loki-mode 11.17.39 → 11.17.40

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: An autonomous software factory that knows what it is supposed to deliver, and proves it did. Use when the user says Loki Mode or asks to build, fix or verify software autonomously.
 ---
 
-# Loki Mode v11.17.39
+# Loki Mode v11.17.40
 
 **Current entry points (Loki 10 engine):** `loki "<task>"`, `loki owner/repo#N` and `loki quick "<task>"` run the Loki 10 engine and end with a signed receipt (`loki verify`). `loki backlog owner/repo --all` runs many issues in parallel. Guide: `docs/v10/GUIDE.md`. The skill instructions below, and `loki start`, describe the previous bash loop. PRD-file starts (`loki start ./prd.md`) and the opencode provider still run on it until FC38-SWEEP ports them; the legacy-engine command and the LOKI_ENGINE switch remain removed. Prefer `loki owner/repo#N` for issues.
 
@@ -483,4 +483,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v11.17.39 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**
+**v11.17.40 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**

package/VERSION

@@ -1 +1 @@
-11.17.39
+11.17.40

package/autonomy/lib/secure-scan.py

@@ -606,10 +606,12 @@ def scan(target_dir, secrets_everywhere=False):
         raise ValueError("not a directory: %s" % target_dir)
 
     findings = []
+    files_scanned = 0
     for abs_path, rel_path in _iter_files(target_dir):
         lines = _read_lines(abs_path)
         if lines is None:
             continue
+        files_scanned += 1
         findings.extend(_scan_file(rel_path, lines, secrets_everywhere))
 
     # deterministic ordering: by file, then line, then rule
@@ -625,6 +627,7 @@ def scan(target_dir, secrets_everywhere=False):
         "summary": {
             "total": len(findings),
             "by_severity": by_severity,
+            "files_scanned": files_scanned,
         },
     }
 

package/autonomy/loki

@@ -446,60 +446,61 @@ EOF
     [ "$l_pat" -gt "$c_pat" ]
 }
 
-# maybe_print_update_hint: print the one-line update nudge to stderr if (and
-# only if) a successful, non-fabricated check reports a strictly newer release.
-# Never blocks, never slows the command, never touches stdout. Always returns 0.
-maybe_print_update_hint() {
-    # Opt-out / non-interactive / CI: do nothing, touch neither disk nor network.
-    [ "${LOKI_NO_UPDATE_CHECK:-}" = "1" ] && return 0
-    [ -n "${CI:-}" ] && return 0
-    [ ! -t 1 ] && return 0
-
-    local current
-    current=$(get_version)
-    case "$current" in
-        [0-9]*.[0-9]*.[0-9]*) ;;
-        *) return 0 ;;  # "unknown" or non-semver -> never nudge
-    esac
-
-    local cache_file latest=""
+# _loki_latest_published_version: print the latest published version (fresh
+# cache first, else one short registry fetch that refreshes the cache), or
+# nothing when offline. Optional $1 = curl timeout seconds (default 3).
+# Never fabricates, always returns 0.
+_loki_latest_published_version() {
+    local timeout="${1:-3}" cache_file latest="" checked_at now age
     cache_file=$(_loki_update_cache_path)
-
-    # Fast path: a fresh (< 24h) cache means zero network.
     if [ -f "$cache_file" ]; then
-        local checked_at now age
         checked_at=$(sed -n 's/.*"checkedAt"[[:space:]]*:[[:space:]]*\([0-9]\{1,\}\).*/\1/p' "$cache_file" 2>/dev/null | head -1)
         latest=$(sed -n 's/.*"latest"[[:space:]]*:[[:space:]]*"\([0-9][0-9.]*\)".*/\1/p' "$cache_file" 2>/dev/null | head -1)
+        now=$(date +%s 2>/dev/null || echo 0)
         if [ -n "$checked_at" ] && [ -n "$latest" ]; then
-            now=$(date +%s 2>/dev/null || echo 0)
             age=$(( now - checked_at ))
             if [ "$age" -ge 0 ] && [ "$age" -lt 86400 ]; then
-                if _loki_semver_newer "$latest" "$current"; then
-                    printf 'A newer loki-mode is available (%s). Update: bun install -g loki-mode\n' "$latest" >&2
-                fi
+                printf '%s\n' "$latest"
                 return 0
             fi
         fi
-        latest=""  # stale cache -> fall through to a fresh fetch
+        latest=""
     fi
-
-    # Cache miss/stale: query the registry. Hard timeout, fail-silent.
     if command -v curl >/dev/null 2>&1; then
-        latest=$(curl -fsS --max-time 1.5 "https://registry.npmjs.org/loki-mode/latest" 2>/dev/null \
+        latest=$(curl -fsS --max-time "$timeout" "https://registry.npmjs.org/loki-mode/latest" 2>/dev/null \
             | sed -n 's/.*"version"[[:space:]]*:[[:space:]]*"\([0-9][0-9.]*\)".*/\1/p' | head -1)
     fi
-    # No usable result -> print nothing, write nothing (never fabricate).
     case "$latest" in
         [0-9]*.[0-9]*.[0-9]*) ;;
         *) return 0 ;;
     esac
-
-    # Persist the fresh result (best-effort; a non-writable HOME must not break).
-    local now2
-    now2=$(date +%s 2>/dev/null || echo 0)
     ( mkdir -p "$(dirname "$cache_file")" 2>/dev/null \
-        && printf '{"checkedAt":%s,"latest":"%s"}\n' "$now2" "$latest" > "$cache_file" 2>/dev/null ) || true
+        && printf '{"checkedAt":%s,"latest":"%s"}\n' "$(date +%s 2>/dev/null || echo 0)" "$latest" > "$cache_file" 2>/dev/null ) || true
+    printf '%s\n' "$latest"
+    return 0
+}
+
+# maybe_print_update_hint: print the one-line update nudge to stderr if (and
+# only if) a successful, non-fabricated check reports a strictly newer release.
+# Never blocks, never slows the command, never touches stdout. Always returns 0.
+maybe_print_update_hint() {
+    # Opt-out / non-interactive / CI: do nothing, touch neither disk nor network.
+    [ "${LOKI_NO_UPDATE_CHECK:-}" = "1" ] && return 0
+    [ -n "${CI:-}" ] && return 0
+    [ ! -t 1 ] && return 0
+
+    local current
+    current=$(get_version)
+    case "$current" in
+        [0-9]*.[0-9]*.[0-9]*) ;;
+        *) return 0 ;;  # "unknown" or non-semver -> never nudge
+    esac
 
