loki-mode 11.17.47 → 11.17.48

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: An autonomous software factory that knows what it is supposed to deliver, and proves it did. Use when the user says Loki Mode or asks to build, fix or verify software autonomously.
 ---
 
-# Loki Mode v11.17.47
+# Loki Mode v11.17.48
 
 **Current entry points (Loki 10 engine):** `loki "<task>"`, `loki owner/repo#N` and `loki quick "<task>"` run the Loki 10 engine and end with a signed receipt (`loki verify`). `loki backlog owner/repo --all` runs many issues in parallel. Guide: `docs/v10/GUIDE.md`. The skill instructions below, and `loki start`, describe the previous bash loop. PRD-file starts (`loki start ./prd.md`) and the opencode provider still run on it until FC38-SWEEP ports them; the legacy-engine command and the LOKI_ENGINE switch remain removed. Prefer `loki owner/repo#N` for issues.
 
@@ -483,4 +483,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v11.17.47 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**
+**v11.17.48 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**

package/VERSION

@@ -1 +1 @@
-11.17.47
+11.17.48

package/autonomy/loki

@@ -74,9 +74,16 @@ fi
 # Default per-run spend cap (single source: default_max_cost_usd in loki-ts/data/model-pricing.json,
 # also read by loki-ts/src/e10ext/budget_cap.ts and autonomy/run.sh). Prints a plain number; 100 only if the file is unreadable.
 loki_budget_default_usd() {
-    local v=""
-    [ -f "$_LOKI_SCRIPT_DIR/../loki-ts/data/model-pricing.json" ] && \
-        v="$(sed -n 's/.*"default_max_cost_usd"[[:space:]]*:[[:space:]]*\([0-9][0-9.]*\).*/\1/p' "$_LOKI_SCRIPT_DIR/../loki-ts/data/model-pricing.json" | head -1)"
+    local f="${1:-$_LOKI_SCRIPT_DIR/../loki-ts/data/model-pricing.json}" v=""
+    if [ -e "$f" ]; then
+        v="$(sed -n 's/.*"default_max_cost_usd"[[:space:]]*:[[:space:]]*\([0-9][0-9.]*\).*/\1/p' "$f" 2>/dev/null | head -1)"
+        case "$v" in
+            '' | *[!0-9.]*)
+                printf '%s\n' "loki: warning: cannot read default_max_cost_usd from $f (unreadable or no parsable key); using fallback 100" >&2
+                v=""
+                ;;
+        esac
+    fi
     printf '%s\n' "${v:-100}"
 }
 
@@ -2697,6 +2704,27 @@ cmd_start() {
         echo -e "${RED}--health-url, --health-match, --auto-rollback, --destination, --canary and --domain apply only with --deploy${NC}" >&2
         exit 2
     fi
+    # Same checks and text as cmd_deploy so the bash route fails before cmd_start.
+    if [ "$_ps_deploy" = 1 ]; then
+        if [ -n "$_ps_dest" ]; then
+            case "$_ps_dest" in
+                preview|staging|production) ;;
+                *) echo -e "${RED}loki deploy --destination must be one of: preview, staging, production${NC}" >&2; exit 2 ;;
+            esac
+        fi
+        if [ "$_ps_rb" = 1 ] && [ -z "$_ps_health" ]; then
+            echo -e "${RED}loki deploy --auto-rollback requires --health-url (no health signal, no rollback)${NC}" >&2
+            exit 2
+        fi
+        if [ -n "$_ps_hmatch" ] && [ -z "$_ps_health" ]; then
+            echo -e "${RED}loki deploy --health-match requires --health-url${NC}" >&2
+            exit 2
+        fi
+        if [ "$_ps_canary" = 1 ] && [ -n "$_ps_dest" ] && [ "$_ps_dest" != production ]; then
+            echo -e "${RED}loki deploy --canary only applies to --destination production${NC}" >&2
+            exit 2
+        fi
+    fi
     if [ -n "$_ps_ws" ]; then
         if [ "$_ps_deploy" = 1 ]; then
             echo -e "${RED}--workspace and --deploy cannot be combined: deploy each repo with loki deploy${NC}" >&2
@@ -7201,7 +7229,7 @@ cmd_stats() {
         case "$1" in
             --json) show_json=true; shift ;;
             --efficiency) show_efficiency=true; shift ;;
-            *) shift ;;
+            *) echo "Unknown option: $1 (see: loki stats --help)" >&2; return 2 ;;
         esac
     done
 

