loki-mode 11.17.44 → 11.17.46

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: An autonomous software factory that knows what it is supposed to deliver, and proves it did. Use when the user says Loki Mode or asks to build, fix or verify software autonomously.
 ---
 
-# Loki Mode v11.17.44
+# Loki Mode v11.17.46
 
 **Current entry points (Loki 10 engine):** `loki "<task>"`, `loki owner/repo#N` and `loki quick "<task>"` run the Loki 10 engine and end with a signed receipt (`loki verify`). `loki backlog owner/repo --all` runs many issues in parallel. Guide: `docs/v10/GUIDE.md`. The skill instructions below, and `loki start`, describe the previous bash loop. PRD-file starts (`loki start ./prd.md`) and the opencode provider still run on it until FC38-SWEEP ports them; the legacy-engine command and the LOKI_ENGINE switch remain removed. Prefer `loki owner/repo#N` for issues.
 
@@ -483,4 +483,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v11.17.44 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**
+**v11.17.46 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**

package/VERSION

@@ -1 +1 @@
-11.17.44
+11.17.46

package/autonomy/lib/secret-scan.sh

@@ -46,6 +46,10 @@ _commit_scan_secret_file() {
         'sk-ant-[A-Za-z0-9_-]{20,}'                 # Anthropic API key (hyphenated body)
         'AIza[0-9A-Za-z_-]{35}'                     # Google API key
         'glpat-[A-Za-z0-9_-]{20,}'                  # GitLab personal access token
+        '(^|[^A-Za-z0-9_])hf_[A-Za-z0-9]{34,}'      # Hugging Face token
+        '(^|[^A-Za-z0-9])SG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}'  # SendGrid API key
+        '(^|[^A-Za-z0-9])SK[0-9a-f]{32}([^A-Za-z0-9]|$)'  # Twilio API key SID
+        'AccountKey=[A-Za-z0-9+/]{40,}={0,2}'       # Azure storage account key
     )
     local p
     for p in "${tier1[@]}"; do

package/autonomy/loki

@@ -1769,7 +1769,7 @@ _help_verify_pr() {
     echo "PR code runs only in the container sandbox (scripts/verify-pr-sandbox.sh); set"
     echo "LOKI_VPR_IMAGE to a locally present image."
     echo ""
-    echo "Exit codes: 0 verified, 2 usage or sandbox blocked, 4 not proven."
+    echo "Exit codes: 0 verified, 2 usage or sandbox blocked, 3 no proof to run (no linked issue or no trusted runnable check), 4 proof ran and failed."
 }
 
 # Appended to `loki help verify`: the v10 DSSE export flag (docs/exit-codes.md).
@@ -7514,7 +7514,17 @@ cmd_provider() {
         models)
             cmd_provider_models
             ;;
+        help|--help|-h)
+            _cmd_provider_help
+            ;;
         *)
+            echo "loki provider: unknown subcommand '${subcommand}' (see 'loki provider help')" >&2
+            return 2
+            ;;
+    esac
+}
+
+_cmd_provider_help() {
             echo -e "${BOLD}Loki Mode Provider Management${NC}"
             echo ""
             echo "Usage: loki provider <command>"
@@ -7543,8 +7553,6 @@ cmd_provider() {
             echo "  loki provider list"
             echo "  loki provider info codex"
             echo "  loki provider models"
-            ;;
-    esac
 }
 
 cmd_provider_show() {
@@ -10056,7 +10064,7 @@ _deploy_latest_receipt() {
     return 0
 }
 
-# _deploy_record <dir> <command> <exit_code> <run_id> <anchor_sha> [state] [health_status] [health_url] [rb_attempted] [rb_exit] [receipt_sha256] [started_at] [finished_at] [target] [canary] [post_rollback_health] [health_http_code] [health_match] [tree_sha] [destination] [deployed_url] [health_url_source] [env_keys_csv] [env_source] [domain] [domain_status] [tls_status] [tls_not_after] [domain_provenance]
+# _deploy_record <dir> <command> <exit_code> <run_id> <anchor_sha> [state] [health_status] [health_url] [rb_attempted] [rb_exit] [receipt_sha256] [started_at] [finished_at] [target] [canary] [post_rollback_health] [health_http_code] [health_match] [tree_sha] [destination] [deployed_url] [health_url_source] [env_keys_csv] [env_source] [domain] [domain_status] [tls_status] [tls_not_after] [domain_provenance] [live_binding]
 # Writes the executed deploy's own record, then signs it (loki.deploy/1, Ed25519 via the
 # receipt signer in loki-ts/src/util/receipt_signer.ts) so it is bound to the receipt that
 # authorized it; `loki verify <record>` re-checks it offline. An unsigned record is reported
@@ -10086,6 +10094,7 @@ _deploy_record() {
     local env_keys_csv="${23:-}" env_source="${24:-}"
     # --domain: tls_status is "unchecked" unless the openssl proof ran and said otherwise.
     local domain_rec="${25:-}" domain_status="${26:-}" tls_status="${27:-unchecked}" tls_not_after="${28:-}" domain_prov="${29:-}"
+    local live_binding="${30:-}"
     local ddir="$dir/.loki/deploys"
     [ -d "${LOKI_DIR:-}" ] && ddir="${LOKI_DIR}/deploys"
     mkdir -p "$ddir" 2>/dev/null || return 0
@@ -10095,7 +10104,7 @@ _deploy_record() {
     DR_RBA="$rb_attempted" DR_RBX="$rb_exit" DR_RSHA="$receipt_sha" DR_T0="$started_at" \
     DR_T1="$finished_at" DR_TGT="$target" DR_CAN="$canary" DR_PRB="$post_rb" DR_HC="$hcode_rec" DR_HM="$hmatch" DR_TREE="$tree_sha" DR_DEST="$dest_rec" DR_DURL="$deployed_url" DR_HSRC="$hsrc" \
     DR_ENVK="$env_keys_csv" DR_ENVS="$env_source" \
-    DR_DOM="$domain_rec" DR_DOMS="$domain_status" DR_TLS="$tls_status" DR_TLSA="$tls_not_after" DR_DOMP="$domain_prov" \
+    DR_DOM="$domain_rec" DR_DOMS="$domain_status" DR_TLS="$tls_status" DR_TLSA="$tls_not_after" DR_DOMP="$domain_prov" DR_LB="$live_binding" \
         python3 -c '
 import json, os, datetime
 state = os.environ.get("DR_STATE") or "anchored"
@@ -10134,6 +10143,7 @@ json.dump({
     "tls_status": os.environ.get("DR_TLS") or "unchecked",
     "tls_not_after": os.environ.get("DR_TLSA", ""),
     "domain_provenance": os.environ.get("DR_DOMP", ""),
+    "live_binding": os.environ.get("DR_LB") or "unchecked",
     "health_http_code": int(os.environ["DR_HC"]) if os.environ.get("DR_HC", "").isdigit() else None,
 }, open(os.environ["DR_OUT"], "w"), indent=2)
 ' 2>/dev/null || return 0
@@ -10232,6 +10242,91 @@ _deploy_probe_health() {
     return 1
 }
 
