loki-mode 11.17.45 → 11.17.47

package/completions/_loki

@@ -32,6 +32,12 @@ function _loki {
                 export)
                     _arguments '--sarif[Write findings.sarif for a run]'
                     ;;
+                control)
+                    _arguments \
+                        '--port[Port for the control plane server]:port:' \
+                        '--json[Output as JSON]' \
+                        '1:subcommand:(serve status help)'
+                    ;;
                 config)
                     _loki_config
                     ;;

package/completions/loki.bash

@@ -238,6 +238,14 @@ _loki_completion() {
             fi
             ;;
 
+        control)
+            if [[ "$cur" == -* ]]; then
+                COMPREPLY=( $(compgen -W "--port --json --help" -- "$cur") )
+                return 0
+            fi
+            COMPREPLY=( $(compgen -W "serve status help" -- "$cur") )
+            ;;
+
         plan)
             if [[ "$cur" == -* ]]; then
                 COMPREPLY=( $(compgen -W "--json --verbose --spec --requirements --help" -- "$cur") )

package/dashboard/__init__.py

@@ -7,6 +7,6 @@ Modules:
     control: Session control helpers (status, atomic writes, origin check)
 """
 
-__version__ = "11.17.45"
+__version__ = "11.17.47"
 
 __all__ = ["__version__"]

package/docs/CLI-REFERENCE.md

@@ -1,6 +1,6 @@
 # CLI reference
 
-Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.17.45. Do not edit by hand.
+Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.17.47. Do not edit by hand.
 Hidden and legacy-only commands are omitted; see `docs/v10/CLI-MODERN.md` for the full inventory.
 
 | Command | Description |

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 Loki Mode, by [Autonomi](https://www.autonomi.dev/), turns a spec or an issue into a verified pull request with a receipt you can check. This page covers installing it, a first run, and the options around it.
 
-**Version:** v11.17.45
+**Version:** v11.17.47
 
 **Engine note:** `loki start` is the primary command. `loki start`, `loki "<task>"`, `loki owner/repo#N` and `loki quick` all run the Loki 10 engine, whatever the flag order or input form (PRD file, issue ref, task or one-word brief). The previous loop runs only on `--engine legacy`, `LOKI_ENGINE=legacy`, or for one call when a flag Loki 10 cannot honor is present. See the [user guide](v10/GUIDE.md) and the [5-minute quickstart](QUICKSTART.md).
 

