --domain requires a hostname" >&2; return 1; }
+                ;;
         esac
         shift
     done
@@ -10931,6 +11043,18 @@ cmd_deploy() {
         _LOKI_DEPLOY_ENV_FILE="$(cd "$(dirname -- "$_LOKI_DEPLOY_ENV_FILE")" && pwd -P)/$(basename -- "$_LOKI_DEPLOY_ENV_FILE")"
     fi
 
+    if [ -n "$_LOKI_DEPLOY_DOMAIN" ]; then
+        if [ "$do_execute" != true ]; then
+            echo "loki deploy --domain requires --execute (the advisory run attaches nothing)" >&2
+            return 1
+        fi
+        _LOKI_DEPLOY_DOMAIN="$(printf '%s' "$_LOKI_DEPLOY_DOMAIN" | tr '[:upper:]' '[:lower:]')"
+        if ! printf '%s' "$_LOKI_DEPLOY_DOMAIN" | grep -Eq '^([a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,}$'; then
+            echo "loki deploy --domain: not a valid hostname: $_LOKI_DEPLOY_DOMAIN" >&2
+            return 1
+        fi
+    fi
+
     if [ "$_LOKI_DEPLOY_AUTO_ROLLBACK" = true ] && [ -z "$_LOKI_DEPLOY_HEALTH_URL" ]; then
         echo "loki deploy --auto-rollback requires --health-url (no health signal, no rollback)" >&2
         return 1

package/autonomy/verify.sh

@@ -1175,6 +1175,7 @@ verify_secret_scan_file() {
         'github_pat_[A-Za-z0-9_]{60,}'              # GitHub fine-grained PAT
         'xox[baprs]-[A-Za-z0-9-]{10,}'              # Slack token (xoxb-/xoxp-/...)
         'sk-[A-Za-z0-9]{20,}'                       # OpenAI-style secret key
+        'sk-ant-[A-Za-z0-9_-]{20,}'                 # Anthropic API key (hyphenated body)
         'AIza[0-9A-Za-z_-]{35}'                     # Google API key
         'glpat-[A-Za-z0-9_-]{20,}'                  # GitLab personal access token
     )

package/completions/_loki

@@ -179,6 +179,7 @@ function _loki {
                         '--execute[Run the deploy command if the receipt gate passes]' \
                         '--canary[With --execute: staged rollout (Vercel promote, Fly canary)]' \
                         '--env-file[With --execute: push KEY=VALUE env via Vercel, Fly, Netlify or Cloudflare (names-only record)]:env file:_files' \
+                        '--domain[With --execute: attach a custom domain and prove TLS with openssl]:hostname:' \
                         '--allow-unanchored[Proceed when the receipt records no baseline]' \
                         '--health-url[Health probe URL]:url:' \
                         '--auto-rollback[Roll back on a failed health probe]' \
@@ -194,6 +195,8 @@ function _loki {
                         '--receipt[Cited receipt file for a deploy record]:receipt:_files' \
                         '--max-age[Reject a receipt older than DUR]:duration:' \
                         '--require-exogenous[Exit 4 when a VERIFIED receipt has no agent-independent passing check]' \
+                        '--explain[List each gate as exogenous or agent-influenced with the evidence it read]' \
+                        '--json[Print the verdict and gates as JSON on stdout]' \
                         '--seal-composite[Sign a workspace composite]:run dir:_directories' \
                         '--help[Show help]' \
                         '*:receipt or deploy record:_files'
@@ -301,7 +304,7 @@ function _loki_commands {
         'verify-pr:Verify a PR against its linked issue in a sandbox'
         'queue:Overnight issue queue with a morning digest'
         'issues:Run every open issue in a repo and open PRs'
-        'undo:Show what undoing a run would do (read-only plan)'
+        'undo:Show what undoing a run would do (read-only plan; --dry-run adds the diffstat)'
         'chat:Interactive chat session (run, attach)'
         'route:Print the engine, provider and model route without running'
         'edit:Make a scoped edit to files'

package/completions/loki.bash

@@ -150,7 +150,7 @@ _loki_completion() {
 
         deploy)
             if [[ "$cur" == -* ]]; then
-                COMPREPLY=( $(compgen -W "--execute --destination --canary --env-file --health-url --health-match --auto-rollback --dir --no-clip --allow-unanchored --help" -- "$cur") )
+                COMPREPLY=( $(compgen -W "--execute --destination --canary --env-file --domain --health-url --health-match --auto-rollback --dir --no-clip --allow-unanchored --help" -- "$cur") )
                 return 0
             fi
             ;;

package/dashboard/__init__.py

@@ -7,6 +7,6 @@ Modules:
     control: Session control helpers (status, atomic writes, origin check)
 """
 
-__version__ = "11.17.36"
+__version__ = "11.17.38"
 
 __all__ = ["__version__"]

package/docs/CLI-REFERENCE.md

@@ -1,6 +1,6 @@
 # CLI reference
 
-Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.17.36. Do not edit by hand.
+Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.17.38. Do not edit by hand.
 Hidden and legacy-only commands are omitted; see `docs/v10/CLI-MODERN.md` for the full inventory.
 
 | Command | Description |

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 Loki Mode, by [Autonomi](https://www.autonomi.dev/), turns a spec or an issue into a verified pull request with a receipt you can check. This page covers installing it, a first run, and the options around it.
 
-**Version:** v11.17.36
+**Version:** v11.17.38
 
 **Engine note:** `loki start` is the primary command. `loki start`, `loki "<task>"`, `loki owner/repo#N` and `loki quick` all run the Loki 10 engine, whatever the flag order or input form (PRD file, issue ref, task or one-word brief). The previous loop runs only on `--engine legacy`, `LOKI_ENGINE=legacy`, or for one call when a flag Loki 10 cannot honor is present. See the [user guide](v10/GUIDE.md) and the [5-minute quickstart](QUICKSTART.md).
 