+    # Fresh cache means zero network; otherwise one short fail-silent fetch.
+    # No usable result -> print nothing (never fabricate).
+    local latest
+    latest=$(_loki_latest_published_version 1.5)
+    [ -n "$latest" ] || return 0
     if _loki_semver_newer "$latest" "$current"; then
         printf 'A newer loki-mode is available (%s). Update: bun install -g loki-mode\n' "$latest" >&2
     fi
@@ -14702,7 +14703,7 @@ cmd_setup_skill() {
 #   loki self-update --to bun       Switch from current to Bun
 #   loki self-update --to npm       Switch from current to npm
 #   loki self-update --to brew      Switch from current to Homebrew
-#   loki self-update --check        Print detection result + exit 0
+#   loki self-update --check        Print detection result, installed vs latest version + exit 0
 #
 cmd_self_update() {
     local target_manager=""
@@ -14731,7 +14732,7 @@ Usage:
   loki self-update --to bun           Switch to Bun (recommended for v8)
   loki self-update --to npm           Switch to npm
   loki self-update --to brew          Switch to Homebrew
-  loki self-update --check            Print detected manager and exit
+  loki self-update --check            Print detected manager, installed vs latest version, and exit
   loki self-update --help             Show this help
 
 Auto-detection looks at the resolved path of the `loki` binary:
@@ -14801,6 +14802,15 @@ EOF
         echo "loki binary:    $resolved"
         echo "package dir:    $pkg_dir"
         echo "current mgr:    $current_mgr"
+        local installed_v latest_v="" update_flag="unknown"
+        installed_v=$(get_version)
+        latest_v=$(_loki_latest_published_version)
+        if [ -z "$latest_v" ]; then
+            echo "installed $installed_v, latest unknown"
+        else
+            if _loki_semver_newer "$latest_v" "$installed_v"; then update_flag="yes"; else update_flag="no"; fi
+            echo "installed $installed_v, latest $latest_v, update available $update_flag"
+        fi
         return 0
     fi
 

package/completions/_loki

@@ -157,6 +157,7 @@ function _loki {
                         '--yes[Skip redaction-preview confirmation]' \
                         '--private[Create a secret gist when sharing]' \
                         '--hosted[Hosted publishing (coming in R9)]' \
+                        '--dry-run[Scan and list what share would publish; publishes nothing]' \
                         '--help[Show help]' \
                         '1:subcommand:(list show open share badge md bundle)'
                     ;;

package/completions/loki.bash

@@ -305,7 +305,7 @@ _loki_completion() {
 
         proof)
             if [[ "$cur" == -* ]]; then
-                COMPREPLY=( $(compgen -W "--yes --private --hosted --out --help" -- "$cur") )
+                COMPREPLY=( $(compgen -W "--yes --private --hosted --dry-run --out --help" -- "$cur") )
                 return 0
             fi
             if [[ $cword -eq 2 ]]; then

package/dashboard/__init__.py

@@ -7,6 +7,6 @@ Modules:
     control: Session control helpers (status, atomic writes, origin check)
 """
 
-__version__ = "11.17.39"
+__version__ = "11.17.40"
 
 __all__ = ["__version__"]

package/docs/CLI-REFERENCE.md

@@ -1,6 +1,6 @@
 # CLI reference
 
-Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.17.39. Do not edit by hand.
+Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.17.40. Do not edit by hand.
 Hidden and legacy-only commands are omitted; see `docs/v10/CLI-MODERN.md` for the full inventory.
 
 | Command | Description |

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 Loki Mode, by [Autonomi](https://www.autonomi.dev/), turns a spec or an issue into a verified pull request with a receipt you can check. This page covers installing it, a first run, and the options around it.
 
-**Version:** v11.17.39
+**Version:** v11.17.40
 
 **Engine note:** `loki start` is the primary command. `loki start`, `loki "<task>"`, `loki owner/repo#N` and `loki quick` all run the Loki 10 engine, whatever the flag order or input form (PRD file, issue ref, task or one-word brief). The previous loop runs only on `--engine legacy`, `LOKI_ENGINE=legacy`, or for one call when a flag Loki 10 cannot honor is present. See the [user guide](v10/GUIDE.md) and the [5-minute quickstart](QUICKSTART.md).
 