package/docs/v10/BOARD.md

@@ -418,7 +418,7 @@ set is declared to avoid overlap with those and with each other.
 | Q17-04 | FC-68 siblings: `assert-wall-executed.sh` also fails the release smoke when an expected non-Wall check (lint, mutation proof, cross review) is missing from the receipt `checks[]` without a failing exit. | scripts/assert-wall-executed.sh, scripts/real-run.sh (SC_* knob in the existing scenario parser), tests/test-real-run-guards.sh | HIGH | `bash tests/test-real-run-guards.sh`; `bash -n scripts/assert-wall-executed.sh scripts/real-run.sh` | parked@2026-10-17T00:20Z | D98 park after HIGH r2 BLOCK on b617d3e1f: B1 fixed, B2 not; SC_EXPECT_CHECKS=node is met by the Wall check node:loki_wall_* alone (verify.ts:277, wall.ts:22), so a dropped non-Wall test still passes. Re-sliced as Q17-04b. r2 fix b617d3e1f (wall guard 36/0); HIGH r2 review running. FAILURE-CLASSES.md:643 FC-68 "Siblings: any other check a receipt could lose without a failing exit ... is not yet counted". Release gate, so HIGH. Needs red-then-green: a receipt with the lint check dropped must go red. |
 | Q17-04b | Q17-04 re-slice: real-run scenarios pin the exact non-Wall check names (trivial-sum node:sum.test.js, two-bug node:lib.test.js) on top of b617d3e1f, plus a guard test where only the Wall test is a node check and token node:sum.test.js fails | tests/real-run/scenarios/trivial-sum.sh, tests/real-run/scenarios/two-bug.sh, tests/test-wall-executed-guard.sh | MEDIUM | `bash tests/test-wall-executed-guard.sh`; `bash tests/test-sigpipe-guard.sh` | released@2026-10-17T03:50Z | TL APPROVE e1bdde7d3 (bare-node mutation caught by structural check); merged with Q17-04 commits. Built e1bdde7d3 (wall guard 0 FAIL, shellcheck rc 0, sigpipe 4/0); TL review running. Source: Q17-04 HIGH r2 finding, fix option 1. Base b617d3e1f (branch q17-04). Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
 | Q17-05 | Shipper sends the sha256 of each event line before redaction, so the Control Plane can tell a genuine redaction from a downgrade (FAILED edited to PARTIAL plus a planted [REDACTED]). Today such a log reads only "(unattested)" or UNVERIFIED. | loki-ts/src/util/redact.ts, packages/control-plane/src/server/integrity.ts, packages/control-plane/test/integrity.test.ts | HIGH | `cd packages/control-plane && bun test test/integrity.test.ts`; `cd loki-ts && bun test tests/util/redact.test.ts` | rejected@2026-10-17T00:38Z | HIGH r1 BLOCK on 36524784d, design unsound (D12): client-supplied pre-redaction chain is trusted, so copying log.sealed events_sha256 makes a FAILED-to-VERIFIED forgery read attested and sig-checked; chain not bound to run id (cross-run replay). Not patchable in place; re-sliced as Q17-05b (engine-side redaction). Branch q17-05 kept. Built 36524784d (control-plane integrity 61/0, loki-ts util 286/0); HIGH r1 review running. FAILURE-CLASSES.md:140 deferred sibling of EL-FC08b. Delivered accuracy and Seal. A forged downgrade must read TAMPERED. Test file paths are the nearest existing ones; the engineer confirms by `ls`. |
-| Q17-05b | EL-FC08b at source: the engine redacts secrets in event data before it hashes the log and signs the seal, so an honest run holding a token ships byte-identical lines that the Control Plane hashes itself and reads VERIFIED; the shipper redaction becomes a no-op on already-redacted lines, and any later edit (including a planted [REDACTED]) reads TAMPERED. No client-supplied hash is ever trusted. | loki-ts/src/util/redact.ts, the engine event-log writer that computes events_sha256 (locate via git grep events_sha256 loki-ts/src), packages/control-plane/test/integrity.test.ts | HIGH | `cd packages/control-plane && bun test test/server/`; `cd loki-ts && bun test tests/util/ tests/engine10/` | ready@2026-10-17T00:38Z | Source: Q17-05 HIGH r1 (FAILURE-CLASSES.md:139-140). Architect pass first: confirm the writer call site and the parity with run.sh before building; forgery fixtures A-D from the Q17-05 review must read TAMPERED or UNVERIFIED, never VERIFIED. |
+| Q17-05b | EL-FC08b at source: the engine redacts secrets in event data before it hashes the log and signs the seal, so an honest run holding a token ships byte-identical lines that the Control Plane hashes itself and reads VERIFIED; the shipper redaction becomes a no-op on already-redacted lines, and any later edit (including a planted [REDACTED]) reads TAMPERED. No client-supplied hash is ever trusted. | loki-ts/src/util/redact.ts, the engine event-log writer that computes events_sha256 (locate via git grep events_sha256 loki-ts/src), packages/control-plane/test/integrity.test.ts | HIGH | `cd packages/control-plane && bun test test/server/`; `cd loki-ts && bun test tests/util/ tests/engine10/` | released v11.17.47 | Source: Q17-05 HIGH r1 (FAILURE-CLASSES.md:139-140). Architect pass first: confirm the writer call site and the parity with run.sh before building; forgery fixtures A-D from the Q17-05 review must read TAMPERED or UNVERIFIED, never VERIFIED. |
 | Q18-01 | FC-25c(b) remainder: control-plane shipper gitOrigin runs raw execFileSync("git") with a real-token env; convert to safeGit and make the raw-spawn guard scan packages/control-plane | packages/control-plane/src/shipper/discover.ts, loki-ts/tests/util/fc25_raw_spawn_guard.test.ts | HIGH | `cd loki-ts && bun test tests/util/fc25_raw_spawn_guard.test.ts tests/util/fc25_safe_git.test.ts`; `cd packages/control-plane && bun test`; `cd loki-ts && bunx tsc --noEmit` | released@2026-10-17T03:50Z | HIGH APPROVE dbb93205a (bun test util 289 pass, 6/6 guard mutations caught); follow-up: comment integrations.ts:85 key-path split Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
 | Q18-02 | FC-25c(a): allowToken keeps repo-local core.sshCommand, remote.*.uploadpack/receivepack and repo-scope credential.helper; pin them off while the user global helper still works | loki-ts/src/util/safe_git.ts, loki-ts/tests/util/fc25_safe_git.test.ts | HIGH | `cd loki-ts && bun test tests/util/fc25_safe_git.test.ts`; `bash tests/moat/p9-rule-of-two.sh`; `cd loki-ts && bunx tsc --noEmit` | released@2026-10-17T03:50Z | HIGH r1 APPROVE 730f27460: tests/util 289/0 rc=0, p9 4 PASS, 2 mutations each fail 1 test; merged 38b6b4b13, dist 3a1c1255c. Reviewer ran no hostile-repo probes, so those go to Q18-02b. Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
 | Q18-02b | FC-25c(b): run the hostile-repo probes against safe_git allowToken and close any that leak: credential.helper with a leading !, credential.<url>.helper (including = in the url), include.path and includeIf, insteadOf to ext:: or file::, http.proxy and TLS keys, core.askPass, GIT_CONFIG_COUNT, extensions.worktreeConfig | loki-ts/src/util/safe_git.ts, loki-ts/tests/util/fc25_safe_git.test.ts | HIGH | `cd loki-ts && bun test tests/util/`; `bash tests/moat/p9-rule-of-two.sh` | released@2026-10-17T03:50Z | merged e0365685b (HIGH r2 APPROVE 9482dbe62) Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
@@ -434,7 +434,7 @@ set is declared to avoid overlap with those and with each other.
 | Q18-11 | group.started/group.unit events and createGroupRenderer (D61-14) have no producer or caller; emit from backlog launcher callbacks and attach the renderer to group runs | loki-ts/src/features/speed/group_grid.ts, loki-ts/src/features/speed/group_output.ts, loki-ts/tests/engine10/output_group.test.ts | MEDIUM | `cd loki-ts && bun test tests/engine10/output_group.test.ts tests/features/speed/group_output.test.ts`; `cd loki-ts && bunx tsc --noEmit` | released@2026-10-17T02:57Z | merge 326cf3402; TL APPROVE cb3e92fca (real-spawn onOut tap untested, follow-up). PO refill 2026-10-17, grep-checked not shipped: Architect confirms file set apart from Q18-08 first; else hold until Q18-08 merges. v11.17.13 npm next 11.17.13 |
 | Q18-03c | P9 allowToken guard residuals from Q18-03b r2: named re-export with as (export { safeGitEnv as x } from safe_git), indirect calls (const f = safeGitEnv; .apply; spread args), and a shadowed args default in a pinned file all give F=0 | tests/moat/p9-rule-of-two.sh | HIGH | bash tests/moat/run.sh | parked@2026-10-17T01:55Z | Shipped via Q18-03d merge 98611351a. D98 2 rounds used: r2 head 2b3421402 closes all r1 bypasses but its comment strip misses regex literals and template nesting, a regression vs main; continued as Q18-03d on top of 2b3421402. r1 BLOCK (HIGH), r2 fix in progress. Source: Q18-03b HIGH r2 notes 1, 2 and 4. Obfuscated key escapes (unicode escapes, computed concatenation) cannot be closed by grep; record as accepted residual. |
 | Q18-03d | P9 allowToken guard: comma, import and indirect scans fail if either raw or comment-stripped text trips them (strip misses regex literals and template nesting); add regex-literal, template-nesting, barrel-of-barrel and strip-only positive controls | tests/moat/p9-rule-of-two.sh | HIGH | bash tests/moat/run.sh | released@2026-10-17T02:57Z | merge 98611351a (includes Q18-03c r2 commits); HIGH APPROVE ec6e0adfd, 4 mutations red, P9 PROVEN. Built on Q18-03c r2 head 2b3421402 (branch q18-03c). HIGH r2 repro payloads: const re = /\/*/; safeGitEnv(process.env, true); // */ and const re = /"/; then const u = "//"; safeGitEnv(...). Fresh review rounds. v11.17.13 npm next 11.17.13 |
-| Q18-03e | P9 allowToken guard: strip helper treats regex literals as opaque (or a regex-aware third pass), so a regex plus a quote inside a comment cannot hide a call from both passes | tests/moat/p9-rule-of-two.sh | HIGH | bash tests/moat/run.sh | ready@2026-10-17T02:14Z | Pre-existing gap found by Q18-03d HIGH review (also on main): after the safe_git import, const re = /\/*/; safeGitEnv(process.env /* ' */, true); is MISSED and runs under node. Add it as a positive control. |
+| Q18-03e | P9 allowToken guard: strip helper treats regex literals as opaque (or a regex-aware third pass), so a regex plus a quote inside a comment cannot hide a call from both passes | tests/moat/p9-rule-of-two.sh | HIGH | bash tests/moat/run.sh | blocked (3 BLOCK rounds, last 83a36e8bc in wf_7226ee62-77f-5: P9 slash heuristic misreads o.in / 2 as a regex opener; reslice to replace the bash regex scan with a real JS tokenizer) | Pre-existing gap found by Q18-03d HIGH review (also on main): after the safe_git import, const re = /\/*/; safeGitEnv(process.env /* ' */, true); is MISSED and runs under node. Add it as a positive control. |
 | Q18-05b | AI-BOM filter gaps: secret filter misses github_pat_, glpat-, AIza, npm_, hf_, ASIA, sk_live_ and is case-sensitive; SAFE_NAME drops provider/model ids with one interior slash; hooks.sealed receives the live receipt (pass a frozen clone) | loki-ts/src/engine10/ai_bom.ts, loki-ts/src/engine10/stages/seal.ts, loki-ts/tests/engine10/ai_bom.test.ts | MEDIUM | cd loki-ts && bun test tests/engine10/ai_bom.test.ts tests/engine10/seal.test.ts | released@2026-10-17T02:57Z | merge ae90c2875 dist 0eb48d905; TL APPROVE 82058ff97 (102 pass, 4 mutations red). Test file is tests/features/ai_bom.test.ts. Source: Q18-05 HIGH review notes. Keep engine10 core net zero. v11.17.13 npm next 11.17.13 |
 | COST-WALL-f | Partial cost read as complete outside benchmarks: trust_trajectory cost_per_accepted_usd ignores cost.cost_partial; check cost-summary.py and proof-generator.py the same way, routing through one partial check | autonomy/lib/trust_trajectory.py, autonomy/lib/cost-summary.py, autonomy/lib/proof-generator.py, tests/test_efficiency_cost_availability.py | HIGH | python3 -m pytest tests/test_efficiency_cost_availability.py -q | released@2026-10-17T02:57Z | merge 3d0587f4f dist 7919f31ca; HIGH r2 APPROVE ef9979ad8 (53 pytest, 11 cost-cli, 33 bun pass; 5 of 6 mutations red). Follow-ups: template costIsPartial JS harness, dashboard series partial marker, cost-summary Avg/iter label. r1 BLOCK (HIGH), r2 fix in progress. Source: COST-WALL-e HIGH r1 note 4 (FC-COST-PARTIAL-b siblings). v11.17.13 npm next 11.17.13 |
 | Q17-06 | COST-6 offline half: `attribution.py` dry-run prints a cost-per-accepted-task table with the ratio against raw Claude Code and against the 0.5x target, using existing result files, so the paid `--execute` run only has to plug in numbers. | benchmarks/bench/attribution.py, benchmarks/bench/test_attribution.py | MEDIUM | `python3 -I benchmarks/bench/attribution.py --dry-run`; `python3 -m pytest benchmarks/bench -k attribution -q` | released@2026-10-17T03:50Z | Merged fe3a4e252 (6b9bd03d6; line-828 mutation caught: 1 failed 93 passed, restored 94 passed). COST-6 is parked as a paid eval needing a spend go. This re-slice needs no spend. Cost audit 2026-10-16: best measured run is 0.68x of raw, none reaches 0.5x. Report both floors (attribution.py:778). Confirm the test file name by `ls`. Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
@@ -1136,7 +1136,7 @@ Source: ~/git/autonomi-dev/research/2026-09-30-adoption/SWARM-PROMPT-ADOPTION.md