package/autonomy/run.sh

@@ -568,12 +568,22 @@ RESOURCE_MEM_THRESHOLD=${LOKI_RESOURCE_MEM_THRESHOLD:-80}     # Memory % thresho
 # LM-002: the default value is read from default_max_cost_usd in loki-ts/data/model-pricing.json, the same
 # file the Loki 10 engine reads (docs/cost-controls.md). "100.00" is only the
 # fallback when that file is absent, and budget_cap.test.ts pins it to the file.
-_loki_budget_default="$(sed -n 's/.*"default_max_cost_usd"[[:space:]]*:[[:space:]]*\([0-9][0-9.]*\).*/\1/p' \
-    "${SCRIPT_DIR}/../loki-ts/data/model-pricing.json" 2>/dev/null | head -n 1)"
-case "$_loki_budget_default" in
-    '' | *[!0-9.]*) _loki_budget_default="100.00" ;;
-    *) _loki_budget_default="$(awk -v v="$_loki_budget_default" 'BEGIN{printf "%.2f", v}')" ;;
-esac
+_loki_budget_default_from() {
+    local f="$1" v=""
+    if [ ! -e "$f" ]; then
+        printf '%s\n' "100.00"
+        return 0
+    fi
+    v="$(sed -n 's/.*"default_max_cost_usd"[[:space:]]*:[[:space:]]*\([0-9][0-9.]*\).*/\1/p' "$f" 2>/dev/null | head -n 1)"
+    case "$v" in
+        '' | *[!0-9.]*)
+            printf '%s\n' "loki: warning: cannot read default_max_cost_usd from $f (unreadable or no parsable key); using fallback 100.00" >&2
+            printf '%s\n' "100.00"
+            ;;
+        *) awk -v v="$v" 'BEGIN{printf "%.2f\n", v}' ;;
+    esac
+}
+_loki_budget_default="$(_loki_budget_default_from "${SCRIPT_DIR}/../loki-ts/data/model-pricing.json")"
 # Where the active cap came from: flag (loki start --budget), config (settings.json),
 # env (LOKI_BUDGET_LIMIT set by the caller), or default. Printed once at run start.
 if [ "${LOKI_BUDGET_LIMIT+set}" = "set" ]; then

package/completions/_loki

@@ -153,6 +153,14 @@ function _loki {
                         '--help[Show help]' \
                         '1:subcommand:(prometheus)'
                     ;;
+                report)
+                    _arguments \
+                        '--json[Machine-readable JSON output]' \
+                        '--since[Only include runs since this time]:since:' \
+                        '--efficiency[Show efficiency metrics]' \
+                        '--help[Show help]' \
+                        '1:subcommand:(session metrics cost kpis export share dogfood)'
+                    ;;
                 share)
                     _arguments \
                         '--private[Create a secret gist]' \

package/completions/loki.bash

@@ -240,7 +240,7 @@ _loki_completion() {
 
         control)
             if [[ "$cur" == -* ]]; then
-                COMPREPLY=( $(compgen -W "--port --json --help" -- "$cur") )
+                COMPREPLY=( $(compgen -W "--port --json --repo --help" -- "$cur") )
                 return 0
             fi
             COMPREPLY=( $(compgen -W "serve status help" -- "$cur") )

package/dashboard/__init__.py

@@ -7,6 +7,6 @@ Modules:
     control: Session control helpers (status, atomic writes, origin check)
 """
 
-__version__ = "11.17.47"
+__version__ = "11.17.48"
 
 __all__ = ["__version__"]

package/docs/CLI-REFERENCE.md

@@ -1,6 +1,6 @@
 # CLI reference
 
-Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.17.47. Do not edit by hand.
+Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.17.48. Do not edit by hand.
 Hidden and legacy-only commands are omitted; see `docs/v10/CLI-MODERN.md` for the full inventory.
 
 | Command | Description |

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 Loki Mode, by [Autonomi](https://www.autonomi.dev/), turns a spec or an issue into a verified pull request with a receipt you can check. This page covers installing it, a first run, and the options around it.
 
