loki-mode 11.17.43 → 11.17.45

package/docs/v10/BOARD.md

@@ -1006,7 +1006,7 @@ Source: ~/git/autonomi-dev/research/2026-09-30-adoption/SWARM-PROMPT-ADOPTION.md
 | FC-23 | FC-23: the Wall writes tests matching the package's module system and test conventions from the Project Model; a lint or type error inside a Wall file is harness-owned, the Wall file is regenerated once or discarded with a NOT PROVEN note, and no fix round is spent on it | loki-ts/src/engine10/stages/wall.ts, the fix-round target filter, project_model conventions, plus tests | MEDIUM | a CommonJS package gets a Wall test with no import.meta; a forced type error in a Wall file yields regenerate-or-discard and zero fix rounds | released@2026-10-04T00:51Z | released@2026-10-04T00:51Z | Merged c0a1c43c2 (38c782386, review-fc23 sonnet APPROVE; nits: duplicate NOT PROVEN line for a discarded file, merged comment in verify.ts). 
 | TEN-DEPLOY-01 | Capture the deployed public URL on every --execute path and probe it by default | autonomy/loki (_deploy_try_execute non-canary exec block and the _deploy_record arg list and JSON fields only), tests/test-deploy-receipt-gate.sh (new section after the existing 14-18 block), CHANGELOG.md | MEDIUM | see Wall in note | released@2026-10-17T02:57Z | merge 60a9bb709; TL APPROVE b14d908a4 (deploy-receipt-gate 56/0, test-deploy 6/6, shellcheck 91=91 vs main). wave 1; depends: none. Goal: After a deploy that exits 0, take the last https URL the provider CLI printed (the canary grep -Eo already does this; reuse that, do not add a second parser). Store it as deployed_url in loki.deploy/1. When no --health-url is given, probe deployed_url with _deploy_probe_health and record health_url_source=captured/flag. No URL printed: deployed_url is empty, health stays 'unchecked', and Loki never invents a URL. Print 'Live at: <url>' only when one was captured. Wall: RED: a new section stubs vercel to print 'https://app-x.vercel.app' and exit 0, and stubs curl to 200. The record lacks deployed_url, health_status is 'unchecked', and the test fails on main. GREEN: deployed_url equals the stub URL, health_status=healthy, health_url_source=captured. A second stub prints no URL: deployed_url is empty, health is 'unchecked', exit 0. A third case passes --health-url: health_url_source=flag. MUTATION: hardcode deployed_url to a constant and the no-URL case goes red. Gate: bash -n autonomy/loki && shellcheck -S warning autonomy/loki && bash tests/test-deploy-receipt-gate.sh && bash tests/test-deploy.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. v11.17.13 npm next 11.17.13 |
 | TEN-DEPLOY-02 | Signed live provenance doc (loki.provenance/1) and loki verify --url | loki-ts/src/util/receipt_signer.ts, loki-ts/tests/engine10/verify_cmd.test.ts (provenance cases; existing deploy-record tests live here), docs/SIGNED-RECEIPTS.md (one section), CHANGELOG.md. Engine10 core is not edited: verify_cmd.ts:164 already routes through deployAttestCmd, and a one-token --url passthrough there needs the budget test to stay green. | HIGH | see Wall in note | released v11.17.26@2026-10-17T05:48Z | SPLIT per CTO critic into (a) signProvenance plus --sign-provenance, (b) verify --url fetch and verdicts; build as two commits or two agents. wave 2; depends: none. Goal: Extend receipt_signer.ts, the owner of signed deploy attestations, with: signProvenance(head_sha, tree_sha, receipt_sha256, run_id, built_at), which signs with the same Ed25519 key as signDeployRecord; a `--sign-provenance FILE` dispatch in deployAttestCmd; and `loki verify --url https://host` plus a pubkey. The --url check fetches <url>/.well-known/loki-provenance.json with a timeout and size cap, checks the signature, and requires a 200 with JSON. The verdict is VERIFIED only when the signature verifies against the local JWKS or --pubkey AND the cited receipt (when present locally or via --receipt) is VERIFIED. The doc alone with an unknown kid is UNCHECKED rc 2. An edited doc is TAMPERED rc 1. A fetch failure is UNCHECKED and never VERIFIED. Optional --expect-sha SHA must equal head_sha. Wall: RED: tests serve a signed provenance doc from Bun.serve on 127.0.0.1. On main, `verify --url` is an unknown arg and exits 2, so the tests fail. GREEN: genuine doc with --pubkey gives VERIFIED rc 0. One edited byte of head_sha gives TAMPERED rc 1. An unknown kid gives UNCHECKED rc 2. A 404, a non-JSON body or a doc over 64KB gives UNCHECKED rc 2. A wrong --expect-sha gives TAMPERED rc 1. MUTATION: skip the signature verify and the edited-byte case goes red. Gate: cd loki-ts && bun test tests/engine10/verify_cmd.test.ts && bun test tests/engine10/ && bunx tsc --noEmit (the full engine10 suite runs the budget and spawn-env guards) Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
-| TEN-DEPLOY-03 | Ship the provenance doc with the build and prove the live URL serves the verified SHA | autonomy/loki (_deploy_try_execute pre-exec and post-health blocks, _deploy_record live_binding field only), tests/test-deploy-receipt-gate.sh (new section), docs/WORKSPACES.md, CHANGELOG.md | HIGH | see Wall in note | ready@2026-10-17T01:40Z | SPLIT per CTO critic into (a) provenance file into deploy root per project type, (b) post-deploy live-binding probe; build as two commits or two agents. wave 3; depends: TEN-DEPLOY-01, TEN-DEPLOY-02. Goal: In _deploy_try_execute, after the gate passes and before the provider runs, write a signed .well-known/loki-provenance.json into the deploy root via `verify --sign-provenance`. The deploy root is public/ for nextjs and vite, the detected dist/ or build/ for static, and is refused with a reason for docker/python where no static root exists. Write it as an untracked build artifact so the dirty-tree gate is evaluated before it. After the deploy, probe <deployed_url>/.well-known/loki-provenance.json. Set live_binding=VERIFIED only when its head_sha equals the anchor. A mismatch gives FAILED_HEALTH exit 4 (stale or wrong build served). Update docs/WORKSPACES.md and replace 'deployed-SHA binding is not implemented' with what is now bound and what is not. Wall: RED: a stubbed vercel copies dist/ into a served dir and a python http.server serves it. On main, no provenance file exists and the record has no live_binding. GREEN: the file exists in dist/.well-known, live_binding=VERIFIED, and its head_sha equals git rev-parse HEAD. A stub that serves an older provenance gives FAILED_HEALTH exit 4. A docker project prints the refusal reason and records live_binding=unsupported, never VERIFIED. The dirty-tree gate still refuses a dirty tree before the file is written. MUTATION: compare against a constant instead of the anchor and the stale-serve case goes red. Gate: bash -n autonomy/loki && shellcheck -S warning autonomy/loki && bash tests/test-deploy-receipt-gate.sh && (cd loki-ts && bun test tests/engine10/verify_cmd.test.ts) Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
+| TEN-DEPLOY-03 | Ship the provenance doc with the build and prove the live URL serves the verified SHA | autonomy/loki (_deploy_try_execute pre-exec and post-health blocks, _deploy_record live_binding field only), tests/test-deploy-receipt-gate.sh (new section), docs/WORKSPACES.md, CHANGELOG.md | HIGH | see Wall in note | released v11.17.45 | SPLIT per CTO critic into (a) provenance file into deploy root per project type, (b) post-deploy live-binding probe; build as two commits or two agents. wave 3; depends: TEN-DEPLOY-01, TEN-DEPLOY-02. Goal: In _deploy_try_execute, after the gate passes and before the provider runs, write a signed .well-known/loki-provenance.json into the deploy root via `verify --sign-provenance`. The deploy root is public/ for nextjs and vite, the detected dist/ or build/ for static, and is refused with a reason for docker/python where no static root exists. Write it as an untracked build artifact so the dirty-tree gate is evaluated before it. After the deploy, probe <deployed_url>/.well-known/loki-provenance.json. Set live_binding=VERIFIED only when its head_sha equals the anchor. A mismatch gives FAILED_HEALTH exit 4 (stale or wrong build served). Update docs/WORKSPACES.md and replace 'deployed-SHA binding is not implemented' with what is now bound and what is not. Wall: RED: a stubbed vercel copies dist/ into a served dir and a python http.server serves it. On main, no provenance file exists and the record has no live_binding. GREEN: the file exists in dist/.well-known, live_binding=VERIFIED, and its head_sha equals git rev-parse HEAD. A stub that serves an older provenance gives FAILED_HEALTH exit 4. A docker project prints the refusal reason and records live_binding=unsupported, never VERIFIED. The dirty-tree gate still refuses a dirty tree before the file is written. MUTATION: compare against a constant instead of the anchor and the stale-serve case goes red. Gate: bash -n autonomy/loki && shellcheck -S warning autonomy/loki && bash tests/test-deploy-receipt-gate.sh && (cd loki-ts && bun test tests/engine10/verify_cmd.test.ts) Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
 | TEN-DEPLOY-04 | Verified deploy badge from loki status --badge | loki-ts/src/commands/status.ts (renderLastDeploy plus --badge flag parse only), loki-ts/tests/commands/status.test.ts, CHANGELOG.md | MEDIUM | see Wall in note | released@2026-10-17T05:06Z | wave 4; depends: TEN-DEPLOY-01 (deployed_url field); live_binding from TEN-DEPLOY-03 is read if present, and its absence omits the badge. Goal: `loki status --badge` reads the newest loki.deploy/1 record (renderLastDeploy already loads it) and verifies it through the existing verify path. It prints a markdown shields badge linking to <deployed_url>/.well-known/loki-provenance.json. The message is 'deployed: verified' (brightgreen) ONLY when the record verifies and live_binding=VERIFIED. 'deployed: unverified' (red) is printed for TAMPERED or a failed health check. In all other cases the badge is omitted with a one-line reason. It never prints green from an unchecked field. The color mapping matches the share badge (autonomy/loki:38291), and no new vocabulary is added. Wall: RED: status.test.ts fixture with a signed healthy record, live_binding=VERIFIED and deployed_url. On main, --badge is unknown and no badge line is printed. GREEN: the badge line contains 'brightgreen' and deployed_url. A record with health FAILED_HEALTH gives a red badge. An unsigned record or a missing live_binding omits the badge and prints the reason. A record with no deployed_url omits the badge. MUTATION: drop the verify call and the unsigned case goes green, so the test goes red. Gate: cd loki-ts && bun test tests/commands/status.test.ts && bunx tsc --noEmit && bash tests/test-status-surface-agrees.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