+# _deploy_provenance_root <dir> <type>
+# Echoes the static root that ships with the deploy and may carry /.well-known/, or "" when no
+# such root exists. nextjs and Vite: public/. Built static: the detected dist/ then build/.
+# docker, python and node serve no static root, so they print "" and are never bound.
+_deploy_provenance_root() {
+    local dir="${1:-.}" type="${2:-}"
+    case "$type" in
+        nextjs) printf '%s' "$dir/public" ;;
+        static)
+            if [ -f "$dir/dist/index.html" ]; then printf '%s' "$dir/dist"
+            elif [ -f "$dir/build/index.html" ]; then printf '%s' "$dir/build"
+            elif [ -f "$dir/package.json" ] && grep -q '"vite"' "$dir/package.json" 2>/dev/null; then printf '%s' "$dir/public"
+            fi
+            ;;
+    esac
+    return 0
+}
+
+# _deploy_clear_provenance <dir>
+# Removes .well-known/loki-provenance.json from EVERY candidate static root (public/, dist/,
+# build/). Runs before each deploy decides whether to write a fresh doc, so a doc left by an
+# earlier deploy can never ship with a build it does not describe (unanchored override,
+# unsupported type, signing failure, or a root that moved between deploys).
+_deploy_clear_provenance() {
+    local dir="${1:-.}" r
+    for r in public dist build; do
+        rm -f "$dir/$r/.well-known/loki-provenance.json" 2>/dev/null || true
+    done
+    return 0
+}
+
+# _deploy_write_provenance <dir> <root> <head_sha> <tree_sha> <receipt_sha256> <run_id>
+# Writes <root>/.well-known/loki-provenance.json and signs it in place (loki verify
+# --sign-provenance). Called only after the gate (including the dirty-tree check) passed, so the
+# untracked file never dirties the tree that was verified; it is also added to .git/info/exclude
+# so the NEXT deploy's dirty-tree gate does not trip over it. Returns non-zero when not signed.
+_deploy_write_provenance() {
+    local dir="$1" root="$2" head="$3" tree="$4" rsha="$5" rid="$6"
+    local f="$root/.well-known/loki-provenance.json" ex
+    rm -f "$f" 2>/dev/null
+    [ -n "$head" ] && [ -n "$tree" ] && [ -n "$rsha" ] && [ -n "$rid" ] || return 1
+    mkdir -p "$root/.well-known" 2>/dev/null || return 1
+    PV_H="$head" PV_T="$tree" PV_R="$rsha" PV_I="$rid" PV_OUT="$f" python3 -c '
+import json, os, datetime
+json.dump({"schema": "loki.provenance/1", "head_sha": os.environ["PV_H"], "tree_sha": os.environ["PV_T"],
+           "receipt_sha256": os.environ["PV_R"], "run_id": os.environ["PV_I"],
+           "built_at": datetime.datetime.now(datetime.timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")},
+          open(os.environ["PV_OUT"], "w"), indent=2)
+' 2>/dev/null || { rm -f "$f"; return 1; }
+    ex="$(git -C "$dir" rev-parse --git-path info/exclude 2>/dev/null)" || ex=""
+    if [ -n "$ex" ]; then
+        case "$ex" in /*) ;; *) ex="$dir/$ex" ;; esac
+        grep -qxF '**/.well-known/loki-provenance.json' "$ex" 2>/dev/null \
+            || { mkdir -p "$(dirname "$ex")" 2>/dev/null; printf '%s\n' '**/.well-known/loki-provenance.json' >> "$ex" 2>/dev/null; } || true
+    fi
+    if ! ( cd "$dir" && _loki_bun_delegate engine10 verify --sign-provenance "$f" ) >/dev/null 2>&1; then
+        rm -f "$f"
+        return 1
+    fi
+    return 0
+}
+
+# _deploy_probe_live_binding <dir> <url> <anchor>
+# Fetches <url>/.well-known/loki-provenance.json through loki verify --url --expect-sha.
+# Returns 0 VERIFIED (signature holds and head_sha equals the anchor), 1 MISMATCH (a doc
+# was served but is forged or names a different SHA, still so on the last bounded retry),
+# 2 UNCHECKED (no doc could be fetched or its key is unknown, after a bounded retry with the
+# health-probe tunables). Never VERIFIED on 2.
+_deploy_probe_live_binding() {
+    local dir="$1" url="$2" anchor="$3"
+    local attempts="${LOKI_DEPLOY_HEALTH_ATTEMPTS:-5}" interval="${LOKI_DEPLOY_HEALTH_INTERVAL:-3}" i=0 vrc=2
+    case "$attempts" in ''|*[!0-9]*) attempts=5 ;; esac
+    case "$interval" in ''|*[!0-9]*) interval=3 ;; esac
+    while [ "$i" -lt "$attempts" ]; do
+        i=$((i + 1))
+        vrc=0
+        ( cd "$dir" && _loki_bun_delegate engine10 verify --url "$url" --expect-sha "$anchor" ) >/dev/null 2>&1 || vrc=$?
+        [ "$vrc" -eq 0 ] && return 0
+        [ "$i" -lt "$attempts" ] && [ "$interval" -gt 0 ] && sleep "$interval"
+    done
+    # A mismatch on the last attempt is FAILED; earlier mismatches may be propagation of the previous build.
+    [ "$vrc" -eq 1 ] && return 1
+    return 2
+}
+
 # _deploy_policy_refusal <dir>
 # Echoes a refusal reason when the policy file does not permit a deploy, else "".
 # No policy file: "" (unchanged behaviour). File present and node or check.js
@@ -10611,6 +10706,25 @@ _deploy_try_execute() {
         esac
     fi
 
+    # Provenance doc: shipped with the build so the live URL can prove which SHA it serves.
+    local live_binding="unchecked" prov_root="" prov_written=false
+    prov_root="$(_deploy_provenance_root "$dir" "$type")"
+    # Every branch below starts from no doc: only a doc written by THIS deploy may ship.
+    _deploy_clear_provenance "$dir"
+    if [ "$anchor_state" = "unanchored_overridden" ]; then
+        live_binding="unanchored"
+        echo "Live binding unanchored: the evidence gate was overridden with the anchor UNPROVEN, so no provenance doc is published and the live URL is not bound to ${anchor:0:12}." >&2
+    elif [ -z "$prov_root" ]; then
+        live_binding="unsupported"
+        echo "Live binding unsupported: a ${type} project has no static root to serve /.well-known/loki-provenance.json, so the live URL is not bound to ${anchor:0:12}." >&2
+    elif _deploy_write_provenance "$dir" "$prov_root" "$anchor" "$(git -C "$dir" rev-parse 'HEAD^{tree}' 2>/dev/null || true)" \
+        "$(python3 -c 'import json,sys;print((json.load(open(sys.argv[1])).get("verification") or {}).get("hash") or "")' "$pj" 2>/dev/null || true)" "$run_id"; then
+        prov_written=true
+        echo "Provenance written: ${prov_root}/.well-known/loki-provenance.json"
+    else
+        echo -e "${YELLOW}WARNING: the provenance doc could not be signed, so the live URL will not be bound to this SHA.${NC}" >&2
+    fi
+
     local rc=0 started_at finished_at purl="" canary_out=""
     local -a deploy_argv=()
     read -r -a deploy_argv <<<"$exec_cmd"
@@ -10695,8 +10809,31 @@ _deploy_try_execute() {
         fi
     fi
 
-    if [ "$health_status" = "FAILED_HEALTH" ]; then
+    # Live binding: the deployed URL must serve the provenance doc for THIS anchor.
+    if [ "$prov_written" = true ] && [ "$rc" -eq 0 ] && [ "$health_status" != "FAILED_HEALTH" ] && [ -n "$deployed_url" ]; then
+        echo "Probing live binding: ${deployed_url%/}/.well-known/loki-provenance.json"
+        local lb_rc=0
+        _deploy_probe_live_binding "$dir" "$deployed_url" "$anchor" || lb_rc=$?
+        case "$lb_rc" in
+            0)
+                live_binding="VERIFIED"
+                echo -e "${GREEN}Live binding VERIFIED:${NC} ${deployed_url} serves a signed provenance doc for ${anchor:0:12}."
+                ;;
+            1)
+                live_binding="FAILED"
+                health_status="FAILED_HEALTH"
+                echo -e "${RED}FAILED_HEALTH: ${deployed_url} served a provenance doc that is forged or is not for ${anchor:0:12} (stale or wrong build served).${NC}" >&2
+                ;;
+            *)
+                echo "  Live binding unchecked: no verifiable provenance doc could be fetched from ${deployed_url}. Not a claim the live build is ${anchor:0:12}." >&2
+                ;;
+        esac
+    fi
+
+    if [ "$health_status" = "FAILED_HEALTH" ] && [ "$live_binding" != "FAILED" ]; then
         echo -e "${RED}FAILED_HEALTH: ${health_url} did not return 2xx${health_match:+ containing \"${health_match}\"} (last status ${hcode:-000}).${NC}" >&2
+    fi
+    if [ "$health_status" = "FAILED_HEALTH" ]; then
         if [ "$auto_rollback" = true ] && [ -n "$rb_cmd" ] && ! _deploy_is_destructive "$rb_cmd"; then
             echo "Rolling back: ${rb_cmd}" >&2
             rb_attempted=true
@@ -10735,7 +10872,7 @@ _deploy_try_execute() {
     rec="$(_deploy_record "$dir" "$exec_disp" "$rc" "${run_id:-unknown}" "${anchor:-unknown}" \
         "$anchor_state" "$health_status" "$health_url" "$rb_attempted" "$rb_exit" \
         "$rsha" "$started_at" "$finished_at" "${command%% *}" "$canary" "$post_rb" "$hcode" "$health_match" "$(git -C "$dir" rev-parse 'HEAD^{tree}' 2>/dev/null || true)" "$dest" "$deployed_url" "$health_src" "$env_keys" "$env_file" \
-        "$domain" "$_DD_STATUS" "$_DD_TLS" "$_DD_NOTAFTER" "$_DD_PROV")"
+        "$domain" "$_DD_STATUS" "$_DD_TLS" "$_DD_NOTAFTER" "$_DD_PROV" "$live_binding")"
     echo ""
     if [ "$rc" -eq 0 ]; then
         echo -e "${GREEN}Deploy command exited 0.${NC}"
@@ -14012,7 +14149,7 @@ cmd_config() {
         validate)
             cmd_config_validate "$@"
             ;;
-        *)
+        help|--help|-h)
             echo -e "${YELLOW}Usage: loki config [show|list|init|edit|path|set|get|example|schema|validate]${NC}"
             echo ""
             echo "  show            Show current configuration (default)"
@@ -14042,6 +14179,10 @@ cmd_config() {
             echo "  notify.discord       Discord webhook URL"
             echo "  budget               Cost budget limit in USD"
             ;;
+        *)
+            echo "loki config: unknown subcommand '${subcommand}' (see 'loki config help')" >&2
+            return 2
+            ;;
     esac
 }
 