package/docs/v10/BOARD.md

@@ -1153,33 +1153,35 @@ Source: ~/git/autonomi-dev/research/2026-09-30-adoption/SWARM-PROMPT-ADOPTION.md
 | TEN-STABILITY-13 | P0 fix-forward: engine10 core is 5006 lines against the 5000 cap (budget.test.ts red on main since at least v11.17.35); bring core to 4950 or below without behavior change | loki-ts/src/engine10 (non-modernize) files only, plus the util or e10ext module that already owns any moved helper | MEDIUM | red: cd loki-ts && bun test tests/engine10/budget.test.ts fails with core is 5006 lines; green: same command passes with core at or below 4950, bun test tests/engine10 and bunx tsc --noEmit pass | released v11.17.38 | Move pure helpers out of the largest core files into the module that owns their concern (extend, never duplicate); delete dead code first; never squeeze lines by joining statements. Source: combined-tree run after v11.17.36. |
 | TEN-SECURITY-03 | fix: the bash secret scanners miss Anthropic keys (sk-ant-...) and the bash run_secure_scan applies the token rule only to browser-served files | autonomy/lib/secret-scan.sh, autonomy/verify.sh (secret pattern near 1177 and run_secure_scan only), the existing test that owns secret-scan.sh | HIGH | red: a runtime-built sk-ant key in a committed non-browser file passes both bash scanners; green: both report it by file and line without echoing the key, clean fixture passes; bash -n on both files plus the owning test | released v11.17.38 | Source: TEN-SECURITY-01 HIGH review (non-blocking item 5). Reuse one pattern list across both scripts if one already exists; fixtures build keys at runtime (gitleaks rule). |
 | TEN-STABILITY-14 | P0 fix-forward: four loki-ts/tests/util structural guards are red on main (model_output_regex_guard: wall.ts count mismatched after TEN-STABILITY-13 moved classifiers to util/check_result.ts; full_env_spawn_guard: doctor.ts mismatched and util/funnel.ts unlisted; registration_list_guard: stale commands/status.ts entry; start_flag_parity_guard: --cost undeclared) | the four allowlist or table files those guards load, plus the src file only when the honest fix is in code (for example funnel.ts spawning with the full env) | MEDIUM | red: cd loki-ts && bun test tests/util/model_output_regex_guard.test.ts tests/util/full_env_spawn_guard.test.ts tests/util/registration_list_guard.test.ts tests/util/start_flag_parity_guard.test.ts has 4 fails; green: 0 fails and bun test tests/util tests/engine10 has 0 fails | released v11.17.39 | Each allowlist entry needs a true reason; a full-env spawn in funnel.ts is fixed in code (allowlisted env) unless it is a documented passthrough. Three were red at ac43fb498 (v11.17.37). Source: combined-tree run before v11.17.38. |
-| TEN-COST-31 | feature: loki report kpis --since <Nd or YYYY-MM-DD> limits the iteration totals to a window and the human output names the window | loki-ts/src/commands/kpis.ts, loki-ts/src/metrics/kpis.ts, loki-ts/tests/commands/kpis.test.ts | MEDIUM | red: `loki report kpis --since 7d` exits 1 with unknown arg; green: iterations older than the window are excluded from cost and token totals, output says "since <date>", bad value exits 1; cd loki-ts && bunx tsc --noEmit && bun test tests/commands/kpis.test.ts | ready@2026-10-17T08:05Z | Gap: grep -n -e '--since' loki-ts/src/commands/kpis.ts returned 0 hits; the flag loop at kpis.ts:66-80 accepts only --json and help. Engineer confirms the iteration file mtime or timestamp field in metrics/kpis.ts before filtering. |
+| TEN-COST-31 | feature: loki report kpis --since <Nd or YYYY-MM-DD> limits the iteration totals to a window and the human output names the window | loki-ts/src/commands/kpis.ts, loki-ts/src/metrics/kpis.ts, loki-ts/tests/commands/kpis.test.ts | MEDIUM | red: `loki report kpis --since 7d` exits 1 with unknown arg; green: iterations older than the window are excluded from cost and token totals, output says "since <date>", bad value exits 1; cd loki-ts && bunx tsc --noEmit && bun test tests/commands/kpis.test.ts | released v11.17.40 | Gap: grep -n -e '--since' loki-ts/src/commands/kpis.ts returned 0 hits; the flag loop at kpis.ts:66-80 accepts only --json and help. Engineer confirms the iteration file mtime or timestamp field in metrics/kpis.ts before filtering. |
 | TEN-COST-32 | enhancement: a BUDGET_STOP run's next line names the exact recovery (loki start --max-cost <higher> or the resume command) instead of the generic loki status | loki-ts/src/util/run_summary.ts, loki-ts/tests/util/run_summary.test.ts | LOW | red: nextOf for a BUDGET_STOP run returns "loki status"; green: next line contains "--max-cost" and the run id; cd loki-ts && bunx tsc --noEmit && bun test tests/util/run_summary.test.ts | ready@2026-10-17T08:05Z | Gap: run_summary.ts:62-67 returns "loki status" for every stopped result; grep -n 'max-cost' loki-ts/src/util/run_summary.ts returned 0 hits. Keep the change in util/ (engine10/output.ts is at the line cap): key on the outcome the summary input already carries. |
 | TEN-COST-33 | feature: loki queue run --max-total-cost <usd> stops the queue before the next item once cumulative spend reaches the cap and says so in the digest | loki-ts/src/commands/queue.ts, loki-ts/tests/commands/queue.test.ts, loki-ts/src/cli/registry.ts | MEDIUM | red: queue run has no total cap, a 3-item queue runs all 3 with injected spend 2 each and cap 3; green: stops after item 2, remaining items stay queued, digest line names the cap; cd loki-ts && bunx tsc --noEmit && bun test tests/commands/queue.test.ts tests/cli/registry_guard.test.ts | ready@2026-10-17T08:05Z | Gap: grep -nE 'max-cost or total or spend' loki-ts/src/commands/queue.ts shows only the governor forecast (queue.ts:213-235); no cumulative cap. Serialize on queue.ts after TEN-STABILITY-15 and TEN-UX-16. |
-| TEN-COST-34 | enhancement: the run summary Spend line adds "of which $X on retries" when retry sessions cost money | loki-ts/src/util/run_summary.ts, loki-ts/tests/util/run_summary.test.ts | LOW | red: a summary input with retry_usd 0.40 prints no retry figure; green: Spend line ends with "($0.40 on retries)", nothing printed when retry_usd is 0 or null; cd loki-ts && bunx tsc --noEmit && bun test tests/util/run_summary.test.ts | ready@2026-10-17T08:05Z | Gap: costBreakdown computes retry_usd and retry_sessions (util/cost_breakdown.ts:17-43) and engine10/cost.ts:168 attaches it, but grep -rn retry_usd loki-ts/src outside cost_breakdown.ts returned 0 hits, so no reader. If the breakdown does not reach the summary input, thread it through spendText in run_summary.ts:166 only. |
+| TEN-COST-34 | enhancement: the run summary Spend line adds "of which $X on retries" when retry sessions cost money | loki-ts/src/util/run_summary.ts, loki-ts/tests/util/run_summary.test.ts | LOW | red: a summary input with retry_usd 0.40 prints no retry figure; green: Spend line ends with "($0.40 on retries)", nothing printed when retry_usd is 0 or null; cd loki-ts && bunx tsc --noEmit && bun test tests/util/run_summary.test.ts | released v11.17.40 | Gap: costBreakdown computes retry_usd and retry_sessions (util/cost_breakdown.ts:17-43) and engine10/cost.ts:168 attaches it, but grep -rn retry_usd loki-ts/src outside cost_breakdown.ts returned 0 hits, so no reader. If the breakdown does not reach the summary input, thread it through spendText in run_summary.ts:166 only. |
 | TEN-SPEED-06 | enhancement: loki doctor runs its independent CLI version and network probes concurrently (Promise.all) so the report takes the slowest probe, not the sum | loki-ts/src/commands/doctor.ts, loki-ts/tests/commands/doctor.test.ts | MEDIUM | red: a test with three injected probes of 200ms each takes at least 600ms; green: under 350ms and the output order is unchanged; cd loki-ts && bunx tsc --noEmit && bun test tests/commands/doctor.test.ts | ready@2026-10-17T08:05Z | Gap: grep -c 'spawnSync or execSync' loki-ts/src/commands/doctor.ts is 11 against 4 Promise.all uses. Output ordering must stay byte-identical (doctor_router and doctor_count tests). Do not touch claudeLoginProbeCached (TEN-SPEED-05). |