 | TEN-DEPLOY-05 | loki deploy --env-file: push env to the provider with names-only records | autonomy/loki (cmd_deploy arg parse for --env-file, _deploy_try_execute env step, _deploy_record env_keys field only), tests/test-deploy-receipt-gate.sh (new section), autonomy/completions (loki deploy flag list only), CHANGELOG.md | HIGH | see Wall in note | released v11.17.35 | SPLIT per CTO critic into (a) env-file parser, .env.example check, masking, env_keys record, (b) four provider verbs; build as two commits or two agents. wave 4; depends: TEN-DEPLOY-03 (same function, serialized to avoid conflicts). Goal: `--env-file FILE` (with --execute only) parses KEY=VALUE with no shell eval. It refuses when a key in .env.example is missing from FILE, naming the keys. Env is applied through documented verbs only: Vercel `vercel --prod -e K=V` per key (args built as an array, never through the shell); Fly `fly secrets set --stage K=V ...` before `fly deploy`; Netlify `netlify env:import FILE`; Cloudflare `wrangler secret bulk FILE`. An unsupported provider refuses with nothing run. The record stores env_keys (names, sorted) and env_source; it NEVER stores values. Values never appear in stdout, the record or the printed 'Running:' line, where they are masked as K=***. Wall: RED: a recording vercel stub logs argv. On main, --env-file is ignored and no -e args appear. GREEN: argv has `-e API_URL=x -e TOKEN=s3cr3t`. Grepping stdout, stderr and the record for s3cr3t finds nothing; env_keys=[API_URL,TOKEN]. When .env.example lists DB_URL and the env file lacks it, the command refuses with rc 1, no stub calls and DB_URL named. A value with $(touch pwned) leaves no file named pwned. MUTATION: write values into the record and the secret-grep goes red. Gate: bash -n autonomy/loki && shellcheck -S warning autonomy/loki && bash tests/test-deploy-receipt-gate.sh && bash tests/test-completion-drift.sh (or whichever completion drift test the CHANGELOG cites) Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
 | TEN-DEPLOY-06 | loki deploy --domain: attach a custom domain and prove TLS | autonomy/loki (cmd_deploy --domain parse and a post-health domain block in _deploy_try_execute, _deploy_record domain/tls fields only), tests/test-deploy-receipt-gate.sh (new section), CHANGELOG.md | MEDIUM | see Wall in note | released v11.17.38 | wave 5; depends: TEN-DEPLOY-05 (same function, serialized). Goal: `--domain example.com` (with --execute) runs documented verbs after a healthy deploy: Vercel `vercel alias set <deployed_url> <domain>`; Fly `fly certs add <domain>`. Netlify and Cloudflare print the manual dashboard step and set domain_status=manual. Then a TLS proof runs: `openssl s_client -servername <domain> -connect <domain>:443` plus `openssl x509 -noout -enddate -checkend 604800`. It records domain, tls_status (valid/expiring/invalid/unchecked) and tls_not_after, and re-probes https://<domain>/.well-known/loki-provenance.json for the same head_sha. DNS not yet pointed gives tls_status=invalid and exit 6, with the DNS record the provider needs printed. It never claims valid without the openssl check. Wall: RED: vercel, openssl and curl are stubbed. On main, --domain is ignored. GREEN: the alias set argv is recorded, tls_status=valid and tls_not_after is set. An openssl stub that fails -checkend gives expiring. An openssl handshake failure gives invalid and exit 6. A netlify project gives domain_status=manual, no alias call, and tls still checked. No openssl on PATH gives unchecked, never valid. MUTATION: default tls_status to valid and the missing-openssl case goes red. Gate: bash -n autonomy/loki && shellcheck -S warning autonomy/loki && bash tests/test-deploy-receipt-gate.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
@@ -1155,7 +1155,7 @@ Source: ~/git/autonomi-dev/research/2026-09-30-adoption/SWARM-PROMPT-ADOPTION.md
 | TEN-STABILITY-14 | P0 fix-forward: four loki-ts/tests/util structural guards are red on main (model_output_regex_guard: wall.ts count mismatched after TEN-STABILITY-13 moved classifiers to util/check_result.ts; full_env_spawn_guard: doctor.ts mismatched and util/funnel.ts unlisted; registration_list_guard: stale commands/status.ts entry; start_flag_parity_guard: --cost undeclared) | the four allowlist or table files those guards load, plus the src file only when the honest fix is in code (for example funnel.ts spawning with the full env) | MEDIUM | red: cd loki-ts && bun test tests/util/model_output_regex_guard.test.ts tests/util/full_env_spawn_guard.test.ts tests/util/registration_list_guard.test.ts tests/util/start_flag_parity_guard.test.ts has 4 fails; green: 0 fails and bun test tests/util tests/engine10 has 0 fails | released v11.17.39 | Each allowlist entry needs a true reason; a full-env spawn in funnel.ts is fixed in code (allowlisted env) unless it is a documented passthrough. Three were red at ac43fb498 (v11.17.37). Source: combined-tree run before v11.17.38. |
 | TEN-COST-31 | feature: loki report kpis --since <Nd or YYYY-MM-DD> limits the iteration totals to a window and the human output names the window | loki-ts/src/commands/kpis.ts, loki-ts/src/metrics/kpis.ts, loki-ts/tests/commands/kpis.test.ts | MEDIUM | red: `loki report kpis --since 7d` exits 1 with unknown arg; green: iterations older than the window are excluded from cost and token totals, output says "since <date>", bad value exits 1; cd loki-ts && bunx tsc --noEmit && bun test tests/commands/kpis.test.ts | released v11.17.40 | Gap: grep -n -e '--since' loki-ts/src/commands/kpis.ts returned 0 hits; the flag loop at kpis.ts:66-80 accepts only --json and help. Engineer confirms the iteration file mtime or timestamp field in metrics/kpis.ts before filtering. |
 | TEN-COST-32 | enhancement: a BUDGET_STOP run's next line names the exact recovery (loki start --max-cost <higher> or the resume command) instead of the generic loki status | loki-ts/src/util/run_summary.ts, loki-ts/tests/util/run_summary.test.ts | LOW | red: nextOf for a BUDGET_STOP run returns "loki status"; green: next line contains "--max-cost" and the run id; cd loki-ts && bunx tsc --noEmit && bun test tests/util/run_summary.test.ts | released v11.17.41 | Gap: run_summary.ts:62-67 returns "loki status" for every stopped result; grep -n 'max-cost' loki-ts/src/util/run_summary.ts returned 0 hits. Keep the change in util/ (engine10/output.ts is at the line cap): key on the outcome the summary input already carries. |
-| TEN-COST-33 | feature: loki queue run --max-total-cost <usd> stops the queue before the next item once cumulative spend reaches the cap and says so in the digest | loki-ts/src/commands/queue.ts, loki-ts/tests/commands/queue.test.ts, loki-ts/src/cli/registry.ts | MEDIUM | red: queue run has no total cap, a 3-item queue runs all 3 with injected spend 2 each and cap 3; green: stops after item 2, remaining items stay queued, digest line names the cap; cd loki-ts && bunx tsc --noEmit && bun test tests/commands/queue.test.ts tests/cli/registry_guard.test.ts | ready@2026-10-17T08:05Z | Gap: grep -nE 'max-cost or total or spend' loki-ts/src/commands/queue.ts shows only the governor forecast (queue.ts:213-235); no cumulative cap. Serialize on queue.ts after TEN-STABILITY-15 and TEN-UX-16. |
+| TEN-COST-33 | feature: loki queue run --max-total-cost <usd> stops the queue before the next item once cumulative spend reaches the cap and says so in the digest | loki-ts/src/commands/queue.ts, loki-ts/tests/commands/queue.test.ts, loki-ts/src/cli/registry.ts | MEDIUM | red: queue run has no total cap, a 3-item queue runs all 3 with injected spend 2 each and cap 3; green: stops after item 2, remaining items stay queued, digest line names the cap; cd loki-ts && bunx tsc --noEmit && bun test tests/commands/queue.test.ts tests/cli/registry_guard.test.ts | released v11.17.44 | Gap: grep -nE 'max-cost or total or spend' loki-ts/src/commands/queue.ts shows only the governor forecast (queue.ts:213-235); no cumulative cap. Serialize on queue.ts after TEN-STABILITY-15 and TEN-UX-16. |
 | TEN-COST-34 | enhancement: the run summary Spend line adds "of which $X on retries" when retry sessions cost money | loki-ts/src/util/run_summary.ts, loki-ts/tests/util/run_summary.test.ts | LOW | red: a summary input with retry_usd 0.40 prints no retry figure; green: Spend line ends with "($0.40 on retries)", nothing printed when retry_usd is 0 or null; cd loki-ts && bunx tsc --noEmit && bun test tests/util/run_summary.test.ts | released v11.17.40 | Gap: costBreakdown computes retry_usd and retry_sessions (util/cost_breakdown.ts:17-43) and engine10/cost.ts:168 attaches it, but grep -rn retry_usd loki-ts/src outside cost_breakdown.ts returned 0 hits, so no reader. If the breakdown does not reach the summary input, thread it through spendText in run_summary.ts:166 only. |
 | TEN-SPEED-06 | enhancement: loki doctor runs its independent CLI version and network probes concurrently (Promise.all) so the report takes the slowest probe, not the sum | loki-ts/src/commands/doctor.ts, loki-ts/tests/commands/doctor.test.ts | MEDIUM | red: a test with three injected probes of 200ms each takes at least 600ms; green: under 350ms and the output order is unchanged; cd loki-ts && bunx tsc --noEmit && bun test tests/commands/doctor.test.ts | released v11.17.41 | Gap: grep -c 'spawnSync or execSync' loki-ts/src/commands/doctor.ts is 11 against 4 Promise.all uses. Output ordering must stay byte-identical (doctor_router and doctor_count tests). Do not touch claudeLoginProbeCached (TEN-SPEED-05). |
 | TEN-SPEED-07 | feature: fix-round verification runs the previously failing test files first (pytest --ff style, bun/vitest file order) and stops at first failure when the runner supports it | loki-ts/src/util/check_result.ts, loki-ts/src/e10ext/select.ts, loki-ts/tests/e10ext/select.test.ts | MEDIUM | red: fix-round test command is identical to the round-1 command; green: command lists last-round failing files first for bun test, pytest and jest, unchanged for unknown runners; cd loki-ts && bunx tsc --noEmit && bun test tests/e10ext/select.test.ts tests/util | released v11.17.40 | Gap: grep -rnE 'failed.?first or lastFailed or --ff or --bail' loki-ts/src returned 0 hits. Engineer finds the verify command builder; if the only wiring point is inside engine10 core, land the pure helper in e10ext/ and wire with a net-zero line change. |
@@ -1166,53 +1166,83 @@ Source: ~/git/autonomi-dev/research/2026-09-30-adoption/SWARM-PROMPT-ADOPTION.md
 | TEN-GATES-18 | feature: Seal risk summary flags a dependency manifest change (package.json deps, pyproject deps, go.mod) with no matching lockfile change | loki-ts/src/util/check_result.ts, loki-ts/tests/util/check_result.test.ts, loki-ts/tests/engine10 L0 guard allowlist (widened at review) | HIGH | red: diff touching package.json dependencies only produces no finding; green: advisory finding "manifest changed without lockfile", clean when both change or only scripts change; cd loki-ts && bunx tsc --noEmit && bun test tests/util tests/engine10 | released v11.17.40 | Gap: check_result.ts:272 classifies lockfile paths and :312 flags deleted tests, but nothing pairs a manifest with its lockfile (grep -nE 'manifest.*lock' returned only the classifier). Advisory only, never turns a VERIFIED into a fail; needs FAILURE-CLASSES row. |
 | TEN-GATES-19 | feature: the signed receipt records the toolchain that ran the checks (bun, node, python3, git versions) so a verifier can see what produced the proof | loki-ts/src/util/composite_seal.ts, loki-ts/src/util/receipt_signer.ts, loki-ts/tests/engine10/seal_group.test.ts | HIGH | red: receipt payload has no toolchain field; green: receipt carries toolchain {bun,node,python3,git}, absent tools recorded as null, old receipts still verify; cd loki-ts && bunx tsc --noEmit && bun test tests/engine10 tests/util/receipt_bundle.test.ts | released v11.17.40 | Gap: grep -rnE 'node_version or toolchain or bun_version or python_version' loki-ts/src/util loki-ts/src/engine10 returned 0 hits. Schema is additive and optional so verify of pre-existing receipts is unchanged; moat file set, two unanimous reviewers. |
 | TEN-GATES-20 | enhancement: secure-scan.py reports files_scanned and the Seal treats a scan of zero files as not_run instead of a clean pass | autonomy/lib/secure-scan.py, loki-ts/src/util/secure_scan.ts, loki-ts/tests/util/secure_scan.test.ts | HIGH | red: scanning an empty directory returns ok with total 0 and no file count; green: result carries summary.files_scanned, zero files yields not_run in the wrapper; cd loki-ts && bunx tsc --noEmit && bun test tests/util/secure_scan.test.ts && bash tests/test-secure-scan.sh | released v11.17.40 | Gap: scan() at autonomy/lib/secure-scan.py:600-630 returns only rules_version, findings, summary.total and by_severity; grep -n 'files_scanned or scanned' loki-ts/src/util/secure_scan.ts returned 0 hits. Serialize with TEN-SECURITY-06/07 (same python file). |