@@ -15800,7 +15941,7 @@ cmd_api() {
             fi
             ;;
 
-        *)
+        help|--help|-h)
             echo -e "${BOLD}Loki Mode Dashboard/API Server${NC}"
             echo ""
             echo "Usage: loki api <command>"
@@ -15823,6 +15964,10 @@ cmd_api() {
             echo "  POST /api/pause   - Pause session"
             echo "  POST /api/resume  - Resume session"
             ;;
+        *)
+            echo "loki api: unknown subcommand '${subcommand}' (see 'loki api help')" >&2
+            return 2
+            ;;
     esac
 }
 
@@ -34912,7 +35057,10 @@ cmd_control() {
             echo "Commands:"
             echo "  serve [--port N] [--db PATH]   Run the control plane + UI on 127.0.0.1"
             echo "  backfill [DIR]                 Ship DIR/.loki/runs to the control plane"
-            echo "  status                         Show whether the control plane is reachable"
+            echo "  prune --repo OWNER/NAME | --before ISO_DATE [--dry-run] [--db PATH]"
+            echo "                                 Delete matching runs, their events and orphaned sources"
+            echo "  stop                           Stop the running control plane"
+            echo "  status [--json]                Show whether the control plane is reachable (--json: one JSON object)"
             return 0
             ;;
     esac

package/completions/_loki

@@ -32,6 +32,12 @@ function _loki {
                 export)
                     _arguments '--sarif[Write findings.sarif for a run]'
                     ;;
+                control)
+                    _arguments \
+                        '--port[Port for the control plane server]:port:' \
+                        '--json[Output as JSON]' \
+                        '1:subcommand:(serve status help)'
+                    ;;
                 config)
                     _loki_config
                     ;;

package/completions/loki.bash

@@ -238,6 +238,14 @@ _loki_completion() {
             fi
             ;;
 
+        control)
+            if [[ "$cur" == -* ]]; then
+                COMPREPLY=( $(compgen -W "--port --json --help" -- "$cur") )
+                return 0
+            fi
+            COMPREPLY=( $(compgen -W "serve status help" -- "$cur") )
+            ;;
+
         plan)
             if [[ "$cur" == -* ]]; then
                 COMPREPLY=( $(compgen -W "--json --verbose --spec --requirements --help" -- "$cur") )

package/dashboard/__init__.py

@@ -7,6 +7,6 @@ Modules:
     control: Session control helpers (status, atomic writes, origin check)
 """
 
-__version__ = "11.17.44"
+__version__ = "11.17.46"
 
 __all__ = ["__version__"]

package/docs/CLI-REFERENCE.md

@@ -1,6 +1,6 @@
 # CLI reference
 
-Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.17.44. Do not edit by hand.
+Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.17.46. Do not edit by hand.
 Hidden and legacy-only commands are omitted; see `docs/v10/CLI-MODERN.md` for the full inventory.
 
 | Command | Description |

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 Loki Mode, by [Autonomi](https://www.autonomi.dev/), turns a spec or an issue into a verified pull request with a receipt you can check. This page covers installing it, a first run, and the options around it.
 
-**Version:** v11.17.44
+**Version:** v11.17.46
 
 **Engine note:** `loki start` is the primary command. `loki start`, `loki "<task>"`, `loki owner/repo#N` and `loki quick` all run the Loki 10 engine, whatever the flag order or input form (PRD file, issue ref, task or one-word brief). The previous loop runs only on `--engine legacy`, `LOKI_ENGINE=legacy`, or for one call when a flag Loki 10 cannot honor is present. See the [user guide](v10/GUIDE.md) and the [5-minute quickstart](QUICKSTART.md).
 

package/docs/WORKSPACES.md

@@ -55,7 +55,7 @@ After `loki workspace run <name> <ref>` finishes, check the evidence rather than
 3. `.loki/workspaces/<name>/<run-id>/integration.json` holds `status`, the head SHA per repo and `timing`.
 4. `python3 autonomy/lib/workspace_metrics.py <run-dir> --attention-min <minutes>` prints `prs`, `prs_per_hour` and `prs_per_attention_minute`; any value it cannot measure prints `unmeasured`.
 5. Each repo PR for the run branch carries exactly one integration comment.
-6. `loki verify <run-dir>/composite.json` re-checks the composite offline (add `--pubkey FILE` on another machine). It recomputes the composite hash, re-verifies every child receipt from disk and checks the signature. It prints the integration result and every repo head SHA it attests. It is TAMPERED for a tampered or swapped child, a child head that is not the integrated head, a failed or interrupted integration status or nonzero exit code, an edited integration section, or an `integration.log` that no longer matches its recorded hash. It is UNCHECKED for an unsigned child under a signed composite, and for a legacy composite that predates the integration section and has no integrated head to compare. Deployed-SHA binding is not implemented: the composite attests what was integrated and tested, not what is running anywhere. Exit codes are the single-receipt ones: 0 VERIFIED, 1 TAMPERED, 2 UNCHECKED, 3 UNSIGNED. The composite never reads higher than its weakest child: one PARTIAL child caps it at PARTIAL.
+6. `loki verify <run-dir>/composite.json` re-checks the composite offline (add `--pubkey FILE` on another machine). It recomputes the composite hash, re-verifies every child receipt from disk and checks the signature. It prints the integration result and every repo head SHA it attests. It is TAMPERED for a tampered or swapped child, a child head that is not the integrated head, a failed or interrupted integration status or nonzero exit code, an edited integration section, or an `integration.log` that no longer matches its recorded hash. It is UNCHECKED for an unsigned child under a signed composite, and for a legacy composite that predates the integration section and has no integrated head to compare. Deployed-SHA binding is partial: `loki deploy --execute` ships a signed `.well-known/loki-provenance.json` (head_sha, tree_sha, receipt_sha256, run_id, built_at) in the static root of a single-repo nextjs, Vite or built-static project (public/, dist/ or build/) and, when the provider prints a URL, fetches it back through `loki verify --url --expect-sha`. The deploy record's `live_binding` is VERIFIED only when the served doc is signed and names the anchor SHA; a stale or forged doc is FAILED (FAILED_HEALTH, exit 4), an unreachable one is `unchecked`, and docker, python and node projects (no static root) are `unsupported`. A mismatch is retried inside the health attempts and interval budget before it is FAILED, so a URL still serving the previous build for a few seconds is not rolled back at once. A live doc that is unsigned or signed with an unknown key is `unchecked`, not FAILED, so a stale non-loki build serving such a doc passes silently. Under `--allow-unanchored` the anchor is UNPROVEN, so no doc is published and `live_binding` is `unanchored`. The deploy appends `**/.well-known/loki-provenance.json` to `.git/info/exclude` and leaves the file in the working tree. Every `loki deploy --execute` first removes that file from public/, dist/ and build/, so only a doc written by the current deploy ships; an unanchored, unsupported or unsigned deploy ships none. A provider run by hand outside `loki deploy --execute` uploads whatever doc the last loki deploy left, which names that deploy's SHA, not the new build. If the provider rebuilds remotely from a gitignored root, the doc is lost and the result is `unchecked`. None of this binds a composite: the composite attests what was integrated and tested, not what is running anywhere, and no workspace deploy writes or probes a provenance doc. Exit codes are the single-receipt ones: 0 VERIFIED, 1 TAMPERED, 2 UNCHECKED, 3 UNSIGNED. The composite never reads higher than its weakest child: one PARTIAL child caps it at PARTIAL.
 7. A run that could not seal prints `composite not sealed: <reason>` (for example a repo with no receipt). Seal by hand with `loki verify --seal-composite <run-dir>`; it refuses unless every child has a receipt.
 