 | TEN-QUALITY-14 | enhancement: Wall authoring prompt requires one negative-case assertion (rejects bad input or fails before the fix) per acceptance line | loki-ts/src/engine10/stages/wall.ts, loki-ts/tests/engine10/wall.test.ts | MEDIUM | red: prompt has no negative-case rule; green: rule present, prompt size growth under 400 chars, existing wall tests green; cd loki-ts && bunx tsc --noEmit && bun test tests/engine10/wall.test.ts | released v11.17.38 | goal: stronger Wall checks reject wrong implementations; wall.ts line budget applies (shrink-or-flat) |
 | TEN-QUALITY-15 | fix: fix rounds stop retrying the same model when the failing test set is identical two rounds in a row and escalate once | loki-ts/src/engine10/stages/fix.ts, loki-ts/tests/engine10/fix.test.ts | MEDIUM | red: identical failure signature loops on the same model to the round cap; green: escalates once then stops with a stalled reason; cd loki-ts && bunx tsc --noEmit && bun test tests/engine10/fix.test.ts | released v11.17.38 | goal: stop wasted fix spend; grep stallClimb in unit_model.ts and reuse it, do not duplicate |
 | TEN-GATES-14 | feature: loki verify --explain lists each gate with exogenous or agent-influenced and the evidence it read | loki-ts/src/engine10/verify_cmd.ts, loki-ts/tests/engine10/verify_cmd.test.ts | HIGH | red: --explain is an unknown flag; green: one line per gate, exit code unchanged, --json carries the same fields; cd loki-ts && bunx tsc --noEmit && bun test tests/engine10/verify_cmd.test.ts | released v11.17.37 | goal: make the moat legible to buyers; read-only output, no verdict change |
-| TEN-GATES-15 | enhancement: Seal receipt records the seeded-defect corpus version and catch rate used for the ablation gate | loki-ts/src/engine10/stages/seal.ts, loki-ts/tests/engine10/seal_verify_roundtrip.test.ts | HIGH | red: receipt lacks corpus id; green: corpus version and rate in the signed payload and loki verify rejects a tampered value; cd loki-ts && bunx tsc --noEmit && bun test tests/engine10/seal_verify_roundtrip.test.ts | ready@2026-10-17T07:00Z | goal: tie the load-bearing claim to evidence; builds on TEN-GATES-12/13 (released) |
+| TEN-GATES-15 | enhancement: Seal receipt records the seeded-defect corpus version and catch rate used for the ablation gate | loki-ts/src/engine10/stages/seal.ts, loki-ts/tests/engine10/seal_verify_roundtrip.test.ts | HIGH | red: receipt lacks corpus id; green: corpus version and rate in the signed payload and loki verify rejects a tampered value; cd loki-ts && bunx tsc --noEmit && bun test tests/engine10/seal_verify_roundtrip.test.ts | released v11.17.47 | goal: tie the load-bearing claim to evidence; builds on TEN-GATES-12/13 (released) |
 | TEN-GATES-16 | fix: loki verify reports DRIFT, not OK, when HEAD moved after the seal and the changed paths overlap the sealed diff | loki-ts/src/util/seal_drift.ts, loki-ts/tests/engine10/log_seal.test.ts | HIGH | red: sealed run then an amend on a sealed path still verifies OK; green: DRIFT with the path named, unrelated commits keep OK; cd loki-ts && bunx tsc --noEmit && bun test tests/engine10/log_seal.test.ts | released v11.17.38 | goal: a seal must not vouch for code it did not see; read seal_drift.ts first and extend it |
 | TEN-UX-13 | feature: loki undo --dry-run prints the diffstat it would revert and changes nothing | loki-ts/src/commands/undo.ts, loki-ts/tests/commands/undo.test.ts | LOW | red: --dry-run unknown or applies the revert; green: diffstat printed, tree and HEAD unchanged, exit 0; cd loki-ts && bunx tsc --noEmit && bun test tests/commands/undo.test.ts | released v11.17.37 | goal: safe undo; new test file because no existing test owns undo.ts (rollback.test.ts covers rollback.ts only) |
 | TEN-UX-14 | enhancement: loki queue list shows age and status columns and a count footer | loki-ts/src/commands/queue.ts, loki-ts/tests/commands/queue.test.ts | LOW | red: list prints ids only; green: id, age, status columns and 'N queued' footer, empty queue prints a next step; cd loki-ts && bunx tsc --noEmit && bun test tests/commands/queue.test.ts | released v11.17.38 | goal: queue is inspectable at a glance |
@@ -1182,36 +1182,66 @@ Source: ~/git/autonomi-dev/research/2026-09-30-adoption/SWARM-PROMPT-ADOPTION.md
 | TEN-STABILITY-18 | P0 fix-forward: nightly 39016259458 reds still red on main e32ee1b5d (pr_body_golden not-recorded producer util/check_result.ts; sizing wall brief 726 vs cap 616; router_optout_golden wall stage haiku for development; verify.test uv resolution CI-only via Bun.which PATH; test-sigpipe-guard 1737 vs ceiling 1728; help-changelog-drift loki verify --require-exogenous; test-ui-bare-loki exact-match on new control lines; test-local-ci-gitleaks scope) | the failing tests, loki-ts/src/util/check_result.ts, loki-ts/src/engine10/stages/wall.ts, loki-ts/src/engine10/stages/verify.ts, verify help and completions, scripts/local-ci.sh, docs/v10/FAILURE-CLASSES.md | MEDIUM | red: each named test fails on e32ee1b5d; green: cd loki-ts && bun test tests/engine10/pr_body_golden.test.ts tests/engine10/sizing.test.ts tests/engine10/router_optout_golden.test.ts tests/engine10/verify.test.ts tests/util; bash tests/test-sigpipe-guard.sh; bash tests/test-help-changelog-drift.sh; bash tests/test-ui-bare-loki.sh; bash tests/test-local-ci-gitleaks.sh | released v11.17.42 | Diagnosis 2026-10-17 by nightly diag agent; one FAILURE-CLASSES row per class |
 | TEN-STABILITY-19 | P0 fix-forward: moat P8.ablation-dead-code-not-sealed positive control headline VERIFIED WITH GAPS (expected VERIFIED) and first-run-gate --stub FAILED with dirty tracked tree M sum.js at intake.ts:61 | tests/moat/p8-*.sh or the ablation producer, scripts/first-run-gate.sh, loki-ts/src/engine10/stages/intake.ts only if the honest fix is there | HIGH | red: bash tests/moat/run.sh prints moat suite: FAIL (1 rule failure(s)); bash scripts/first-run-gate.sh --stub fails 7 assertions; green: both exit 0 | released v11.17.42 | Diagnosis 2026-10-17; never weaken a moat assertion to pass |
 | TEN-STABILITY-20 | Fix help-changelog-drift red after v11.17.42: list report kpis --since and undo --list in Bun help, autonomy/loki help and both completions | completions/loki.bash, completions/_loki, loki-ts/src help, autonomy/loki, docs/v10/FAILURE-CLASSES.md | LOW | merged 3c4e2fcd9 | released v11.17.43 |
-| TEN-STABILITY-26 | fix: `loki control backfill --repo` with no value silently falls back to the first positional or cwd and ships that dir; fail with one error line naming --repo and exit 2 (same class as TEN-STABILITY-21) | loki-ts/src/commands/control.ts, loki-ts/tests/commands/control.test.ts | LOW | red: `cd loki-ts && bun test tests/commands/control.test.ts -t "backfill repo missing value"` fails (exit 0, ingests cwd); green: passes, `--repo DIR` and bare DIR unchanged | ready | Gap: control.ts:234 `flag(rest, "--repo") ?? rest.find(...) ?? cwd`; flag() at :33 returns undefined for a trailing flag, missingValue() at :38 exists but is not applied here |
-| TEN-UX-24 | fix: the second `control` help block in autonomy/loki (cmd_control, ~line 34902) lists only serve, backfill, status; add prune, stop and `status --json` so it matches the Bun usage in control.ts | autonomy/loki, tests/test-help-discoverability.sh | LOW | red: `bash tests/test-help-discoverability.sh` fails on a new assertion that bash `loki control --help` names prune, stop and status --json; green: passes and `bash tests/test-help-changelog-drift.sh` still exits 0 | ready | Gap: control.ts:22 documents prune --repo/--before; the bash fallback help (LOKI_LEGACY_BASH) omits it |
-| TEN-UX-25 | fix: bash `cmd_provider` default arm (autonomy/loki:7488) prints help and returns 0 for an unknown subcommand; return 2 with one "unknown subcommand" line (TS side fixed in TEN-UX-20); chain after TEN-UX-24 | autonomy/loki, tests/test-help-discoverability.sh | LOW | red: `bash tests/test-help-discoverability.sh` fails on `loki provider frobnicate` expecting exit 2; green: passes, `loki provider` and `loki provider --help` still exit 0 | ready | Gap: the `*)` arm at autonomy/loki ~7517 echoes the help block with no return code; chain after TEN-UX-24 |
-| TEN-UX-26 | fix: sibling sweep of bash commands whose default arm prints help and exits 0 on an unknown subcommand (cmd_config ~14144 and cmd_api ~15932 are the first candidates; confirm each with a probe, skip any that already fail non-zero); make each exit 2 with an "unknown subcommand" line; chain after TEN-UX-25 | autonomy/loki, tests/test-help-discoverability.sh | LOW | red: `bash tests/test-help-discoverability.sh` fails on `loki config frobnicate` and `loki api frobnicate` expecting exit 2; green: passes, bare and --help forms still exit 0 | ready | Gap: FAILURE-CLASSES row required (siblings exist); chain after TEN-UX-25 |
-| TEN-UX-27 | fix: `loki doctor --quiet` writes `Install:` hint lines to stderr while the WARN/FAIL row goes to stdout, so the hint prints detached from its row; write each hint directly under its row on the same stream | loki-ts/src/commands/doctor.ts, loki-ts/tests/commands/doctor.test.ts | LOW | red: `cd loki-ts && bun test tests/commands/doctor.test.ts -t "install hint follows its row"` fails (hint absent from stdout); green: passes and `bunx tsc --noEmit` exits 0 | ready | Gap: doctor.ts:1276 `process.stderr.write(... Install: ...)` after `process.stdout.write(formatToolLine(c))` at :1274 |
-| TEN-QUALITY-22 | test: pin the doctor disk text-mode "on <name> volume" label (home, cwd, tmp) so the low-volume name cannot regress; chain after TEN-UX-27 | loki-ts/src/commands/doctor.ts, loki-ts/tests/commands/doctor.test.ts | LOW | red: mutate lowestVolume to return null low_volume and `cd loki-ts && bun test tests/commands/doctor.test.ts -t "disk text volume label"` fails; green: passes unmutated | ready | Gap: doctor.test.ts:161 covers the JSON low_volume only; no test renders the text line; chain after TEN-UX-27 |
-| TEN-SPEED-10 | enhancement: `loki doctor --json` (buildDoctorJson) awaits checkSentrux, checkMemoryHealth and requirementsSection one after another; run them with Promise.all and keep output byte-identical; chain after TEN-QUALITY-22 | loki-ts/src/commands/doctor.ts, loki-ts/tests/commands/doctor.test.ts | MEDIUM | red: `cd loki-ts && bun test tests/commands/doctor.test.ts -t "json checks run concurrently"` fails (elapsed ~ sum of stubbed 200ms probes); green: passes and `bun test tests/commands/doctor_router.test.ts tests/commands/doctor_count.test.ts` exit 0 | ready | Gap: doctor.ts:940-946 serial awaits; the text path already batches runAllToolChecks; chain after TEN-QUALITY-22 |
-| TEN-QUALITY-23 | test: help-changelog-drift guards exact completion cases; assert every `loki` subcommand and flag named in CHANGELOG appears as a literal case in completions/loki.bash and completions/_loki so a flag typo fails | tests/test-help-changelog-drift.sh, completions/loki.bash, completions/_loki | LOW | red: introduce a typo `--sinse` in completions/loki.bash and `bash tests/test-help-changelog-drift.sh` must exit 1 naming it; green: reverted typo exits 0 | ready | Gap: current test greps for substrings loosely, a misspelled flag in a different case arm still passes |
-| TEN-GATES-22 | feature: the per-run signed receipt (not only the composite) records the toolchain {bun,node,python3,git}, absent tools null, old receipts still verify (follow-up from the TEN-GATES-19 review) | loki-ts/src/util/receipt_signer.ts, loki-ts/tests/engine10/seal_group.test.ts | HIGH | red: `cd loki-ts && bun test tests/engine10/seal_group.test.ts -t "per-run receipt toolchain"` fails (no toolchain key); green: passes, `bun test tests/engine10 tests/util/receipt_bundle.test.ts` and `bunx tsc --noEmit` exit 0 | ready | Gap: collectToolchain is used only by composite_seal.ts:54; receipt_signer.ts has no toolchain reference |
-| TEN-COST-39 | fix: a malformed `.loki/metrics/budget.json` is discarded and returns null, so spend resets to zero and the cap is silently disarmed; rebuild budget_used from the efficiency records (readEfficiencyDir) and warn once | loki-ts/src/runner/budget.ts, loki-ts/tests/runner/budget.test.ts | MEDIUM | red: `cd loki-ts && bun test tests/runner/budget.test.ts -t "corrupt budget state rebuilds used"` fails (used 0); green: passes and `bun test tests/runner/autonomous_budget.test.ts` exit 0 | ready | Gap: budget.ts:305-318 returns null on parse failure and the caller treats null as no spend |
-| TEN-COST-40 | fix: `loadDefaultMaxCostUsd` silently falls back to the literal 100 when model-pricing.json is unreadable; print one stderr warning naming the file and the fallback; chain after TEN-COST-39 | loki-ts/src/runner/budget.ts, loki-ts/tests/runner/budget.test.ts | LOW | red: `cd loki-ts && bun test tests/runner/budget.test.ts -t "pricing file missing warns"` fails (no warning); green: passes, warning emitted once per process | ready | Gap: budget.ts:24-33 swallows every read error; chain after TEN-COST-39 |