-| TEN-UX-16 | feature: loki queue remove <issue...> and loki queue clear take items out of the queue | loki-ts/src/commands/queue.ts, loki-ts/src/cli/registry.ts, loki-ts/tests/commands/queue.test.ts | LOW | red: `loki queue remove 12` prints the usage error; green: remove drops the normalized ref and reports "N removed, M left", clear empties the file, missing ref exits 0 with "not queued"; cd loki-ts && bunx tsc --noEmit && bun test tests/commands/queue.test.ts tests/cli/registry_guard.test.ts | ready@2026-10-17T08:05Z | Gap: runQueue dispatches only add, list, run (queue.ts:384-390) and registry.ts:174 declares the same three subcommands; grep -nE 'queue.*(remove or rm or clear)' loki-ts/src returned 0 hits. Serialize after TEN-STABILITY-15. |
+| TEN-UX-16 | feature: loki queue remove <issue...> and loki queue clear take items out of the queue | loki-ts/src/commands/queue.ts, loki-ts/src/cli/registry.ts, loki-ts/tests/commands/queue.test.ts | LOW | red: `loki queue remove 12` prints the usage error; green: remove drops the normalized ref and reports "N removed, M left", clear empties the file, missing ref exits 0 with "not queued"; cd loki-ts && bunx tsc --noEmit && bun test tests/commands/queue.test.ts tests/cli/registry_guard.test.ts | released v11.17.44 | Gap: runQueue dispatches only add, list, run (queue.ts:384-390) and registry.ts:174 declares the same three subcommands; grep -nE 'queue.*(remove or rm or clear)' loki-ts/src returned 0 hits. Serialize after TEN-STABILITY-15. |
 | TEN-UX-17 | feature: loki undo --list prints the recent runs that can be undone (run id, verdict, files changed, age) | loki-ts/src/commands/undo.ts, loki-ts/tests/commands/undo.test.ts | LOW | red: `loki undo --list` prints the usage text and exits 2; green: lists newest first from the runs dir, exits 0, empty state says "no runs to undo"; cd loki-ts && bunx tsc --noEmit && bun test tests/commands/undo.test.ts | released v11.17.40 | Gap: undo.ts:156 USAGE lists only --plan and --dry-run forms and :180 requires a run id; grep -rnE '"--list"' loki-ts/src/commands returned 0 hits. New test file only if grep -rl runUndo loki-ts/tests finds none. Read-only: no git writes. |
-| TEN-UX-18 | enhancement: loki doctor --quiet prints only failed and warned checks plus the summary footer | loki-ts/src/commands/doctor.ts, loki-ts/tests/commands/doctor.test.ts | LOW | red: doctor --quiet is rejected or prints every pass row; green: only non-pass rows and the footer, exit code unchanged, --json unaffected; cd loki-ts && bunx tsc --noEmit && bun test tests/commands/doctor.test.ts | ready@2026-10-17T08:05Z | Gap: grep -nE 'quiet or -q\b' loki-ts/src/commands/doctor.ts returned 0 hits; the footer tally is at doctor.ts:1026. Update the usage text at doctor.ts:1052 and the start_flag_parity or help-drift guards if they list doctor flags. |
+| TEN-UX-18 | enhancement: loki doctor --quiet prints only failed and warned checks plus the summary footer | loki-ts/src/commands/doctor.ts, loki-ts/tests/commands/doctor.test.ts | LOW | red: doctor --quiet is rejected or prints every pass row; green: only non-pass rows and the footer, exit code unchanged, --json unaffected; cd loki-ts && bunx tsc --noEmit && bun test tests/commands/doctor.test.ts | released v11.17.44 | Gap: grep -nE 'quiet or -q\b' loki-ts/src/commands/doctor.ts returned 0 hits; the footer tally is at doctor.ts:1026. Update the usage text at doctor.ts:1052 and the start_flag_parity or help-drift guards if they list doctor flags. |
 | TEN-UX-19 | enhancement: loki start --help ends with three copyable examples (brief, PRD file, issue ref) | loki-ts/src/commands/start.ts, loki-ts/tests/commands/start.test.ts | LOW | red: start help text has no Examples section; green: help lists loki start "<brief>", loki start ./prd.md, loki start owner/repo#123 and the quick-start docs agree; cd loki-ts && bunx tsc --noEmit && bun test tests/commands/start.test.ts tests/commands/cli_help_routes.test.ts | released v11.17.41 | Gap: grep -nE 'Examples?:' loki-ts/src/commands/start.ts returned 0 hits. Check the bash help route (autonomy/help-core.sh) is not the one users reach; if it is, change the one that owns the text and keep the other byte-equal per the help-drift guard. |
 | TEN-ADOPTION-13 | feature: loki proof share --dry-run runs the secret scan and prints what would be published without publishing | loki-ts/src/commands/proof.ts, loki-ts/tests/commands/proof.test.ts | MEDIUM | red: `proof share <id> --dry-run` is treated as an unknown arg or publishes; green: prints the file list and scan verdict, publishes nothing, exit 0 clean and 1 when the scan blocks; cd loki-ts && bunx tsc --noEmit && bun test tests/commands/proof.test.ts | released v11.17.40 | Gap: grep -n 'dry' loki-ts/src/commands/proof.ts returned 0 hits; share dispatch is at proof.ts:890 and its token scan came from TEN-ADOPTION-03-F1. |
 | TEN-ADOPTION-14 | enhancement: loki proof list --json prints the proof index as machine-readable JSON | loki-ts/src/commands/proof.ts, loki-ts/tests/commands/proof.test.ts | LOW | red: `proof list --json` prints the text table; green: JSON array of {id, verdict, created} sorted newest first, text output unchanged; cd loki-ts && bunx tsc --noEmit && bun test tests/commands/proof.test.ts | released v11.17.41 | Gap: only show handles --json (proof.ts:47 and :149 args.includes("--json") inside show); the list arm at proof.ts:873 ignores it. Serialize after TEN-ADOPTION-13 (same file). |
 | TEN-ADOPTION-15 | enhancement: loki self-update --check also reports the installed version, the latest published version and whether an update is available | autonomy/loki, tests/test-self-update.sh | MEDIUM | red: --check prints only the detected package manager; green: also prints "installed X, latest Y, update available yes/no", offline prints "latest unknown" and exits 0; bash tests/test-self-update.sh | released v11.17.40 | Gap: autonomy/loki:14665 and :14694 document --check as "Print detection result" only. Reuse the registry lookup already in loki-ts/src/util/update_check.ts:97 instead of a second fetch. If tests/test-self-update.sh does not exist, extend the test that owns cmd_self_update (grep -l self-update tests/*.sh). |
 | TEN-DEPLOY-13 | fix: loki status --probe reports a regression when the health URL redirects to a different host (login page, provider not-found page) even though the final status is 200 | loki-ts/src/commands/status.ts, loki-ts/tests/commands/status.test.ts | MEDIUM | red: probe of a URL that redirects to another host returning 200 prints "Deploy health OK"; green: prints a failure naming the final host and exits 1, same-host redirects (http to https, trailing slash) still pass; cd loki-ts && bunx tsc --noEmit && bun test tests/commands/status.test.ts | released v11.17.40 | Gap: status.ts:865 fetches with redirect follow and accepts 200-399 without comparing res.url to the recorded health_url host, so a redirect to a shared provider page reads healthy. |
 | TEN-DEPLOY-14 | feature: loki status --probe --json prints the probe result as one JSON object (url, ok, status, attempts, reason) | loki-ts/src/commands/status.ts, loki-ts/tests/commands/status.test.ts | LOW | red: --probe --json prints text lines; green: single JSON object, exit codes unchanged (0 healthy or nothing to probe, 1 regression); cd loki-ts && bunx tsc --noEmit && bun test tests/commands/status.test.ts | released v11.17.41 | Gap: status.ts:1023-1031 parses --probe and the usage text allows --json only without --probe; probe output at status.ts:850-880 is text only. Serialize after TEN-DEPLOY-13 (same region). |
-| TEN-DEPLOY-15 | enhancement: loki doctor disk check measures the current repo directory and the temp directory volumes, not only the home directory | loki-ts/src/commands/doctor.ts, loki-ts/tests/commands/doctor.test.ts | LOW | red: checkDisk reads statfs of homedir only; green: result reports the minimum free GB across home, cwd and tmpdir and names which volume is low; cd loki-ts && bunx tsc --noEmit && bun test tests/commands/doctor.test.ts | ready@2026-10-17T08:05Z | Gap: checkDisk at doctor.ts:353-365 calls statfsSync(homedir()) only; builds and worktrees write under cwd and tmpdir, which can be a separate full volume. Keep the DiskCheck JSON shape backwards compatible (add a field, do not rename). Serialize after TEN-SPEED-06 and TEN-UX-18 (same file). |
+| TEN-DEPLOY-15 | enhancement: loki doctor disk check measures the current repo directory and the temp directory volumes, not only the home directory | loki-ts/src/commands/doctor.ts, loki-ts/tests/commands/doctor.test.ts | LOW | red: checkDisk reads statfs of homedir only; green: result reports the minimum free GB across home, cwd and tmpdir and names which volume is low; cd loki-ts && bunx tsc --noEmit && bun test tests/commands/doctor.test.ts | released v11.17.44 | Gap: checkDisk at doctor.ts:353-365 calls statfsSync(homedir()) only; builds and worktrees write under cwd and tmpdir, which can be a separate full volume. Keep the DiskCheck JSON shape backwards compatible (add a field, do not rename). Serialize after TEN-SPEED-06 and TEN-UX-18 (same file). |
 | TEN-STABILITY-15 | fix: queue add on a corrupt queue file quarantines it and warns instead of silently overwriting every queued item | loki-ts/src/commands/queue.ts, loki-ts/tests/commands/queue.test.ts | MEDIUM | red: a truncated queue.json followed by queue add leaves a file holding only the new item; green: the bad file is renamed to queue.json.corrupt-<ts>, a warning is printed once, the new item is added to a fresh file; cd loki-ts && bunx tsc --noEmit && bun test tests/commands/queue.test.ts | released v11.17.41 | Gap: readQueue returns [] on any JSON error (queue.ts:79-86) and queueAdd then writeQueue overwrites (queue.ts:108-124). Same class as TEN-STABILITY-12 (outbox quarantine at util/outbox.ts:28-33); reuse that pattern and add the row to FAILURE-CLASSES.md. |
 | TEN-STABILITY-16 | enhancement: loki start sweeps stale temp files left by a killed atomic write (name.tmp.<deadpid>.<n>) older than 1 hour in the .loki state dirs | loki-ts/src/util/atomic.ts, loki-ts/tests/util/atomic.test.ts | MEDIUM | red: a leftover state.json.tmp.99999.1 with a dead pid stays forever; green: swept when pid is dead and mtime older than 1h, a live pid or fresh file is untouched, only exact tmp names matched; cd loki-ts && bunx tsc --noEmit && bun test tests/util | released (already shipped before the row: loki-ts/src/runner/state.ts:444 sweepOrphanTmpFiles) | Gap: grep -rnE '\.tmp\.' loki-ts/src shows temp names created at util/atomic.ts:89 and run_control.ts:13 with no sweeper anywhere. Never glob outside .loki; reuse processStartTime or kill -0 from util/run_pid.ts for the liveness test; wire from a util/ entry point, not engine10 core. |
-| TEN-STABILITY-17 | feature: loki doctor lists orphan runs (a run dir whose owner process died before run.completed) with the resume or undo command for each | loki-ts/src/commands/doctor.ts, loki-ts/tests/commands/doctor.test.ts | MEDIUM | red: doctor ignores a run dir with a dead pid and no run.completed event; green: a warn row names the run id and "loki resume" or "loki undo", live and completed runs produce no row; cd loki-ts && bunx tsc --noEmit && bun test tests/commands/doctor.test.ts | ready@2026-10-17T08:05Z | Gap: runOwnerAlive (util/run_pid.ts:59) is consumed only by util/run_outputs.ts:156; grep -n runOwnerAlive loki-ts/src/commands/doctor.ts returned 0 hits. Warn level only, never fails doctor. Serialize after TEN-DEPLOY-15 (same file). |