package/docs/v10/BOARD.md

@@ -1009,7 +1009,7 @@ Source: ~/git/autonomi-dev/research/2026-09-30-adoption/SWARM-PROMPT-ADOPTION.md
 | TEN-DEPLOY-03 | Ship the provenance doc with the build and prove the live URL serves the verified SHA | autonomy/loki (_deploy_try_execute pre-exec and post-health blocks, _deploy_record live_binding field only), tests/test-deploy-receipt-gate.sh (new section), docs/WORKSPACES.md, CHANGELOG.md | HIGH | see Wall in note | ready@2026-10-17T01:40Z | SPLIT per CTO critic into (a) provenance file into deploy root per project type, (b) post-deploy live-binding probe; build as two commits or two agents. wave 3; depends: TEN-DEPLOY-01, TEN-DEPLOY-02. Goal: In _deploy_try_execute, after the gate passes and before the provider runs, write a signed .well-known/loki-provenance.json into the deploy root via `verify --sign-provenance`. The deploy root is public/ for nextjs and vite, the detected dist/ or build/ for static, and is refused with a reason for docker/python where no static root exists. Write it as an untracked build artifact so the dirty-tree gate is evaluated before it. After the deploy, probe <deployed_url>/.well-known/loki-provenance.json. Set live_binding=VERIFIED only when its head_sha equals the anchor. A mismatch gives FAILED_HEALTH exit 4 (stale or wrong build served). Update docs/WORKSPACES.md and replace 'deployed-SHA binding is not implemented' with what is now bound and what is not. Wall: RED: a stubbed vercel copies dist/ into a served dir and a python http.server serves it. On main, no provenance file exists and the record has no live_binding. GREEN: the file exists in dist/.well-known, live_binding=VERIFIED, and its head_sha equals git rev-parse HEAD. A stub that serves an older provenance gives FAILED_HEALTH exit 4. A docker project prints the refusal reason and records live_binding=unsupported, never VERIFIED. The dirty-tree gate still refuses a dirty tree before the file is written. MUTATION: compare against a constant instead of the anchor and the stale-serve case goes red. Gate: bash -n autonomy/loki && shellcheck -S warning autonomy/loki && bash tests/test-deploy-receipt-gate.sh && (cd loki-ts && bun test tests/engine10/verify_cmd.test.ts) Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
 | TEN-DEPLOY-04 | Verified deploy badge from loki status --badge | loki-ts/src/commands/status.ts (renderLastDeploy plus --badge flag parse only), loki-ts/tests/commands/status.test.ts, CHANGELOG.md | MEDIUM | see Wall in note | released@2026-10-17T05:06Z | wave 4; depends: TEN-DEPLOY-01 (deployed_url field); live_binding from TEN-DEPLOY-03 is read if present, and its absence omits the badge. Goal: `loki status --badge` reads the newest loki.deploy/1 record (renderLastDeploy already loads it) and verifies it through the existing verify path. It prints a markdown shields badge linking to <deployed_url>/.well-known/loki-provenance.json. The message is 'deployed: verified' (brightgreen) ONLY when the record verifies and live_binding=VERIFIED. 'deployed: unverified' (red) is printed for TAMPERED or a failed health check. In all other cases the badge is omitted with a one-line reason. It never prints green from an unchecked field. The color mapping matches the share badge (autonomy/loki:38291), and no new vocabulary is added. Wall: RED: status.test.ts fixture with a signed healthy record, live_binding=VERIFIED and deployed_url. On main, --badge is unknown and no badge line is printed. GREEN: the badge line contains 'brightgreen' and deployed_url. A record with health FAILED_HEALTH gives a red badge. An unsigned record or a missing live_binding omits the badge and prints the reason. A record with no deployed_url omits the badge. MUTATION: drop the verify call and the unsigned case goes green, so the test goes red. Gate: cd loki-ts && bun test tests/commands/status.test.ts && bunx tsc --noEmit && bash tests/test-status-surface-agrees.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
 | TEN-DEPLOY-05 | loki deploy --env-file: push env to the provider with names-only records | autonomy/loki (cmd_deploy arg parse for --env-file, _deploy_try_execute env step, _deploy_record env_keys field only), tests/test-deploy-receipt-gate.sh (new section), autonomy/completions (loki deploy flag list only), CHANGELOG.md | HIGH | see Wall in note | released v11.17.35 | SPLIT per CTO critic into (a) env-file parser, .env.example check, masking, env_keys record, (b) four provider verbs; build as two commits or two agents. wave 4; depends: TEN-DEPLOY-03 (same function, serialized to avoid conflicts). Goal: `--env-file FILE` (with --execute only) parses KEY=VALUE with no shell eval. It refuses when a key in .env.example is missing from FILE, naming the keys. Env is applied through documented verbs only: Vercel `vercel --prod -e K=V` per key (args built as an array, never through the shell); Fly `fly secrets set --stage K=V ...` before `fly deploy`; Netlify `netlify env:import FILE`; Cloudflare `wrangler secret bulk FILE`. An unsupported provider refuses with nothing run. The record stores env_keys (names, sorted) and env_source; it NEVER stores values. Values never appear in stdout, the record or the printed 'Running:' line, where they are masked as K=***. Wall: RED: a recording vercel stub logs argv. On main, --env-file is ignored and no -e args appear. GREEN: argv has `-e API_URL=x -e TOKEN=s3cr3t`. Grepping stdout, stderr and the record for s3cr3t finds nothing; env_keys=[API_URL,TOKEN]. When .env.example lists DB_URL and the env file lacks it, the command refuses with rc 1, no stub calls and DB_URL named. A value with $(touch pwned) leaves no file named pwned. MUTATION: write values into the record and the secret-grep goes red. Gate: bash -n autonomy/loki && shellcheck -S warning autonomy/loki && bash tests/test-deploy-receipt-gate.sh && bash tests/test-completion-drift.sh (or whichever completion drift test the CHANGELOG cites) Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
-| TEN-DEPLOY-06 | loki deploy --domain: attach a custom domain and prove TLS | autonomy/loki (cmd_deploy --domain parse and a post-health domain block in _deploy_try_execute, _deploy_record domain/tls fields only), tests/test-deploy-receipt-gate.sh (new section), CHANGELOG.md | MEDIUM | see Wall in note | ready@2026-10-17T01:40Z | wave 5; depends: TEN-DEPLOY-05 (same function, serialized). Goal: `--domain example.com` (with --execute) runs documented verbs after a healthy deploy: Vercel `vercel alias set <deployed_url> <domain>`; Fly `fly certs add <domain>`. Netlify and Cloudflare print the manual dashboard step and set domain_status=manual. Then a TLS proof runs: `openssl s_client -servername <domain> -connect <domain>:443` plus `openssl x509 -noout -enddate -checkend 604800`. It records domain, tls_status (valid/expiring/invalid/unchecked) and tls_not_after, and re-probes https://<domain>/.well-known/loki-provenance.json for the same head_sha. DNS not yet pointed gives tls_status=invalid and exit 6, with the DNS record the provider needs printed. It never claims valid without the openssl check. Wall: RED: vercel, openssl and curl are stubbed. On main, --domain is ignored. GREEN: the alias set argv is recorded, tls_status=valid and tls_not_after is set. An openssl stub that fails -checkend gives expiring. An openssl handshake failure gives invalid and exit 6. A netlify project gives domain_status=manual, no alias call, and tls still checked. No openssl on PATH gives unchecked, never valid. MUTATION: default tls_status to valid and the missing-openssl case goes red. Gate: bash -n autonomy/loki && shellcheck -S warning autonomy/loki && bash tests/test-deploy-receipt-gate.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