-| TEN-SPEED-07 | feature: fix-round verification runs the previously failing test files first (pytest --ff style, bun/vitest file order) and stops at first failure when the runner supports it | loki-ts/src/util/check_result.ts, loki-ts/src/e10ext/select.ts, loki-ts/tests/e10ext/select.test.ts | MEDIUM | red: fix-round test command is identical to the round-1 command; green: command lists last-round failing files first for bun test, pytest and jest, unchanged for unknown runners; cd loki-ts && bunx tsc --noEmit && bun test tests/e10ext/select.test.ts tests/util | ready@2026-10-17T08:05Z | Gap: grep -rnE 'failed.?first or lastFailed or --ff or --bail' loki-ts/src returned 0 hits. Engineer finds the verify command builder; if the only wiring point is inside engine10 core, land the pure helper in e10ext/ and wire with a net-zero line change. |
-| TEN-SPEED-08 | fix: back-to-back loki start runs reuse a successful gh auth status probe for 10 minutes like the Claude login probe | loki-ts/src/commands/doctor.ts, loki-ts/src/engine10/preflight.ts, loki-ts/tests/engine10/preflight.test.ts | MEDIUM | red: two checkPreflight calls with --pr spawn gh auth status twice; green: second call within 10 minutes spawns once, a failed probe is never cached; cd loki-ts && bunx tsc --noEmit && bun test tests/engine10/preflight.test.ts tests/engine10 | ready@2026-10-17T08:05Z | Gap: engine10/preflight.ts:36-38 spawns gh --version and gh auth status on every PR run; TEN-SPEED-05 cached only claudeLoginProbeCached (preflight.ts:30). Put ghAuthProbeCached beside claudeLoginProbeCached in doctor.ts; preflight.ts may change by net zero lines (4949 of 5000 core cap). |
+| TEN-SPEED-07 | feature: fix-round verification runs the previously failing test files first (pytest --ff style, bun/vitest file order) and stops at first failure when the runner supports it | loki-ts/src/util/check_result.ts, loki-ts/src/e10ext/select.ts, loki-ts/tests/e10ext/select.test.ts | MEDIUM | red: fix-round test command is identical to the round-1 command; green: command lists last-round failing files first for bun test, pytest and jest, unchanged for unknown runners; cd loki-ts && bunx tsc --noEmit && bun test tests/e10ext/select.test.ts tests/util | released v11.17.40 | Gap: grep -rnE 'failed.?first or lastFailed or --ff or --bail' loki-ts/src returned 0 hits. Engineer finds the verify command builder; if the only wiring point is inside engine10 core, land the pure helper in e10ext/ and wire with a net-zero line change. |
+| TEN-SPEED-08 | fix: back-to-back loki start runs reuse a successful gh auth status probe for 10 minutes like the Claude login probe | loki-ts/src/commands/doctor.ts, loki-ts/src/engine10/preflight.ts, loki-ts/tests/engine10/preflight.test.ts | MEDIUM | red: two checkPreflight calls with --pr spawn gh auth status twice; green: second call within 10 minutes spawns once, a failed probe is never cached; cd loki-ts && bunx tsc --noEmit && bun test tests/engine10/preflight.test.ts tests/engine10 | released v11.17.40 | Gap: engine10/preflight.ts:36-38 spawns gh --version and gh auth status on every PR run; TEN-SPEED-05 cached only claudeLoginProbeCached (preflight.ts:30). Put ghAuthProbeCached beside claudeLoginProbeCached in doctor.ts; preflight.ts may change by net zero lines (4949 of 5000 core cap). |
 | TEN-QUALITY-16 | feature: before the commit stage the run formats only its own changed files with the repo's own formatter when the repo already configures one (ruff format, prettier, gofmt, cargo fmt) | loki-ts/src/e10ext/commit_filter.ts, loki-ts/src/runner/repo_profile.ts, loki-ts/tests/e10ext/commit_filter_guard.test.ts | MEDIUM | red: a run that leaves an unformatted py file commits it unformatted; green: changed files are formatted, unchanged files untouched, no formatter config means no-op; cd loki-ts && bunx tsc --noEmit && bun test tests/e10ext tests/runner/harness_intelligence.test.ts | ready@2026-10-17T08:05Z | Gap: grep -rnE 'ruff format or prettier --write or eslint --fix or gofmt -w or cargo fmt' loki-ts/src returned 0 hits. Detect config only (pyproject [tool.ruff], .prettierrc, rustfmt.toml); never install a formatter. Reviewer PRs stay small because no unrelated reformat. |
-| TEN-QUALITY-17 | enhancement: a failing test that passes on one immediate rerun is classified flaky (not fail) so fix rounds are not spent on it | loki-ts/src/util/check_result.ts, loki-ts/tests/util/check_result.test.ts | MEDIUM | red: a check that fails then passes on rerun is classified fail; green: classified flaky with the rerun evidence, a deterministic fail stays fail; cd loki-ts && bunx tsc --noEmit && bun test tests/util | ready@2026-10-17T08:05Z | Gap: grep -nE 'rerun or re-run or retryOnce' loki-ts/src/util/check_result.ts returned 0 hits; the flaky label exists only for Playwright output (check_result.ts:162) and the summary renderer (run_summary.ts:192). A flaky result must never count as agent-independent proof. If no check_result.test.ts exists, add cases to the nearest test that imports it. |
-| TEN-QUALITY-18 | feature: a TypeScript repo with tsconfig.json and a typescript dependency but no typecheck script gets a tsc --noEmit typecheck command in the repo profile | loki-ts/src/runner/repo_profile.ts, loki-ts/tests/runner/harness_intelligence.test.ts | LOW | red: profile for such a repo has no typecheck command; green: entry "typecheck: <runner> tsc --noEmit" sourced from tsconfig.json, a script named typecheck still wins; cd loki-ts && bunx tsc --noEmit && bun test tests/runner/harness_intelligence.test.ts | ready@2026-10-17T08:05Z | Gap: repo_profile.ts:296 picks typecheck only from package scripts named typecheck, type-check or tsc, while Python gets a config-based mypy fallback at repo_profile.ts:311; grep -n tsconfig loki-ts/src/runner/repo_profile.ts returned 0 hits. |
-| TEN-GATES-18 | feature: Seal risk summary flags a dependency manifest change (package.json deps, pyproject deps, go.mod) with no matching lockfile change | loki-ts/src/util/check_result.ts, loki-ts/tests/util/check_result.test.ts | HIGH | red: diff touching package.json dependencies only produces no finding; green: advisory finding "manifest changed without lockfile", clean when both change or only scripts change; cd loki-ts && bunx tsc --noEmit && bun test tests/util tests/engine10 | ready@2026-10-17T08:05Z | Gap: check_result.ts:272 classifies lockfile paths and :312 flags deleted tests, but nothing pairs a manifest with its lockfile (grep -nE 'manifest.*lock' returned only the classifier). Advisory only, never turns a VERIFIED into a fail; needs FAILURE-CLASSES row. |
-| TEN-GATES-19 | feature: the signed receipt records the toolchain that ran the checks (bun, node, python3, git versions) so a verifier can see what produced the proof | loki-ts/src/util/composite_seal.ts, loki-ts/src/util/receipt_signer.ts, loki-ts/tests/engine10/seal_group.test.ts | HIGH | red: receipt payload has no toolchain field; green: receipt carries toolchain {bun,node,python3,git}, absent tools recorded as null, old receipts still verify; cd loki-ts && bunx tsc --noEmit && bun test tests/engine10 tests/util/receipt_bundle.test.ts | ready@2026-10-17T08:05Z | Gap: grep -rnE 'node_version or toolchain or bun_version or python_version' loki-ts/src/util loki-ts/src/engine10 returned 0 hits. Schema is additive and optional so verify of pre-existing receipts is unchanged; moat file set, two unanimous reviewers. |