+| TEN-STABILITY-17 | feature: loki doctor lists orphan runs (a run dir whose owner process died before run.completed) with the resume or undo command for each | loki-ts/src/commands/doctor.ts, loki-ts/tests/commands/doctor.test.ts | MEDIUM | red: doctor ignores a run dir with a dead pid and no run.completed event; green: a warn row names the run id and "loki resume" or "loki undo", live and completed runs produce no row; cd loki-ts && bunx tsc --noEmit && bun test tests/commands/doctor.test.ts | released v11.17.44 | Gap: runOwnerAlive (util/run_pid.ts:59) is consumed only by util/run_outputs.ts:156; grep -n runOwnerAlive loki-ts/src/commands/doctor.ts returned 0 hits. Warn level only, never fails doctor. Serialize after TEN-DEPLOY-15 (same file). |
 | TEN-STABILITY-18 | P0 fix-forward: nightly 39016259458 reds still red on main e32ee1b5d (pr_body_golden not-recorded producer util/check_result.ts; sizing wall brief 726 vs cap 616; router_optout_golden wall stage haiku for development; verify.test uv resolution CI-only via Bun.which PATH; test-sigpipe-guard 1737 vs ceiling 1728; help-changelog-drift loki verify --require-exogenous; test-ui-bare-loki exact-match on new control lines; test-local-ci-gitleaks scope) | the failing tests, loki-ts/src/util/check_result.ts, loki-ts/src/engine10/stages/wall.ts, loki-ts/src/engine10/stages/verify.ts, verify help and completions, scripts/local-ci.sh, docs/v10/FAILURE-CLASSES.md | MEDIUM | red: each named test fails on e32ee1b5d; green: cd loki-ts && bun test tests/engine10/pr_body_golden.test.ts tests/engine10/sizing.test.ts tests/engine10/router_optout_golden.test.ts tests/engine10/verify.test.ts tests/util; bash tests/test-sigpipe-guard.sh; bash tests/test-help-changelog-drift.sh; bash tests/test-ui-bare-loki.sh; bash tests/test-local-ci-gitleaks.sh | released v11.17.42 | Diagnosis 2026-10-17 by nightly diag agent; one FAILURE-CLASSES row per class |
 | TEN-STABILITY-19 | P0 fix-forward: moat P8.ablation-dead-code-not-sealed positive control headline VERIFIED WITH GAPS (expected VERIFIED) and first-run-gate --stub FAILED with dirty tracked tree M sum.js at intake.ts:61 | tests/moat/p8-*.sh or the ablation producer, scripts/first-run-gate.sh, loki-ts/src/engine10/stages/intake.ts only if the honest fix is there | HIGH | red: bash tests/moat/run.sh prints moat suite: FAIL (1 rule failure(s)); bash scripts/first-run-gate.sh --stub fails 7 assertions; green: both exit 0 | released v11.17.42 | Diagnosis 2026-10-17; never weaken a moat assertion to pass |
 | TEN-STABILITY-20 | Fix help-changelog-drift red after v11.17.42: list report kpis --since and undo --list in Bun help, autonomy/loki help and both completions | completions/loki.bash, completions/_loki, loki-ts/src help, autonomy/loki, docs/v10/FAILURE-CLASSES.md | LOW | merged 3c4e2fcd9 | released v11.17.43 |
-| TEN-COST-35 | fix: `loki start --budget-limit=5` (and --provider=, --session-model=, --prd=, --brief=) is accepted by the flag validator then silently ignored, so the default $100 cap and default provider apply; read the `=` form everywhere argVal reads a flag | loki-ts/src/commands/start.ts, loki-ts/tests/commands/start.test.ts | MEDIUM | red: bun test tests/commands/start.test.ts -t "equals form" fails (cap stays default); green: same test passes and `cd loki-ts && bunx tsc --noEmit` exits 0 | ready@2026-10-17T10:00Z | Gap: start.ts:23 argVal matches only exact args via indexOf; start.ts:212 validator splits on "=" so the form is accepted; only --cost and --attempts parse "=" |
-| TEN-COST-36 | fix: `loki start --budget-limit abc`, `--max-iterations -1`, `--budget-limit 0x` and a trailing value flag with no value are silently dropped so the default cap applies; print one error line naming the flag and exit 2 | loki-ts/src/commands/start.ts, loki-ts/tests/commands/start.test.ts | MEDIUM | red: bun test tests/commands/start.test.ts -t "invalid numeric" fails (exit 0, no message); green: passes, valid values unchanged | ready@2026-10-17T10:00Z | Gap: start.ts:123 posNum returns undefined for non-numeric, zero or negative with no diagnostic; chain after TEN-COST-35 |
-| TEN-STABILITY-21 | fix: control `--port` with no value or a non-numeric value silently falls back to the default port; reject with a usage line and exit 2 | loki-ts/src/commands/control.ts, loki-ts/tests/commands/control.test.ts | LOW | red: bun test tests/commands/control.test.ts -t "port without value" fails; green: passes and existing control tests stay green | ready@2026-10-17T10:00Z | Gap: control.ts:33 flag() returns args[i+1] unchecked (undefined or the next flag) and callers fall through to the default |
-| TEN-SECURITY-08 | fix: `loki status <run-id>` and `loki intent show <id>` join the user id into a path with no id check, so `../..` reads an events.jsonl outside .loki/runs; validate against the same RUN_ID_RE as undo and exit 2 | loki-ts/src/commands/run_status.ts, loki-ts/tests/commands/run_status.test.ts | HIGH | red: bun test tests/commands/run_status.test.ts -t "traversal" fails (reads the planted file); green: passes, exit 2 with "invalid run id" | ready@2026-10-17T10:00Z | Gap: run_status.ts:50 eventsPath and :148 readEvents(eventsPath(root, wanted)) take wanted unchecked; undo.ts defines RUN_ID_RE = /^[A-Za-z0-9][A-Za-z0-9._-]*$/ (reuse it, do not copy) |
-| TEN-STABILITY-22 | fix: `loki pause|cancel` prints "requested" for a run whose supervisor pid is dead and targets latestRunId instead of the live run; refuse with "no live run" and exit 1 when run_pid says the owner is gone | loki-ts/src/commands/run_status.ts, loki-ts/tests/commands/run_status.test.ts | MEDIUM | red: bun test tests/commands/run_status.test.ts -t "dead supervisor" fails; green: passes, live-run pause path unchanged | ready@2026-10-17T10:00Z | Gap: run_status.ts:189 runControlVerb never calls runOwnerAlive from util/run_pid.ts; chain after TEN-SECURITY-08 |
-| TEN-UX-20 | fix: `loki provider frobnicate` prints the help text and exits 0, so scripts and typos look like success; unknown subcommand prints one error line plus help and exits 2 (help, -h, --help stay exit 0) | loki-ts/src/commands/provider.ts, loki-ts/tests/commands/provider.test.ts | LOW | red: bun test tests/commands/provider.test.ts -t "unknown subcommand" fails (exit 0); green: passes, and `bash autonomy/loki provider frobnicate` behavior is checked and the Bun route matches or the bash arm is noted in the PR | ready@2026-10-17T10:00Z | Gap: provider.ts:161 default case returns printProviderHelp() which returns 0 |
-| TEN-DEPLOY-16 | fix: `loki rollback list --bogus` and `rollback to <id> --bogus` ignore unknown flags, so a mistyped safety flag (for example --dry-run spelled wrong) runs the real rollback; reject unknown flags with exit 2 | loki-ts/src/commands/rollback.ts, loki-ts/tests/commands/rollback.test.ts | MEDIUM | red: bun test tests/commands/rollback.test.ts -t "unknown flag" fails; green: passes, valid invocations unchanged | ready@2026-10-17T10:00Z | Gap: rollback.ts:120 rejects only unknown subcommands; no flag check on to, latest or list |
-| TEN-COST-37 | fix: a set but unparseable LOKI_BUDGET_LIMIT (for example "5usd") or loki.yaml budgets.per_run is skipped without a warning and the $100 default silently applies; return the existing {error} form so the run refuses to start (0 stays a valid no-cap value) | loki-ts/src/e10ext/budget_cap.ts, loki-ts/tests/engine10/budget_cap.test.ts | MEDIUM | red: bun test tests/engine10/budget_cap.test.ts -t "unparseable" fails; green: passes, all existing cases green, net line change in engine10 core is zero (e10ext is outside it) | ready@2026-10-17T10:00Z | Gap: budget_cap.ts:20 resolveCap falls through on NaN for env and yaml sources with no error or note |
-| TEN-UX-21 | fix: run summary color ignores the NO_COLOR convention inconsistently: useColor treats NO_COLOR="" as set (disables color) while util/colors.ts treats empty as unset, and neither honors TERM=dumb; make both read one rule (non-empty NO_COLOR or TERM=dumb disables) | loki-ts/src/util/run_summary.ts, loki-ts/src/util/colors.ts, loki-ts/tests/util/run_summary.test.ts | LOW | red: bun test tests/util/run_summary.test.ts -t "NO_COLOR empty" fails; green: passes and `bun test tests/util` stays green | ready@2026-10-17T10:00Z | Gap: run_summary.ts:75 `env.NO_COLOR === undefined` vs colors.ts:9 `.length > 0`; grep TERM in both files returns 0 hits |
-| TEN-STABILITY-23 | fix: LOKI_E10_DASHBOARD_PORT="abc", "" or 70000 reaches Bun.serve as NaN, 0 (random port) or out of range; validate 1-65535, else print the bad value and fall back to the default port with a one-line note | loki-ts/src/runner/engine10_dashboard.ts, loki-ts/tests/engine10/dashboard_entry.test.ts | LOW | red: bun test tests/engine10/dashboard_entry.test.ts -t "bad port env" fails; green: passes, default behavior unchanged | ready@2026-10-17T10:00Z | Gap: engine10_dashboard.ts:330 `Number(process.env["LOKI_E10_DASHBOARD_PORT"] ?? DEFAULT_PORT)` has no range or NaN check |
-| TEN-QUALITY-19 | fix: two different long tasks that share their first 40 slug characters map to one .loki/specs/<slug>.md and one spec-<slug> run dir, so the second task fails with "spec exists" or reuses the first task's edited spec; append a short task hash when the slug was truncated | loki-ts/src/util/spec_file.ts, loki-ts/tests/engine10/spec_first_intent.test.ts | MEDIUM | red: bun test tests/engine10/spec_first_intent.test.ts -t "long task collision" fails; green: passes, short-task slugs unchanged byte for byte | ready@2026-10-17T10:00Z | Gap: spec_file.ts:29 slugify slices to 40 chars with no disambiguator; generateSpec uses it for both the path and the run dir |
-| TEN-UX-22 | fix: `loki memory brief --task` with no value silently briefs for an empty task; print usage and exit 2 | loki-ts/src/commands/memory.ts, loki-ts/tests/commands/memory.test.ts | LOW | red: bun test tests/commands/memory.test.ts -t "brief without task" fails; green: passes, `brief --task "x"` output unchanged | ready@2026-10-17T10:00Z | Gap: memory.ts:123 `argv[i + 1] ?? ""` accepts a missing value |
-| TEN-QUALITY-20 | fix: `loki wiki show architecture modules` silently shows only the last section named; reject a second positional with a usage error and exit 1 | loki-ts/src/commands/wiki.ts, loki-ts/tests/commands/wiki.test.ts | LOW | red: bun test tests/commands/wiki.test.ts -t "two sections" fails; green: passes, single section output unchanged | ready@2026-10-17T10:00Z | Gap: wiki.ts:59 `section = a` overwrites on each positional |
-| TEN-ADOPTION-16 | feature: `--json` for the control status verb so scripts can read running, pid, port and url without parsing text | loki-ts/src/commands/control.ts, loki-ts/tests/commands/control.test.ts | LOW | red: bun test tests/commands/control.test.ts -t "status json" fails; green: passes, text output byte identical | ready@2026-10-17T10:00Z | Gap: grep -c '"--json"' loki-ts/src/commands/control.ts returns 0; chain after TEN-STABILITY-21 |
-| TEN-ADOPTION-17 | feature: `loki provider list --json` printing name, tier, installed and version per provider for CI and editor integrations | loki-ts/src/commands/provider.ts, loki-ts/tests/commands/provider.test.ts | LOW | red: bun test tests/commands/provider.test.ts -t "list json" fails; green: passes, plain `provider list` unchanged | ready@2026-10-17T10:00Z | Gap: provider.ts has a single "--json" mention and none on the list arm; chain after TEN-UX-20 |