 Not measured: no scale test exists for large repo counts. Claim only what you have run.

package/docs/v10/BOARD.md

@@ -1006,7 +1006,7 @@ Source: ~/git/autonomi-dev/research/2026-09-30-adoption/SWARM-PROMPT-ADOPTION.md
 | FC-23 | FC-23: the Wall writes tests matching the package's module system and test conventions from the Project Model; a lint or type error inside a Wall file is harness-owned, the Wall file is regenerated once or discarded with a NOT PROVEN note, and no fix round is spent on it | loki-ts/src/engine10/stages/wall.ts, the fix-round target filter, project_model conventions, plus tests | MEDIUM | a CommonJS package gets a Wall test with no import.meta; a forced type error in a Wall file yields regenerate-or-discard and zero fix rounds | released@2026-10-04T00:51Z | released@2026-10-04T00:51Z | Merged c0a1c43c2 (38c782386, review-fc23 sonnet APPROVE; nits: duplicate NOT PROVEN line for a discarded file, merged comment in verify.ts). 
 | TEN-DEPLOY-01 | Capture the deployed public URL on every --execute path and probe it by default | autonomy/loki (_deploy_try_execute non-canary exec block and the _deploy_record arg list and JSON fields only), tests/test-deploy-receipt-gate.sh (new section after the existing 14-18 block), CHANGELOG.md | MEDIUM | see Wall in note | released@2026-10-17T02:57Z | merge 60a9bb709; TL APPROVE b14d908a4 (deploy-receipt-gate 56/0, test-deploy 6/6, shellcheck 91=91 vs main). wave 1; depends: none. Goal: After a deploy that exits 0, take the last https URL the provider CLI printed (the canary grep -Eo already does this; reuse that, do not add a second parser). Store it as deployed_url in loki.deploy/1. When no --health-url is given, probe deployed_url with _deploy_probe_health and record health_url_source=captured/flag. No URL printed: deployed_url is empty, health stays 'unchecked', and Loki never invents a URL. Print 'Live at: <url>' only when one was captured. Wall: RED: a new section stubs vercel to print 'https://app-x.vercel.app' and exit 0, and stubs curl to 200. The record lacks deployed_url, health_status is 'unchecked', and the test fails on main. GREEN: deployed_url equals the stub URL, health_status=healthy, health_url_source=captured. A second stub prints no URL: deployed_url is empty, health is 'unchecked', exit 0. A third case passes --health-url: health_url_source=flag. MUTATION: hardcode deployed_url to a constant and the no-URL case goes red. Gate: bash -n autonomy/loki && shellcheck -S warning autonomy/loki && bash tests/test-deploy-receipt-gate.sh && bash tests/test-deploy.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. v11.17.13 npm next 11.17.13 |
 | TEN-DEPLOY-02 | Signed live provenance doc (loki.provenance/1) and loki verify --url | loki-ts/src/util/receipt_signer.ts, loki-ts/tests/engine10/verify_cmd.test.ts (provenance cases; existing deploy-record tests live here), docs/SIGNED-RECEIPTS.md (one section), CHANGELOG.md. Engine10 core is not edited: verify_cmd.ts:164 already routes through deployAttestCmd, and a one-token --url passthrough there needs the budget test to stay green. | HIGH | see Wall in note | released v11.17.26@2026-10-17T05:48Z | SPLIT per CTO critic into (a) signProvenance plus --sign-provenance, (b) verify --url fetch and verdicts; build as two commits or two agents. wave 2; depends: none. Goal: Extend receipt_signer.ts, the owner of signed deploy attestations, with: signProvenance(head_sha, tree_sha, receipt_sha256, run_id, built_at), which signs with the same Ed25519 key as signDeployRecord; a `--sign-provenance FILE` dispatch in deployAttestCmd; and `loki verify --url https://host` plus a pubkey. The --url check fetches <url>/.well-known/loki-provenance.json with a timeout and size cap, checks the signature, and requires a 200 with JSON. The verdict is VERIFIED only when the signature verifies against the local JWKS or --pubkey AND the cited receipt (when present locally or via --receipt) is VERIFIED. The doc alone with an unknown kid is UNCHECKED rc 2. An edited doc is TAMPERED rc 1. A fetch failure is UNCHECKED and never VERIFIED. Optional --expect-sha SHA must equal head_sha. Wall: RED: tests serve a signed provenance doc from Bun.serve on 127.0.0.1. On main, `verify --url` is an unknown arg and exits 2, so the tests fail. GREEN: genuine doc with --pubkey gives VERIFIED rc 0. One edited byte of head_sha gives TAMPERED rc 1. An unknown kid gives UNCHECKED rc 2. A 404, a non-JSON body or a doc over 64KB gives UNCHECKED rc 2. A wrong --expect-sha gives TAMPERED rc 1. MUTATION: skip the signature verify and the edited-byte case goes red. Gate: cd loki-ts && bun test tests/engine10/verify_cmd.test.ts && bun test tests/engine10/ && bunx tsc --noEmit (the full engine10 suite runs the budget and spawn-env guards) Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
-| TEN-DEPLOY-03 | Ship the provenance doc with the build and prove the live URL serves the verified SHA | autonomy/loki (_deploy_try_execute pre-exec and post-health blocks, _deploy_record live_binding field only), tests/test-deploy-receipt-gate.sh (new section), docs/WORKSPACES.md, CHANGELOG.md | HIGH | see Wall in note | ready@2026-10-17T01:40Z | SPLIT per CTO critic into (a) provenance file into deploy root per project type, (b) post-deploy live-binding probe; build as two commits or two agents. wave 3; depends: TEN-DEPLOY-01, TEN-DEPLOY-02. Goal: In _deploy_try_execute, after the gate passes and before the provider runs, write a signed .well-known/loki-provenance.json into the deploy root via `verify --sign-provenance`. The deploy root is public/ for nextjs and vite, the detected dist/ or build/ for static, and is refused with a reason for docker/python where no static root exists. Write it as an untracked build artifact so the dirty-tree gate is evaluated before it. After the deploy, probe <deployed_url>/.well-known/loki-provenance.json. Set live_binding=VERIFIED only when its head_sha equals the anchor. A mismatch gives FAILED_HEALTH exit 4 (stale or wrong build served). Update docs/WORKSPACES.md and replace 'deployed-SHA binding is not implemented' with what is now bound and what is not. Wall: RED: a stubbed vercel copies dist/ into a served dir and a python http.server serves it. On main, no provenance file exists and the record has no live_binding. GREEN: the file exists in dist/.well-known, live_binding=VERIFIED, and its head_sha equals git rev-parse HEAD. A stub that serves an older provenance gives FAILED_HEALTH exit 4. A docker project prints the refusal reason and records live_binding=unsupported, never VERIFIED. The dirty-tree gate still refuses a dirty tree before the file is written. MUTATION: compare against a constant instead of the anchor and the stale-serve case goes red. Gate: bash -n autonomy/loki && shellcheck -S warning autonomy/loki && bash tests/test-deploy-receipt-gate.sh && (cd loki-ts && bun test tests/engine10/verify_cmd.test.ts) Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
+| TEN-DEPLOY-03 | Ship the provenance doc with the build and prove the live URL serves the verified SHA | autonomy/loki (_deploy_try_execute pre-exec and post-health blocks, _deploy_record live_binding field only), tests/test-deploy-receipt-gate.sh (new section), docs/WORKSPACES.md, CHANGELOG.md | HIGH | see Wall in note | released v11.17.45 | SPLIT per CTO critic into (a) provenance file into deploy root per project type, (b) post-deploy live-binding probe; build as two commits or two agents. wave 3; depends: TEN-DEPLOY-01, TEN-DEPLOY-02. Goal: In _deploy_try_execute, after the gate passes and before the provider runs, write a signed .well-known/loki-provenance.json into the deploy root via `verify --sign-provenance`. The deploy root is public/ for nextjs and vite, the detected dist/ or build/ for static, and is refused with a reason for docker/python where no static root exists. Write it as an untracked build artifact so the dirty-tree gate is evaluated before it. After the deploy, probe <deployed_url>/.well-known/loki-provenance.json. Set live_binding=VERIFIED only when its head_sha equals the anchor. A mismatch gives FAILED_HEALTH exit 4 (stale or wrong build served). Update docs/WORKSPACES.md and replace 'deployed-SHA binding is not implemented' with what is now bound and what is not. Wall: RED: a stubbed vercel copies dist/ into a served dir and a python http.server serves it. On main, no provenance file exists and the record has no live_binding. GREEN: the file exists in dist/.well-known, live_binding=VERIFIED, and its head_sha equals git rev-parse HEAD. A stub that serves an older provenance gives FAILED_HEALTH exit 4. A docker project prints the refusal reason and records live_binding=unsupported, never VERIFIED. The dirty-tree gate still refuses a dirty tree before the file is written. MUTATION: compare against a constant instead of the anchor and the stale-serve case goes red. Gate: bash -n autonomy/loki && shellcheck -S warning autonomy/loki && bash tests/test-deploy-receipt-gate.sh && (cd loki-ts && bun test tests/engine10/verify_cmd.test.ts) Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