-**Version:** v11.17.47
+**Version:** v11.17.48
 
 **Engine note:** `loki start` is the primary command. `loki start`, `loki "<task>"`, `loki owner/repo#N` and `loki quick` all run the Loki 10 engine, whatever the flag order or input form (PRD file, issue ref, task or one-word brief). The previous loop runs only on `--engine legacy`, `LOKI_ENGINE=legacy`, or for one call when a flag Loki 10 cannot honor is present. See the [user guide](v10/GUIDE.md) and the [5-minute quickstart](QUICKSTART.md).
 

package/docs/v10/BOARD.md

@@ -434,7 +434,7 @@ set is declared to avoid overlap with those and with each other.
 | Q18-11 | group.started/group.unit events and createGroupRenderer (D61-14) have no producer or caller; emit from backlog launcher callbacks and attach the renderer to group runs | loki-ts/src/features/speed/group_grid.ts, loki-ts/src/features/speed/group_output.ts, loki-ts/tests/engine10/output_group.test.ts | MEDIUM | `cd loki-ts && bun test tests/engine10/output_group.test.ts tests/features/speed/group_output.test.ts`; `cd loki-ts && bunx tsc --noEmit` | released@2026-10-17T02:57Z | merge 326cf3402; TL APPROVE cb3e92fca (real-spawn onOut tap untested, follow-up). PO refill 2026-10-17, grep-checked not shipped: Architect confirms file set apart from Q18-08 first; else hold until Q18-08 merges. v11.17.13 npm next 11.17.13 |
 | Q18-03c | P9 allowToken guard residuals from Q18-03b r2: named re-export with as (export { safeGitEnv as x } from safe_git), indirect calls (const f = safeGitEnv; .apply; spread args), and a shadowed args default in a pinned file all give F=0 | tests/moat/p9-rule-of-two.sh | HIGH | bash tests/moat/run.sh | parked@2026-10-17T01:55Z | Shipped via Q18-03d merge 98611351a. D98 2 rounds used: r2 head 2b3421402 closes all r1 bypasses but its comment strip misses regex literals and template nesting, a regression vs main; continued as Q18-03d on top of 2b3421402. r1 BLOCK (HIGH), r2 fix in progress. Source: Q18-03b HIGH r2 notes 1, 2 and 4. Obfuscated key escapes (unicode escapes, computed concatenation) cannot be closed by grep; record as accepted residual. |
 | Q18-03d | P9 allowToken guard: comma, import and indirect scans fail if either raw or comment-stripped text trips them (strip misses regex literals and template nesting); add regex-literal, template-nesting, barrel-of-barrel and strip-only positive controls | tests/moat/p9-rule-of-two.sh | HIGH | bash tests/moat/run.sh | released@2026-10-17T02:57Z | merge 98611351a (includes Q18-03c r2 commits); HIGH APPROVE ec6e0adfd, 4 mutations red, P9 PROVEN. Built on Q18-03c r2 head 2b3421402 (branch q18-03c). HIGH r2 repro payloads: const re = /\/*/; safeGitEnv(process.env, true); // */ and const re = /"/; then const u = "//"; safeGitEnv(...). Fresh review rounds. v11.17.13 npm next 11.17.13 |
-| Q18-03e | P9 allowToken guard: strip helper treats regex literals as opaque (or a regex-aware third pass), so a regex plus a quote inside a comment cannot hide a call from both passes | tests/moat/p9-rule-of-two.sh | HIGH | bash tests/moat/run.sh | blocked (3 BLOCK rounds, last 83a36e8bc in wf_7226ee62-77f-5: P9 slash heuristic misreads o.in / 2 as a regex opener; reslice to replace the bash regex scan with a real JS tokenizer) | Pre-existing gap found by Q18-03d HIGH review (also on main): after the safe_git import, const re = /\/*/; safeGitEnv(process.env /* ' */, true); is MISSED and runs under node. Add it as a positive control. |