-| TEN-DEPLOY-17 | feature: `loki rollback list --json` so deploy automation can pick a rollback target without scraping text | loki-ts/src/commands/rollback.ts, loki-ts/tests/commands/rollback.test.ts | LOW | red: bun test tests/commands/rollback.test.ts -t "list json" fails; green: passes, text output byte identical | ready@2026-10-17T10:00Z | Gap: grep -c '"--json"' loki-ts/src/commands/rollback.ts returns 0; chain after TEN-DEPLOY-16 |
-| TEN-ADOPTION-18 | feature: `loki version --json` printing {version, runtime, install_path}; plain `loki version` output stays byte identical to bash | loki-ts/src/commands/version.ts, loki-ts/tests/commands/version.test.ts | LOW | red: bun test tests/commands/version.test.ts -t "version json" fails; green: passes including the existing byte parity test | ready@2026-10-17T10:00Z | Gap: version.ts:12 lines, runVersion() takes no args and the file has no "--json" |
-| TEN-ADOPTION-19 | feature: `loki crash list --json` (and `crash --json`) emitting id, captured_at, error_class, fingerprint for tooling | loki-ts/src/commands/crash.ts, loki-ts/tests/commands/crash.test.ts | LOW | red: bun test tests/commands/crash.test.ts -t "list json" fails; green: passes, text list unchanged | ready@2026-10-17T10:00Z | Gap: crash.ts listCrashes prints a padded table only; grep -c '"--json"' returns 0 |
-| TEN-GATES-21 | feature: `loki verify-pr <ref> --json` printing the verify-pr-result.json verdict object on stdout (the file is already written) so CI can gate on it without reading disk | loki-ts/src/commands/verify_pr.ts, loki-ts/tests/commands/verify_pr.test.ts | MEDIUM | red: bun test tests/commands/verify_pr.test.ts -t "json stdout" fails; green: passes, exit codes 0/2/4 unchanged | ready@2026-10-17T10:00Z | Gap: verify_pr.ts runVerifyPr handles only --out and --help and treats --json as an extra positional (usage error, exit 2) |
-| TEN-ADOPTION-20 | feature: `loki memory list --json` returning the pattern, mistake and success counts and learnings path | loki-ts/src/commands/memory.ts, loki-ts/tests/commands/memory.test.ts | LOW | red: bun test tests/commands/memory.test.ts -t "list json" fails; green: passes, text output unchanged | ready@2026-10-17T10:00Z | Gap: memory.ts runMemoryList() takes no args; only `lessons` has --json; chain after TEN-UX-22 |
-| TEN-SECURITY-09 | enhancement: SARIF secret scan misses hyphenated and common vendor keys (sk-ant-api03-..., sk-proj-..., npm_..., sk_live_..., JWT); extend SECRET_PATTERNS with one fixture each and a no-false-positive fixture | loki-ts/src/commands/export_sarif.ts, loki-ts/tests/commands/export_sarif.test.ts | HIGH | red: bun test tests/commands/export_sarif.test.ts -t "vendor keys" fails (0 findings); green: passes and clean fixtures still report 0 | ready@2026-10-17T10:00Z | Gap: export_sarif.ts:11 `openai-style-key: /sk-[A-Za-z0-9]{20,}/` stops at the first hyphen so sk-ant-api03-XXXX is not matched; no npm_, Stripe or JWT pattern |
-| TEN-SECURITY-10 | enhancement: redact() leaves SendGrid (SG.), Twilio (SK + 32 hex), Docker (dckr_pat_), DigitalOcean (dop_v1_) and Google OAuth (ya29.) tokens in logs and receipts; add anchored patterns with a positive and a near-miss fixture each | loki-ts/src/util/redact.ts, loki-ts/tests/util/redact.test.ts | HIGH | red: bun test tests/util/redact.test.ts -t "vendor tokens" fails; green: passes, existing redact tests and `bun test tests/util` green | ready@2026-10-17T10:00Z | Gap: grep -n 'SG\\.' loki-ts/src/util/redact.ts returns 0 hits; same for dckr_pat_, dop_v1_, ya29 |
-| TEN-ADOPTION-21 | enhancement: update nudge ignores LOKI_NO_UPDATE_CHECK=true and always suggests `bun install -g loki-mode` even for npm or brew installs; accept 1/true/yes and pick the hint from the install path | loki-ts/src/util/update_check.ts, loki-ts/tests/util/update_check.test.ts | LOW | red: bun test tests/util/update_check.test.ts -t "opt out true" fails; green: passes, default hint unchanged for bun installs | ready@2026-10-17T10:00Z | Gap: update_check.ts:62 `=== "1"` only; :286 hint string is fixed |
-| TEN-STABILITY-24 | enhancement: provider failover does not recognize HTTP 529, insufficient_quota, "quota exceeded", RESOURCE_EXHAUSTED or ETIMEDOUT, so those provider failures stall instead of failing over; extend RATE_LIMIT and OUTAGE with a fixture per marker and a non-match for plain app text | loki-ts/src/runner/provider_failover.ts, loki-ts/tests/engine10/failover.test.ts | MEDIUM | red: bun test tests/engine10/failover.test.ts -t "529 and quota" fails; green: passes, existing failover and failover_receipt tests green | ready@2026-10-17T10:00Z | Gap: provider_failover.ts:18-19 RATE_LIMIT/OUTAGE list 429 and 502-504 only |
-| TEN-QUALITY-21 | enhancement: runner error classifier does not recognize the unittest load failure `ImportError: Failed to import test module`, so a broken test module reads as a code failure instead of a load error; add the pattern with a fixture | loki-ts/src/runner/runner_errors.ts, loki-ts/tests/engine10/runner_errors.test.ts | LOW | red: bun test tests/engine10/runner_errors.test.ts -t "unittest import" fails; green: passes, existing patterns unchanged | ready@2026-10-17T10:00Z | Gap: runner_errors.ts:24 LOAD_PATTERNS has no unittest "Failed to import test module" entry |
-| TEN-DEPLOY-18 | enhancement: `loki rollback deploy` knows only vercel, fly, netlify and wrangler; add heroku (`heroku releases:rollback`), railway and render manual notes, and a gcloud run revisions hint, each read only (never run) | loki-ts/src/commands/rollback.ts, loki-ts/tests/commands/rollback.test.ts | LOW | red: bun test tests/commands/rollback.test.ts -t "more providers" fails (prints "No rollback command known"); green: passes, existing four unchanged | ready@2026-10-17T10:00Z | Gap: rollback.ts:173 DEPLOY_ROLLBACKS has four prefixes; chain after TEN-DEPLOY-17 |
-| TEN-COST-38 | enhancement: retry classifier treats OpenAI's "You exceeded your current quota" and Gemini RESOURCE_EXHAUSTED billing text as retryable, burning retries (and cost) on an account that is out of funds; add to quota_exhausted with a fixture and keep rate limit wording transient | loki-ts/src/runner/retry_class.ts, loki-ts/tests/runner/retry_class.test.ts | MEDIUM | red: bun test tests/runner/retry_class.test.ts -t "exceeded current quota" fails; green: passes, TRANSIENT_OVERRIDE cases unchanged | ready@2026-10-17T10:00Z | Gap: retry_class.ts:53 quota_exhausted matches insufficient quota/credit/funds and billing only |
-| TEN-STABILITY-25 | enhancement: retry classifier lacks HTTP 529 (Anthropic overloaded status) and "bad gateway"/"gateway timeout" words in TRANSIENT_OVERRIDE, so a 529 body that also carries permanent-looking text can be classed non-retryable | loki-ts/src/runner/retry_class.ts, loki-ts/tests/runner/retry_class.test.ts | MEDIUM | red: bun test tests/runner/retry_class.test.ts -t "529" fails; green: passes | ready@2026-10-17T10:00Z | Gap: retry_class.ts:61 lists 502, 503, 504 but not 529; chain after TEN-COST-38 |
-| TEN-SPEED-09 | enhancement: unit mode silently drops its cost cap when LOKI_UNIT_USD_PER_MTOK is invalid (NaN, 0, negative); emit a NOT PROVEN style note so the user sees the cap was not applied, never loosen the existing cap | loki-ts/src/features/speed/unit_mode.ts, loki-ts/tests/e10ext/unit_mode.test.ts | MEDIUM | red: bun test tests/e10ext/unit_mode.test.ts -t "invalid rate note" fails; green: passes, valid rate output byte identical | ready@2026-10-17T10:00Z | Gap: unit_mode.ts:83 returns the existing cap or {} for a non-finite rate with no note; unit_mode.ts:107 parses Number(env) unchecked |
-| TEN-UX-23 | fix: `loki crash show <id> extra` and `crash submit <id> extra` silently ignore extra args, and `crash list --foo` lists anyway; reject extra args with a usage line and exit 2 | loki-ts/src/commands/crash.ts, loki-ts/tests/commands/crash.test.ts | LOW | red: bun test tests/commands/crash.test.ts -t "extra args" fails; green: passes, single-arg forms unchanged | ready@2026-10-17T10:00Z | Gap: crash.ts runCrash passes argv[1] only and ignores the rest; chain after TEN-ADOPTION-19 |
+| TEN-STABILITY-26 | fix: `loki control backfill --repo` with no value silently falls back to the first positional or cwd and ships that dir; fail with one error line naming --repo and exit 2 (same class as TEN-STABILITY-21) | loki-ts/src/commands/control.ts, loki-ts/tests/commands/control.test.ts | LOW | red: `cd loki-ts && bun test tests/commands/control.test.ts -t "backfill repo missing value"` fails (exit 0, ingests cwd); green: passes, `--repo DIR` and bare DIR unchanged | ready | Gap: control.ts:234 `flag(rest, "--repo") ?? rest.find(...) ?? cwd`; flag() at :33 returns undefined for a trailing flag, missingValue() at :38 exists but is not applied here |
+| TEN-UX-24 | fix: the second `control` help block in autonomy/loki (cmd_control, ~line 34902) lists only serve, backfill, status; add prune, stop and `status --json` so it matches the Bun usage in control.ts | autonomy/loki, tests/test-help-discoverability.sh | LOW | red: `bash tests/test-help-discoverability.sh` fails on a new assertion that bash `loki control --help` names prune, stop and status --json; green: passes and `bash tests/test-help-changelog-drift.sh` still exits 0 | ready | Gap: control.ts:22 documents prune --repo/--before; the bash fallback help (LOKI_LEGACY_BASH) omits it |
+| TEN-UX-25 | fix: bash `cmd_provider` default arm (autonomy/loki:7488) prints help and returns 0 for an unknown subcommand; return 2 with one "unknown subcommand" line (TS side fixed in TEN-UX-20); chain after TEN-UX-24 | autonomy/loki, tests/test-help-discoverability.sh | LOW | red: `bash tests/test-help-discoverability.sh` fails on `loki provider frobnicate` expecting exit 2; green: passes, `loki provider` and `loki provider --help` still exit 0 | ready | Gap: the `*)` arm at autonomy/loki ~7517 echoes the help block with no return code; chain after TEN-UX-24 |
+| TEN-UX-26 | fix: sibling sweep of bash commands whose default arm prints help and exits 0 on an unknown subcommand (cmd_config ~14144 and cmd_api ~15932 are the first candidates; confirm each with a probe, skip any that already fail non-zero); make each exit 2 with an "unknown subcommand" line; chain after TEN-UX-25 | autonomy/loki, tests/test-help-discoverability.sh | LOW | red: `bash tests/test-help-discoverability.sh` fails on `loki config frobnicate` and `loki api frobnicate` expecting exit 2; green: passes, bare and --help forms still exit 0 | ready | Gap: FAILURE-CLASSES row required (siblings exist); chain after TEN-UX-25 |
+| TEN-UX-27 | fix: `loki doctor --quiet` writes `Install:` hint lines to stderr while the WARN/FAIL row goes to stdout, so the hint prints detached from its row; write each hint directly under its row on the same stream | loki-ts/src/commands/doctor.ts, loki-ts/tests/commands/doctor.test.ts | LOW | red: `cd loki-ts && bun test tests/commands/doctor.test.ts -t "install hint follows its row"` fails (hint absent from stdout); green: passes and `bunx tsc --noEmit` exits 0 | ready | Gap: doctor.ts:1276 `process.stderr.write(... Install: ...)` after `process.stdout.write(formatToolLine(c))` at :1274 |
+| TEN-QUALITY-22 | test: pin the doctor disk text-mode "on <name> volume" label (home, cwd, tmp) so the low-volume name cannot regress; chain after TEN-UX-27 | loki-ts/src/commands/doctor.ts, loki-ts/tests/commands/doctor.test.ts | LOW | red: mutate lowestVolume to return null low_volume and `cd loki-ts && bun test tests/commands/doctor.test.ts -t "disk text volume label"` fails; green: passes unmutated | ready | Gap: doctor.test.ts:161 covers the JSON low_volume only; no test renders the text line; chain after TEN-UX-27 |