-| TEN-STABILITY-27 | fix: `LOKI_E10_STALL_S=abc` or `LOKI_E10_STALL_KILL_S=-5` is silently ignored and the default applies; warn once on stderr naming the variable and the value used | loki-ts/src/runner/watchdog.ts, loki-ts/tests/runner/watchdog.test.ts | LOW | red: `cd loki-ts && bun test tests/runner/watchdog.test.ts -t "invalid stall env warns"` fails (no warning); green: passes, valid and unset values unchanged | ready | Gap: watchdog.ts:8-17 return the default with no diagnostic |
-| TEN-STABILITY-28 | fix: `loki undo <run> --bogus` ignores unknown flags and proceeds; validate against the known set (--list --plan --dry-run --json --allow-unsigned --yes --close-pr --help) and exit 2 with one line naming the flag | loki-ts/src/commands/undo.ts, loki-ts/tests/commands/undo.test.ts | MEDIUM | red: `cd loki-ts && bun test tests/commands/undo.test.ts -t "unknown flag"` fails (exit 0 or applies); green: passes, all valid combinations unchanged | ready | Gap: undo.ts:218-238 uses args.includes for each flag with no unknown-flag check; a typo such as `--dry-rn` falls through to apply |
-| TEN-STABILITY-29 | fix: `loki rollback <id> --forse` and other unknown flags are ignored (the typo drops --force silently); validate against known flags and exit 2 | loki-ts/src/commands/rollback.ts, loki-ts/tests/commands/rollback.test.ts | LOW | red: `cd loki-ts && bun test tests/commands/rollback.test.ts -t "unknown flag"` fails; green: passes, --json and --force unchanged | ready | Gap: rollback.ts:77,116,128 use rest.includes only |
-| TEN-STABILITY-30 | fix: `loki start ./prd.md` with a mistyped or missing path treats the path string as an inline brief and starts a paid run on it; when the spec looks like a path (contains / or ends in .md/.txt/.yaml/.json) and does not exist, exit 2 "PRD file not found: <path>" | loki-ts/src/commands/start.ts, loki-ts/tests/commands/start.test.ts | MEDIUM | red: `cd loki-ts && bun test tests/commands/start.test.ts -t "missing prd path"` fails (run starts); green: passes, real files and plain briefs unchanged | ready | Gap: start.ts:376 `existsSync(spec) ? readFileSync : spec` falls through to the literal string; verify the same fall-through on the --prd flag before building |
-| TEN-COST-41 | enhancement: `loki start` prints one line before the first iteration stating the effective per-run cap and where it came from (flag, env, loki.yaml, default $100) so a silent default cap is visible; skip if already printed (check first); chain after TEN-STABILITY-30 | loki-ts/src/commands/start.ts, loki-ts/tests/commands/start.test.ts | LOW | red: `cd loki-ts && bun test tests/commands/start.test.ts -t "cap source line"` fails (no line); green: passes for flag, env and default sources | ready | Gap: capNote exists in e10ext/budget_cap.ts (start.ts:425); confirm it covers the legacy default path; chain after TEN-STABILITY-30 |
-| TEN-STABILITY-31 | fix: `listCheckpoints` silently skips a checkpoint whose metadata.json is corrupt or fails validation, so it vanishes from rollback choices with no trace; collect skipped ids and warn once on stderr | loki-ts/src/runner/checkpoint.ts, loki-ts/tests/runner/checkpoint.test.ts | MEDIUM | red: `cd loki-ts && bun test tests/runner/checkpoint.test.ts -t "corrupt metadata warns"` fails (no warning); green: passes, valid listing order unchanged | ready | Gap: checkpoint.ts:414-436 readCheckpointSafe returns null in a bare catch |
-| TEN-QUALITY-25 | test: pin provider failover classification (rate limit vs outage vs killed vs clean exit) and nextProvider ordering with a fake installed() probe | loki-ts/src/runner/provider_failover.ts, loki-ts/tests/runner/provider_failover.test.ts | MEDIUM | red: mutate classifyOutage to return null for exit 137 and `cd loki-ts && bun test tests/runner/provider_failover.test.ts` fails; green: passes unmutated and `bunx tsc --noEmit` exits 0 | ready | Gap: no tests/runner file names provider_failover; new test file justified because no existing file owns it (verify with grep first) |
-| TEN-UX-28 | enhancement: `loki queue run` prints a progress line `[n/m] <ref>` before each item and the digest links each item verdict; skip if already present (check first) | loki-ts/src/commands/queue.ts, loki-ts/tests/commands/queue.test.ts | LOW | red: `cd loki-ts && bun test tests/commands/queue.test.ts -t "progress line per item"` fails; green: passes and the existing digest test still exits 0 | ready | Gap: queue.ts run loop (~line 290-320) records results only in the final digest |
-| TEN-SPEED-11 | enhancement: `loki report kpis --since 7d` should skip run directories whose newest mtime is before the cutoff instead of parsing every run, with identical output | loki-ts/src/commands/kpis.ts, loki-ts/tests/commands/kpis.test.ts | LOW | red: `cd loki-ts && bun test tests/commands/kpis.test.ts -t "since skips old runs"` fails (old run files read, counted by a spy); green: passes and output byte-identical on the fixture | ready | Gap: kpis.ts:96 computeKpis receives sinceMs; confirm it filters after reading (read computeKpis first, drop if already pruned by mtime) |
-| TEN-SECURITY-11 | fix: the SARIF secret scan misses common token formats (Hugging Face `hf_`, SendGrid `SG.`, Twilio `SK`+32 hex, Azure storage `AccountKey=`); add Tier 1 patterns that report label only, never the matched text, and mirror them in autonomy/lib/secret-scan.sh in the same change | loki-ts/src/commands/export_sarif.ts, loki-ts/tests/commands/export_sarif.test.ts, autonomy/lib/secret-scan.sh | MEDIUM | red: `cd loki-ts && bun test tests/commands/export_sarif.test.ts -t "extra token formats"` fails (0 findings); green: passes with label-only output and `bash tests/test-secret-scan.sh` exits 0 | ready | Gap: export_sarif.ts:12-24 lists 12 formats; none cover those four; parity with secret-scan.sh required |
-| TEN-DEPLOY-19 | fix: `loki start --deploy --health-url X --domain Y` accepts any string; validate --health-url is http or https with a host and --domain is a bare hostname, exit 2 with one line naming the flag, before any run work; chain after TEN-COST-41 | loki-ts/src/commands/start.ts, loki-ts/tests/commands/start.test.ts | MEDIUM | red: `cd loki-ts && bun test tests/commands/start.test.ts -t "deploy flag validation"` fails (exit 0); green: passes, valid URLs unchanged | ready | Gap: start.ts:158 lists the deploy flags as value flags with no validation; verify on the Bun route and the bash route; chain after TEN-COST-41 |
-| TEN-DEPLOY-20 | fix: `loki start --deploy --env-file ./missing.env` is accepted and fails only after the build; check the file exists and is readable up front and exit 2; chain after TEN-DEPLOY-19 | loki-ts/src/commands/start.ts, loki-ts/tests/commands/start.test.ts | LOW | red: `cd loki-ts && bun test tests/commands/start.test.ts -t "env-file missing"` fails (exit 0); green: passes, existing file unchanged | ready | Gap: start.ts:158 --env-file is passed through unchecked; chain after TEN-DEPLOY-19 |
-| TEN-ADOPTION-22 | enhancement: `loki provider list` marks each provider CLI as installed or missing and prints the install command for a missing one (reuse the table doctor.ts providerInstall) | loki-ts/src/commands/provider.ts, loki-ts/tests/commands/provider.test.ts | LOW | red: `cd loki-ts && bun test tests/commands/provider.test.ts -t "list shows install hint"` fails; green: passes with a stubbed which() and `bunx tsc --noEmit` exits 0 | ready | Gap: check provider.ts list output first; doctor.ts:1263 holds the only install-hint table, move it to a shared export rather than copying |
-| TEN-ADOPTION-23 | fix: `loki completion fish` or an unknown shell must print the supported shells and exit 2; `loki completion` with no shell prints usage; check current behaviour first and drop if already correct | loki-ts/src/commands/completion.ts, loki-ts/tests/commands/cli_help_routes.test.ts | LOW | red: `cd loki-ts && bun test tests/commands/cli_help_routes.test.ts -t "completion unknown shell"` fails; green: passes, bash and zsh output unchanged | ready | Gap: completion.ts has no dedicated test file; extend cli_help_routes.test.ts rather than add one |
-| TEN-GATES-23 | enhancement: record each quality gate's wall-clock duration in the gate result so `loki status` and the receipt can show which gate dominates a slow run; additive field only, old readers ignore it | loki-ts/src/runner/quality_gates.ts, loki-ts/tests/runner/quality_gates.test.ts | MEDIUM | red: `cd loki-ts && bun test tests/runner/quality_gates.test.ts -t "gate duration recorded"` fails (no duration_ms); green: passes and `bun test tests/runner/quality_gates_inconclusive.test.ts` exits 0 | ready | Gap: grep duration in quality_gates.ts first; if present, narrow the row to surfacing it in status |
-| TEN-GATES-24 | fix: `loki verify-pr` on a PR with no receipt must exit with a code distinct from "receipt present, verdict fail" and say which it is; check current exit codes first and drop if already distinct | loki-ts/src/commands/verify_pr.ts, loki-ts/tests/commands/verify_pr.test.ts | MEDIUM | red: `cd loki-ts && bun test tests/commands/verify_pr.test.ts -t "no receipt exit code"` fails; green: passes, existing verdict exits unchanged | ready | Gap: a CI caller cannot tell missing proof from failed proof if both exit 1 |
-| TEN-SPEED-12 | enhancement: cache the repo profile (LOKI_REPO_PROFILE=1 path) keyed on HEAD sha and dirty flag so a resumed run does not rescan the tree | loki-ts/src/runner/repo_profile.ts, loki-ts/tests/runner/autonomous.test.ts | MEDIUM | red: `cd loki-ts && bun test tests/runner/autonomous.test.ts -t "repo profile cache hit"` fails (scan runs twice); green: passes, cache invalidates on a new commit | ready | Gap: autonomous.ts:633 calls the profiler each start; read repo_profile.ts first and drop if a cache exists |
-| TEN-QUALITY-26 | fix: `loki wiki show <bad-section>` should list the valid sections (architecture, modules, data-flow) in the error and exit 2; extend the wiki test | loki-ts/src/commands/wiki.ts, loki-ts/tests/commands/wiki.test.ts | LOW | red: `cd loki-ts && bun test tests/commands/wiki.test.ts -t "bad section lists valid"` fails; green: passes, valid sections unchanged | ready | Gap: wiki.ts:51 prints the section list only in the usage branch; check the unknown-section branch first |
-| TEN-UX-29 | fix: `loki report kpis --since` with no value, or followed by another flag, reports an empty invalid value and consumes the next flag; print "--since requires a value" and exit 1 without swallowing the next token; chain after TEN-SPEED-11 | loki-ts/src/commands/kpis.ts, loki-ts/tests/commands/kpis.test.ts | LOW | red: `cd loki-ts && bun test tests/commands/kpis.test.ts -t "since missing value"` fails (message names an empty value); green: passes, `--since 7d` and `--since=7d` unchanged | ready | Gap: kpis.ts:87 `args[++i] ?? ""` eats the next token; chain after TEN-SPEED-11 |
+| TEN-STABILITY-26 | fix: `loki control backfill --repo` with no value silently falls back to the first positional or cwd and ships that dir; fail with one error line naming --repo and exit 2 (same class as TEN-STABILITY-21) | loki-ts/src/commands/control.ts, loki-ts/tests/commands/control.test.ts | LOW | red: `cd loki-ts && bun test tests/commands/control.test.ts -t "backfill repo missing value"` fails (exit 0, ingests cwd); green: passes, `--repo DIR` and bare DIR unchanged | released v11.17.46 | Gap: control.ts:234 `flag(rest, "--repo") ?? rest.find(...) ?? cwd`; flag() at :33 returns undefined for a trailing flag, missingValue() at :38 exists but is not applied here |
+| TEN-UX-24 | fix: the second `control` help block in autonomy/loki (cmd_control, ~line 34902) lists only serve, backfill, status; add prune, stop and `status --json` so it matches the Bun usage in control.ts | autonomy/loki, tests/test-help-discoverability.sh | LOW | red: `bash tests/test-help-discoverability.sh` fails on a new assertion that bash `loki control --help` names prune, stop and status --json; green: passes and `bash tests/test-help-changelog-drift.sh` still exits 0 | released v11.17.46 | Gap: control.ts:22 documents prune --repo/--before; the bash fallback help (LOKI_LEGACY_BASH) omits it |
+| TEN-UX-25 | fix: bash `cmd_provider` default arm (autonomy/loki:7488) prints help and returns 0 for an unknown subcommand; return 2 with one "unknown subcommand" line (TS side fixed in TEN-UX-20); chain after TEN-UX-24 | autonomy/loki, tests/test-help-discoverability.sh | LOW | red: `bash tests/test-help-discoverability.sh` fails on `loki provider frobnicate` expecting exit 2; green: passes, `loki provider` and `loki provider --help` still exit 0 | released v11.17.46 | Gap: the `*)` arm at autonomy/loki ~7517 echoes the help block with no return code; chain after TEN-UX-24 |