-| TEN-GATES-20 | enhancement: secure-scan.py reports files_scanned and the Seal treats a scan of zero files as not_run instead of a clean pass | autonomy/lib/secure-scan.py, loki-ts/src/util/secure_scan.ts, loki-ts/tests/util/secure_scan.test.ts | HIGH | red: scanning an empty directory returns ok with total 0 and no file count; green: result carries summary.files_scanned, zero files yields not_run in the wrapper; cd loki-ts && bunx tsc --noEmit && bun test tests/util/secure_scan.test.ts && bash tests/test-secure-scan.sh | ready@2026-10-17T08:05Z | Gap: scan() at autonomy/lib/secure-scan.py:600-630 returns only rules_version, findings, summary.total and by_severity; grep -n 'files_scanned or scanned' loki-ts/src/util/secure_scan.ts returned 0 hits. Serialize with TEN-SECURITY-06/07 (same python file). |
+| TEN-QUALITY-17 | enhancement: a failing test that passes on one immediate rerun is classified flaky (not fail) so fix rounds are not spent on it | loki-ts/src/util/check_result.ts, loki-ts/tests/util/check_result.test.ts | MEDIUM | red: a check that fails then passes on rerun is classified fail; green: classified flaky with the rerun evidence, a deterministic fail stays fail; cd loki-ts && bunx tsc --noEmit && bun test tests/util | released v11.17.40 | Gap: grep -nE 'rerun or re-run or retryOnce' loki-ts/src/util/check_result.ts returned 0 hits; the flaky label exists only for Playwright output (check_result.ts:162) and the summary renderer (run_summary.ts:192). A flaky result must never count as agent-independent proof. If no check_result.test.ts exists, add cases to the nearest test that imports it. |
+| TEN-QUALITY-18 | feature: a TypeScript repo with tsconfig.json and a typescript dependency but no typecheck script gets a tsc --noEmit typecheck command in the repo profile | loki-ts/src/runner/repo_profile.ts, loki-ts/tests/runner/harness_intelligence.test.ts | LOW | red: profile for such a repo has no typecheck command; green: entry "typecheck: <runner> tsc --noEmit" sourced from tsconfig.json, a script named typecheck still wins; cd loki-ts && bunx tsc --noEmit && bun test tests/runner/harness_intelligence.test.ts | released v11.17.40 | Gap: repo_profile.ts:296 picks typecheck only from package scripts named typecheck, type-check or tsc, while Python gets a config-based mypy fallback at repo_profile.ts:311; grep -n tsconfig loki-ts/src/runner/repo_profile.ts returned 0 hits. |
+| TEN-GATES-18 | feature: Seal risk summary flags a dependency manifest change (package.json deps, pyproject deps, go.mod) with no matching lockfile change | loki-ts/src/util/check_result.ts, loki-ts/tests/util/check_result.test.ts, loki-ts/tests/engine10 L0 guard allowlist (widened at review) | HIGH | red: diff touching package.json dependencies only produces no finding; green: advisory finding "manifest changed without lockfile", clean when both change or only scripts change; cd loki-ts && bunx tsc --noEmit && bun test tests/util tests/engine10 | released v11.17.40 | Gap: check_result.ts:272 classifies lockfile paths and :312 flags deleted tests, but nothing pairs a manifest with its lockfile (grep -nE 'manifest.*lock' returned only the classifier). Advisory only, never turns a VERIFIED into a fail; needs FAILURE-CLASSES row. |
+| TEN-GATES-19 | feature: the signed receipt records the toolchain that ran the checks (bun, node, python3, git versions) so a verifier can see what produced the proof | loki-ts/src/util/composite_seal.ts, loki-ts/src/util/receipt_signer.ts, loki-ts/tests/engine10/seal_group.test.ts | HIGH | red: receipt payload has no toolchain field; green: receipt carries toolchain {bun,node,python3,git}, absent tools recorded as null, old receipts still verify; cd loki-ts && bunx tsc --noEmit && bun test tests/engine10 tests/util/receipt_bundle.test.ts | released v11.17.40 | Gap: grep -rnE 'node_version or toolchain or bun_version or python_version' loki-ts/src/util loki-ts/src/engine10 returned 0 hits. Schema is additive and optional so verify of pre-existing receipts is unchanged; moat file set, two unanimous reviewers. |
+| TEN-GATES-20 | enhancement: secure-scan.py reports files_scanned and the Seal treats a scan of zero files as not_run instead of a clean pass | autonomy/lib/secure-scan.py, loki-ts/src/util/secure_scan.ts, loki-ts/tests/util/secure_scan.test.ts | HIGH | red: scanning an empty directory returns ok with total 0 and no file count; green: result carries summary.files_scanned, zero files yields not_run in the wrapper; cd loki-ts && bunx tsc --noEmit && bun test tests/util/secure_scan.test.ts && bash tests/test-secure-scan.sh | released v11.17.40 | Gap: scan() at autonomy/lib/secure-scan.py:600-630 returns only rules_version, findings, summary.total and by_severity; grep -n 'files_scanned or scanned' loki-ts/src/util/secure_scan.ts returned 0 hits. Serialize with TEN-SECURITY-06/07 (same python file). |
 | TEN-UX-16 | feature: loki queue remove <issue...> and loki queue clear take items out of the queue | loki-ts/src/commands/queue.ts, loki-ts/src/cli/registry.ts, loki-ts/tests/commands/queue.test.ts | LOW | red: `loki queue remove 12` prints the usage error; green: remove drops the normalized ref and reports "N removed, M left", clear empties the file, missing ref exits 0 with "not queued"; cd loki-ts && bunx tsc --noEmit && bun test tests/commands/queue.test.ts tests/cli/registry_guard.test.ts | ready@2026-10-17T08:05Z | Gap: runQueue dispatches only add, list, run (queue.ts:384-390) and registry.ts:174 declares the same three subcommands; grep -nE 'queue.*(remove or rm or clear)' loki-ts/src returned 0 hits. Serialize after TEN-STABILITY-15. |
-| TEN-UX-17 | feature: loki undo --list prints the recent runs that can be undone (run id, verdict, files changed, age) | loki-ts/src/commands/undo.ts, loki-ts/tests/commands/undo.test.ts | LOW | red: `loki undo --list` prints the usage text and exits 2; green: lists newest first from the runs dir, exits 0, empty state says "no runs to undo"; cd loki-ts && bunx tsc --noEmit && bun test tests/commands/undo.test.ts | ready@2026-10-17T08:05Z | Gap: undo.ts:156 USAGE lists only --plan and --dry-run forms and :180 requires a run id; grep -rnE '"--list"' loki-ts/src/commands returned 0 hits. New test file only if grep -rl runUndo loki-ts/tests finds none. Read-only: no git writes. |
+| TEN-UX-17 | feature: loki undo --list prints the recent runs that can be undone (run id, verdict, files changed, age) | loki-ts/src/commands/undo.ts, loki-ts/tests/commands/undo.test.ts | LOW | red: `loki undo --list` prints the usage text and exits 2; green: lists newest first from the runs dir, exits 0, empty state says "no runs to undo"; cd loki-ts && bunx tsc --noEmit && bun test tests/commands/undo.test.ts | released v11.17.40 | Gap: undo.ts:156 USAGE lists only --plan and --dry-run forms and :180 requires a run id; grep -rnE '"--list"' loki-ts/src/commands returned 0 hits. New test file only if grep -rl runUndo loki-ts/tests finds none. Read-only: no git writes. |
 | TEN-UX-18 | enhancement: loki doctor --quiet prints only failed and warned checks plus the summary footer | loki-ts/src/commands/doctor.ts, loki-ts/tests/commands/doctor.test.ts | LOW | red: doctor --quiet is rejected or prints every pass row; green: only non-pass rows and the footer, exit code unchanged, --json unaffected; cd loki-ts && bunx tsc --noEmit && bun test tests/commands/doctor.test.ts | ready@2026-10-17T08:05Z | Gap: grep -nE 'quiet or -q\b' loki-ts/src/commands/doctor.ts returned 0 hits; the footer tally is at doctor.ts:1026. Update the usage text at doctor.ts:1052 and the start_flag_parity or help-drift guards if they list doctor flags. |
 | TEN-UX-19 | enhancement: loki start --help ends with three copyable examples (brief, PRD file, issue ref) | loki-ts/src/commands/start.ts, loki-ts/tests/commands/start.test.ts | LOW | red: start help text has no Examples section; green: help lists loki start "<brief>", loki start ./prd.md, loki start owner/repo#123 and the quick-start docs agree; cd loki-ts && bunx tsc --noEmit && bun test tests/commands/start.test.ts tests/commands/cli_help_routes.test.ts | ready@2026-10-17T08:05Z | Gap: grep -nE 'Examples?:' loki-ts/src/commands/start.ts returned 0 hits. Check the bash help route (autonomy/help-core.sh) is not the one users reach; if it is, change the one that owns the text and keep the other byte-equal per the help-drift guard. |