+| TEN-SPEED-10 | enhancement: `loki doctor --json` (buildDoctorJson) awaits checkSentrux, checkMemoryHealth and requirementsSection one after another; run them with Promise.all and keep output byte-identical; chain after TEN-QUALITY-22 | loki-ts/src/commands/doctor.ts, loki-ts/tests/commands/doctor.test.ts | MEDIUM | red: `cd loki-ts && bun test tests/commands/doctor.test.ts -t "json checks run concurrently"` fails (elapsed ~ sum of stubbed 200ms probes); green: passes and `bun test tests/commands/doctor_router.test.ts tests/commands/doctor_count.test.ts` exit 0 | ready | Gap: doctor.ts:940-946 serial awaits; the text path already batches runAllToolChecks; chain after TEN-QUALITY-22 |
+| TEN-QUALITY-23 | test: help-changelog-drift guards exact completion cases; assert every `loki` subcommand and flag named in CHANGELOG appears as a literal case in completions/loki.bash and completions/_loki so a flag typo fails | tests/test-help-changelog-drift.sh, completions/loki.bash, completions/_loki | LOW | red: introduce a typo `--sinse` in completions/loki.bash and `bash tests/test-help-changelog-drift.sh` must exit 1 naming it; green: reverted typo exits 0 | ready | Gap: current test greps for substrings loosely, a misspelled flag in a different case arm still passes |
+| TEN-GATES-22 | feature: the per-run signed receipt (not only the composite) records the toolchain {bun,node,python3,git}, absent tools null, old receipts still verify (follow-up from the TEN-GATES-19 review) | loki-ts/src/util/receipt_signer.ts, loki-ts/tests/engine10/seal_group.test.ts | HIGH | red: `cd loki-ts && bun test tests/engine10/seal_group.test.ts -t "per-run receipt toolchain"` fails (no toolchain key); green: passes, `bun test tests/engine10 tests/util/receipt_bundle.test.ts` and `bunx tsc --noEmit` exit 0 | ready | Gap: collectToolchain is used only by composite_seal.ts:54; receipt_signer.ts has no toolchain reference |
+| TEN-COST-39 | fix: a malformed `.loki/metrics/budget.json` is discarded and returns null, so spend resets to zero and the cap is silently disarmed; rebuild budget_used from the efficiency records (readEfficiencyDir) and warn once | loki-ts/src/runner/budget.ts, loki-ts/tests/runner/budget.test.ts | MEDIUM | red: `cd loki-ts && bun test tests/runner/budget.test.ts -t "corrupt budget state rebuilds used"` fails (used 0); green: passes and `bun test tests/runner/autonomous_budget.test.ts` exit 0 | ready | Gap: budget.ts:305-318 returns null on parse failure and the caller treats null as no spend |
+| TEN-COST-40 | fix: `loadDefaultMaxCostUsd` silently falls back to the literal 100 when model-pricing.json is unreadable; print one stderr warning naming the file and the fallback; chain after TEN-COST-39 | loki-ts/src/runner/budget.ts, loki-ts/tests/runner/budget.test.ts | LOW | red: `cd loki-ts && bun test tests/runner/budget.test.ts -t "pricing file missing warns"` fails (no warning); green: passes, warning emitted once per process | ready | Gap: budget.ts:24-33 swallows every read error; chain after TEN-COST-39 |
+| TEN-STABILITY-27 | fix: `LOKI_E10_STALL_S=abc` or `LOKI_E10_STALL_KILL_S=-5` is silently ignored and the default applies; warn once on stderr naming the variable and the value used | loki-ts/src/runner/watchdog.ts, loki-ts/tests/runner/watchdog.test.ts | LOW | red: `cd loki-ts && bun test tests/runner/watchdog.test.ts -t "invalid stall env warns"` fails (no warning); green: passes, valid and unset values unchanged | ready | Gap: watchdog.ts:8-17 return the default with no diagnostic |
+| TEN-STABILITY-28 | fix: `loki undo <run> --bogus` ignores unknown flags and proceeds; validate against the known set (--list --plan --dry-run --json --allow-unsigned --yes --close-pr --help) and exit 2 with one line naming the flag | loki-ts/src/commands/undo.ts, loki-ts/tests/commands/undo.test.ts | MEDIUM | red: `cd loki-ts && bun test tests/commands/undo.test.ts -t "unknown flag"` fails (exit 0 or applies); green: passes, all valid combinations unchanged | ready | Gap: undo.ts:218-238 uses args.includes for each flag with no unknown-flag check; a typo such as `--dry-rn` falls through to apply |
+| TEN-STABILITY-29 | fix: `loki rollback <id> --forse` and other unknown flags are ignored (the typo drops --force silently); validate against known flags and exit 2 | loki-ts/src/commands/rollback.ts, loki-ts/tests/commands/rollback.test.ts | LOW | red: `cd loki-ts && bun test tests/commands/rollback.test.ts -t "unknown flag"` fails; green: passes, --json and --force unchanged | ready | Gap: rollback.ts:77,116,128 use rest.includes only |
+| TEN-STABILITY-30 | fix: `loki start ./prd.md` with a mistyped or missing path treats the path string as an inline brief and starts a paid run on it; when the spec looks like a path (contains / or ends in .md/.txt/.yaml/.json) and does not exist, exit 2 "PRD file not found: <path>" | loki-ts/src/commands/start.ts, loki-ts/tests/commands/start.test.ts | MEDIUM | red: `cd loki-ts && bun test tests/commands/start.test.ts -t "missing prd path"` fails (run starts); green: passes, real files and plain briefs unchanged | ready | Gap: start.ts:376 `existsSync(spec) ? readFileSync : spec` falls through to the literal string; verify the same fall-through on the --prd flag before building |
+| TEN-COST-41 | enhancement: `loki start` prints one line before the first iteration stating the effective per-run cap and where it came from (flag, env, loki.yaml, default $100) so a silent default cap is visible; skip if already printed (check first); chain after TEN-STABILITY-30 | loki-ts/src/commands/start.ts, loki-ts/tests/commands/start.test.ts | LOW | red: `cd loki-ts && bun test tests/commands/start.test.ts -t "cap source line"` fails (no line); green: passes for flag, env and default sources | ready | Gap: capNote exists in e10ext/budget_cap.ts (start.ts:425); confirm it covers the legacy default path; chain after TEN-STABILITY-30 |
+| TEN-STABILITY-31 | fix: `listCheckpoints` silently skips a checkpoint whose metadata.json is corrupt or fails validation, so it vanishes from rollback choices with no trace; collect skipped ids and warn once on stderr | loki-ts/src/runner/checkpoint.ts, loki-ts/tests/runner/checkpoint.test.ts | MEDIUM | red: `cd loki-ts && bun test tests/runner/checkpoint.test.ts -t "corrupt metadata warns"` fails (no warning); green: passes, valid listing order unchanged | ready | Gap: checkpoint.ts:414-436 readCheckpointSafe returns null in a bare catch |
+| TEN-QUALITY-25 | test: pin provider failover classification (rate limit vs outage vs killed vs clean exit) and nextProvider ordering with a fake installed() probe | loki-ts/src/runner/provider_failover.ts, loki-ts/tests/runner/provider_failover.test.ts | MEDIUM | red: mutate classifyOutage to return null for exit 137 and `cd loki-ts && bun test tests/runner/provider_failover.test.ts` fails; green: passes unmutated and `bunx tsc --noEmit` exits 0 | ready | Gap: no tests/runner file names provider_failover; new test file justified because no existing file owns it (verify with grep first) |
+| TEN-UX-28 | enhancement: `loki queue run` prints a progress line `[n/m] <ref>` before each item and the digest links each item verdict; skip if already present (check first) | loki-ts/src/commands/queue.ts, loki-ts/tests/commands/queue.test.ts | LOW | red: `cd loki-ts && bun test tests/commands/queue.test.ts -t "progress line per item"` fails; green: passes and the existing digest test still exits 0 | ready | Gap: queue.ts run loop (~line 290-320) records results only in the final digest |
+| TEN-SPEED-11 | enhancement: `loki report kpis --since 7d` should skip run directories whose newest mtime is before the cutoff instead of parsing every run, with identical output | loki-ts/src/commands/kpis.ts, loki-ts/tests/commands/kpis.test.ts | LOW | red: `cd loki-ts && bun test tests/commands/kpis.test.ts -t "since skips old runs"` fails (old run files read, counted by a spy); green: passes and output byte-identical on the fixture | ready | Gap: kpis.ts:96 computeKpis receives sinceMs; confirm it filters after reading (read computeKpis first, drop if already pruned by mtime) |
+| TEN-SECURITY-11 | fix: the SARIF secret scan misses common token formats (Hugging Face `hf_`, SendGrid `SG.`, Twilio `SK`+32 hex, Azure storage `AccountKey=`); add Tier 1 patterns that report label only, never the matched text, and mirror them in autonomy/lib/secret-scan.sh in the same change | loki-ts/src/commands/export_sarif.ts, loki-ts/tests/commands/export_sarif.test.ts, autonomy/lib/secret-scan.sh | MEDIUM | red: `cd loki-ts && bun test tests/commands/export_sarif.test.ts -t "extra token formats"` fails (0 findings); green: passes with label-only output and `bash tests/test-secret-scan.sh` exits 0 | ready | Gap: export_sarif.ts:12-24 lists 12 formats; none cover those four; parity with secret-scan.sh required |
+| TEN-DEPLOY-19 | fix: `loki start --deploy --health-url X --domain Y` accepts any string; validate --health-url is http or https with a host and --domain is a bare hostname, exit 2 with one line naming the flag, before any run work; chain after TEN-COST-41 | loki-ts/src/commands/start.ts, loki-ts/tests/commands/start.test.ts | MEDIUM | red: `cd loki-ts && bun test tests/commands/start.test.ts -t "deploy flag validation"` fails (exit 0); green: passes, valid URLs unchanged | ready | Gap: start.ts:158 lists the deploy flags as value flags with no validation; verify on the Bun route and the bash route; chain after TEN-COST-41 |
+| TEN-DEPLOY-20 | fix: `loki start --deploy --env-file ./missing.env` is accepted and fails only after the build; check the file exists and is readable up front and exit 2; chain after TEN-DEPLOY-19 | loki-ts/src/commands/start.ts, loki-ts/tests/commands/start.test.ts | LOW | red: `cd loki-ts && bun test tests/commands/start.test.ts -t "env-file missing"` fails (exit 0); green: passes, existing file unchanged | ready | Gap: start.ts:158 --env-file is passed through unchecked; chain after TEN-DEPLOY-19 |
+| TEN-ADOPTION-22 | enhancement: `loki provider list` marks each provider CLI as installed or missing and prints the install command for a missing one (reuse the table doctor.ts providerInstall) | loki-ts/src/commands/provider.ts, loki-ts/tests/commands/provider.test.ts | LOW | red: `cd loki-ts && bun test tests/commands/provider.test.ts -t "list shows install hint"` fails; green: passes with a stubbed which() and `bunx tsc --noEmit` exits 0 | ready | Gap: check provider.ts list output first; doctor.ts:1263 holds the only install-hint table, move it to a shared export rather than copying |
+| TEN-ADOPTION-23 | fix: `loki completion fish` or an unknown shell must print the supported shells and exit 2; `loki completion` with no shell prints usage; check current behaviour first and drop if already correct | loki-ts/src/commands/completion.ts, loki-ts/tests/commands/cli_help_routes.test.ts | LOW | red: `cd loki-ts && bun test tests/commands/cli_help_routes.test.ts -t "completion unknown shell"` fails; green: passes, bash and zsh output unchanged | ready | Gap: completion.ts has no dedicated test file; extend cli_help_routes.test.ts rather than add one |
+| TEN-GATES-23 | enhancement: record each quality gate's wall-clock duration in the gate result so `loki status` and the receipt can show which gate dominates a slow run; additive field only, old readers ignore it | loki-ts/src/runner/quality_gates.ts, loki-ts/tests/runner/quality_gates.test.ts | MEDIUM | red: `cd loki-ts && bun test tests/runner/quality_gates.test.ts -t "gate duration recorded"` fails (no duration_ms); green: passes and `bun test tests/runner/quality_gates_inconclusive.test.ts` exits 0 | ready | Gap: grep duration in quality_gates.ts first; if present, narrow the row to surfacing it in status |