+| TEN-DEPLOY-06 | loki deploy --domain: attach a custom domain and prove TLS | autonomy/loki (cmd_deploy --domain parse and a post-health domain block in _deploy_try_execute, _deploy_record domain/tls fields only), tests/test-deploy-receipt-gate.sh (new section), CHANGELOG.md | MEDIUM | see Wall in note | released v11.17.38 | wave 5; depends: TEN-DEPLOY-05 (same function, serialized). Goal: `--domain example.com` (with --execute) runs documented verbs after a healthy deploy: Vercel `vercel alias set <deployed_url> <domain>`; Fly `fly certs add <domain>`. Netlify and Cloudflare print the manual dashboard step and set domain_status=manual. Then a TLS proof runs: `openssl s_client -servername <domain> -connect <domain>:443` plus `openssl x509 -noout -enddate -checkend 604800`. It records domain, tls_status (valid/expiring/invalid/unchecked) and tls_not_after, and re-probes https://<domain>/.well-known/loki-provenance.json for the same head_sha. DNS not yet pointed gives tls_status=invalid and exit 6, with the DNS record the provider needs printed. It never claims valid without the openssl check. Wall: RED: vercel, openssl and curl are stubbed. On main, --domain is ignored. GREEN: the alias set argv is recorded, tls_status=valid and tls_not_after is set. An openssl stub that fails -checkend gives expiring. An openssl handshake failure gives invalid and exit 6. A netlify project gives domain_status=manual, no alias call, and tls still checked. No openssl on PATH gives unchecked, never valid. MUTATION: default tls_status to valid and the missing-openssl case goes red. Gate: bash -n autonomy/loki && shellcheck -S warning autonomy/loki && bash tests/test-deploy-receipt-gate.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
 | TEN-DEPLOY-07 | loki github publish: receipt-stamped GitHub export from the CLI | autonomy/loki (cmd_github publish arm and its help line only), tests/test-github-publish.sh (new: no existing test owns cmd_github repo creation; test-proven-pr-check.sh covers PR checks only) plus its run-all-tests.sh registration and shard row, CHANGELOG.md | MEDIUM | see Wall in note | released@2026-10-17T03:50Z | merged efa201ffd (TL APPROVE 81346df2a) Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
 | TEN-DEPLOY-08 | Web app deploy and GitHub push go through the gated CLI; no fabricated URLs | web-app/server.py (deploy_session ~5236-5336 and github_push_session ~5339-5395 only), web-app/tests/test_server.py (new cases), CHANGELOG.md | HIGH | see Wall in note | released v11.17.35 | SPLIT per CTO critic into (a) deploy_session, (b) github_push_session plus web-app url:null handling; build as two commits or two agents. wave 4; depends: TEN-DEPLOY-01 (deployed_url), TEN-DEPLOY-07 (github publish). Goal: Replace the bodies of deploy_session and github_push_session in web-app/server.py. Deploy runs `loki deploy --execute --dir <session_dir>` as an argv list with a timeout, then reads the newest <session>/.loki/deploys/*.json. It returns {url: deployed_url or null, health_status, live_binding, record_path, refused_reasons} and exits non-2xx on refusal. The platform param is kept as a hint only when it matches the CLI's detected provider; otherwise it returns 409 with the reason. GitHub push calls `loki github publish` (private default). Delete the hardcoded https://vercel.app, https://netlify.app and https://github.io fallbacks and the `git add -A` / `--public` path in the same change. Wall: RED: test_server.py with monkeypatched subprocess. On main, a deploy whose output has no URL returns url='https://vercel.app' (assert url is None fails), and no receipt gate is invoked. GREEN: the subprocess argv is [loki, deploy, --execute, --dir, <dir>]. A gate refusal returns 4xx with the reasons. A no-URL deploy returns url null. A github push argv contains `github publish` and never `add -A`. `grep -n 'https://vercel.app\/https://netlify.app\/"https://github.io"' web-app/server.py` exits 1. MUTATION: restore a fallback URL and the null-URL test goes red. Gate: python3 -m pytest web-app/tests/test_server.py -q && bash tests/moat/p7-no-fabricated-data.sh && bash tests/test-web-app-no-orphan-components.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
 | TEN-DEPLOY-09 | One-click from loki start and loki chat: pass the new deploy flags through | autonomy/loki (cmd_start _ps_ deploy parse block ~2625-2690 only), loki-ts/src/commands/start.ts (help string ~148-151 only), autonomy/lib/chat.sh (help line 53, system prompt line 6, _chat_deploy echo only), tests/test-help-start-flags.sh, docs/DEPLOYMENT.md, CHANGELOG.md | LOW | see Wall in note | building@2026-10-17T05:48Z | SPLIT per CTO critic into (a) start passthrough, (b) chat and docs text; build as two commits or two agents. wave 5; depends: TEN-DEPLOY-05, TEN-DEPLOY-06, TEN-DEPLOY-07. Goal: `loki start --deploy` passes --destination, --canary, --env-file, --domain and --github through to cmd_deploy. --github runs `loki github publish` after a successful deploy. Flag validation uses the existing _ps_ pattern (a value must not start with '-'). Bun-route start.ts help text lists them, and the PATH-slice divert keeps routing --deploy to bash. chat.sh `/deploy` help and _LOKI_CHAT_SYSTEM_PROMPT mention --domain, --env-file and `loki verify --url`, and the confirm prompt prints the full argv. docs/DEPLOYMENT.md gets one end-to-end 'brief to verified URL' section. Wall: RED: test-help-start-flags.sh asserts `loki start --help` lists --domain and --env-file, and a stubbed cmd_deploy recorder receives `--domain x.com --env-file .env` from `loki start --deploy --domain x.com --env-file .env`. It fails on main. GREEN: both pass. `--domain --env-file` (flag-shaped value) exits 2. A non-zero start exit still never deploys. MUTATION: drop the --domain forward and the recorder assertion goes red. Gate: bash -n autonomy/loki autonomy/lib/chat.sh && bash tests/test-help-start-flags.sh && (cd loki-ts && bun test tests/commands/start.test.ts && bunx tsc --noEmit) && bash tests/test-help-drift.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
@@ -1125,28 +1125,30 @@ Source: ~/git/autonomi-dev/research/2026-09-30-adoption/SWARM-PROMPT-ADOPTION.md
 | TEN-QUALITY-11 | enhancement: a Python repo with uv.lock and no .venv runs tests and lint through uv run as the project interpreter | loki-ts/src/engine10/stages/verify.ts (resolveTool only, at most 3 core lines), loki-ts/tests/engine10/verify.test.ts | MEDIUM | red: uv.lock repo without .venv gets interpreter system and 'tests ran on the system interpreter' NOT PROVEN (verify.ts:43,339); green: interpreter project via uv run; no uv on PATH keeps today's system result | released v11.17.36 | goal: avoid a false PARTIAL for uv projects; verify.ts has no uv handling today |