 | TEN-DEPLOY-04 | Verified deploy badge from loki status --badge | loki-ts/src/commands/status.ts (renderLastDeploy plus --badge flag parse only), loki-ts/tests/commands/status.test.ts, CHANGELOG.md | MEDIUM | see Wall in note | released@2026-10-17T05:06Z | wave 4; depends: TEN-DEPLOY-01 (deployed_url field); live_binding from TEN-DEPLOY-03 is read if present, and its absence omits the badge. Goal: `loki status --badge` reads the newest loki.deploy/1 record (renderLastDeploy already loads it) and verifies it through the existing verify path. It prints a markdown shields badge linking to <deployed_url>/.well-known/loki-provenance.json. The message is 'deployed: verified' (brightgreen) ONLY when the record verifies and live_binding=VERIFIED. 'deployed: unverified' (red) is printed for TAMPERED or a failed health check. In all other cases the badge is omitted with a one-line reason. It never prints green from an unchecked field. The color mapping matches the share badge (autonomy/loki:38291), and no new vocabulary is added. Wall: RED: status.test.ts fixture with a signed healthy record, live_binding=VERIFIED and deployed_url. On main, --badge is unknown and no badge line is printed. GREEN: the badge line contains 'brightgreen' and deployed_url. A record with health FAILED_HEALTH gives a red badge. An unsigned record or a missing live_binding omits the badge and prints the reason. A record with no deployed_url omits the badge. MUTATION: drop the verify call and the unsigned case goes green, so the test goes red. Gate: cd loki-ts && bun test tests/commands/status.test.ts && bunx tsc --noEmit && bash tests/test-status-surface-agrees.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
 | TEN-DEPLOY-05 | loki deploy --env-file: push env to the provider with names-only records | autonomy/loki (cmd_deploy arg parse for --env-file, _deploy_try_execute env step, _deploy_record env_keys field only), tests/test-deploy-receipt-gate.sh (new section), autonomy/completions (loki deploy flag list only), CHANGELOG.md | HIGH | see Wall in note | released v11.17.35 | SPLIT per CTO critic into (a) env-file parser, .env.example check, masking, env_keys record, (b) four provider verbs; build as two commits or two agents. wave 4; depends: TEN-DEPLOY-03 (same function, serialized to avoid conflicts). Goal: `--env-file FILE` (with --execute only) parses KEY=VALUE with no shell eval. It refuses when a key in .env.example is missing from FILE, naming the keys. Env is applied through documented verbs only: Vercel `vercel --prod -e K=V` per key (args built as an array, never through the shell); Fly `fly secrets set --stage K=V ...` before `fly deploy`; Netlify `netlify env:import FILE`; Cloudflare `wrangler secret bulk FILE`. An unsupported provider refuses with nothing run. The record stores env_keys (names, sorted) and env_source; it NEVER stores values. Values never appear in stdout, the record or the printed 'Running:' line, where they are masked as K=***. Wall: RED: a recording vercel stub logs argv. On main, --env-file is ignored and no -e args appear. GREEN: argv has `-e API_URL=x -e TOKEN=s3cr3t`. Grepping stdout, stderr and the record for s3cr3t finds nothing; env_keys=[API_URL,TOKEN]. When .env.example lists DB_URL and the env file lacks it, the command refuses with rc 1, no stub calls and DB_URL named. A value with $(touch pwned) leaves no file named pwned. MUTATION: write values into the record and the secret-grep goes red. Gate: bash -n autonomy/loki && shellcheck -S warning autonomy/loki && bash tests/test-deploy-receipt-gate.sh && bash tests/test-completion-drift.sh (or whichever completion drift test the CHANGELOG cites) Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
 | TEN-DEPLOY-06 | loki deploy --domain: attach a custom domain and prove TLS | autonomy/loki (cmd_deploy --domain parse and a post-health domain block in _deploy_try_execute, _deploy_record domain/tls fields only), tests/test-deploy-receipt-gate.sh (new section), CHANGELOG.md | MEDIUM | see Wall in note | released v11.17.38 | wave 5; depends: TEN-DEPLOY-05 (same function, serialized). Goal: `--domain example.com` (with --execute) runs documented verbs after a healthy deploy: Vercel `vercel alias set <deployed_url> <domain>`; Fly `fly certs add <domain>`. Netlify and Cloudflare print the manual dashboard step and set domain_status=manual. Then a TLS proof runs: `openssl s_client -servername <domain> -connect <domain>:443` plus `openssl x509 -noout -enddate -checkend 604800`. It records domain, tls_status (valid/expiring/invalid/unchecked) and tls_not_after, and re-probes https://<domain>/.well-known/loki-provenance.json for the same head_sha. DNS not yet pointed gives tls_status=invalid and exit 6, with the DNS record the provider needs printed. It never claims valid without the openssl check. Wall: RED: vercel, openssl and curl are stubbed. On main, --domain is ignored. GREEN: the alias set argv is recorded, tls_status=valid and tls_not_after is set. An openssl stub that fails -checkend gives expiring. An openssl handshake failure gives invalid and exit 6. A netlify project gives domain_status=manual, no alias call, and tls still checked. No openssl on PATH gives unchecked, never valid. MUTATION: default tls_status to valid and the missing-openssl case goes red. Gate: bash -n autonomy/loki && shellcheck -S warning autonomy/loki && bash tests/test-deploy-receipt-gate.sh Rules: FAILURE-CLASSES row first for any bug fix (D86); no CHANGELOG edits (Release Manager writes notes); DECISIONS numbers assigned by the Chief of Staff; reuse util/secure_scan.ts, the shared badge helper, keys_cmd export and the TS claude login probe instead of new copies; new CLI flags update autonomy/completions and the help-drift guard. |
@@ -1182,6 +1182,36 @@ Source: ~/git/autonomi-dev/research/2026-09-30-adoption/SWARM-PROMPT-ADOPTION.md
 | TEN-STABILITY-18 | P0 fix-forward: nightly 39016259458 reds still red on main e32ee1b5d (pr_body_golden not-recorded producer util/check_result.ts; sizing wall brief 726 vs cap 616; router_optout_golden wall stage haiku for development; verify.test uv resolution CI-only via Bun.which PATH; test-sigpipe-guard 1737 vs ceiling 1728; help-changelog-drift loki verify --require-exogenous; test-ui-bare-loki exact-match on new control lines; test-local-ci-gitleaks scope) | the failing tests, loki-ts/src/util/check_result.ts, loki-ts/src/engine10/stages/wall.ts, loki-ts/src/engine10/stages/verify.ts, verify help and completions, scripts/local-ci.sh, docs/v10/FAILURE-CLASSES.md | MEDIUM | red: each named test fails on e32ee1b5d; green: cd loki-ts && bun test tests/engine10/pr_body_golden.test.ts tests/engine10/sizing.test.ts tests/engine10/router_optout_golden.test.ts tests/engine10/verify.test.ts tests/util; bash tests/test-sigpipe-guard.sh; bash tests/test-help-changelog-drift.sh; bash tests/test-ui-bare-loki.sh; bash tests/test-local-ci-gitleaks.sh | released v11.17.42 | Diagnosis 2026-10-17 by nightly diag agent; one FAILURE-CLASSES row per class |
 | TEN-STABILITY-19 | P0 fix-forward: moat P8.ablation-dead-code-not-sealed positive control headline VERIFIED WITH GAPS (expected VERIFIED) and first-run-gate --stub FAILED with dirty tracked tree M sum.js at intake.ts:61 | tests/moat/p8-*.sh or the ablation producer, scripts/first-run-gate.sh, loki-ts/src/engine10/stages/intake.ts only if the honest fix is there | HIGH | red: bash tests/moat/run.sh prints moat suite: FAIL (1 rule failure(s)); bash scripts/first-run-gate.sh --stub fails 7 assertions; green: both exit 0 | released v11.17.42 | Diagnosis 2026-10-17; never weaken a moat assertion to pass |
 | TEN-STABILITY-20 | Fix help-changelog-drift red after v11.17.42: list report kpis --since and undo --list in Bun help, autonomy/loki help and both completions | completions/loki.bash, completions/_loki, loki-ts/src help, autonomy/loki, docs/v10/FAILURE-CLASSES.md | LOW | merged 3c4e2fcd9 | released v11.17.43 |
+| TEN-STABILITY-26 | fix: `loki control backfill --repo` with no value silently falls back to the first positional or cwd and ships that dir; fail with one error line naming --repo and exit 2 (same class as TEN-STABILITY-21) | loki-ts/src/commands/control.ts, loki-ts/tests/commands/control.test.ts | LOW | red: `cd loki-ts && bun test tests/commands/control.test.ts -t "backfill repo missing value"` fails (exit 0, ingests cwd); green: passes, `--repo DIR` and bare DIR unchanged | released v11.17.46 | Gap: control.ts:234 `flag(rest, "--repo") ?? rest.find(...) ?? cwd`; flag() at :33 returns undefined for a trailing flag, missingValue() at :38 exists but is not applied here |
+| TEN-UX-24 | fix: the second `control` help block in autonomy/loki (cmd_control, ~line 34902) lists only serve, backfill, status; add prune, stop and `status --json` so it matches the Bun usage in control.ts | autonomy/loki, tests/test-help-discoverability.sh | LOW | red: `bash tests/test-help-discoverability.sh` fails on a new assertion that bash `loki control --help` names prune, stop and status --json; green: passes and `bash tests/test-help-changelog-drift.sh` still exits 0 | released v11.17.46 | Gap: control.ts:22 documents prune --repo/--before; the bash fallback help (LOKI_LEGACY_BASH) omits it |