-| TEN-ADOPTION-13 | feature: loki proof share --dry-run runs the secret scan and prints what would be published without publishing | loki-ts/src/commands/proof.ts, loki-ts/tests/commands/proof.test.ts | MEDIUM | red: `proof share <id> --dry-run` is treated as an unknown arg or publishes; green: prints the file list and scan verdict, publishes nothing, exit 0 clean and 1 when the scan blocks; cd loki-ts && bunx tsc --noEmit && bun test tests/commands/proof.test.ts | ready@2026-10-17T08:05Z | Gap: grep -n 'dry' loki-ts/src/commands/proof.ts returned 0 hits; share dispatch is at proof.ts:890 and its token scan came from TEN-ADOPTION-03-F1. |
+| TEN-ADOPTION-13 | feature: loki proof share --dry-run runs the secret scan and prints what would be published without publishing | loki-ts/src/commands/proof.ts, loki-ts/tests/commands/proof.test.ts | MEDIUM | red: `proof share <id> --dry-run` is treated as an unknown arg or publishes; green: prints the file list and scan verdict, publishes nothing, exit 0 clean and 1 when the scan blocks; cd loki-ts && bunx tsc --noEmit && bun test tests/commands/proof.test.ts | released v11.17.40 | Gap: grep -n 'dry' loki-ts/src/commands/proof.ts returned 0 hits; share dispatch is at proof.ts:890 and its token scan came from TEN-ADOPTION-03-F1. |
 | TEN-ADOPTION-14 | enhancement: loki proof list --json prints the proof index as machine-readable JSON | loki-ts/src/commands/proof.ts, loki-ts/tests/commands/proof.test.ts | LOW | red: `proof list --json` prints the text table; green: JSON array of {id, verdict, created} sorted newest first, text output unchanged; cd loki-ts && bunx tsc --noEmit && bun test tests/commands/proof.test.ts | ready@2026-10-17T08:05Z | Gap: only show handles --json (proof.ts:47 and :149 args.includes("--json") inside show); the list arm at proof.ts:873 ignores it. Serialize after TEN-ADOPTION-13 (same file). |
-| TEN-ADOPTION-15 | enhancement: loki self-update --check also reports the installed version, the latest published version and whether an update is available | autonomy/loki, tests/test-self-update.sh | MEDIUM | red: --check prints only the detected package manager; green: also prints "installed X, latest Y, update available yes/no", offline prints "latest unknown" and exits 0; bash tests/test-self-update.sh | ready@2026-10-17T08:05Z | Gap: autonomy/loki:14665 and :14694 document --check as "Print detection result" only. Reuse the registry lookup already in loki-ts/src/util/update_check.ts:97 instead of a second fetch. If tests/test-self-update.sh does not exist, extend the test that owns cmd_self_update (grep -l self-update tests/*.sh). |
-| TEN-DEPLOY-13 | fix: loki status --probe reports a regression when the health URL redirects to a different host (login page, provider not-found page) even though the final status is 200 | loki-ts/src/commands/status.ts, loki-ts/tests/commands/status.test.ts | MEDIUM | red: probe of a URL that redirects to another host returning 200 prints "Deploy health OK"; green: prints a failure naming the final host and exits 1, same-host redirects (http to https, trailing slash) still pass; cd loki-ts && bunx tsc --noEmit && bun test tests/commands/status.test.ts | ready@2026-10-17T08:05Z | Gap: status.ts:865 fetches with redirect follow and accepts 200-399 without comparing res.url to the recorded health_url host, so a redirect to a shared provider page reads healthy. |
+| TEN-ADOPTION-15 | enhancement: loki self-update --check also reports the installed version, the latest published version and whether an update is available | autonomy/loki, tests/test-self-update.sh | MEDIUM | red: --check prints only the detected package manager; green: also prints "installed X, latest Y, update available yes/no", offline prints "latest unknown" and exits 0; bash tests/test-self-update.sh | released v11.17.40 | Gap: autonomy/loki:14665 and :14694 document --check as "Print detection result" only. Reuse the registry lookup already in loki-ts/src/util/update_check.ts:97 instead of a second fetch. If tests/test-self-update.sh does not exist, extend the test that owns cmd_self_update (grep -l self-update tests/*.sh). |
+| TEN-DEPLOY-13 | fix: loki status --probe reports a regression when the health URL redirects to a different host (login page, provider not-found page) even though the final status is 200 | loki-ts/src/commands/status.ts, loki-ts/tests/commands/status.test.ts | MEDIUM | red: probe of a URL that redirects to another host returning 200 prints "Deploy health OK"; green: prints a failure naming the final host and exits 1, same-host redirects (http to https, trailing slash) still pass; cd loki-ts && bunx tsc --noEmit && bun test tests/commands/status.test.ts | released v11.17.40 | Gap: status.ts:865 fetches with redirect follow and accepts 200-399 without comparing res.url to the recorded health_url host, so a redirect to a shared provider page reads healthy. |
 | TEN-DEPLOY-14 | feature: loki status --probe --json prints the probe result as one JSON object (url, ok, status, attempts, reason) | loki-ts/src/commands/status.ts, loki-ts/tests/commands/status.test.ts | LOW | red: --probe --json prints text lines; green: single JSON object, exit codes unchanged (0 healthy or nothing to probe, 1 regression); cd loki-ts && bunx tsc --noEmit && bun test tests/commands/status.test.ts | ready@2026-10-17T08:05Z | Gap: status.ts:1023-1031 parses --probe and the usage text allows --json only without --probe; probe output at status.ts:850-880 is text only. Serialize after TEN-DEPLOY-13 (same region). |
 | TEN-DEPLOY-15 | enhancement: loki doctor disk check measures the current repo directory and the temp directory volumes, not only the home directory | loki-ts/src/commands/doctor.ts, loki-ts/tests/commands/doctor.test.ts | LOW | red: checkDisk reads statfs of homedir only; green: result reports the minimum free GB across home, cwd and tmpdir and names which volume is low; cd loki-ts && bunx tsc --noEmit && bun test tests/commands/doctor.test.ts | ready@2026-10-17T08:05Z | Gap: checkDisk at doctor.ts:353-365 calls statfsSync(homedir()) only; builds and worktrees write under cwd and tmpdir, which can be a separate full volume. Keep the DiskCheck JSON shape backwards compatible (add a field, do not rename). Serialize after TEN-SPEED-06 and TEN-UX-18 (same file). |
 | TEN-STABILITY-15 | fix: queue add on a corrupt queue file quarantines it and warns instead of silently overwriting every queued item | loki-ts/src/commands/queue.ts, loki-ts/tests/commands/queue.test.ts | MEDIUM | red: a truncated queue.json followed by queue add leaves a file holding only the new item; green: the bad file is renamed to queue.json.corrupt-<ts>, a warning is printed once, the new item is added to a fresh file; cd loki-ts && bunx tsc --noEmit && bun test tests/commands/queue.test.ts | ready@2026-10-17T08:05Z | Gap: readQueue returns [] on any JSON error (queue.ts:79-86) and queueAdd then writeQueue overwrites (queue.ts:108-124). Same class as TEN-STABILITY-12 (outbox quarantine at util/outbox.ts:28-33); reuse that pattern and add the row to FAILURE-CLASSES.md. |
-| TEN-STABILITY-16 | enhancement: loki start sweeps stale temp files left by a killed atomic write (name.tmp.<deadpid>.<n>) older than 1 hour in the .loki state dirs | loki-ts/src/util/atomic.ts, loki-ts/tests/util/atomic.test.ts | MEDIUM | red: a leftover state.json.tmp.99999.1 with a dead pid stays forever; green: swept when pid is dead and mtime older than 1h, a live pid or fresh file is untouched, only exact tmp names matched; cd loki-ts && bunx tsc --noEmit && bun test tests/util | ready@2026-10-17T08:05Z | Gap: grep -rnE '\.tmp\.' loki-ts/src shows temp names created at util/atomic.ts:89 and run_control.ts:13 with no sweeper anywhere. Never glob outside .loki; reuse processStartTime or kill -0 from util/run_pid.ts for the liveness test; wire from a util/ entry point, not engine10 core. |