+| Q18-03e | P9 allowToken guard: strip helper treats regex literals as opaque (or a regex-aware third pass), so a regex plus a quote inside a comment cannot hide a call from both passes | tests/moat/p9-rule-of-two.sh | HIGH | bash tests/moat/run.sh | ready (reslice 4: 4 BLOCK rounds, last 339fe02ad in wf_d85b02bd-e63; hand-rolled regex/division disambiguation is unfixable (export default /re/, if (a) /re/ vs (4) / 2). ADOPT OSS: find calls with the TypeScript compiler API from loki-ts/node_modules/typescript (ts.createSourceFile plus a CallExpression walk), so comments, strings, regex and JSX are parsed by the real grammar; keep every existing control plus probe-default, probe-extends, probe-mixed; fail closed on parse diagnostics) | Pre-existing gap found by Q18-03d HIGH review (also on main): after the safe_git import, const re = /\/*/; safeGitEnv(process.env /* ' */, true); is MISSED and runs under node. Add it as a positive control. |
 | Q18-05b | AI-BOM filter gaps: secret filter misses github_pat_, glpat-, AIza, npm_, hf_, ASIA, sk_live_ and is case-sensitive; SAFE_NAME drops provider/model ids with one interior slash; hooks.sealed receives the live receipt (pass a frozen clone) | loki-ts/src/engine10/ai_bom.ts, loki-ts/src/engine10/stages/seal.ts, loki-ts/tests/engine10/ai_bom.test.ts | MEDIUM | cd loki-ts && bun test tests/engine10/ai_bom.test.ts tests/engine10/seal.test.ts | released@2026-10-17T02:57Z | merge ae90c2875 dist 0eb48d905; TL APPROVE 82058ff97 (102 pass, 4 mutations red). Test file is tests/features/ai_bom.test.ts. Source: Q18-05 HIGH review notes. Keep engine10 core net zero. v11.17.13 npm next 11.17.13 |
 | COST-WALL-f | Partial cost read as complete outside benchmarks: trust_trajectory cost_per_accepted_usd ignores cost.cost_partial; check cost-summary.py and proof-generator.py the same way, routing through one partial check | autonomy/lib/trust_trajectory.py, autonomy/lib/cost-summary.py, autonomy/lib/proof-generator.py, tests/test_efficiency_cost_availability.py | HIGH | python3 -m pytest tests/test_efficiency_cost_availability.py -q | released@2026-10-17T02:57Z | merge 3d0587f4f dist 7919f31ca; HIGH r2 APPROVE ef9979ad8 (53 pytest, 11 cost-cli, 33 bun pass; 5 of 6 mutations red). Follow-ups: template costIsPartial JS harness, dashboard series partial marker, cost-summary Avg/iter label. r1 BLOCK (HIGH), r2 fix in progress. Source: COST-WALL-e HIGH r1 note 4 (FC-COST-PARTIAL-b siblings). v11.17.13 npm next 11.17.13 |
 | Q17-06 | COST-6 offline half: `attribution.py` dry-run prints a cost-per-accepted-task table with the ratio against raw Claude Code and against the 0.5x target, using existing result files, so the paid `--execute` run only has to plug in numbers. | benchmarks/bench/attribution.py, benchmarks/bench/test_attribution.py | MEDIUM | `python3 -I benchmarks/bench/attribution.py --dry-run`; `python3 -m pytest benchmarks/bench -k attribution -q` | released@2026-10-17T03:50Z | Merged fe3a4e252 (6b9bd03d6; line-828 mutation caught: 1 failed 93 passed, restored 94 passed). COST-6 is parked as a paid eval needing a spend go. This re-slice needs no spend. Cost audit 2026-10-16: best measured run is 0.68x of raw, none reaches 0.5x. Report both floors (attribution.py:778). Confirm the test file name by `ls`. Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
@@ -1212,36 +1212,36 @@ Source: ~/git/autonomi-dev/research/2026-09-30-adoption/SWARM-PROMPT-ADOPTION.md
 | TEN-SPEED-12 | enhancement: cache the repo profile (LOKI_REPO_PROFILE=1 path) keyed on HEAD sha and dirty flag so a resumed run does not rescan the tree | loki-ts/src/runner/repo_profile.ts, loki-ts/tests/runner/autonomous.test.ts | MEDIUM | red: `cd loki-ts && bun test tests/runner/autonomous.test.ts -t "repo profile cache hit"` fails (scan runs twice); green: passes, cache invalidates on a new commit | released v11.17.46 | Gap: autonomous.ts:633 calls the profiler each start; read repo_profile.ts first and drop if a cache exists |