+| TEN-UX-25 | fix: bash `cmd_provider` default arm (autonomy/loki:7488) prints help and returns 0 for an unknown subcommand; return 2 with one "unknown subcommand" line (TS side fixed in TEN-UX-20); chain after TEN-UX-24 | autonomy/loki, tests/test-help-discoverability.sh | LOW | red: `bash tests/test-help-discoverability.sh` fails on `loki provider frobnicate` expecting exit 2; green: passes, `loki provider` and `loki provider --help` still exit 0 | released v11.17.46 | Gap: the `*)` arm at autonomy/loki ~7517 echoes the help block with no return code; chain after TEN-UX-24 |
+| TEN-UX-26 | fix: sibling sweep of bash commands whose default arm prints help and exits 0 on an unknown subcommand (cmd_config ~14144 and cmd_api ~15932 are the first candidates; confirm each with a probe, skip any that already fail non-zero); make each exit 2 with an "unknown subcommand" line; chain after TEN-UX-25 | autonomy/loki, tests/test-help-discoverability.sh | LOW | red: `bash tests/test-help-discoverability.sh` fails on `loki config frobnicate` and `loki api frobnicate` expecting exit 2; green: passes, bare and --help forms still exit 0 | released v11.17.46 | Gap: FAILURE-CLASSES row required (siblings exist); chain after TEN-UX-25 |
+| TEN-UX-27 | fix: `loki doctor --quiet` writes `Install:` hint lines to stderr while the WARN/FAIL row goes to stdout, so the hint prints detached from its row; write each hint directly under its row on the same stream | loki-ts/src/commands/doctor.ts, loki-ts/tests/commands/doctor.test.ts | LOW | red: `cd loki-ts && bun test tests/commands/doctor.test.ts -t "install hint follows its row"` fails (hint absent from stdout); green: passes and `bunx tsc --noEmit` exits 0 | released v11.17.46 | Gap: doctor.ts:1276 `process.stderr.write(... Install: ...)` after `process.stdout.write(formatToolLine(c))` at :1274 |
+| TEN-QUALITY-22 | test: pin the doctor disk text-mode "on <name> volume" label (home, cwd, tmp) so the low-volume name cannot regress; chain after TEN-UX-27 | loki-ts/src/commands/doctor.ts, loki-ts/tests/commands/doctor.test.ts | LOW | red: mutate lowestVolume to return null low_volume and `cd loki-ts && bun test tests/commands/doctor.test.ts -t "disk text volume label"` fails; green: passes unmutated | released v11.17.46 | Gap: doctor.test.ts:161 covers the JSON low_volume only; no test renders the text line; chain after TEN-UX-27 |
+| TEN-SPEED-10 | enhancement: `loki doctor --json` (buildDoctorJson) awaits checkSentrux, checkMemoryHealth and requirementsSection one after another; run them with Promise.all and keep output byte-identical; chain after TEN-QUALITY-22 | loki-ts/src/commands/doctor.ts, loki-ts/tests/commands/doctor.test.ts | MEDIUM | red: `cd loki-ts && bun test tests/commands/doctor.test.ts -t "json checks run concurrently"` fails (elapsed ~ sum of stubbed 200ms probes); green: passes and `bun test tests/commands/doctor_router.test.ts tests/commands/doctor_count.test.ts` exit 0 | released v11.17.46 | Gap: doctor.ts:940-946 serial awaits; the text path already batches runAllToolChecks; chain after TEN-QUALITY-22 |
+| TEN-QUALITY-23 | test: help-changelog-drift guards exact completion cases; assert every `loki` subcommand and flag named in CHANGELOG appears as a literal case in completions/loki.bash and completions/_loki so a flag typo fails | tests/test-help-changelog-drift.sh, completions/loki.bash, completions/_loki | LOW | red: introduce a typo `--sinse` in completions/loki.bash and `bash tests/test-help-changelog-drift.sh` must exit 1 naming it; green: reverted typo exits 0 | released v11.17.46 | Gap: current test greps for substrings loosely, a misspelled flag in a different case arm still passes |
+| TEN-GATES-22 | feature: the per-run signed receipt (not only the composite) records the toolchain {bun,node,python3,git}, absent tools null, old receipts still verify (follow-up from the TEN-GATES-19 review) | loki-ts/src/util/receipt_signer.ts, loki-ts/tests/engine10/seal_group.test.ts | HIGH | red: `cd loki-ts && bun test tests/engine10/seal_group.test.ts -t "per-run receipt toolchain"` fails (no toolchain key); green: passes, `bun test tests/engine10 tests/util/receipt_bundle.test.ts` and `bunx tsc --noEmit` exit 0 | released v11.17.46 | Gap: collectToolchain is used only by composite_seal.ts:54; receipt_signer.ts has no toolchain reference |
+| TEN-COST-39 | fix: a malformed `.loki/metrics/budget.json` is discarded and returns null, so spend resets to zero and the cap is silently disarmed; rebuild budget_used from the efficiency records (readEfficiencyDir) and warn once | loki-ts/src/runner/budget.ts, loki-ts/tests/runner/budget.test.ts | MEDIUM | red: `cd loki-ts && bun test tests/runner/budget.test.ts -t "corrupt budget state rebuilds used"` fails (used 0); green: passes and `bun test tests/runner/autonomous_budget.test.ts` exit 0 | released v11.17.46 | Gap: budget.ts:305-318 returns null on parse failure and the caller treats null as no spend |
+| TEN-COST-40 | fix: `loadDefaultMaxCostUsd` silently falls back to the literal 100 when model-pricing.json is unreadable; print one stderr warning naming the file and the fallback; chain after TEN-COST-39 | loki-ts/src/runner/budget.ts, loki-ts/tests/runner/budget.test.ts | LOW | red: `cd loki-ts && bun test tests/runner/budget.test.ts -t "pricing file missing warns"` fails (no warning); green: passes, warning emitted once per process | released v11.17.46 | Gap: budget.ts:24-33 swallows every read error; chain after TEN-COST-39 |
+| TEN-STABILITY-27 | fix: `LOKI_E10_STALL_S=abc` or `LOKI_E10_STALL_KILL_S=-5` is silently ignored and the default applies; warn once on stderr naming the variable and the value used | loki-ts/src/runner/watchdog.ts, loki-ts/tests/runner/watchdog.test.ts | LOW | red: `cd loki-ts && bun test tests/runner/watchdog.test.ts -t "invalid stall env warns"` fails (no warning); green: passes, valid and unset values unchanged | released v11.17.46 | Gap: watchdog.ts:8-17 return the default with no diagnostic |
+| TEN-STABILITY-28 | fix: `loki undo <run> --bogus` ignores unknown flags and proceeds; validate against the known set (--list --plan --dry-run --json --allow-unsigned --yes --close-pr --help) and exit 2 with one line naming the flag | loki-ts/src/commands/undo.ts, loki-ts/tests/commands/undo.test.ts | MEDIUM | red: `cd loki-ts && bun test tests/commands/undo.test.ts -t "unknown flag"` fails (exit 0 or applies); green: passes, all valid combinations unchanged | released v11.17.46 | Gap: undo.ts:218-238 uses args.includes for each flag with no unknown-flag check; a typo such as `--dry-rn` falls through to apply |
+| TEN-STABILITY-29 | fix: `loki rollback <id> --forse` and other unknown flags are ignored (the typo drops --force silently); validate against known flags and exit 2 | loki-ts/src/commands/rollback.ts, loki-ts/tests/commands/rollback.test.ts | LOW | red: `cd loki-ts && bun test tests/commands/rollback.test.ts -t "unknown flag"` fails; green: passes, --json and --force unchanged | rejected (already shipped by 8d630fa59 TEN-DEPLOY-16) | Gap: rollback.ts:77,116,128 use rest.includes only |
+| TEN-STABILITY-30 | fix: `loki start ./prd.md` with a mistyped or missing path treats the path string as an inline brief and starts a paid run on it; when the spec looks like a path (contains / or ends in .md/.txt/.yaml/.json) and does not exist, exit 2 "PRD file not found: <path>" | loki-ts/src/commands/start.ts, loki-ts/tests/commands/start.test.ts | MEDIUM | red: `cd loki-ts && bun test tests/commands/start.test.ts -t "missing prd path"` fails (run starts); green: passes, real files and plain briefs unchanged | released v11.17.46 | Gap: start.ts:376 `existsSync(spec) ? readFileSync : spec` falls through to the literal string; verify the same fall-through on the --prd flag before building |
+| TEN-COST-41 | enhancement: `loki start` prints one line before the first iteration stating the effective per-run cap and where it came from (flag, env, loki.yaml, default $100) so a silent default cap is visible; skip if already printed (check first); chain after TEN-STABILITY-30 | loki-ts/src/commands/start.ts, loki-ts/tests/commands/start.test.ts | LOW | red: `cd loki-ts && bun test tests/commands/start.test.ts -t "cap source line"` fails (no line); green: passes for flag, env and default sources | released v11.17.46 | Gap: capNote exists in e10ext/budget_cap.ts (start.ts:425); confirm it covers the legacy default path; chain after TEN-STABILITY-30 |
+| TEN-STABILITY-31 | fix: `listCheckpoints` silently skips a checkpoint whose metadata.json is corrupt or fails validation, so it vanishes from rollback choices with no trace; collect skipped ids and warn once on stderr | loki-ts/src/runner/checkpoint.ts, loki-ts/tests/runner/checkpoint.test.ts | MEDIUM | red: `cd loki-ts && bun test tests/runner/checkpoint.test.ts -t "corrupt metadata warns"` fails (no warning); green: passes, valid listing order unchanged | released v11.17.46 | Gap: checkpoint.ts:414-436 readCheckpointSafe returns null in a bare catch |