+| TEN-GATES-24 | fix: `loki verify-pr` on a PR with no receipt must exit with a code distinct from "receipt present, verdict fail" and say which it is; check current exit codes first and drop if already distinct | loki-ts/src/commands/verify_pr.ts, loki-ts/tests/commands/verify_pr.test.ts | MEDIUM | red: `cd loki-ts && bun test tests/commands/verify_pr.test.ts -t "no receipt exit code"` fails; green: passes, existing verdict exits unchanged | ready | Gap: a CI caller cannot tell missing proof from failed proof if both exit 1 |
+| TEN-SPEED-12 | enhancement: cache the repo profile (LOKI_REPO_PROFILE=1 path) keyed on HEAD sha and dirty flag so a resumed run does not rescan the tree | loki-ts/src/runner/repo_profile.ts, loki-ts/tests/runner/autonomous.test.ts | MEDIUM | red: `cd loki-ts && bun test tests/runner/autonomous.test.ts -t "repo profile cache hit"` fails (scan runs twice); green: passes, cache invalidates on a new commit | ready | Gap: autonomous.ts:633 calls the profiler each start; read repo_profile.ts first and drop if a cache exists |
+| TEN-QUALITY-26 | fix: `loki wiki show <bad-section>` should list the valid sections (architecture, modules, data-flow) in the error and exit 2; extend the wiki test | loki-ts/src/commands/wiki.ts, loki-ts/tests/commands/wiki.test.ts | LOW | red: `cd loki-ts && bun test tests/commands/wiki.test.ts -t "bad section lists valid"` fails; green: passes, valid sections unchanged | ready | Gap: wiki.ts:51 prints the section list only in the usage branch; check the unknown-section branch first |
+| TEN-UX-29 | fix: `loki report kpis --since` with no value, or followed by another flag, reports an empty invalid value and consumes the next flag; print "--since requires a value" and exit 1 without swallowing the next token; chain after TEN-SPEED-11 | loki-ts/src/commands/kpis.ts, loki-ts/tests/commands/kpis.test.ts | LOW | red: `cd loki-ts && bun test tests/commands/kpis.test.ts -t "since missing value"` fails (message names an empty value); green: passes, `--since 7d` and `--since=7d` unchanged | ready | Gap: kpis.ts:87 `args[++i] ?? ""` eats the next token; chain after TEN-SPEED-11 |
+| TEN-COST-35 | fix: `loki start --budget-limit=5` (and --provider=, --session-model=, --prd=, --brief=) is accepted by the flag validator then silently ignored, so the default $100 cap and default provider apply; read the `=` form everywhere argVal reads a flag | loki-ts/src/commands/start.ts, loki-ts/tests/commands/start.test.ts | MEDIUM | red: bun test tests/commands/start.test.ts -t "equals form" fails (cap stays default); green: same test passes and `cd loki-ts && bunx tsc --noEmit` exits 0 | released v11.17.44 | Gap: start.ts:23 argVal matches only exact args via indexOf; start.ts:212 validator splits on "=" so the form is accepted; only --cost and --attempts parse "=" |
+| TEN-COST-36 | fix: `loki start --budget-limit abc`, `--max-iterations -1`, `--budget-limit 0x` and a trailing value flag with no value are silently dropped so the default cap applies; print one error line naming the flag and exit 2 | loki-ts/src/commands/start.ts, loki-ts/tests/commands/start.test.ts | MEDIUM | red: bun test tests/commands/start.test.ts -t "invalid numeric" fails (exit 0, no message); green: passes, valid values unchanged | released v11.17.44 | Gap: start.ts:123 posNum returns undefined for non-numeric, zero or negative with no diagnostic; chain after TEN-COST-35 |
+| TEN-STABILITY-21 | fix: control `--port` with no value or a non-numeric value silently falls back to the default port; reject with a usage line and exit 2 | loki-ts/src/commands/control.ts, loki-ts/tests/commands/control.test.ts | LOW | red: bun test tests/commands/control.test.ts -t "port without value" fails; green: passes and existing control tests stay green | released v11.17.44 | Gap: control.ts:33 flag() returns args[i+1] unchecked (undefined or the next flag) and callers fall through to the default |
+| TEN-SECURITY-08 | fix: `loki status <run-id>` and `loki intent show <id>` join the user id into a path with no id check, so `../..` reads an events.jsonl outside .loki/runs; validate against the same RUN_ID_RE as undo and exit 2 | loki-ts/src/commands/run_status.ts, loki-ts/tests/commands/run_status.test.ts | HIGH | red: bun test tests/commands/run_status.test.ts -t "traversal" fails (reads the planted file); green: passes, exit 2 with "invalid run id" | released v11.17.44 | Gap: run_status.ts:50 eventsPath and :148 readEvents(eventsPath(root, wanted)) take wanted unchecked; undo.ts defines RUN_ID_RE = /^[A-Za-z0-9][A-Za-z0-9._-]*$/ (reuse it, do not copy) |
+| TEN-STABILITY-22 | fix: `loki pause|cancel` prints "requested" for a run whose supervisor pid is dead and targets latestRunId instead of the live run; refuse with "no live run" and exit 1 when run_pid says the owner is gone | loki-ts/src/commands/run_status.ts, loki-ts/tests/commands/run_status.test.ts | MEDIUM | released v11.17.44 | ready@2026-10-17T10:00Z | Gap: run_status.ts:189 runControlVerb never calls runOwnerAlive from util/run_pid.ts; chain after TEN-SECURITY-08 |
+| TEN-UX-20 | fix: `loki provider frobnicate` prints the help text and exits 0, so scripts and typos look like success; unknown subcommand prints one error line plus help and exits 2 (help, -h, --help stay exit 0) | loki-ts/src/commands/provider.ts, loki-ts/tests/commands/provider.test.ts | LOW | red: bun test tests/commands/provider.test.ts -t "unknown subcommand" fails (exit 0); green: passes, and `bash autonomy/loki provider frobnicate` behavior is checked and the Bun route matches or the bash arm is noted in the PR | released v11.17.44 | Gap: provider.ts:161 default case returns printProviderHelp() which returns 0 |
+| TEN-DEPLOY-16 | fix: `loki rollback list --bogus` and `rollback to <id> --bogus` ignore unknown flags, so a mistyped safety flag (for example --dry-run spelled wrong) runs the real rollback; reject unknown flags with exit 2 | loki-ts/src/commands/rollback.ts, loki-ts/tests/commands/rollback.test.ts | MEDIUM | red: bun test tests/commands/rollback.test.ts -t "unknown flag" fails; green: passes, valid invocations unchanged | released v11.17.44 | Gap: rollback.ts:120 rejects only unknown subcommands; no flag check on to, latest or list |
+| TEN-COST-37 | fix: a set but unparseable LOKI_BUDGET_LIMIT (for example "5usd") or loki.yaml budgets.per_run is skipped without a warning and the $100 default silently applies; return the existing {error} form so the run refuses to start (0 stays a valid no-cap value) | loki-ts/src/e10ext/budget_cap.ts, loki-ts/tests/engine10/budget_cap.test.ts | MEDIUM | red: bun test tests/engine10/budget_cap.test.ts -t "unparseable" fails; green: passes, all existing cases green, net line change in engine10 core is zero (e10ext is outside it) | released v11.17.44 | Gap: budget_cap.ts:20 resolveCap falls through on NaN for env and yaml sources with no error or note |
+| TEN-UX-21 | fix: run summary color ignores the NO_COLOR convention inconsistently: useColor treats NO_COLOR="" as set (disables color) while util/colors.ts treats empty as unset, and neither honors TERM=dumb; make both read one rule (non-empty NO_COLOR or TERM=dumb disables) | loki-ts/src/util/run_summary.ts, loki-ts/src/util/colors.ts, loki-ts/tests/util/run_summary.test.ts | LOW | red: bun test tests/util/run_summary.test.ts -t "NO_COLOR empty" fails; green: passes and `bun test tests/util` stays green | released v11.17.44 | Gap: run_summary.ts:75 `env.NO_COLOR === undefined` vs colors.ts:9 `.length > 0`; grep TERM in both files returns 0 hits |
+| TEN-STABILITY-23 | fix: LOKI_E10_DASHBOARD_PORT="abc", "" or 70000 reaches Bun.serve as NaN, 0 (random port) or out of range; validate 1-65535, else print the bad value and fall back to the default port with a one-line note | loki-ts/src/runner/engine10_dashboard.ts, loki-ts/tests/engine10/dashboard_entry.test.ts | LOW | red: bun test tests/engine10/dashboard_entry.test.ts -t "bad port env" fails; green: passes, default behavior unchanged | released v11.17.44 | Gap: engine10_dashboard.ts:330 `Number(process.env["LOKI_E10_DASHBOARD_PORT"] ?? DEFAULT_PORT)` has no range or NaN check |
+| TEN-QUALITY-19 | fix: two different long tasks that share their first 40 slug characters map to one .loki/specs/<slug>.md and one spec-<slug> run dir, so the second task fails with "spec exists" or reuses the first task's edited spec; append a short task hash when the slug was truncated | loki-ts/src/util/spec_file.ts, loki-ts/tests/engine10/spec_first_intent.test.ts | MEDIUM | red: bun test tests/engine10/spec_first_intent.test.ts -t "long task collision" fails; green: passes, short-task slugs unchanged byte for byte | released v11.17.44 | Gap: spec_file.ts:29 slugify slices to 40 chars with no disambiguator; generateSpec uses it for both the path and the run dir |
+| TEN-UX-22 | fix: `loki memory brief --task` with no value silently briefs for an empty task; print usage and exit 2 | loki-ts/src/commands/memory.ts, loki-ts/tests/commands/memory.test.ts | LOW | red: bun test tests/commands/memory.test.ts -t "brief without task" fails; green: passes, `brief --task "x"` output unchanged | released v11.17.44 | Gap: memory.ts:123 `argv[i + 1] ?? ""` accepts a missing value |
+| TEN-QUALITY-20 | fix: `loki wiki show architecture modules` silently shows only the last section named; reject a second positional with a usage error and exit 1 | loki-ts/src/commands/wiki.ts, loki-ts/tests/commands/wiki.test.ts | LOW | red: bun test tests/commands/wiki.test.ts -t "two sections" fails; green: passes, single section output unchanged | released v11.17.44 | Gap: wiki.ts:59 `section = a` overwrites on each positional |
+| TEN-ADOPTION-16 | feature: `--json` for the control status verb so scripts can read running, pid, port and url without parsing text | loki-ts/src/commands/control.ts, loki-ts/tests/commands/control.test.ts | LOW | red: bun test tests/commands/control.test.ts -t "status json" fails; green: passes, text output byte identical | released v11.17.44 | Gap: grep -c '"--json"' loki-ts/src/commands/control.ts returns 0; chain after TEN-STABILITY-21 |
+| TEN-ADOPTION-17 | feature: `loki provider list --json` printing name, tier, installed and version per provider for CI and editor integrations | loki-ts/src/commands/provider.ts, loki-ts/tests/commands/provider.test.ts | LOW | red: bun test tests/commands/provider.test.ts -t "list json" fails; green: passes, plain `provider list` unchanged | released v11.17.44 | Gap: provider.ts has a single "--json" mention and none on the list arm; chain after TEN-UX-20 |
+| TEN-DEPLOY-17 | feature: `loki rollback list --json` so deploy automation can pick a rollback target without scraping text | loki-ts/src/commands/rollback.ts, loki-ts/tests/commands/rollback.test.ts | LOW | red: bun test tests/commands/rollback.test.ts -t "list json" fails; green: passes, text output byte identical | released v11.17.44 | Gap: grep -c '"--json"' loki-ts/src/commands/rollback.ts returns 0; chain after TEN-DEPLOY-16 |
+| TEN-ADOPTION-18 | feature: `loki version --json` printing {version, runtime, install_path}; plain `loki version` output stays byte identical to bash | loki-ts/src/commands/version.ts, loki-ts/tests/commands/version.test.ts | LOW | red: bun test tests/commands/version.test.ts -t "version json" fails; green: passes including the existing byte parity test | released v11.17.44 | Gap: version.ts:12 lines, runVersion() takes no args and the file has no "--json" |
+| TEN-ADOPTION-19 | feature: `loki crash list --json` (and `crash --json`) emitting id, captured_at, error_class, fingerprint for tooling | loki-ts/src/commands/crash.ts, loki-ts/tests/commands/crash.test.ts | LOW | red: bun test tests/commands/crash.test.ts -t "list json" fails; green: passes, text list unchanged | released v11.17.44 | Gap: crash.ts listCrashes prints a padded table only; grep -c '"--json"' returns 0 |