 | TEN-QUALITY-26 | fix: `loki wiki show <bad-section>` should list the valid sections (architecture, modules, data-flow) in the error and exit 2; extend the wiki test | loki-ts/src/commands/wiki.ts, loki-ts/tests/commands/wiki.test.ts | LOW | red: `cd loki-ts && bun test tests/commands/wiki.test.ts -t "bad section lists valid"` fails; green: passes, valid sections unchanged | released v11.17.46 | Gap: wiki.ts:51 prints the section list only in the usage branch; check the unknown-section branch first |
 | TEN-UX-29 | fix: `loki report kpis --since` with no value, or followed by another flag, reports an empty invalid value and consumes the next flag; print "--since requires a value" and exit 1 without swallowing the next token; chain after TEN-SPEED-11 | loki-ts/src/commands/kpis.ts, loki-ts/tests/commands/kpis.test.ts | LOW | red: `cd loki-ts && bun test tests/commands/kpis.test.ts -t "since missing value"` fails (message names an empty value); green: passes, `--since 7d` and `--since=7d` unchanged | released v11.17.46 | Gap: kpis.ts:87 `args[++i] ?? ""` eats the next token; chain after TEN-SPEED-11 |
-| TEN-QUALITY-27 | test: the "corrupt budget state rebuilds used from efficiency records" case in budget.test.ts asserts only budget_used; also assert limit, budget_limit and exceeded for BUDGET_LIMIT unset, below the cap and at the cap, so a rebuild can never silently disarm the cap | loki-ts/tests/runner/budget.test.ts | LOW | red: mutate rebuildBudgetState to return `exceeded: false` and `limit: 0` and run `cd loki-ts && bun test tests/runner/budget.test.ts -t "rebuilds"`, it fails; green: restored source passes | ready | Gap: budget.test.ts:278-290 checks `.budget_used` only; budget.ts:316-325 computes limit, budget_limit and exceeded with no test; seed from the TEN-COST-39 review |
-| TEN-QUALITY-28 | test: control.test.ts has only the missing-value cases for `backfill --repo`; add the positive `backfill --repo DIR` case (ships DIR, not cwd) and the bare `backfill DIR` case, with an injected env so nothing is sent | loki-ts/tests/commands/control.test.ts | LOW | red: mutate control.ts:235 to ignore `--repo` and run `cd loki-ts && bun test tests/commands/control.test.ts -t "backfill repo DIR"`, it fails; green: restored source passes | ready | Gap: control.test.ts:171-180 is the only backfill block and covers only exit 2; the positive path is unpinned; seed from the TEN-STABILITY-26 review |
-| TEN-COST-42 | fix: the bash readers of default_max_cost_usd (run.sh `_loki_budget_default`, autonomy/loki `loki_budget_default_usd`) fall back to 100 with no word when model-pricing.json is present but unreadable or has no parsable key; print one stderr warning naming the file, as the TS side does (TEN-COST-40), and keep the 100 fallback | autonomy/run.sh, autonomy/loki, tests/test-pricing-parity.sh | MEDIUM | red: add a case in tests/test-pricing-parity.sh that points the reader at an unreadable copy and expects a warning on stderr; `bash tests/test-pricing-parity.sh` fails; green: passes and a healthy file prints nothing extra | ready | Gap: run.sh:571 `sed ... 2>/dev/null` then `case '' ) 100.00`; autonomy/loki:79 `[ -f ... ] && sed` with no else branch; absent-file stays silent (that is the documented fallback), unreadable or keyless must warn |
-| TEN-COST-44 | enhancement: readEfficiencyDir skips malformed efficiency records silently, so a rebuilt budget undercounts spend with no hint; count the skipped files and have rebuildBudgetState include the count in its existing one-line warning; chain after TEN-QUALITY-27 | loki-ts/src/runner/budget.ts, loki-ts/tests/runner/budget.test.ts | MEDIUM | red: `cd loki-ts && bun test tests/runner/budget.test.ts -t "skipped malformed"` fails (warning has no count); green: passes, the returned records and the 4-decimal cost are unchanged | ready | Gap: budget.ts:280-286 `catch { // ignore malformed file }`; budget.ts:320 warns only with the record count; chain after TEN-QUALITY-27 (same test file) |