 | TEN-QUALITY-12 | enhancement: repo map cap configurable (LOKI_E10_REPOMAP_MAX_FILES) and truncation drops vendored or generated dirs before source | loki-ts/src/engine10/repomap.ts (at most 3 core lines), loki-ts/tests/engine10/repomap.test.ts | LOW | red: 2500-file repo with 1500 vendor/ files maps mostly vendor and ignores the env knob; green: knob honored, vendor/ node_modules dist dropped first, default 2000 unchanged | released v11.17.36 | goal: plan context quality on large repos; complements TEN-QUALITY-10 with no shared file |
 | TEN-DEPLOY-04-F1 | register --badge in dispatcher route, help, registry and completions | loki-ts/src/commands/run_status.ts, registry.ts, cli.ts, autonomy/loki, help-core.sh, completions | LOW | help-changelog drift and completions coverage pass; removing the route line turns the status test red | released@2026-10-17T05:34Z v11.17.24 | TL APPROVE 50579a177 |
-| TEN-COST-11-F1 | enhancement: direct test for the machine.ts wall-stage distrust call (TEN-COST-11 review follow-up) | loki-ts/tests/engine10/machine.test.ts | LOW | wall base run green while implement changed files must yield already_satisfied false and base_run unproven; red mutation: delete the distrustGreenBase call at machine.ts:221 turns the test red; cd loki-ts && bunx tsc --noEmit && bun test tests/engine10/machine.test.ts | ready@2026-10-17T07:00Z | goal: pin the fail-closed branch (machine.ts:221) that has no direct test; test only, no src change |
-| TEN-COST-28 | feature: per-stage share of spend printed in the cost summary (plan, wall, implement, fix, xreview) with the top stage named | loki-ts/src/engine10/cost.ts, loki-ts/tests/engine10/cost.test.ts | MEDIUM | red: summary shows only a total; green: stage shares sum to 100 percent, unmetered stages say unmetered not 0; cd loki-ts && bunx tsc --noEmit && bun test tests/engine10/cost.test.ts | ready@2026-10-17T07:00Z | goal: make the 2x cost proof attributable; grep cost.ts for an existing by-stage field first |
-| TEN-COST-29 | enhancement: flag a cache-cold stage (cache read under 30 percent of input) with one line in the cost breakdown | loki-ts/src/util/cost_breakdown.ts, loki-ts/tests/engine10/cost_unmetered.test.ts | LOW | red: a stage with 5 percent cache reads prints no hint; green: one 'cache cold: <stage>' line, none when all stages are warm or unmetered; cd loki-ts && bunx tsc --noEmit && bun test tests/engine10/cost_unmetered.test.ts | ready@2026-10-17T07:00Z | goal: surface the biggest cost lever (prefix cache hit) per run |
-| TEN-COST-30 | fix: an unknown cost.profile value in loki.yaml or --cost (for example 'leen') warns once and names the valid profiles instead of silently using default | loki-ts/src/util/cost_profile.ts, loki-ts/tests/util/cost_profile.test.ts | MEDIUM | red: 'leen' resolves to default with no message; green: one stderr warning naming lean and default, valid values unchanged and quiet mode keeps stdout clean; cd loki-ts && bunx tsc --noEmit && bun test tests/util/cost_profile.test.ts | ready@2026-10-17T07:00Z | goal: a typo must not forfeit the cost win silently; follows TEN-COST-27 |
-| TEN-SPEED-03 | feature: run summary Time line names the slowest stage and its share of wall time | loki-ts/src/util/run_summary.ts, loki-ts/tests/util/run_summary.test.ts | LOW | red: Time line has total only; green: 'slowest: <stage> NN%' appended, omitted when stage durations are missing; cd loki-ts && bunx tsc --noEmit && bun test tests/util/run_summary.test.ts | ready@2026-10-17T07:00Z | goal: speed work needs a visible per-run bottleneck |
-| TEN-SPEED-04 | enhancement: repo map and test map reused across fix rounds when the git tree hash is unchanged | loki-ts/src/engine10/cache.ts, loki-ts/tests/engine10/cache.test.ts | MEDIUM | red: second fix round rebuilds the map with identical tree; green: cache hit counted, miss when tree hash differs; cd loki-ts && bunx tsc --noEmit && bun test tests/engine10/cache.test.ts | ready@2026-10-17T07:00Z | goal: cut seconds per fix round; read cache.ts key first and skip if the tree hash is already in the key |
-| TEN-SPEED-05 | fix: back-to-back loki start runs reuse a successful claude login probe for 10 minutes instead of re-spawning the CLI every time | loki-ts/src/engine10/preflight.ts, loki-ts/tests/engine10/preflight.test.ts | MEDIUM | red: two starts inside 10 min spawn the probe twice; green: second reuses the result, a failed probe is never cached, TTL expiry re-probes; cd loki-ts && bunx tsc --noEmit && bun test tests/engine10/preflight.test.ts | ready@2026-10-17T07:00Z | goal: shave start latency without hiding a logged-out state |
-| TEN-QUALITY-13 | feature: cross-review (xreview) prompt carries the intent card Acceptance lines and the verdict names any line left unmet | loki-ts/src/engine10/stages/xreview.ts, loki-ts/tests/engine10/xreview.test.ts | MEDIUM | red: reviewer prompt omits acceptance lines; green: prompt includes them, verdict lists unmet lines, absent card keeps today's prompt byte-identical; cd loki-ts && bunx tsc --noEmit && bun test tests/engine10/xreview.test.ts | ready@2026-10-17T07:00Z | goal: review checks what the user asked, not only the diff |
-| TEN-QUALITY-14 | enhancement: Wall authoring prompt requires one negative-case assertion (rejects bad input or fails before the fix) per acceptance line | loki-ts/src/engine10/stages/wall.ts, loki-ts/tests/engine10/wall.test.ts | MEDIUM | red: prompt has no negative-case rule; green: rule present, prompt size growth under 400 chars, existing wall tests green; cd loki-ts && bunx tsc --noEmit && bun test tests/engine10/wall.test.ts | ready@2026-10-17T07:00Z | goal: stronger Wall checks reject wrong implementations; wall.ts line budget applies (shrink-or-flat) |
-| TEN-QUALITY-15 | fix: fix rounds stop retrying the same model when the failing test set is identical two rounds in a row and escalate once | loki-ts/src/engine10/stages/fix.ts, loki-ts/tests/engine10/fix.test.ts | MEDIUM | red: identical failure signature loops on the same model to the round cap; green: escalates once then stops with a stalled reason; cd loki-ts && bunx tsc --noEmit && bun test tests/engine10/fix.test.ts | ready@2026-10-17T07:00Z | goal: stop wasted fix spend; grep stallClimb in unit_model.ts and reuse it, do not duplicate |
-| TEN-GATES-14 | feature: loki verify --explain lists each gate with exogenous or agent-influenced and the evidence it read | loki-ts/src/engine10/verify_cmd.ts, loki-ts/tests/engine10/verify_cmd.test.ts | HIGH | red: --explain is an unknown flag; green: one line per gate, exit code unchanged, --json carries the same fields; cd loki-ts && bunx tsc --noEmit && bun test tests/engine10/verify_cmd.test.ts | ready@2026-10-17T07:00Z | goal: make the moat legible to buyers; read-only output, no verdict change |