+| TEN-STABILITY-16 | enhancement: loki start sweeps stale temp files left by a killed atomic write (name.tmp.<deadpid>.<n>) older than 1 hour in the .loki state dirs | loki-ts/src/util/atomic.ts, loki-ts/tests/util/atomic.test.ts | MEDIUM | red: a leftover state.json.tmp.99999.1 with a dead pid stays forever; green: swept when pid is dead and mtime older than 1h, a live pid or fresh file is untouched, only exact tmp names matched; cd loki-ts && bunx tsc --noEmit && bun test tests/util | released (already shipped before the row: loki-ts/src/runner/state.ts:444 sweepOrphanTmpFiles) | Gap: grep -rnE '\.tmp\.' loki-ts/src shows temp names created at util/atomic.ts:89 and run_control.ts:13 with no sweeper anywhere. Never glob outside .loki; reuse processStartTime or kill -0 from util/run_pid.ts for the liveness test; wire from a util/ entry point, not engine10 core. |
 | TEN-STABILITY-17 | feature: loki doctor lists orphan runs (a run dir whose owner process died before run.completed) with the resume or undo command for each | loki-ts/src/commands/doctor.ts, loki-ts/tests/commands/doctor.test.ts | MEDIUM | red: doctor ignores a run dir with a dead pid and no run.completed event; green: a warn row names the run id and "loki resume" or "loki undo", live and completed runs produce no row; cd loki-ts && bunx tsc --noEmit && bun test tests/commands/doctor.test.ts | ready@2026-10-17T08:05Z | Gap: runOwnerAlive (util/run_pid.ts:59) is consumed only by util/run_outputs.ts:156; grep -n runOwnerAlive loki-ts/src/commands/doctor.ts returned 0 hits. Warn level only, never fails doctor. Serialize after TEN-DEPLOY-15 (same file). |
-| TEN-SECURITY-04 | fix: redactSecrets also strips GitLab (glpat-), npm (npm_), Hugging Face (hf_), Stripe (sk_live_, rk_live_) tokens and PEM private key blocks | loki-ts/src/util/redact.ts, loki-ts/tests/util/redact.test.ts | HIGH | red: each of the five token shapes and a -----BEGIN PRIVATE KEY----- block survive redactSecrets; green: all replaced with [REDACTED:...] markers, existing rules and ordering unchanged; cd loki-ts && bunx tsc --noEmit && bun test tests/util/redact.test.ts | ready@2026-10-17T08:05Z | Gap: redact.ts RULES (lines 3-14) cover Anthropic, GitHub, Slack, AWS, JWT, Google, OpenAI, Bearer, URL userinfo; grep -rnE 'glpat or npm_ or hf_ or BEGIN [A-Z ]*PRIVATE or sk_live' loki-ts/src/util/redact.ts returned 0 hits (export_sarif.ts:18 and contrib/ai_bom.ts:83 know the shapes but are not the redactor). Specific rules before generic, keep ReDoS-safe quantifiers. |
+| TEN-STABILITY-18 | P0 fix-forward: nightly 39016259458 reds still red on main e32ee1b5d (pr_body_golden not-recorded producer util/check_result.ts; sizing wall brief 726 vs cap 616; router_optout_golden wall stage haiku for development; verify.test uv resolution CI-only via Bun.which PATH; test-sigpipe-guard 1737 vs ceiling 1728; help-changelog-drift loki verify --require-exogenous; test-ui-bare-loki exact-match on new control lines; test-local-ci-gitleaks scope) | the failing tests, loki-ts/src/util/check_result.ts, loki-ts/src/engine10/stages/wall.ts, loki-ts/src/engine10/stages/verify.ts, verify help and completions, scripts/local-ci.sh, docs/v10/FAILURE-CLASSES.md | MEDIUM | red: each named test fails on e32ee1b5d; green: cd loki-ts && bun test tests/engine10/pr_body_golden.test.ts tests/engine10/sizing.test.ts tests/engine10/router_optout_golden.test.ts tests/engine10/verify.test.ts tests/util; bash tests/test-sigpipe-guard.sh; bash tests/test-help-changelog-drift.sh; bash tests/test-ui-bare-loki.sh; bash tests/test-local-ci-gitleaks.sh | ready@2026-10-17T09:20Z | Diagnosis 2026-10-17 by nightly diag agent; one FAILURE-CLASSES row per class |
+| TEN-STABILITY-19 | P0 fix-forward: moat P8.ablation-dead-code-not-sealed positive control headline VERIFIED WITH GAPS (expected VERIFIED) and first-run-gate --stub FAILED with dirty tracked tree M sum.js at intake.ts:61 | tests/moat/p8-*.sh or the ablation producer, scripts/first-run-gate.sh, loki-ts/src/engine10/stages/intake.ts only if the honest fix is there | HIGH | red: bash tests/moat/run.sh prints moat suite: FAIL (1 rule failure(s)); bash scripts/first-run-gate.sh --stub fails 7 assertions; green: both exit 0 | ready@2026-10-17T09:20Z | Diagnosis 2026-10-17; never weaken a moat assertion to pass |
+| TEN-SECURITY-04 | fix: redactSecrets also strips GitLab (glpat-), npm (npm_), Hugging Face (hf_), Stripe (sk_live_, rk_live_) tokens and PEM private key blocks | loki-ts/src/util/redact.ts, loki-ts/tests/util/redact.test.ts | HIGH | red: each of the five token shapes and a -----BEGIN PRIVATE KEY----- block survive redactSecrets; green: all replaced with [REDACTED:...] markers, existing rules and ordering unchanged; cd loki-ts && bunx tsc --noEmit && bun test tests/util/redact.test.ts | released v11.17.40 | Gap: redact.ts RULES (lines 3-14) cover Anthropic, GitHub, Slack, AWS, JWT, Google, OpenAI, Bearer, URL userinfo; grep -rnE 'glpat or npm_ or hf_ or BEGIN [A-Z ]*PRIVATE or sk_live' loki-ts/src/util/redact.ts returned 0 hits (export_sarif.ts:18 and contrib/ai_bom.ts:83 know the shapes but are not the redactor). Specific rules before generic, keep ReDoS-safe quantifiers. |
 | TEN-SECURITY-05 | enhancement: redactSecrets strips secret query parameters (token, access_token, api_key, apikey, password, secret, sig) from URLs in logged and receipted output | loki-ts/src/util/redact.ts, loki-ts/tests/util/redact.test.ts | HIGH | red: https://h/x?access_token=abc123 survives; green: value replaced, parameter name and other params kept, non-secret params untouched; cd loki-ts && bunx tsc --noEmit && bun test tests/util/redact.test.ts | ready@2026-10-17T08:05Z | Gap: TEN-SECURITY-02 covers URL userinfo and Authorization only (redact.ts:12-13); grep -nE 'access_token or api_key or \?' loki-ts/src/util/redact.ts returned 0 query-string rules. Serialize after TEN-SECURITY-04 (same two files). |
 | TEN-SECURITY-06 | feature: secure-scan rule 6 flags disabled TLS verification in committed code (verify=False, rejectUnauthorized: false, InsecureSkipVerify: true, NODE_TLS_REJECT_UNAUTHORIZED=0) | autonomy/lib/secure-scan.py, tests/test-secure-scan.sh | HIGH | red: a fixture with requests.get(url, verify=False) scans clean; green: finding rule tls-verify-disabled with file and line, test and fixture paths and comments excluded like rule 4; bash tests/test-secure-scan.sh | ready@2026-10-17T08:05Z | Gap: secure-scan.py has rules 1-5 only (rule comments at lines 93, 105, 193, 238, 345); grep -nE 'verify=False or rejectUnauthorized or InsecureSkipVerify or NODE_TLS' autonomy/lib/secure-scan.py returned 0 hits. Bump RULES_VERSION (line 49). Serialize after TEN-GATES-20 and before TEN-SECURITY-07. |
 | TEN-SECURITY-07 | feature: secure-scan rule 7 flags shell injection shapes (subprocess with shell=True and an f-string or format argument, os.system with concatenation, child_process.exec with a template literal) | autonomy/lib/secure-scan.py, tests/test-secure-scan.sh | HIGH | red: subprocess.run(f"rm {x}", shell=True) scans clean; green: finding rule shell-injection with file and line, constant-string commands and test paths not flagged; bash tests/test-secure-scan.sh | ready@2026-10-17T08:05Z | Gap: grep -nE 'shell=True or os\.system or child_process' autonomy/lib/secure-scan.py returned 0 hits. Precision first (the file's stated design: literal forms only), measure false positives on this repo's own tests before shipping. Serialize after TEN-SECURITY-06. |