+| TEN-UX-26 | fix: sibling sweep of bash commands whose default arm prints help and exits 0 on an unknown subcommand (cmd_config ~14144 and cmd_api ~15932 are the first candidates; confirm each with a probe, skip any that already fail non-zero); make each exit 2 with an "unknown subcommand" line; chain after TEN-UX-25 | autonomy/loki, tests/test-help-discoverability.sh | LOW | red: `bash tests/test-help-discoverability.sh` fails on `loki config frobnicate` and `loki api frobnicate` expecting exit 2; green: passes, bare and --help forms still exit 0 | released v11.17.46 | Gap: FAILURE-CLASSES row required (siblings exist); chain after TEN-UX-25 |
+| TEN-UX-27 | fix: `loki doctor --quiet` writes `Install:` hint lines to stderr while the WARN/FAIL row goes to stdout, so the hint prints detached from its row; write each hint directly under its row on the same stream | loki-ts/src/commands/doctor.ts, loki-ts/tests/commands/doctor.test.ts | LOW | red: `cd loki-ts && bun test tests/commands/doctor.test.ts -t "install hint follows its row"` fails (hint absent from stdout); green: passes and `bunx tsc --noEmit` exits 0 | released v11.17.46 | Gap: doctor.ts:1276 `process.stderr.write(... Install: ...)` after `process.stdout.write(formatToolLine(c))` at :1274 |
+| TEN-QUALITY-22 | test: pin the doctor disk text-mode "on <name> volume" label (home, cwd, tmp) so the low-volume name cannot regress; chain after TEN-UX-27 | loki-ts/src/commands/doctor.ts, loki-ts/tests/commands/doctor.test.ts | LOW | red: mutate lowestVolume to return null low_volume and `cd loki-ts && bun test tests/commands/doctor.test.ts -t "disk text volume label"` fails; green: passes unmutated | released v11.17.46 | Gap: doctor.test.ts:161 covers the JSON low_volume only; no test renders the text line; chain after TEN-UX-27 |
+| TEN-SPEED-10 | enhancement: `loki doctor --json` (buildDoctorJson) awaits checkSentrux, checkMemoryHealth and requirementsSection one after another; run them with Promise.all and keep output byte-identical; chain after TEN-QUALITY-22 | loki-ts/src/commands/doctor.ts, loki-ts/tests/commands/doctor.test.ts | MEDIUM | red: `cd loki-ts && bun test tests/commands/doctor.test.ts -t "json checks run concurrently"` fails (elapsed ~ sum of stubbed 200ms probes); green: passes and `bun test tests/commands/doctor_router.test.ts tests/commands/doctor_count.test.ts` exit 0 | released v11.17.46 | Gap: doctor.ts:940-946 serial awaits; the text path already batches runAllToolChecks; chain after TEN-QUALITY-22 |
+| TEN-QUALITY-23 | test: help-changelog-drift guards exact completion cases; assert every `loki` subcommand and flag named in CHANGELOG appears as a literal case in completions/loki.bash and completions/_loki so a flag typo fails | tests/test-help-changelog-drift.sh, completions/loki.bash, completions/_loki | LOW | red: introduce a typo `--sinse` in completions/loki.bash and `bash tests/test-help-changelog-drift.sh` must exit 1 naming it; green: reverted typo exits 0 | released v11.17.46 | Gap: current test greps for substrings loosely, a misspelled flag in a different case arm still passes |
+| TEN-GATES-22 | feature: the per-run signed receipt (not only the composite) records the toolchain {bun,node,python3,git}, absent tools null, old receipts still verify (follow-up from the TEN-GATES-19 review) | loki-ts/src/util/receipt_signer.ts, loki-ts/tests/engine10/seal_group.test.ts | HIGH | red: `cd loki-ts && bun test tests/engine10/seal_group.test.ts -t "per-run receipt toolchain"` fails (no toolchain key); green: passes, `bun test tests/engine10 tests/util/receipt_bundle.test.ts` and `bunx tsc --noEmit` exit 0 | released v11.17.46 | Gap: collectToolchain is used only by composite_seal.ts:54; receipt_signer.ts has no toolchain reference |
+| TEN-COST-39 | fix: a malformed `.loki/metrics/budget.json` is discarded and returns null, so spend resets to zero and the cap is silently disarmed; rebuild budget_used from the efficiency records (readEfficiencyDir) and warn once | loki-ts/src/runner/budget.ts, loki-ts/tests/runner/budget.test.ts | MEDIUM | red: `cd loki-ts && bun test tests/runner/budget.test.ts -t "corrupt budget state rebuilds used"` fails (used 0); green: passes and `bun test tests/runner/autonomous_budget.test.ts` exit 0 | released v11.17.46 | Gap: budget.ts:305-318 returns null on parse failure and the caller treats null as no spend |
+| TEN-COST-40 | fix: `loadDefaultMaxCostUsd` silently falls back to the literal 100 when model-pricing.json is unreadable; print one stderr warning naming the file and the fallback; chain after TEN-COST-39 | loki-ts/src/runner/budget.ts, loki-ts/tests/runner/budget.test.ts | LOW | red: `cd loki-ts && bun test tests/runner/budget.test.ts -t "pricing file missing warns"` fails (no warning); green: passes, warning emitted once per process | released v11.17.46 | Gap: budget.ts:24-33 swallows every read error; chain after TEN-COST-39 |
+| TEN-STABILITY-27 | fix: `LOKI_E10_STALL_S=abc` or `LOKI_E10_STALL_KILL_S=-5` is silently ignored and the default applies; warn once on stderr naming the variable and the value used | loki-ts/src/runner/watchdog.ts, loki-ts/tests/runner/watchdog.test.ts | LOW | red: `cd loki-ts && bun test tests/runner/watchdog.test.ts -t "invalid stall env warns"` fails (no warning); green: passes, valid and unset values unchanged | released v11.17.46 | Gap: watchdog.ts:8-17 return the default with no diagnostic |
+| TEN-STABILITY-28 | fix: `loki undo <run> --bogus` ignores unknown flags and proceeds; validate against the known set (--list --plan --dry-run --json --allow-unsigned --yes --close-pr --help) and exit 2 with one line naming the flag | loki-ts/src/commands/undo.ts, loki-ts/tests/commands/undo.test.ts | MEDIUM | red: `cd loki-ts && bun test tests/commands/undo.test.ts -t "unknown flag"` fails (exit 0 or applies); green: passes, all valid combinations unchanged | released v11.17.46 | Gap: undo.ts:218-238 uses args.includes for each flag with no unknown-flag check; a typo such as `--dry-rn` falls through to apply |
+| TEN-STABILITY-29 | fix: `loki rollback <id> --forse` and other unknown flags are ignored (the typo drops --force silently); validate against known flags and exit 2 | loki-ts/src/commands/rollback.ts, loki-ts/tests/commands/rollback.test.ts | LOW | red: `cd loki-ts && bun test tests/commands/rollback.test.ts -t "unknown flag"` fails; green: passes, --json and --force unchanged | rejected (already shipped by 8d630fa59 TEN-DEPLOY-16) | Gap: rollback.ts:77,116,128 use rest.includes only |
+| TEN-STABILITY-30 | fix: `loki start ./prd.md` with a mistyped or missing path treats the path string as an inline brief and starts a paid run on it; when the spec looks like a path (contains / or ends in .md/.txt/.yaml/.json) and does not exist, exit 2 "PRD file not found: <path>" | loki-ts/src/commands/start.ts, loki-ts/tests/commands/start.test.ts | MEDIUM | red: `cd loki-ts && bun test tests/commands/start.test.ts -t "missing prd path"` fails (run starts); green: passes, real files and plain briefs unchanged | released v11.17.46 | Gap: start.ts:376 `existsSync(spec) ? readFileSync : spec` falls through to the literal string; verify the same fall-through on the --prd flag before building |
+| TEN-COST-41 | enhancement: `loki start` prints one line before the first iteration stating the effective per-run cap and where it came from (flag, env, loki.yaml, default $100) so a silent default cap is visible; skip if already printed (check first); chain after TEN-STABILITY-30 | loki-ts/src/commands/start.ts, loki-ts/tests/commands/start.test.ts | LOW | red: `cd loki-ts && bun test tests/commands/start.test.ts -t "cap source line"` fails (no line); green: passes for flag, env and default sources | released v11.17.46 | Gap: capNote exists in e10ext/budget_cap.ts (start.ts:425); confirm it covers the legacy default path; chain after TEN-STABILITY-30 |
+| TEN-STABILITY-31 | fix: `listCheckpoints` silently skips a checkpoint whose metadata.json is corrupt or fails validation, so it vanishes from rollback choices with no trace; collect skipped ids and warn once on stderr | loki-ts/src/runner/checkpoint.ts, loki-ts/tests/runner/checkpoint.test.ts | MEDIUM | red: `cd loki-ts && bun test tests/runner/checkpoint.test.ts -t "corrupt metadata warns"` fails (no warning); green: passes, valid listing order unchanged | released v11.17.46 | Gap: checkpoint.ts:414-436 readCheckpointSafe returns null in a bare catch |
+| TEN-QUALITY-25 | test: pin provider failover classification (rate limit vs outage vs killed vs clean exit) and nextProvider ordering with a fake installed() probe | loki-ts/src/runner/provider_failover.ts, loki-ts/tests/runner/provider_failover.test.ts | MEDIUM | red: mutate classifyOutage to return null for exit 137 and `cd loki-ts && bun test tests/runner/provider_failover.test.ts` fails; green: passes unmutated and `bunx tsc --noEmit` exits 0 | released v11.17.46 | Gap: no tests/runner file names provider_failover; new test file justified because no existing file owns it (verify with grep first) |
+| TEN-UX-28 | enhancement: `loki queue run` prints a progress line `[n/m] <ref>` before each item and the digest links each item verdict; skip if already present (check first) | loki-ts/src/commands/queue.ts, loki-ts/tests/commands/queue.test.ts | LOW | red: `cd loki-ts && bun test tests/commands/queue.test.ts -t "progress line per item"` fails; green: passes and the existing digest test still exits 0 | released v11.17.46 | Gap: queue.ts run loop (~line 290-320) records results only in the final digest |
+| TEN-SPEED-11 | enhancement: `loki report kpis --since 7d` should skip run directories whose newest mtime is before the cutoff instead of parsing every run, with identical output | loki-ts/src/commands/kpis.ts, loki-ts/tests/commands/kpis.test.ts | LOW | red: `cd loki-ts && bun test tests/commands/kpis.test.ts -t "since skips old runs"` fails (old run files read, counted by a spy); green: passes and output byte-identical on the fixture | released v11.17.46 | Gap: kpis.ts:96 computeKpis receives sinceMs; confirm it filters after reading (read computeKpis first, drop if already pruned by mtime) |
+| TEN-SECURITY-11 | fix: the SARIF secret scan misses common token formats (Hugging Face `hf_`, SendGrid `SG.`, Twilio `SK`+32 hex, Azure storage `AccountKey=`); add Tier 1 patterns that report label only, never the matched text, and mirror them in autonomy/lib/secret-scan.sh in the same change | loki-ts/src/commands/export_sarif.ts, loki-ts/tests/commands/export_sarif.test.ts, autonomy/lib/secret-scan.sh | MEDIUM | red: `cd loki-ts && bun test tests/commands/export_sarif.test.ts -t "extra token formats"` fails (0 findings); green: passes with label-only output and `bash tests/test-secret-scan.sh` exits 0 | released v11.17.46 | Gap: export_sarif.ts:12-24 lists 12 formats; none cover those four; parity with secret-scan.sh required |
+| TEN-DEPLOY-19 | fix: `loki start --deploy --health-url X --domain Y` accepts any string; validate --health-url is http or https with a host and --domain is a bare hostname, exit 2 with one line naming the flag, before any run work; chain after TEN-COST-41 | loki-ts/src/commands/start.ts, loki-ts/tests/commands/start.test.ts | MEDIUM | red: `cd loki-ts && bun test tests/commands/start.test.ts -t "deploy flag validation"` fails (exit 0); green: passes, valid URLs unchanged | released v11.17.46 | Gap: start.ts:158 lists the deploy flags as value flags with no validation; verify on the Bun route and the bash route; chain after TEN-COST-41 |
+| TEN-DEPLOY-20 | fix: `loki start --deploy --env-file ./missing.env` is accepted and fails only after the build; check the file exists and is readable up front and exit 2; chain after TEN-DEPLOY-19 | loki-ts/src/commands/start.ts, loki-ts/tests/commands/start.test.ts | LOW | red: `cd loki-ts && bun test tests/commands/start.test.ts -t "env-file missing"` fails (exit 0); green: passes, existing file unchanged | released v11.17.46 | Gap: start.ts:158 --env-file is passed through unchecked; chain after TEN-DEPLOY-19 |
+| TEN-ADOPTION-22 | enhancement: `loki provider list` marks each provider CLI as installed or missing and prints the install command for a missing one (reuse the table doctor.ts providerInstall) | loki-ts/src/commands/provider.ts, loki-ts/tests/commands/provider.test.ts | LOW | red: `cd loki-ts && bun test tests/commands/provider.test.ts -t "list shows install hint"` fails; green: passes with a stubbed which() and `bunx tsc --noEmit` exits 0 | released v11.17.46 | Gap: check provider.ts list output first; doctor.ts:1263 holds the only install-hint table, move it to a shared export rather than copying |
+| TEN-ADOPTION-23 | fix: `loki completion fish` or an unknown shell must print the supported shells and exit 2; `loki completion` with no shell prints usage; check current behaviour first and drop if already correct | loki-ts/src/commands/completion.ts, loki-ts/tests/commands/cli_help_routes.test.ts | LOW | red: `cd loki-ts && bun test tests/commands/cli_help_routes.test.ts -t "completion unknown shell"` fails; green: passes, bash and zsh output unchanged | rejected (already correct on read, dropped per row note) | Gap: completion.ts has no dedicated test file; extend cli_help_routes.test.ts rather than add one |