+| TEN-COST-11-F1 | enhancement: direct test for the machine.ts wall-stage distrust call (TEN-COST-11 review follow-up) | loki-ts/tests/engine10/machine.test.ts | LOW | wall base run green while implement changed files must yield already_satisfied false and base_run unproven; red mutation: delete the distrustGreenBase call at machine.ts:221 turns the test red; cd loki-ts && bunx tsc --noEmit && bun test tests/engine10/machine.test.ts | released v11.17.37 | goal: pin the fail-closed branch (machine.ts:221) that has no direct test; test only, no src change |
+| TEN-COST-28 | feature: per-stage share of spend printed in the cost summary (plan, wall, implement, fix, xreview) with the top stage named | loki-ts/src/engine10/cost.ts, loki-ts/tests/engine10/cost.test.ts | MEDIUM | red: summary shows only a total; green: stage shares sum to 100 percent, unmetered stages say unmetered not 0; cd loki-ts && bunx tsc --noEmit && bun test tests/engine10/cost.test.ts | released v11.17.37 | goal: make the 2x cost proof attributable; grep cost.ts for an existing by-stage field first |
+| TEN-COST-29 | enhancement: flag a cache-cold stage (cache read under 30 percent of input) with one line in the cost breakdown | loki-ts/src/util/cost_breakdown.ts, loki-ts/tests/engine10/cost_unmetered.test.ts | LOW | red: a stage with 5 percent cache reads prints no hint; green: one 'cache cold: <stage>' line, none when all stages are warm or unmetered; cd loki-ts && bunx tsc --noEmit && bun test tests/engine10/cost_unmetered.test.ts | released v11.17.38 | goal: surface the biggest cost lever (prefix cache hit) per run |
+| TEN-COST-30 | fix: an unknown cost.profile value in loki.yaml or --cost (for example 'leen') warns once and names the valid profiles instead of silently using default | loki-ts/src/util/cost_profile.ts, loki-ts/tests/util/cost_profile.test.ts | MEDIUM | red: 'leen' resolves to default with no message; green: one stderr warning naming lean and default, valid values unchanged and quiet mode keeps stdout clean; cd loki-ts && bunx tsc --noEmit && bun test tests/util/cost_profile.test.ts | released v11.17.38 | goal: a typo must not forfeit the cost win silently; follows TEN-COST-27 |
+| TEN-SPEED-03 | feature: run summary Time line names the slowest stage and its share of wall time | loki-ts/src/util/run_summary.ts, loki-ts/tests/util/run_summary.test.ts | LOW | red: Time line has total only; green: 'slowest: <stage> NN%' appended, omitted when stage durations are missing; cd loki-ts && bunx tsc --noEmit && bun test tests/util/run_summary.test.ts | released v11.17.37 | goal: speed work needs a visible per-run bottleneck |
+| TEN-SPEED-04 | enhancement: repo map and test map reused across fix rounds when the git tree hash is unchanged | loki-ts/src/engine10/cache.ts, loki-ts/tests/engine10/cache.test.ts | MEDIUM | red: second fix round rebuilds the map with identical tree; green: cache hit counted, miss when tree hash differs; cd loki-ts && bunx tsc --noEmit && bun test tests/engine10/cache.test.ts | released v11.17.38 | goal: cut seconds per fix round; read cache.ts key first and skip if the tree hash is already in the key |
+| TEN-SPEED-05 | fix: back-to-back loki start runs reuse a successful claude login probe for 10 minutes instead of re-spawning the CLI every time | loki-ts/src/engine10/preflight.ts, loki-ts/tests/engine10/preflight.test.ts | MEDIUM | red: two starts inside 10 min spawn the probe twice; green: second reuses the result, a failed probe is never cached, TTL expiry re-probes; cd loki-ts && bunx tsc --noEmit && bun test tests/engine10/preflight.test.ts | released v11.17.38 | goal: shave start latency without hiding a logged-out state |
+| TEN-QUALITY-13 | feature: cross-review (xreview) prompt carries the intent card Acceptance lines and the verdict names any line left unmet | loki-ts/src/engine10/stages/xreview.ts, loki-ts/tests/engine10/xreview.test.ts | MEDIUM | red: reviewer prompt omits acceptance lines; green: prompt includes them, verdict lists unmet lines, absent card keeps today's prompt byte-identical; cd loki-ts && bunx tsc --noEmit && bun test tests/engine10/xreview.test.ts | released v11.17.37 | goal: review checks what the user asked, not only the diff |
+| TEN-QUALITY-14 | enhancement: Wall authoring prompt requires one negative-case assertion (rejects bad input or fails before the fix) per acceptance line | loki-ts/src/engine10/stages/wall.ts, loki-ts/tests/engine10/wall.test.ts | MEDIUM | red: prompt has no negative-case rule; green: rule present, prompt size growth under 400 chars, existing wall tests green; cd loki-ts && bunx tsc --noEmit && bun test tests/engine10/wall.test.ts | released v11.17.38 | goal: stronger Wall checks reject wrong implementations; wall.ts line budget applies (shrink-or-flat) |
+| TEN-QUALITY-15 | fix: fix rounds stop retrying the same model when the failing test set is identical two rounds in a row and escalate once | loki-ts/src/engine10/stages/fix.ts, loki-ts/tests/engine10/fix.test.ts | MEDIUM | red: identical failure signature loops on the same model to the round cap; green: escalates once then stops with a stalled reason; cd loki-ts && bunx tsc --noEmit && bun test tests/engine10/fix.test.ts | released v11.17.38 | goal: stop wasted fix spend; grep stallClimb in unit_model.ts and reuse it, do not duplicate |
+| TEN-GATES-14 | feature: loki verify --explain lists each gate with exogenous or agent-influenced and the evidence it read | loki-ts/src/engine10/verify_cmd.ts, loki-ts/tests/engine10/verify_cmd.test.ts | HIGH | red: --explain is an unknown flag; green: one line per gate, exit code unchanged, --json carries the same fields; cd loki-ts && bunx tsc --noEmit && bun test tests/engine10/verify_cmd.test.ts | released v11.17.37 | goal: make the moat legible to buyers; read-only output, no verdict change |
 | TEN-GATES-15 | enhancement: Seal receipt records the seeded-defect corpus version and catch rate used for the ablation gate | loki-ts/src/engine10/stages/seal.ts, loki-ts/tests/engine10/seal_verify_roundtrip.test.ts | HIGH | red: receipt lacks corpus id; green: corpus version and rate in the signed payload and loki verify rejects a tampered value; cd loki-ts && bunx tsc --noEmit && bun test tests/engine10/seal_verify_roundtrip.test.ts | ready@2026-10-17T07:00Z | goal: tie the load-bearing claim to evidence; builds on TEN-GATES-12/13 (released) |
-| TEN-GATES-16 | fix: loki verify reports DRIFT, not OK, when HEAD moved after the seal and the changed paths overlap the sealed diff | loki-ts/src/util/seal_drift.ts, loki-ts/tests/engine10/log_seal.test.ts | HIGH | red: sealed run then an amend on a sealed path still verifies OK; green: DRIFT with the path named, unrelated commits keep OK; cd loki-ts && bunx tsc --noEmit && bun test tests/engine10/log_seal.test.ts | ready@2026-10-17T07:00Z | goal: a seal must not vouch for code it did not see; read seal_drift.ts first and extend it |
-| TEN-UX-13 | feature: loki undo --dry-run prints the diffstat it would revert and changes nothing | loki-ts/src/commands/undo.ts, loki-ts/tests/commands/undo.test.ts | LOW | red: --dry-run unknown or applies the revert; green: diffstat printed, tree and HEAD unchanged, exit 0; cd loki-ts && bunx tsc --noEmit && bun test tests/commands/undo.test.ts | ready@2026-10-17T07:00Z | goal: safe undo; new test file because no existing test owns undo.ts (rollback.test.ts covers rollback.ts only) |