-| TEN-COST-45 | fix: `loki estimate --provider bogus` and `--model nosuchmodel` are accepted and priced through whatever the resolver returns, while `loki start` rejects an unknown provider with exit 2; validate against the same provider list and print one error line naming the fix, exit 1 | loki-ts/src/runner/router/cost_preview.ts, loki-ts/tests/runner/cost_preview.test.ts | LOW | red: `cd loki-ts && bun test tests/runner/cost_preview.test.ts -t "unknown provider"` fails (exit 0); green: passes, claude, codex and a known model unchanged | ready | Gap: cost_preview.ts:151 stores any `--provider` value; start.ts:272 is the validating counterpart (VALID_PROVIDERS); confirm the run-history fixture prints a number for a bogus provider before filing the fix |
-| TEN-STABILITY-32 | fix: a set but unparseable LOKI_E10_CAP_S ("abc", "0", "-5") or loki.yaml budgets.run_cap_s is dropped by envCapS and yamlRunCapS and the 900s default silently applies in four readers; make the one helper return a warning once on stderr naming the bad value and the default used (never loosen the cap) | loki-ts/src/engine10/types.ts, loki-ts/src/util/run_cap.ts, loki-ts/tests/engine10/cap.test.ts | MEDIUM | red: `cd loki-ts && bun test tests/engine10/cap.test.ts -t "invalid cap warns"` fails (no output); green: passes, valid values and the unset case print nothing | ready | Gap: types.ts:23 `Number.isFinite(n) && n > 0 ? n : null` with no diagnostic; consumers worker.ts:41, supervisor.ts:163, run_cap.ts:60 all read it; sibling of TEN-STABILITY-27 which covered only LOKI_E10_STALL_S |
-| TEN-STABILITY-33 | fix: `loki start ./prd.md --brief --yes` (and --prd, --completion-promise, --aider-model, --aider-flags, --cline-model) takes the next flag token as the value, so a forgotten value becomes a paid run on the text "--yes"; a value that starts with "-" or is empty must print one error naming the flag and exit 2 (use `--flag=-x` for a dash-leading value) | loki-ts/src/commands/start.ts, loki-ts/tests/commands/start.test.ts | MEDIUM | red: `cd loki-ts && bun test tests/commands/start.test.ts -t "value flag swallows flag"` fails (parse succeeds with brief "--yes"); green: passes and `cd loki-ts && bunx tsc --noEmit` exits 0 | ready | Gap: start.ts:29 argVal returns args[i+1] with no flag-shape check; TEN-COST-36 only covered the six numeric flags; chain before TEN-UX-32 |
-| TEN-UX-32 | fix: `loki start ./a.md --prd ./b.md --brief "x"` silently picks --prd and drops the others; when two or more of positional spec, --prd and --brief are given with different values, print which one wins or refuse with exit 2 naming all of them; chain after TEN-STABILITY-33 | loki-ts/src/commands/start.ts, loki-ts/tests/commands/start.test.ts | MEDIUM | red: `cd loki-ts && bun test tests/commands/start.test.ts -t "conflicting spec sources"` fails (exit 0); green: passes, a single source and `--prd` equal to the positional are unchanged | ready | Gap: start.ts `prdFlag ?? briefFlag ?? spec` precedence with no conflict check; chain after TEN-STABILITY-33 (same file) |
-| TEN-COST-43 | fix: `loki start prd.md --budget-limit 5 --budget 50` reads the first flag and silently drops the second, so the cap the user meant last can be the one ignored; differing values must print one error naming both flags and exit 2; chain after TEN-UX-32 | loki-ts/src/commands/start.ts, loki-ts/tests/commands/start.test.ts | MEDIUM | red: `cd loki-ts && bun test tests/commands/start.test.ts -t "conflicting budget flags"` fails (cap 5 applied, no message); green: passes, equal values and a single flag unchanged | ready | Gap: start.ts `posNum(argVal(args, "--budget-limit") ?? argVal(args, "--budget"))`; chain after TEN-UX-32 (same file) |