+| TEN-GATES-23 | enhancement: record each quality gate's wall-clock duration in the gate result so `loki status` and the receipt can show which gate dominates a slow run; additive field only, old readers ignore it | loki-ts/src/runner/quality_gates.ts, loki-ts/tests/runner/quality_gates.test.ts | MEDIUM | red: `cd loki-ts && bun test tests/runner/quality_gates.test.ts -t "gate duration recorded"` fails (no duration_ms); green: passes and `bun test tests/runner/quality_gates_inconclusive.test.ts` exits 0 | released v11.17.46 | Gap: grep duration in quality_gates.ts first; if present, narrow the row to surfacing it in status |
+| TEN-GATES-24 | fix: `loki verify-pr` on a PR with no receipt must exit with a code distinct from "receipt present, verdict fail" and say which it is; check current exit codes first and drop if already distinct | loki-ts/src/commands/verify_pr.ts, loki-ts/tests/commands/verify_pr.test.ts | MEDIUM | red: `cd loki-ts && bun test tests/commands/verify_pr.test.ts -t "no receipt exit code"` fails; green: passes, existing verdict exits unchanged | released v11.17.46 | Gap: a CI caller cannot tell missing proof from failed proof if both exit 1 |
+| TEN-SPEED-12 | enhancement: cache the repo profile (LOKI_REPO_PROFILE=1 path) keyed on HEAD sha and dirty flag so a resumed run does not rescan the tree | loki-ts/src/runner/repo_profile.ts, loki-ts/tests/runner/autonomous.test.ts | MEDIUM | red: `cd loki-ts && bun test tests/runner/autonomous.test.ts -t "repo profile cache hit"` fails (scan runs twice); green: passes, cache invalidates on a new commit | released v11.17.46 | Gap: autonomous.ts:633 calls the profiler each start; read repo_profile.ts first and drop if a cache exists |
+| TEN-QUALITY-26 | fix: `loki wiki show <bad-section>` should list the valid sections (architecture, modules, data-flow) in the error and exit 2; extend the wiki test | loki-ts/src/commands/wiki.ts, loki-ts/tests/commands/wiki.test.ts | LOW | red: `cd loki-ts && bun test tests/commands/wiki.test.ts -t "bad section lists valid"` fails; green: passes, valid sections unchanged | released v11.17.46 | Gap: wiki.ts:51 prints the section list only in the usage branch; check the unknown-section branch first |
+| TEN-UX-29 | fix: `loki report kpis --since` with no value, or followed by another flag, reports an empty invalid value and consumes the next flag; print "--since requires a value" and exit 1 without swallowing the next token; chain after TEN-SPEED-11 | loki-ts/src/commands/kpis.ts, loki-ts/tests/commands/kpis.test.ts | LOW | red: `cd loki-ts && bun test tests/commands/kpis.test.ts -t "since missing value"` fails (message names an empty value); green: passes, `--since 7d` and `--since=7d` unchanged | released v11.17.46 | Gap: kpis.ts:87 `args[++i] ?? ""` eats the next token; chain after TEN-SPEED-11 |
+| TEN-QUALITY-27 | test: the "corrupt budget state rebuilds used from efficiency records" case in budget.test.ts asserts only budget_used; also assert limit, budget_limit and exceeded for BUDGET_LIMIT unset, below the cap and at the cap, so a rebuild can never silently disarm the cap | loki-ts/tests/runner/budget.test.ts | LOW | red: mutate rebuildBudgetState to return `exceeded: false` and `limit: 0` and run `cd loki-ts && bun test tests/runner/budget.test.ts -t "rebuilds"`, it fails; green: restored source passes | ready | Gap: budget.test.ts:278-290 checks `.budget_used` only; budget.ts:316-325 computes limit, budget_limit and exceeded with no test; seed from the TEN-COST-39 review |
+| TEN-QUALITY-28 | test: control.test.ts has only the missing-value cases for `backfill --repo`; add the positive `backfill --repo DIR` case (ships DIR, not cwd) and the bare `backfill DIR` case, with an injected env so nothing is sent | loki-ts/tests/commands/control.test.ts | LOW | red: mutate control.ts:235 to ignore `--repo` and run `cd loki-ts && bun test tests/commands/control.test.ts -t "backfill repo DIR"`, it fails; green: restored source passes | ready | Gap: control.test.ts:171-180 is the only backfill block and covers only exit 2; the positive path is unpinned; seed from the TEN-STABILITY-26 review |
+| TEN-COST-42 | fix: the bash readers of default_max_cost_usd (run.sh `_loki_budget_default`, autonomy/loki `loki_budget_default_usd`) fall back to 100 with no word when model-pricing.json is present but unreadable or has no parsable key; print one stderr warning naming the file, as the TS side does (TEN-COST-40), and keep the 100 fallback | autonomy/run.sh, autonomy/loki, tests/test-pricing-parity.sh | MEDIUM | red: add a case in tests/test-pricing-parity.sh that points the reader at an unreadable copy and expects a warning on stderr; `bash tests/test-pricing-parity.sh` fails; green: passes and a healthy file prints nothing extra | ready | Gap: run.sh:571 `sed ... 2>/dev/null` then `case '' ) 100.00`; autonomy/loki:79 `[ -f ... ] && sed` with no else branch; absent-file stays silent (that is the documented fallback), unreadable or keyless must warn |
+| TEN-COST-44 | enhancement: readEfficiencyDir skips malformed efficiency records silently, so a rebuilt budget undercounts spend with no hint; count the skipped files and have rebuildBudgetState include the count in its existing one-line warning; chain after TEN-QUALITY-27 | loki-ts/src/runner/budget.ts, loki-ts/tests/runner/budget.test.ts | MEDIUM | red: `cd loki-ts && bun test tests/runner/budget.test.ts -t "skipped malformed"` fails (warning has no count); green: passes, the returned records and the 4-decimal cost are unchanged | ready | Gap: budget.ts:280-286 `catch { // ignore malformed file }`; budget.ts:320 warns only with the record count; chain after TEN-QUALITY-27 (same test file) |
+| TEN-COST-45 | fix: `loki estimate --provider bogus` and `--model nosuchmodel` are accepted and priced through whatever the resolver returns, while `loki start` rejects an unknown provider with exit 2; validate against the same provider list and print one error line naming the fix, exit 1 | loki-ts/src/runner/router/cost_preview.ts, loki-ts/tests/runner/cost_preview.test.ts | LOW | red: `cd loki-ts && bun test tests/runner/cost_preview.test.ts -t "unknown provider"` fails (exit 0); green: passes, claude, codex and a known model unchanged | ready | Gap: cost_preview.ts:151 stores any `--provider` value; start.ts:272 is the validating counterpart (VALID_PROVIDERS); confirm the run-history fixture prints a number for a bogus provider before filing the fix |
+| TEN-STABILITY-32 | fix: a set but unparseable LOKI_E10_CAP_S ("abc", "0", "-5") or loki.yaml budgets.run_cap_s is dropped by envCapS and yamlRunCapS and the 900s default silently applies in four readers; make the one helper return a warning once on stderr naming the bad value and the default used (never loosen the cap) | loki-ts/src/engine10/types.ts, loki-ts/src/util/run_cap.ts, loki-ts/tests/engine10/cap.test.ts | MEDIUM | red: `cd loki-ts && bun test tests/engine10/cap.test.ts -t "invalid cap warns"` fails (no output); green: passes, valid values and the unset case print nothing | ready | Gap: types.ts:23 `Number.isFinite(n) && n > 0 ? n : null` with no diagnostic; consumers worker.ts:41, supervisor.ts:163, run_cap.ts:60 all read it; sibling of TEN-STABILITY-27 which covered only LOKI_E10_STALL_S |
+| TEN-STABILITY-33 | fix: `loki start ./prd.md --brief --yes` (and --prd, --completion-promise, --aider-model, --aider-flags, --cline-model) takes the next flag token as the value, so a forgotten value becomes a paid run on the text "--yes"; a value that starts with "-" or is empty must print one error naming the flag and exit 2 (use `--flag=-x` for a dash-leading value) | loki-ts/src/commands/start.ts, loki-ts/tests/commands/start.test.ts | MEDIUM | red: `cd loki-ts && bun test tests/commands/start.test.ts -t "value flag swallows flag"` fails (parse succeeds with brief "--yes"); green: passes and `cd loki-ts && bunx tsc --noEmit` exits 0 | ready | Gap: start.ts:29 argVal returns args[i+1] with no flag-shape check; TEN-COST-36 only covered the six numeric flags; chain before TEN-UX-32 |
+| TEN-UX-32 | fix: `loki start ./a.md --prd ./b.md --brief "x"` silently picks --prd and drops the others; when two or more of positional spec, --prd and --brief are given with different values, print which one wins or refuse with exit 2 naming all of them; chain after TEN-STABILITY-33 | loki-ts/src/commands/start.ts, loki-ts/tests/commands/start.test.ts | MEDIUM | red: `cd loki-ts && bun test tests/commands/start.test.ts -t "conflicting spec sources"` fails (exit 0); green: passes, a single source and `--prd` equal to the positional are unchanged | ready | Gap: start.ts `prdFlag ?? briefFlag ?? spec` precedence with no conflict check; chain after TEN-STABILITY-33 (same file) |
+| TEN-COST-43 | fix: `loki start prd.md --budget-limit 5 --budget 50` reads the first flag and silently drops the second, so the cap the user meant last can be the one ignored; differing values must print one error naming both flags and exit 2; chain after TEN-UX-32 | loki-ts/src/commands/start.ts, loki-ts/tests/commands/start.test.ts | MEDIUM | red: `cd loki-ts && bun test tests/commands/start.test.ts -t "conflicting budget flags"` fails (cap 5 applied, no message); green: passes, equal values and a single flag unchanged | ready | Gap: start.ts `posNum(argVal(args, "--budget-limit") ?? argVal(args, "--budget"))`; chain after TEN-UX-32 (same file) |
+| TEN-DEPLOY-21 | fix: `loki start prd.md --deploy --destination prod`, `--auto-rollback` or `--health-match` without `--health-url`, and `--canary` with a non-production destination are only rejected by `loki deploy` AFTER the paid build finishes; reject them in deployFlagError before the run; chain after TEN-COST-43 | loki-ts/src/commands/start.ts, loki-ts/tests/commands/start.test.ts | MEDIUM | red: `cd loki-ts && bun test tests/commands/start.test.ts -t "deploy flags fail before build"` fails (returns null for each case); green: passes, valid combinations unchanged | ready | Gap: start.ts deployFlagError checks only --health-url, --domain and --env-file; the destination enum, health-url requirement and canary rule live at autonomy/loki:11176-11256 and run after cmd_start (autonomy/loki:2733); chain after TEN-COST-43 (same file) |
+| TEN-DEPLOY-22 | fix: the bash `start` parser (autonomy/loki `_ps_*`) has the same late validation for `--destination`, `--health-match`/`--auto-rollback` without `--health-url`, and `--canary` with a non-production destination; copy the three checks next to the existing "apply only with --deploy" guard so the bash route fails before cmd_start | autonomy/loki, tests/test-deploy.sh | MEDIUM | red: add cases to tests/test-deploy.sh that run `loki start --deploy --destination prod` and expect exit 2 before any start output; `bash tests/test-deploy.sh` fails; green: passes | ready | Gap: autonomy/loki:2696 checks only that deploy flags need --deploy; enum and pairing checks sit in cmd_deploy at 11176 and 11245-11256; message text must match cmd_deploy so one doc covers both |
+| TEN-STABILITY-34 | fix: `loki queue list --bogus`, `queue clear extra` and `queue run --bogus` ignore unknown flags and extra args (queueRun only looks for --no-pr and --max-total-cost); reject with the usage line and exit 2, so a mistyped --no-pr cannot open PRs | loki-ts/src/commands/queue.ts, loki-ts/tests/commands/queue.test.ts | LOW | red: `cd loki-ts && bun test tests/commands/queue.test.ts -t "unknown flag"` fails (exit 0); green: passes, valid forms unchanged | ready | Gap: queue.ts:262 `args.includes("--no-pr")` with no allow-list; queueList(d) and queueClear(d) are called without their args at queue.ts:475-481; sibling of TEN-DEPLOY-16 |
+| TEN-ADOPTION-25 | feature: `loki queue list --json` printing the queued refs as a JSON array so scripts and editors can read the queue; plain output stays byte identical; chain after TEN-STABILITY-34 | loki-ts/src/commands/queue.ts, loki-ts/tests/commands/queue.test.ts | LOW | red: `cd loki-ts && bun test tests/commands/queue.test.ts -t "list json"` fails (unknown flag); green: passes, text output golden unchanged | ready | Gap: queue.ts has no --json for list (the only --json at :353 is the usage governor call); chain after TEN-STABILITY-34 (same file) |
+| TEN-STABILITY-35 | fix: preflight passes a git repo with no commits (git init, nothing committed) and the run then dies inside worktree creation with a raw "invalid reference: HEAD"; add a HEAD check and the fatal line `repository has no commits; run: git add . && git commit -m init` | loki-ts/src/engine10/preflight.ts, loki-ts/tests/engine10/preflight.test.ts | MEDIUM | red: `cd loki-ts && bun test tests/engine10/preflight.test.ts -t "no commits"` fails (fatal is null); green: passes, a repo with one commit and the empty-folder auto-init path unchanged | ready | Gap: preflight.ts checks only `rev-parse --is-inside-work-tree` and the git identity; first_run_repo.ts:11 even tells a non-empty folder user to run `git init` first, which leaves exactly this state |