-| TEN-UX-14 | enhancement: loki queue list shows age and status columns and a count footer | loki-ts/src/commands/queue.ts, loki-ts/tests/commands/queue.test.ts | LOW | red: list prints ids only; green: id, age, status columns and 'N queued' footer, empty queue prints a next step; cd loki-ts && bunx tsc --noEmit && bun test tests/commands/queue.test.ts | ready@2026-10-17T07:00Z | goal: queue is inspectable at a glance |
-| TEN-UX-15 | fix: shell completions list flags added after the completion table was written (--probe, --badge, --cost) from the registry | loki-ts/src/commands/completion.ts, loki-ts/tests/commands/cli_help_routes.test.ts | LOW | red: completion output lacks a registered flag; green: every flag in registry.ts appears for its command; cd loki-ts && bunx tsc --noEmit && bun test tests/commands/cli_help_routes.test.ts | ready@2026-10-17T07:00Z | goal: no hand-maintained drift; derive from registry |
-| TEN-ADOPTION-11 | feature: loki trust prints a copyable README badge snippet for the last sealed run | loki-ts/src/commands/trust.ts, loki-ts/tests/commands/trust.test.ts | MEDIUM | red: no snippet; green: markdown snippet pointing at the verified badge, absent when no sealed run (prints the next step); cd loki-ts && bunx tsc --noEmit && bun test tests/commands/trust.test.ts | ready@2026-10-17T07:00Z | goal: every sealed repo advertises Loki; reuse the TEN-DEPLOY-04 badge output |
-| TEN-ADOPTION-12 | enhancement: after an upgrade the next loki start prints a one-line what-is-new once | loki-ts/src/util/update_check.ts, loki-ts/tests/util/update_check.test.ts | LOW | red: no notice after version change; green: one line once per version, none in quiet or CI mode; cd loki-ts && bunx tsc --noEmit && bun test tests/util/update_check.test.ts | ready@2026-10-17T07:00Z | goal: retention; no network call added |
-| TEN-DEPLOY-11 | feature: loki rollback prints the provider rollback command (names only, no secrets) for the last deploy record | loki-ts/src/commands/rollback.ts, loki-ts/tests/commands/rollback.test.ts | MEDIUM | red: rollback ignores deploy records; green: prints provider command from the record, nothing when no record, no env values; cd loki-ts && bunx tsc --noEmit && bun test tests/commands/rollback.test.ts | ready@2026-10-17T07:00Z | goal: complete the deploy loop; read-only, never executes the provider command |
-| TEN-DEPLOY-12 | fix: loki status --probe retries once after 5 seconds before reporting a regression, so a cold start is not a false alarm | loki-ts/src/commands/status.ts, loki-ts/tests/commands/status.test.ts | MEDIUM | red: first 503 then 200 exits non-zero; green: retry passes exit 0, two failures exit non-zero, retry visible in output; cd loki-ts && bunx tsc --noEmit && bun test tests/commands/status.test.ts | ready@2026-10-17T07:00Z | goal: stop false regressions; depends on TEN-DEPLOY-10 (released v11.17.33) |
-| TEN-STABILITY-11 | enhancement: run_pid detects a reused PID by comparing process start time and treats it as dead | loki-ts/src/util/run_pid.ts, loki-ts/tests/engine10/run_pid.test.ts | MEDIUM | red: unrelated live process with the recorded PID blocks a new run; green: start-time mismatch treated as stale; cd loki-ts && bunx tsc --noEmit && bun test tests/engine10/run_pid.test.ts | ready@2026-10-17T07:00Z | goal: no phantom lock after reboot; never kill by name or pattern |
-| TEN-STABILITY-12 | fix: a truncated outbox entry left by a crash is quarantined and skipped, not fatal to the next start | loki-ts/src/util/outbox.ts, loki-ts/tests/util/outbox.test.ts | MEDIUM | red: half-written JSON entry throws on drain; green: entry moved to a quarantine name, the rest drain, one warning printed; cd loki-ts && bunx tsc --noEmit && bun test tests/util/outbox.test.ts | ready@2026-10-17T07:00Z | goal: crash-safe delivery |
-| TEN-SECURITY-01 | feature: the pre-PR secure scan also matches provider keys (sk-ant, AIza, xox[bp]-, ghp_) in added lines and blocks with the file and line | loki-ts/src/util/secure_scan.ts, loki-ts/tests/util/secure_scan.test.ts | HIGH | red: fixture with a runtime-built sk-ant key passes the scan; green: blocked naming file:line without echoing the secret, clean diff passes; cd loki-ts && bunx tsc --noEmit && bun test tests/util/secure_scan.test.ts | ready@2026-10-17T07:00Z | goal: no leaked key in a Loki PR; fixtures build keys at runtime (gitleaks rule); grep first, extend patterns only |
-| TEN-SECURITY-02 | fix: redact() strips URL userinfo (https://user:pass@host) and Authorization headers from logged and receipted output | loki-ts/src/util/redact.ts, loki-ts/tests/util/redact.test.ts | HIGH | red: https://u:p@host survives redact; green: userinfo replaced, plain URLs and existing redactions unchanged; cd loki-ts && bunx tsc --noEmit && bun test tests/util/redact.test.ts | ready@2026-10-17T07:00Z | goal: close a credential-in-log path; new test file because no existing test owns redact.ts |
-| TEN-GATES-17 | fix: a pre-existing test file the run edited must not count as agent-independent proof for loki verify --require-exogenous (reviewer finding on the n-key fix: status M edits keep provenance exogenous) | loki-ts/src/util/check_result.ts, loki-ts/tests/engine10/seal.test.ts | HIGH | red: a sealed run whose only passing check is a test file the run modified (status M, assertions weakened or replaced) passes --require-exogenous with rc 0; green: that check is advisory and --require-exogenous exits 4 while an untouched exogenous test still counts; cd loki-ts && bunx tsc --noEmit && bun test tests/engine10/seal.test.ts tests/engine10/verify_cmd.test.ts tests/engine10/budget.test.ts | ready@2026-10-17T06:55Z | Source: HIGH review of c958f563c. Grep checkProvenance and the A-119 edit rule first; decide whether to reuse the weakened-test detector instead of a blanket M rule, so legit test fixes stay exogenous. Record the call in DECISIONS.md if it changes D104. |
+| TEN-GATES-16 | fix: loki verify reports DRIFT, not OK, when HEAD moved after the seal and the changed paths overlap the sealed diff | loki-ts/src/util/seal_drift.ts, loki-ts/tests/engine10/log_seal.test.ts | HIGH | red: sealed run then an amend on a sealed path still verifies OK; green: DRIFT with the path named, unrelated commits keep OK; cd loki-ts && bunx tsc --noEmit && bun test tests/engine10/log_seal.test.ts | released v11.17.38 | goal: a seal must not vouch for code it did not see; read seal_drift.ts first and extend it |
+| TEN-UX-13 | feature: loki undo --dry-run prints the diffstat it would revert and changes nothing | loki-ts/src/commands/undo.ts, loki-ts/tests/commands/undo.test.ts | LOW | red: --dry-run unknown or applies the revert; green: diffstat printed, tree and HEAD unchanged, exit 0; cd loki-ts && bunx tsc --noEmit && bun test tests/commands/undo.test.ts | released v11.17.37 | goal: safe undo; new test file because no existing test owns undo.ts (rollback.test.ts covers rollback.ts only) |