+| TEN-QUALITY-25 | test: pin provider failover classification (rate limit vs outage vs killed vs clean exit) and nextProvider ordering with a fake installed() probe | loki-ts/src/runner/provider_failover.ts, loki-ts/tests/runner/provider_failover.test.ts | MEDIUM | red: mutate classifyOutage to return null for exit 137 and `cd loki-ts && bun test tests/runner/provider_failover.test.ts` fails; green: passes unmutated and `bunx tsc --noEmit` exits 0 | released v11.17.46 | Gap: no tests/runner file names provider_failover; new test file justified because no existing file owns it (verify with grep first) |
+| TEN-UX-28 | enhancement: `loki queue run` prints a progress line `[n/m] <ref>` before each item and the digest links each item verdict; skip if already present (check first) | loki-ts/src/commands/queue.ts, loki-ts/tests/commands/queue.test.ts | LOW | red: `cd loki-ts && bun test tests/commands/queue.test.ts -t "progress line per item"` fails; green: passes and the existing digest test still exits 0 | released v11.17.46 | Gap: queue.ts run loop (~line 290-320) records results only in the final digest |
+| TEN-SPEED-11 | enhancement: `loki report kpis --since 7d` should skip run directories whose newest mtime is before the cutoff instead of parsing every run, with identical output | loki-ts/src/commands/kpis.ts, loki-ts/tests/commands/kpis.test.ts | LOW | red: `cd loki-ts && bun test tests/commands/kpis.test.ts -t "since skips old runs"` fails (old run files read, counted by a spy); green: passes and output byte-identical on the fixture | released v11.17.46 | Gap: kpis.ts:96 computeKpis receives sinceMs; confirm it filters after reading (read computeKpis first, drop if already pruned by mtime) |
+| TEN-SECURITY-11 | fix: the SARIF secret scan misses common token formats (Hugging Face `hf_`, SendGrid `SG.`, Twilio `SK`+32 hex, Azure storage `AccountKey=`); add Tier 1 patterns that report label only, never the matched text, and mirror them in autonomy/lib/secret-scan.sh in the same change | loki-ts/src/commands/export_sarif.ts, loki-ts/tests/commands/export_sarif.test.ts, autonomy/lib/secret-scan.sh | MEDIUM | red: `cd loki-ts && bun test tests/commands/export_sarif.test.ts -t "extra token formats"` fails (0 findings); green: passes with label-only output and `bash tests/test-secret-scan.sh` exits 0 | released v11.17.46 | Gap: export_sarif.ts:12-24 lists 12 formats; none cover those four; parity with secret-scan.sh required |
+| TEN-DEPLOY-19 | fix: `loki start --deploy --health-url X --domain Y` accepts any string; validate --health-url is http or https with a host and --domain is a bare hostname, exit 2 with one line naming the flag, before any run work; chain after TEN-COST-41 | loki-ts/src/commands/start.ts, loki-ts/tests/commands/start.test.ts | MEDIUM | red: `cd loki-ts && bun test tests/commands/start.test.ts -t "deploy flag validation"` fails (exit 0); green: passes, valid URLs unchanged | released v11.17.46 | Gap: start.ts:158 lists the deploy flags as value flags with no validation; verify on the Bun route and the bash route; chain after TEN-COST-41 |
+| TEN-DEPLOY-20 | fix: `loki start --deploy --env-file ./missing.env` is accepted and fails only after the build; check the file exists and is readable up front and exit 2; chain after TEN-DEPLOY-19 | loki-ts/src/commands/start.ts, loki-ts/tests/commands/start.test.ts | LOW | red: `cd loki-ts && bun test tests/commands/start.test.ts -t "env-file missing"` fails (exit 0); green: passes, existing file unchanged | released v11.17.46 | Gap: start.ts:158 --env-file is passed through unchecked; chain after TEN-DEPLOY-19 |
+| TEN-ADOPTION-22 | enhancement: `loki provider list` marks each provider CLI as installed or missing and prints the install command for a missing one (reuse the table doctor.ts providerInstall) | loki-ts/src/commands/provider.ts, loki-ts/tests/commands/provider.test.ts | LOW | red: `cd loki-ts && bun test tests/commands/provider.test.ts -t "list shows install hint"` fails; green: passes with a stubbed which() and `bunx tsc --noEmit` exits 0 | released v11.17.46 | Gap: check provider.ts list output first; doctor.ts:1263 holds the only install-hint table, move it to a shared export rather than copying |
+| TEN-ADOPTION-23 | fix: `loki completion fish` or an unknown shell must print the supported shells and exit 2; `loki completion` with no shell prints usage; check current behaviour first and drop if already correct | loki-ts/src/commands/completion.ts, loki-ts/tests/commands/cli_help_routes.test.ts | LOW | red: `cd loki-ts && bun test tests/commands/cli_help_routes.test.ts -t "completion unknown shell"` fails; green: passes, bash and zsh output unchanged | rejected (already correct on read, dropped per row note) | Gap: completion.ts has no dedicated test file; extend cli_help_routes.test.ts rather than add one |
+| TEN-GATES-23 | enhancement: record each quality gate's wall-clock duration in the gate result so `loki status` and the receipt can show which gate dominates a slow run; additive field only, old readers ignore it | loki-ts/src/runner/quality_gates.ts, loki-ts/tests/runner/quality_gates.test.ts | MEDIUM | red: `cd loki-ts && bun test tests/runner/quality_gates.test.ts -t "gate duration recorded"` fails (no duration_ms); green: passes and `bun test tests/runner/quality_gates_inconclusive.test.ts` exits 0 | released v11.17.46 | Gap: grep duration in quality_gates.ts first; if present, narrow the row to surfacing it in status |
+| TEN-GATES-24 | fix: `loki verify-pr` on a PR with no receipt must exit with a code distinct from "receipt present, verdict fail" and say which it is; check current exit codes first and drop if already distinct | loki-ts/src/commands/verify_pr.ts, loki-ts/tests/commands/verify_pr.test.ts | MEDIUM | red: `cd loki-ts && bun test tests/commands/verify_pr.test.ts -t "no receipt exit code"` fails; green: passes, existing verdict exits unchanged | released v11.17.46 | Gap: a CI caller cannot tell missing proof from failed proof if both exit 1 |
+| TEN-SPEED-12 | enhancement: cache the repo profile (LOKI_REPO_PROFILE=1 path) keyed on HEAD sha and dirty flag so a resumed run does not rescan the tree | loki-ts/src/runner/repo_profile.ts, loki-ts/tests/runner/autonomous.test.ts | MEDIUM | red: `cd loki-ts && bun test tests/runner/autonomous.test.ts -t "repo profile cache hit"` fails (scan runs twice); green: passes, cache invalidates on a new commit | released v11.17.46 | Gap: autonomous.ts:633 calls the profiler each start; read repo_profile.ts first and drop if a cache exists |
+| TEN-QUALITY-26 | fix: `loki wiki show <bad-section>` should list the valid sections (architecture, modules, data-flow) in the error and exit 2; extend the wiki test | loki-ts/src/commands/wiki.ts, loki-ts/tests/commands/wiki.test.ts | LOW | red: `cd loki-ts && bun test tests/commands/wiki.test.ts -t "bad section lists valid"` fails; green: passes, valid sections unchanged | released v11.17.46 | Gap: wiki.ts:51 prints the section list only in the usage branch; check the unknown-section branch first |
+| TEN-UX-29 | fix: `loki report kpis --since` with no value, or followed by another flag, reports an empty invalid value and consumes the next flag; print "--since requires a value" and exit 1 without swallowing the next token; chain after TEN-SPEED-11 | loki-ts/src/commands/kpis.ts, loki-ts/tests/commands/kpis.test.ts | LOW | red: `cd loki-ts && bun test tests/commands/kpis.test.ts -t "since missing value"` fails (message names an empty value); green: passes, `--since 7d` and `--since=7d` unchanged | released v11.17.46 | Gap: kpis.ts:87 `args[++i] ?? ""` eats the next token; chain after TEN-SPEED-11 |
 | TEN-COST-35 | fix: `loki start --budget-limit=5` (and --provider=, --session-model=, --prd=, --brief=) is accepted by the flag validator then silently ignored, so the default $100 cap and default provider apply; read the `=` form everywhere argVal reads a flag | loki-ts/src/commands/start.ts, loki-ts/tests/commands/start.test.ts | MEDIUM | red: bun test tests/commands/start.test.ts -t "equals form" fails (cap stays default); green: same test passes and `cd loki-ts && bunx tsc --noEmit` exits 0 | released v11.17.44 | Gap: start.ts:23 argVal matches only exact args via indexOf; start.ts:212 validator splits on "=" so the form is accepted; only --cost and --attempts parse "=" |
 | TEN-COST-36 | fix: `loki start --budget-limit abc`, `--max-iterations -1`, `--budget-limit 0x` and a trailing value flag with no value are silently dropped so the default cap applies; print one error line naming the flag and exit 2 | loki-ts/src/commands/start.ts, loki-ts/tests/commands/start.test.ts | MEDIUM | red: bun test tests/commands/start.test.ts -t "invalid numeric" fails (exit 0, no message); green: passes, valid values unchanged | released v11.17.44 | Gap: start.ts:123 posNum returns undefined for non-numeric, zero or negative with no diagnostic; chain after TEN-COST-35 |
 | TEN-STABILITY-21 | fix: control `--port` with no value or a non-numeric value silently falls back to the default port; reject with a usage line and exit 2 | loki-ts/src/commands/control.ts, loki-ts/tests/commands/control.test.ts | LOW | red: bun test tests/commands/control.test.ts -t "port without value" fails; green: passes and existing control tests stay green | released v11.17.44 | Gap: control.ts:33 flag() returns args[i+1] unchecked (undefined or the next flag) and callers fall through to the default |