+| TEN-STABILITY-36 | enhancement: preflight has no free-disk check, so a full volume fails mid-run in worktree or event-log writes; warn under 2 GB free and refuse under 200 MB on the repo volume with a message naming the volume, reuse statfsSync like the doctor disk check; chain after TEN-STABILITY-35 | loki-ts/src/engine10/preflight.ts, loki-ts/tests/engine10/preflight.test.ts | MEDIUM | red: `cd loki-ts && bun test tests/engine10/preflight.test.ts -t "low disk"` fails (no warning, injected statfs ignored); green: passes, normal disk prints nothing | ready | Gap: no statfs in src/engine10; doctor.ts:405 already computes it for `loki doctor`; thresholds overridable by LOKI_MIN_FREE_MB; chain after TEN-STABILITY-35 (same file) |
+| TEN-SPEED-14 | enhancement: checkPreflight awaits `rev-parse` before it starts the two `git config` reads; start all three together and re-run the work-tree check only when auto-init ran, saving one git spawn on every `loki start`; chain after TEN-STABILITY-36 | loki-ts/src/engine10/preflight.ts, loki-ts/tests/engine10/preflight.test.ts | LOW | red: `cd loki-ts && bun test tests/engine10/preflight.test.ts -t "parallel git reads"` fails (spawn order is serial); green: passes, every existing preflight verdict and message unchanged | ready | Gap: preflight.ts `let wt0 = await git(...)` then `Promise.all([Promise.resolve(wt0), git(name), git(email)])`; chain after TEN-STABILITY-36 (same file) |
+| TEN-SPEED-13 | enhancement: buildTestMap walks the whole tree with readdirSync minus a skip list, which is slow on a large monorepo; take the file list from `git ls-files` (safe_git) with the walk as the fallback outside a repo, same sorted output | loki-ts/src/engine10/testmap.ts, loki-ts/tests/engine10/testmap.test.ts | MEDIUM | red: `cd loki-ts && bun test tests/engine10/testmap.test.ts -t "tracked files only"` fails (an ignored node_modules-like dir is walked); green: passes, existing fixtures give the same map | ready | Gap: testmap.ts:66 carries the author note "full recursive walk ... use git ls-files if a huge monorepo makes this slow"; untracked-but-ignored dirs not in SKIP_DIRS are walked today |
+| TEN-STABILITY-37 | fix: engine10 supervisor main() pushes every unrecognised token into the task words, so `loki "fix the bug" --no-prr` or `--dry-run` becomes part of the paid task text; reject unknown dash-leading tokens with a usage line and exit 2, and honour `--` as the end of options | loki-ts/src/engine10/supervisor.ts, loki-ts/tests/engine10/spec_first_intent.test.ts | MEDIUM | red: `cd loki-ts && bun test tests/engine10/spec_first_intent.test.ts -t "unknown flag"` fails (task contains the flag); green: passes, tasks without flags and `-- -weird task` unchanged | ready | Gap: supervisor.ts:255-262 final `else words.push(a)`; the start route (engineArgv) only emits known flags, so the direct `loki "<task>"` entry is the exposed one |
+| TEN-UX-33 | fix: supervisor `--provider` with no value or a flag-shaped value keeps the env provider or takes the next flag as the provider name; print "--provider needs a value" and exit 2; chain after TEN-STABILITY-37 | loki-ts/src/engine10/supervisor.ts, loki-ts/tests/engine10/spec_first_intent.test.ts | LOW | red: `cd loki-ts && bun test tests/engine10/spec_first_intent.test.ts -t "provider needs a value"` fails; green: passes, `--provider codex` unchanged | ready | Gap: supervisor.ts:254 `provider = args[++i] ?? provider`; chain after TEN-STABILITY-37 (same file) |
+| TEN-STABILITY-38 | fix: supervisor treats any token starting with `--max-cost` as the cap flag, so `--max-costly` or `--max-cost5` slices garbage (`a.slice(11)`) or swallows the next token; match `--max-cost` exactly or `--max-cost=`; chain after TEN-UX-33 | loki-ts/src/engine10/supervisor.ts, loki-ts/tests/engine10/spec_first_intent.test.ts | LOW | red: `cd loki-ts && bun test tests/engine10/spec_first_intent.test.ts -t "max-cost prefix"` fails; green: passes, `--max-cost 5` and `--max-cost=5` unchanged | ready | Gap: supervisor.ts:253 `a.startsWith("--max-cost")`; chain after TEN-UX-33 (same file) |
+| TEN-UX-30 | fix: `loki stats --bogus` is ignored and prints stats with exit 0 on the TS route and in bash; reject unknown flags with one line and exit 2 on both routes (--json, --efficiency, --help stay) | loki-ts/src/commands/stats.ts, loki-ts/tests/commands/stats.test.ts | LOW | red: `cd loki-ts && bun test tests/commands/stats.test.ts -t "unknown flag"` fails (exit 0); green: passes and `bun test tests/commands/stats.test.ts` stays green; if a bash-parity test pins the old exit 0, update it in the same change | ready | Gap: stats.ts:473 comment "unknown flags ignored to match bash behavior"; observed `loki stats --bogus` prints the session table and exits 0; a mistyped --json silently gives text |
+| TEN-UX-31 | fix: `loki version --bogus` prints the version and exits 0; reject an unknown flag with a usage line and exit 2 (--json, --help, -h, help stay) | loki-ts/src/commands/version.ts, loki-ts/tests/commands/version.test.ts | LOW | red: `cd loki-ts && bun test tests/commands/version.test.ts -t "unknown flag"` fails (exit 0); green: passes, plain output byte identical | ready | Gap: version.ts:17-27 reads only --json and the help words; observed `loki version --bogus` prints `Loki Mode v11.17.46` exit 0; seed from the sibling sweep of TEN-UX-20 |
+| TEN-UX-36 | fix: `loki status run-a run-b` reports "unknown flag run-b" for a second run id and the usage line omits [run-id]; print "too many arguments: expected one run id" with the full usage and exit 1 | loki-ts/src/commands/run_status.ts, loki-ts/tests/commands/run_status.test.ts | LOW | red: `cd loki-ts && bun test tests/commands/run_status.test.ts -t "second run id"` fails (message says unknown flag); green: passes, one run id and --json unchanged | ready | Gap: run_status.ts:143 shares one else branch for extra positionals and flags and prints `Usage: loki status [--json]` |
+| TEN-UX-34 | fix: `loki answer --text` with no value silently falls through to the saved Control Plane answer (or "no answer"), so a forgotten value answers with stale text; print "--text needs a value" and exit 2 | loki-ts/src/features/blocked_answer.ts, loki-ts/tests/features/blocked_answer.test.ts | LOW | red: `cd loki-ts && bun test tests/features/blocked_answer.test.ts -t "text needs a value"` fails; green: passes, `--text "x"`, `--text=x` and the file path unchanged | ready | Gap: blocked_answer.ts:63 `text = args[++i]` stores undefined, then `text ?? readAnswerFile(...)` at :70 |
+| TEN-SECURITY-12 | fix: loadSigningKey returns null with no word when LOKI_RECEIPT_SIGNING_KEY_FILE points at an unreadable file, a malformed PEM or a non-ed25519 key, so the run seals an UNSIGNED receipt and the user never learns why; return a reason (file unreadable, not a PEM, not ed25519) that the seal step prints on one stderr line, never the key bytes, and keep the receipt UNSIGNED, never invent a signature | loki-ts/src/util/receipt_signer.ts, loki-ts/tests/engine10/seal_verify_roundtrip.test.ts | HIGH | red: `cd loki-ts && bun test tests/engine10/seal_verify_roundtrip.test.ts -t "unusable signing key names the reason"` fails (no reason, no stderr line); green: passes, the default generated key and a valid explicit key sign exactly as before | ready | Gap: receipt_signer.ts:57-59 outer `catch { return null; }` and :50 `k.asymmetricKeyType === "ed25519" ? k : null` collapse every failure into the same UNSIGNED result; HIGH because it is the Seal; reviewers must confirm no key material reaches the message |
+| TEN-SPEED-15 | enhancement: collectToolchain spawns `node`, `python3` and `git --version` serially with spawnSync on every seal; memoize the result per process (tools do not change inside one run) and run the probes together, receipt body unchanged; chain after TEN-SECURITY-12 | loki-ts/src/util/receipt_signer.ts, loki-ts/tests/engine10/seal_verify_roundtrip.test.ts | MEDIUM | red: `cd loki-ts && bun test tests/engine10/seal_verify_roundtrip.test.ts -t "toolchain probed once"` fails (probe called per seal); green: passes, toolchain fields identical in the receipt | ready | Gap: receipt_signer.ts:75-80 toolVersion uses spawnSync with a 5s timeout per tool and collectToolchain has no cache; chain after TEN-SECURITY-12 (same file) |
+| TEN-GATES-25 | fix: `loki verify --bogus` and `loki verify run-a run-b` treat the first token as the run id, so a typo yields a misleading "no such receipt" style verdict and extra ids are ignored; reject unknown dash-leading flags and more than one positional with a usage line and exit 2, never change any verdict exit code | loki-ts/src/engine10/verify_cmd.ts, loki-ts/tests/engine10/verify_cmd.test.ts | HIGH | red: `cd loki-ts && bun test tests/engine10/verify_cmd.test.ts -t "unknown flag and extra id"` fails; green: passes and the whole verify_cmd suite stays green (exit 0/1/2/3/4/66 mapping unchanged) | ready | Gap: verify_cmd.ts verifyMain strips known flags then uses `args[0] ?? latestRunId(...)` with no leftover check; HIGH because it is the verifier front door and a wrong exit here is a false-green risk |
+| TEN-GATES-26 | feature: `loki verify [run-id] --json` printing {run, verdict, receipt_sha256, reasons, agent_independent:{k,of}} on stdout so CI can gate without scraping text; exit codes unchanged and the text output stays byte identical without the flag; chain after TEN-GATES-25 | loki-ts/src/engine10/verify_cmd.ts, loki-ts/tests/engine10/verify_cmd.test.ts | HIGH | red: `cd loki-ts && bun test tests/engine10/verify_cmd.test.ts -t "verify json"` fails (unknown flag); green: passes, golden text output unchanged | ready | Gap: verify_cmd.ts has no --json (verify-pr has one, TEN-GATES-21); independentLine() already computes k and the pass count; chain after TEN-GATES-25 (same file) |
+| TEN-ADOPTION-24 | feature: `loki wiki show --json` printing {section, content} (or all sections) so tooling can read the generated wiki without parsing text; text output unchanged | loki-ts/src/commands/wiki.ts, loki-ts/tests/commands/wiki.test.ts | LOW | red: `cd loki-ts && bun test tests/commands/wiki.test.ts -t "show json"` fails (unknown option); green: passes, text golden unchanged | ready | Gap: wiki.ts:55 rejects every dash token except --help and there is no json path; wiki.ts has 0 --json occurrences |
+| TEN-ADOPTION-26 | feature: `loki issues run --dry-run --json` printing the triage decision per issue (number, decision, reason, covered_by_pr) so CI can review the plan before any paid run | loki-ts/src/commands/issues_run.ts, loki-ts/tests/commands/issues_run.test.ts | LOW | red: `cd loki-ts && bun test tests/commands/issues_run.test.ts -t "dry run json"` fails (unexpected argument: --json); green: passes, the text table unchanged | ready | Gap: issues_run.ts:82-99 arg loop has no --json; triage results (`t.decision`, `t.reason`) and coveredIssues() already exist at :262-290 and :104 |
 | TEN-COST-35 | fix: `loki start --budget-limit=5` (and --provider=, --session-model=, --prd=, --brief=) is accepted by the flag validator then silently ignored, so the default $100 cap and default provider apply; read the `=` form everywhere argVal reads a flag | loki-ts/src/commands/start.ts, loki-ts/tests/commands/start.test.ts | MEDIUM | red: bun test tests/commands/start.test.ts -t "equals form" fails (cap stays default); green: same test passes and `cd loki-ts && bunx tsc --noEmit` exits 0 | released v11.17.44 | Gap: start.ts:23 argVal matches only exact args via indexOf; start.ts:212 validator splits on "=" so the form is accepted; only --cost and --attempts parse "=" |
 | TEN-COST-36 | fix: `loki start --budget-limit abc`, `--max-iterations -1`, `--budget-limit 0x` and a trailing value flag with no value are silently dropped so the default cap applies; print one error line naming the flag and exit 2 | loki-ts/src/commands/start.ts, loki-ts/tests/commands/start.test.ts | MEDIUM | red: bun test tests/commands/start.test.ts -t "invalid numeric" fails (exit 0, no message); green: passes, valid values unchanged | released v11.17.44 | Gap: start.ts:123 posNum returns undefined for non-numeric, zero or negative with no diagnostic; chain after TEN-COST-35 |
 | TEN-STABILITY-21 | fix: control `--port` with no value or a non-numeric value silently falls back to the default port; reject with a usage line and exit 2 | loki-ts/src/commands/control.ts, loki-ts/tests/commands/control.test.ts | LOW | red: bun test tests/commands/control.test.ts -t "port without value" fails; green: passes and existing control tests stay green | released v11.17.44 | Gap: control.ts:33 flag() returns args[i+1] unchecked (undefined or the next flag) and callers fall through to the default |