+| TEN-UX-14 | enhancement: loki queue list shows age and status columns and a count footer | loki-ts/src/commands/queue.ts, loki-ts/tests/commands/queue.test.ts | LOW | red: list prints ids only; green: id, age, status columns and 'N queued' footer, empty queue prints a next step; cd loki-ts && bunx tsc --noEmit && bun test tests/commands/queue.test.ts | released v11.17.38 | goal: queue is inspectable at a glance |
+| TEN-UX-15 | fix: shell completions list flags added after the completion table was written (--probe, --badge, --cost) from the registry | loki-ts/src/commands/completion.ts, loki-ts/tests/commands/cli_help_routes.test.ts | LOW | red: completion output lacks a registered flag; green: every flag in registry.ts appears for its command; cd loki-ts && bunx tsc --noEmit && bun test tests/commands/cli_help_routes.test.ts | released v11.17.38 | goal: no hand-maintained drift; derive from registry |
+| TEN-ADOPTION-11 | feature: loki trust prints a copyable README badge snippet for the last sealed run | loki-ts/src/commands/trust.ts, loki-ts/tests/commands/trust.test.ts | MEDIUM | red: no snippet; green: markdown snippet pointing at the verified badge, absent when no sealed run (prints the next step); cd loki-ts && bunx tsc --noEmit && bun test tests/commands/trust.test.ts | released v11.17.38 | goal: every sealed repo advertises Loki; reuse the TEN-DEPLOY-04 badge output |
+| TEN-ADOPTION-12 | enhancement: after an upgrade the next loki start prints a one-line what-is-new once | loki-ts/src/util/update_check.ts, loki-ts/tests/util/update_check.test.ts | LOW | red: no notice after version change; green: one line once per version, none in quiet or CI mode; cd loki-ts && bunx tsc --noEmit && bun test tests/util/update_check.test.ts | released v11.17.38 | goal: retention; no network call added |
+| TEN-DEPLOY-11 | feature: loki rollback prints the provider rollback command (names only, no secrets) for the last deploy record | loki-ts/src/commands/rollback.ts, loki-ts/tests/commands/rollback.test.ts | MEDIUM | red: rollback ignores deploy records; green: prints provider command from the record, nothing when no record, no env values; cd loki-ts && bunx tsc --noEmit && bun test tests/commands/rollback.test.ts | released v11.17.37 | goal: complete the deploy loop; read-only, never executes the provider command |
+| TEN-DEPLOY-12 | fix: loki status --probe retries once after 5 seconds before reporting a regression, so a cold start is not a false alarm | loki-ts/src/commands/status.ts, loki-ts/tests/commands/status.test.ts | MEDIUM | red: first 503 then 200 exits non-zero; green: retry passes exit 0, two failures exit non-zero, retry visible in output; cd loki-ts && bunx tsc --noEmit && bun test tests/commands/status.test.ts | released v11.17.38 | goal: stop false regressions; depends on TEN-DEPLOY-10 (released v11.17.33) |
+| TEN-STABILITY-11 | enhancement: run_pid detects a reused PID by comparing process start time and treats it as dead | loki-ts/src/util/run_pid.ts, loki-ts/tests/engine10/run_pid.test.ts | MEDIUM | red: unrelated live process with the recorded PID blocks a new run; green: start-time mismatch treated as stale; cd loki-ts && bunx tsc --noEmit && bun test tests/engine10/run_pid.test.ts | released v11.17.37 | goal: no phantom lock after reboot; never kill by name or pattern |
+| TEN-STABILITY-12 | fix: a truncated outbox entry left by a crash is quarantined and skipped, not fatal to the next start | loki-ts/src/util/outbox.ts, loki-ts/tests/util/outbox.test.ts | MEDIUM | red: half-written JSON entry throws on drain; green: entry moved to a quarantine name, the rest drain, one warning printed; cd loki-ts && bunx tsc --noEmit && bun test tests/util/outbox.test.ts | released v11.17.38 | goal: crash-safe delivery |
+| TEN-SECURITY-01 | feature: the pre-PR secure scan also matches provider keys (sk-ant, AIza, xox[bp]-, ghp_) in added lines and blocks with the file and line | loki-ts/src/util/secure_scan.ts, loki-ts/tests/util/secure_scan.test.ts | HIGH | red: fixture with a runtime-built sk-ant key passes the scan; green: blocked naming file:line without echoing the secret, clean diff passes; cd loki-ts && bunx tsc --noEmit && bun test tests/util/secure_scan.test.ts | released v11.17.38 | goal: no leaked key in a Loki PR; fixtures build keys at runtime (gitleaks rule); grep first, extend patterns only |
+| TEN-SECURITY-02 | fix: redact() strips URL userinfo (https://user:pass@host) and Authorization headers from logged and receipted output | loki-ts/src/util/redact.ts, loki-ts/tests/util/redact.test.ts | HIGH | red: https://u:p@host survives redact; green: userinfo replaced, plain URLs and existing redactions unchanged; cd loki-ts && bunx tsc --noEmit && bun test tests/util/redact.test.ts | released v11.17.38 | goal: close a credential-in-log path; new test file because no existing test owns redact.ts |
+| TEN-GATES-17 | fix: a pre-existing test file the run edited must not count as agent-independent proof for loki verify --require-exogenous (reviewer finding on the n-key fix: status M edits keep provenance exogenous) | loki-ts/src/util/check_result.ts, loki-ts/tests/engine10/seal.test.ts | HIGH | red: a sealed run whose only passing check is a test file the run modified (status M, assertions weakened or replaced) passes --require-exogenous with rc 0; green: that check is advisory and --require-exogenous exits 4 while an untouched exogenous test still counts; cd loki-ts && bunx tsc --noEmit && bun test tests/engine10/seal.test.ts tests/engine10/verify_cmd.test.ts tests/engine10/budget.test.ts | released v11.17.38 | Source: HIGH review of c958f563c. Grep checkProvenance and the A-119 edit rule first; decide whether to reuse the weakened-test detector instead of a blanket M rule, so legit test fixes stay exogenous. Record the call in DECISIONS.md if it changes D104. |
+| TEN-STABILITY-13 | P0 fix-forward: engine10 core is 5006 lines against the 5000 cap (budget.test.ts red on main since at least v11.17.35); bring core to 4950 or below without behavior change | loki-ts/src/engine10 (non-modernize) files only, plus the util or e10ext module that already owns any moved helper | MEDIUM | red: cd loki-ts && bun test tests/engine10/budget.test.ts fails with core is 5006 lines; green: same command passes with core at or below 4950, bun test tests/engine10 and bunx tsc --noEmit pass | released v11.17.38 | Move pure helpers out of the largest core files into the module that owns their concern (extend, never duplicate); delete dead code first; never squeeze lines by joining statements. Source: combined-tree run after v11.17.36. |
+| TEN-SECURITY-03 | fix: the bash secret scanners miss Anthropic keys (sk-ant-...) and the bash run_secure_scan applies the token rule only to browser-served files | autonomy/lib/secret-scan.sh, autonomy/verify.sh (secret pattern near 1177 and run_secure_scan only), the existing test that owns secret-scan.sh | HIGH | red: a runtime-built sk-ant key in a committed non-browser file passes both bash scanners; green: both report it by file and line without echoing the key, clean fixture passes; bash -n on both files plus the owning test | released v11.17.38 | Source: TEN-SECURITY-01 HIGH review (non-blocking item 5). Reuse one pattern list across both scripts if one already exists; fixtures build keys at runtime (gitleaks rule). |