package/docs/v10/FAILURE-CLASSES.md

@@ -1089,3 +1089,11 @@ L0 review rule (ENGINE-LAWS.md L0): a fix that adds an `if` or a regex about the
 - Siblings: swept the other newest-window invocations (proof list --json, proof share --dry-run, queue add, start --help, status --probe/--json); all already pass. completions/_loki carries no per-flag lists for report or undo; its undo description now names --list.
 - Mechanism: autonomy/loki help text lists both flags; completions/loki.bash gains report and undo cases. The drift test already guards both.
 - Fixture: tests/test-help-changelog-drift.sh (22 passed, 0 failed); removing the `undo --list` help line turns it red.
+
+## FC-TEN-UX-26 Bash commands whose default case arm printed help and exited 0 on an unknown subcommand
+
+- User-visible vs raw: user-visible. `loki config frobnicate` and `loki api frobnicate` printed usage and returned 0, so scripts could not detect a typo (same class as `loki provider`, TEN-UX-25).
+- Law broken: an unknown subcommand must fail non-zero with a one-line error; help stays reachable via help, --help and -h.
+- Siblings: swept 24 bash commands with `<cmd> frobnicate`; only config and api (fixed here) returned 0, plus `loki voice`, a stub with no subcommands that prints a planned-feature notice (left as is).
+- Mechanism: explicit help|--help|-h arm, default arm prints `loki <cmd>: unknown subcommand` to stderr and returns 2.
+- Fixture: tests/test-help-discoverability.sh; restoring the old default arm turns the frobnicate assertions red.

package/docs/v10/PROGRESS.md

@@ -2512,3 +2512,9 @@ v11.17.21 published (Release success on 462fbc40a; npm latest 11.17.21, next 11.
 
 ## 2026-10-17T10:10Z (CoS) v11.17.44
 - Released waves AL (30 slices, 21 chains, all APPROVE) and AK (6 slices). Combined main: tsc rc 0; bun 1233/0 and 528/0; help-changelog-drift rc 0; secure-scan rc 0.
+
+## 2026-10-17T10:17Z (CoS) v11.17.45
+- Released TEN-DEPLOY-03 (wave AH fix round, APPROVE fe1026bf1). Board refilled with 30 TEN rows for wave AM (fbde018b2).
+
+## 2026-10-17T11:21Z (CoS) v11.17.46
+- Released wave AM: 28 slices APPROVE across 19 chains; TEN-STABILITY-29 and TEN-ADOPTION-23 dropped as already fixed. Combined main: tsc rc 0; bun 593/0 and 449/0; help-changelog-drift, help-discoverability, secret-scan rc 0.