+| TEN-GATES-21 | feature: `loki verify-pr <ref> --json` printing the verify-pr-result.json verdict object on stdout (the file is already written) so CI can gate on it without reading disk | loki-ts/src/commands/verify_pr.ts, loki-ts/tests/commands/verify_pr.test.ts | MEDIUM | red: bun test tests/commands/verify_pr.test.ts -t "json stdout" fails; green: passes, exit codes 0/2/4 unchanged | released v11.17.44 | Gap: verify_pr.ts runVerifyPr handles only --out and --help and treats --json as an extra positional (usage error, exit 2) |
+| TEN-ADOPTION-20 | feature: `loki memory list --json` returning the pattern, mistake and success counts and learnings path | loki-ts/src/commands/memory.ts, loki-ts/tests/commands/memory.test.ts | LOW | red: bun test tests/commands/memory.test.ts -t "list json" fails; green: passes, text output unchanged | released v11.17.44 | Gap: memory.ts runMemoryList() takes no args; only `lessons` has --json; chain after TEN-UX-22 |
+| TEN-SECURITY-09 | enhancement: SARIF secret scan misses hyphenated and common vendor keys (sk-ant-api03-..., sk-proj-..., npm_..., sk_live_..., JWT); extend SECRET_PATTERNS with one fixture each and a no-false-positive fixture | loki-ts/src/commands/export_sarif.ts, loki-ts/tests/commands/export_sarif.test.ts | HIGH | red: bun test tests/commands/export_sarif.test.ts -t "vendor keys" fails (0 findings); green: passes and clean fixtures still report 0 | released v11.17.44 | Gap: export_sarif.ts:11 `openai-style-key: /sk-[A-Za-z0-9]{20,}/` stops at the first hyphen so sk-ant-api03-XXXX is not matched; no npm_, Stripe or JWT pattern |
+| TEN-SECURITY-10 | enhancement: redact() leaves SendGrid (SG.), Twilio (SK + 32 hex), Docker (dckr_pat_), DigitalOcean (dop_v1_) and Google OAuth (ya29.) tokens in logs and receipts; add anchored patterns with a positive and a near-miss fixture each | loki-ts/src/util/redact.ts, loki-ts/tests/util/redact.test.ts | HIGH | red: bun test tests/util/redact.test.ts -t "vendor tokens" fails; green: passes, existing redact tests and `bun test tests/util` green | released v11.17.44 | Gap: grep -n 'SG\\.' loki-ts/src/util/redact.ts returns 0 hits; same for dckr_pat_, dop_v1_, ya29 |
+| TEN-ADOPTION-21 | enhancement: update nudge ignores LOKI_NO_UPDATE_CHECK=true and always suggests `bun install -g loki-mode` even for npm or brew installs; accept 1/true/yes and pick the hint from the install path | loki-ts/src/util/update_check.ts, loki-ts/tests/util/update_check.test.ts | LOW | red: bun test tests/util/update_check.test.ts -t "opt out true" fails; green: passes, default hint unchanged for bun installs | released v11.17.44 | Gap: update_check.ts:62 `=== "1"` only; :286 hint string is fixed |
+| TEN-STABILITY-24 | enhancement: provider failover does not recognize HTTP 529, insufficient_quota, "quota exceeded", RESOURCE_EXHAUSTED or ETIMEDOUT, so those provider failures stall instead of failing over; extend RATE_LIMIT and OUTAGE with a fixture per marker and a non-match for plain app text | loki-ts/src/runner/provider_failover.ts, loki-ts/tests/engine10/failover.test.ts | MEDIUM | red: bun test tests/engine10/failover.test.ts -t "529 and quota" fails; green: passes, existing failover and failover_receipt tests green | released v11.17.44 | Gap: provider_failover.ts:18-19 RATE_LIMIT/OUTAGE list 429 and 502-504 only |
+| TEN-QUALITY-21 | enhancement: runner error classifier does not recognize the unittest load failure `ImportError: Failed to import test module`, so a broken test module reads as a code failure instead of a load error; add the pattern with a fixture | loki-ts/src/runner/runner_errors.ts, loki-ts/tests/engine10/runner_errors.test.ts | LOW | red: bun test tests/engine10/runner_errors.test.ts -t "unittest import" fails; green: passes, existing patterns unchanged | released v11.17.44 | Gap: runner_errors.ts:24 LOAD_PATTERNS has no unittest "Failed to import test module" entry |
+| TEN-DEPLOY-18 | enhancement: `loki rollback deploy` knows only vercel, fly, netlify and wrangler; add heroku (`heroku releases:rollback`), railway and render manual notes, and a gcloud run revisions hint, each read only (never run) | loki-ts/src/commands/rollback.ts, loki-ts/tests/commands/rollback.test.ts | LOW | red: bun test tests/commands/rollback.test.ts -t "more providers" fails (prints "No rollback command known"); green: passes, existing four unchanged | released v11.17.44 | Gap: rollback.ts:173 DEPLOY_ROLLBACKS has four prefixes; chain after TEN-DEPLOY-17 |
+| TEN-COST-38 | enhancement: retry classifier treats OpenAI's "You exceeded your current quota" and Gemini RESOURCE_EXHAUSTED billing text as retryable, burning retries (and cost) on an account that is out of funds; add to quota_exhausted with a fixture and keep rate limit wording transient | loki-ts/src/runner/retry_class.ts, loki-ts/tests/runner/retry_class.test.ts | MEDIUM | red: bun test tests/runner/retry_class.test.ts -t "exceeded current quota" fails; green: passes, TRANSIENT_OVERRIDE cases unchanged | released v11.17.44 | Gap: retry_class.ts:53 quota_exhausted matches insufficient quota/credit/funds and billing only |
+| TEN-STABILITY-25 | enhancement: retry classifier lacks HTTP 529 (Anthropic overloaded status) and "bad gateway"/"gateway timeout" words in TRANSIENT_OVERRIDE, so a 529 body that also carries permanent-looking text can be classed non-retryable | loki-ts/src/runner/retry_class.ts, loki-ts/tests/runner/retry_class.test.ts | MEDIUM | red: bun test tests/runner/retry_class.test.ts -t "529" fails; green: passes | released v11.17.44 | Gap: retry_class.ts:61 lists 502, 503, 504 but not 529; chain after TEN-COST-38 |
+| TEN-SPEED-09 | enhancement: unit mode silently drops its cost cap when LOKI_UNIT_USD_PER_MTOK is invalid (NaN, 0, negative); emit a NOT PROVEN style note so the user sees the cap was not applied, never loosen the existing cap | loki-ts/src/features/speed/unit_mode.ts, loki-ts/tests/e10ext/unit_mode.test.ts | MEDIUM | red: bun test tests/e10ext/unit_mode.test.ts -t "invalid rate note" fails; green: passes, valid rate output byte identical | released v11.17.44 | Gap: unit_mode.ts:83 returns the existing cap or {} for a non-finite rate with no note; unit_mode.ts:107 parses Number(env) unchecked |
+| TEN-UX-23 | fix: `loki crash show <id> extra` and `crash submit <id> extra` silently ignore extra args, and `crash list --foo` lists anyway; reject extra args with a usage line and exit 2 | loki-ts/src/commands/crash.ts, loki-ts/tests/commands/crash.test.ts | LOW | red: bun test tests/commands/crash.test.ts -t "extra args" fails; green: passes, single-arg forms unchanged | released v11.17.44 | Gap: crash.ts runCrash passes argv[1] only and ignores the rest; chain after TEN-ADOPTION-19 |
 | TEN-SECURITY-04 | fix: redactSecrets also strips GitLab (glpat-), npm (npm_), Hugging Face (hf_), Stripe (sk_live_, rk_live_) tokens and PEM private key blocks | loki-ts/src/util/redact.ts, loki-ts/tests/util/redact.test.ts | HIGH | red: each of the five token shapes and a -----BEGIN PRIVATE KEY----- block survive redactSecrets; green: all replaced with [REDACTED:...] markers, existing rules and ordering unchanged; cd loki-ts && bunx tsc --noEmit && bun test tests/util/redact.test.ts | released v11.17.40 | Gap: redact.ts RULES (lines 3-14) cover Anthropic, GitHub, Slack, AWS, JWT, Google, OpenAI, Bearer, URL userinfo; grep -rnE 'glpat or npm_ or hf_ or BEGIN [A-Z ]*PRIVATE or sk_live' loki-ts/src/util/redact.ts returned 0 hits (export_sarif.ts:18 and contrib/ai_bom.ts:83 know the shapes but are not the redactor). Specific rules before generic, keep ReDoS-safe quantifiers. |
 | TEN-SECURITY-05 | enhancement: redactSecrets strips secret query parameters (token, access_token, api_key, apikey, password, secret, sig) from URLs in logged and receipted output | loki-ts/src/util/redact.ts, loki-ts/tests/util/redact.test.ts | HIGH | red: https://h/x?access_token=abc123 survives; green: value replaced, parameter name and other params kept, non-secret params untouched; cd loki-ts && bunx tsc --noEmit && bun test tests/util/redact.test.ts | released v11.17.41 | Gap: TEN-SECURITY-02 covers URL userinfo and Authorization only (redact.ts:12-13); grep -nE 'access_token or api_key or \?' loki-ts/src/util/redact.ts returned 0 query-string rules. Serialize after TEN-SECURITY-04 (same two files). |
 | TEN-SECURITY-06 | feature: secure-scan rule 6 flags disabled TLS verification in committed code (verify=False, rejectUnauthorized: false, InsecureSkipVerify: true, NODE_TLS_REJECT_UNAUTHORIZED=0) | autonomy/lib/secure-scan.py, tests/test-secure-scan.sh | HIGH | red: a fixture with requests.get(url, verify=False) scans clean; green: finding rule tls-verify-disabled with file and line, test and fixture paths and comments excluded like rule 4; bash tests/test-secure-scan.sh | released v11.17.41 | Gap: secure-scan.py has rules 1-5 only (rule comments at lines 93, 105, 193, 238, 345); grep -nE 'verify=False or rejectUnauthorized or InsecureSkipVerify or NODE_TLS' autonomy/lib/secure-scan.py returned 0 hits. Bump RULES_VERSION (line 49). Serialize after TEN-GATES-20 and before TEN-SECURITY-07. |
-| TEN-SECURITY-07 | feature: secure-scan rule 7 flags shell injection shapes (subprocess with shell=True and an f-string or format argument, os.system with concatenation, child_process.exec with a template literal) | autonomy/lib/secure-scan.py, tests/test-secure-scan.sh | HIGH | red: subprocess.run(f"rm {x}", shell=True) scans clean; green: finding rule shell-injection with file and line, constant-string commands and test paths not flagged; bash tests/test-secure-scan.sh | ready@2026-10-17T08:05Z | Gap: grep -nE 'shell=True or os\.system or child_process' autonomy/lib/secure-scan.py returned 0 hits. Precision first (the file's stated design: literal forms only), measure false positives on this repo's own tests before shipping. Serialize after TEN-SECURITY-06. |
+| TEN-SECURITY-07 | feature: secure-scan rule 7 flags shell injection shapes (subprocess with shell=True and an f-string or format argument, os.system with concatenation, child_process.exec with a template literal) | autonomy/lib/secure-scan.py, tests/test-secure-scan.sh | HIGH | red: subprocess.run(f"rm {x}", shell=True) scans clean; green: finding rule shell-injection with file and line, constant-string commands and test paths not flagged; bash tests/test-secure-scan.sh | released v11.17.44 | Gap: grep -nE 'shell=True or os\.system or child_process' autonomy/lib/secure-scan.py returned 0 hits. Precision first (the file's stated design: literal forms only), measure false positives on this repo's own tests before shipping. Serialize after TEN-SECURITY-06. |

package/docs/v10/CLI-MODERN.md

@@ -11,7 +11,7 @@ Classes: KEEP-MODERN (v10-native or engine-neutral), UPDATE (live but needs mode
 - DROP-LEGACY: 31
 - DELETE: 14
 - Total rows: 141
-- Registry paths (commands and nested subcommands): 202
+- Registry paths (commands and nested subcommands): 204
 
 ## Commands
 

package/docs/v10/PROGRESS.md

@@ -2509,3 +2509,9 @@ v11.17.21 published (Release success on 462fbc40a; npm latest 11.17.21, next 11.
 
 ## 2026-10-17T09:49Z (CoS) v11.17.43
 - Released TEN-STABILITY-20 (help/completion drift fix-forward). Board refilled with 30 TEN rows for wave AL (fc36b4548).
+
+## 2026-10-17T10:10Z (CoS) v11.17.44
+- Released waves AL (30 slices, 21 chains, all APPROVE) and AK (6 slices). Combined main: tsc rc 0; bun 1233/0 and 528/0; help-changelog-drift rc 0; secure-scan rc 0.
+
+## 2026-10-17T10:17Z (CoS) v11.17.45
+- Released TEN-DEPLOY-03 (wave AH fix round, APPROVE fe1026bf1). Board refilled with 30 TEN rows for wave AM (fbde018b2).