package/docs/v10/PROGRESS.md

@@ -2488,3 +2488,9 @@ v11.17.21 published (Release success on 462fbc40a; npm latest 11.17.21, next 11.
 
 ## 2026-10-17T07:11Z (CoS) v11.17.36
 - Wave AC released: TEN-QUALITY-11, TEN-QUALITY-12, TEN-ADOPTION-09 (HIGH), TEN-UX-12, TEN-ADOPTION-07, TEN-ADOPTION-08; 6 of 6 APPROVE, merged clean via merge.sh (merged-ac.txt).
+
+## 2026-10-17T07:20Z (CoS) v11.17.37
+- Wave AD released: TEN-COST-11-F1, TEN-COST-28, TEN-SPEED-03, TEN-QUALITY-13, TEN-GATES-14 (HIGH), TEN-UX-13, TEN-DEPLOY-11 (7 APPROVE, merged clean, merged-ad.txt). TEN-STABILITY-11 already shipped (run_pid.ts verifyRunPid). TEN-SECURITY-01 BLOCK 13bec58ff after fix round. Combined tree: bun test tests/engine10 had 1 fail, the core size budget (core is 5006 lines, cap 5000), pre-existing at 18900e64d and b81a1012a; P0 fix-forward dispatched.
+
+## 2026-10-17T08:00Z (CoS) v11.17.38
+- Wave AE released: 17 APPROVE merged clean (merged-ae.txt), including P0 TEN-STABILITY-13 (core 4949 lines) and HIGH TEN-SECURITY-01/02/03, TEN-GATES-16/17. TEN-COST-30 and TEN-QUALITY-15 already shipped. TEN-DEPLOY-03 BLOCK eca0e17e0 and TEN-GATES-15 BLOCK 6f7591b8c re-dispatched. Combined tree: bun test tests/engine10 tests/util had 4 structural guard fails (3 pre-existing at ac43fb498: full_env_spawn, registration_list, start_flag_parity; 1 new: model_output_regex wall.ts count); P0 TEN-STABILITY-14 opened.