package/docs/v10/PROGRESS.md

@@ -2497,3 +2497,6 @@ v11.17.21 published (Release success on 462fbc40a; npm latest 11.17.21, next 11.
 
 ## 2026-10-17T09:06Z (CoS) v11.17.39
 - Wave AF: TEN-STABILITY-14 (APPROVE f0a131549) and TEN-DEPLOY-09 (APPROVE 87fa1bbfb) merged; cd loki-ts && bun test tests/util: 382 pass, 0 fail on the merged tree. A-112b already shipped (bfd6b98d8). Q17-05b BLOCK 812d13e0c and Q18-03e BLOCK 0c0c7ef0c after a fix round; TEN-DEPLOY-03 and TEN-GATES-15 fix rounds never ran (CoS script bug: the review pointer did not start with BLOCK), re-dispatched.
+
+## 2026-10-17T09:21Z (CoS) v11.17.40
+- v11.17.40: wave AG, 14 slices merged (QUALITY-17 test file hand-merged with GATES-18, 16 pass 0 fail); tests/util 407 pass 0 fail, budget and L0 guards 36 pass 0 fail, tsc clean outside control-plane. STABILITY-16 was already shipped. COST-32, SPEED-06, QUALITY-16, UX-19 and STABILITY-15 builders started from a stale base without their rows and are re-dispatched. P0 rows TEN-STABILITY-18 and TEN-STABILITY-19 added for nightly 39016259458 reds.