package/docs/v10/CONTROL-PLANE.md

@@ -117,4 +117,4 @@ A run blocked on a spec conflict shows its question in the run view with an answ
 
 Ingest runs a pure verifier (`src/server/integrity.ts`) over every stored run and persists `tampered`, `attested`, `sig_checked` and `integrity_reasons`. Only the sealed prefix (events through `log.sealed`) supplies the verdict; a second `run.completed`, or any verdict-bearing event after `log.sealed`, is TAMPERED. The `log.sealed` kid must equal the signed receipt kid, and with keys configured an unknown kid is TAMPERED.
 
-Display verdicts (`effective_verdict`, mirrored by `ui/src/api.ts`): TAMPERED; UNVERIFIED (a VERIFIED claim that is not attested, or a log redacted before ingest); "VERIFIED (signature not checked)" (attested, but no key in `LOKI_CP_RECEIPT_PUBKEYS` checked the seal signature); VERIFIED (attested and signature-checked). With no keys configured nothing can be plain VERIFIED. Choice for the list filter: `?verdict=VERIFIED` lists signature-checked runs only; `?verdict=VERIFIED (signature not checked)` lists the rest. ALREADY_SATISFIED is a success outcome and needs a seal exactly like VERIFIED (same UNVERIFIED and signature-not-checked rules). Any other verdict on an unattested run shows `<verdict> (unattested)`, so an edited or redacted FAILED or PARTIAL never reads as plain. The Overview VERIFIED tile counts only plain VERIFIED; a separate tile counts signature-not-checked runs. Rows are recomputed at boot in chunks (one transaction each) when attested is NULL or the stored key-set fingerprint (`integrity_key_fp`) differs from the configured one; rows whose events are gone are marked unattested once and not retried.
+Display verdicts (`effective_verdict`, mirrored by `ui/src/api.ts`): TAMPERED; UNVERIFIED (a VERIFIED claim that is not attested); "VERIFIED (signature not checked)" (attested, but no key in `LOKI_CP_RECEIPT_PUBKEYS` checked the seal signature); VERIFIED (attested and signature-checked). With no keys configured nothing can be plain VERIFIED. Choice for the list filter: `?verdict=VERIFIED` lists signature-checked runs only; `?verdict=VERIFIED (signature not checked)` lists the rest. ALREADY_SATISFIED is a success outcome and needs a seal exactly like VERIFIED (same UNVERIFIED and signature-not-checked rules). Any other verdict on an unattested run shows `<verdict> (unattested)`, so an edited or redacted FAILED or PARTIAL never reads as plain. The Overview VERIFIED tile counts only plain VERIFIED; a separate tile counts signature-not-checked runs. Redaction (Q17-05b): the engine redacts event data with `redactEnvelope` (`loki-ts/src/util/redact.ts`) before it hashes the log and signs the seal; the shipper and ingest apply the same function, which is a fixpoint, so on an engine-written line both are no-ops. Seal crypto fields of the exact engine shape are exempt. A log whose bytes no longer match its seal, including one rewritten by redaction after sealing, is TAMPERED; there is no UNVERIFIED escape for redaction. Rows are recomputed at boot in chunks (one transaction each) when attested is NULL or the stored key-set fingerprint (`integrity_key_fp`) differs from the configured one; rows whose events are gone are marked unattested once and not retried.

package/docs/v10/FAILURE-CLASSES.md

@@ -136,7 +136,7 @@ L0 review rule (ENGINE-LAWS.md L0): a fix that adds an `if` or a regex about the
   - `loki status`.
 - Mechanism: one verdict-display function that returns TAMPERED whenever the run is tampered or its seal is invalid (CPE-27).
 - Fixture: an ingested run with tamper.detected never shows VERIFIED in any surface.
-- Sibling follow-up (EL-FC08b): redact at source in the engine before hashing. Today the shipper (redactEvent) and the server (redactSecrets) rewrite event data before the CP can hash it, so an honest signed run holding a token reads UNVERIFIED ("log redacted before ingest; seal not checkable"), never TAMPERED and never VERIFIED. Redacting before the engine hashes and signs would make such runs checkable end to end.
+- Sibling follow-up (EL-FC08b): redact at source in the engine before hashing. Today the shipper (redactEvent) and the server (redactSecrets) rewrite event data before the CP can hash it, so an honest signed run holding a token reads UNVERIFIED ("log redacted before ingest; seal not checkable"), never TAMPERED and never VERIFIED. Redacting before the engine hashes and signs would make such runs checkable end to end. Status: built in Q17-05b (engine writer, shipper and ingest share redactEnvelope; redactSecrets iterates to a fixpoint so the layers produce the same bytes; a redaction-rewritten signed log now reads TAMPERED).
 - Sibling follow-up (deferred, not built in EL-FC08b): the shipper should send the sha256 of each line before redaction (alongside the redacted line). The CP could then check the seal over the original hashes and tell a genuine redaction from a downgrade (a FAILED log edited to PARTIAL plus a planted [REDACTED]); today such a log can only read "<verdict> (unattested)" or UNVERIFIED. This is the lasting fix for placeholder downgrades. REJECTED 2026-10-17 (Q17-05, HIGH r1 on 36524784d): a client-supplied original hash cannot be checked by the server, so a forger copies log.sealed events_sha256 into the shipped chain and a FAILED run displays VERIFIED; the chain is also unbound to the run id, so any signed seal replays onto any log. Rule: the CP never accepts a client-supplied hash in place of recomputing one over the bytes it received. The lasting fix is the line above: redact in the engine before hashing and signing (Q17-05b).
 - Sibling follow-up: the Slack summary, PR status and `loki status` do not yet read the CP effective_verdict.
 
@@ -1089,3 +1089,11 @@ L0 review rule (ENGINE-LAWS.md L0): a fix that adds an `if` or a regex about the
 - Siblings: swept the other newest-window invocations (proof list --json, proof share --dry-run, queue add, start --help, status --probe/--json); all already pass. completions/_loki carries no per-flag lists for report or undo; its undo description now names --list.
 - Mechanism: autonomy/loki help text lists both flags; completions/loki.bash gains report and undo cases. The drift test already guards both.
 - Fixture: tests/test-help-changelog-drift.sh (22 passed, 0 failed); removing the `undo --list` help line turns it red.
+
+## FC-TEN-UX-26 Bash commands whose default case arm printed help and exited 0 on an unknown subcommand
+
+- User-visible vs raw: user-visible. `loki config frobnicate` and `loki api frobnicate` printed usage and returned 0, so scripts could not detect a typo (same class as `loki provider`, TEN-UX-25).
+- Law broken: an unknown subcommand must fail non-zero with a one-line error; help stays reachable via help, --help and -h.
+- Siblings: swept 24 bash commands with `<cmd> frobnicate`; only config and api (fixed here) returned 0, plus `loki voice`, a stub with no subcommands that prints a planned-feature notice (left as is).
+- Mechanism: explicit help|--help|-h arm, default arm prints `loki <cmd>: unknown subcommand` to stderr and returns 2.
+- Fixture: tests/test-help-discoverability.sh; restoring the old default arm turns the frobnicate assertions red.

package/docs/v10/PROGRESS.md

@@ -2515,3 +2515,9 @@ v11.17.21 published (Release success on 462fbc40a; npm latest 11.17.21, next 11.
 
 ## 2026-10-17T10:17Z (CoS) v11.17.45
 - Released TEN-DEPLOY-03 (wave AH fix round, APPROVE fe1026bf1). Board refilled with 30 TEN rows for wave AM (fbde018b2).
+
+## 2026-10-17T11:21Z (CoS) v11.17.46
+- Released wave AM: 28 slices APPROVE across 19 chains; TEN-STABILITY-29 and TEN-ADOPTION-23 dropped as already fixed. Combined main: tsc rc 0; bun 593/0 and 449/0; help-changelog-drift, help-discoverability, secret-scan rc 0.
+
+## 2026-10-17T11:59Z (CoS) v11.17.47
+- Released TEN-GATES-15 and Q17-05b (wave AH redo, opus APPROVE 708682ea2 and 0112c4fcc) plus a tsc fix-forward in redact.test.ts (325df1f44). Q18-03e blocked after 3 rounds; reslice to a real tokenizer. Combined: tsc rc 0; loki-ts bun 557/0; control-plane server 335/0. Board refill wave AN (bda2ee54d) included.