-| TEN-DEPLOY-21 | fix: `loki start prd.md --deploy --destination prod`, `--auto-rollback` or `--health-match` without `--health-url`, and `--canary` with a non-production destination are only rejected by `loki deploy` AFTER the paid build finishes; reject them in deployFlagError before the run; chain after TEN-COST-43 | loki-ts/src/commands/start.ts, loki-ts/tests/commands/start.test.ts | MEDIUM | red: `cd loki-ts && bun test tests/commands/start.test.ts -t "deploy flags fail before build"` fails (returns null for each case); green: passes, valid combinations unchanged | ready | Gap: start.ts deployFlagError checks only --health-url, --domain and --env-file; the destination enum, health-url requirement and canary rule live at autonomy/loki:11176-11256 and run after cmd_start (autonomy/loki:2733); chain after TEN-COST-43 (same file) |
-| TEN-DEPLOY-22 | fix: the bash `start` parser (autonomy/loki `_ps_*`) has the same late validation for `--destination`, `--health-match`/`--auto-rollback` without `--health-url`, and `--canary` with a non-production destination; copy the three checks next to the existing "apply only with --deploy" guard so the bash route fails before cmd_start | autonomy/loki, tests/test-deploy.sh | MEDIUM | red: add cases to tests/test-deploy.sh that run `loki start --deploy --destination prod` and expect exit 2 before any start output; `bash tests/test-deploy.sh` fails; green: passes | ready | Gap: autonomy/loki:2696 checks only that deploy flags need --deploy; enum and pairing checks sit in cmd_deploy at 11176 and 11245-11256; message text must match cmd_deploy so one doc covers both |
-| TEN-STABILITY-34 | fix: `loki queue list --bogus`, `queue clear extra` and `queue run --bogus` ignore unknown flags and extra args (queueRun only looks for --no-pr and --max-total-cost); reject with the usage line and exit 2, so a mistyped --no-pr cannot open PRs | loki-ts/src/commands/queue.ts, loki-ts/tests/commands/queue.test.ts | LOW | red: `cd loki-ts && bun test tests/commands/queue.test.ts -t "unknown flag"` fails (exit 0); green: passes, valid forms unchanged | ready | Gap: queue.ts:262 `args.includes("--no-pr")` with no allow-list; queueList(d) and queueClear(d) are called without their args at queue.ts:475-481; sibling of TEN-DEPLOY-16 |
-| TEN-ADOPTION-25 | feature: `loki queue list --json` printing the queued refs as a JSON array so scripts and editors can read the queue; plain output stays byte identical; chain after TEN-STABILITY-34 | loki-ts/src/commands/queue.ts, loki-ts/tests/commands/queue.test.ts | LOW | red: `cd loki-ts && bun test tests/commands/queue.test.ts -t "list json"` fails (unknown flag); green: passes, text output golden unchanged | ready | Gap: queue.ts has no --json for list (the only --json at :353 is the usage governor call); chain after TEN-STABILITY-34 (same file) |
-| TEN-STABILITY-35 | fix: preflight passes a git repo with no commits (git init, nothing committed) and the run then dies inside worktree creation with a raw "invalid reference: HEAD"; add a HEAD check and the fatal line `repository has no commits; run: git add . && git commit -m init` | loki-ts/src/engine10/preflight.ts, loki-ts/tests/engine10/preflight.test.ts | MEDIUM | red: `cd loki-ts && bun test tests/engine10/preflight.test.ts -t "no commits"` fails (fatal is null); green: passes, a repo with one commit and the empty-folder auto-init path unchanged | ready | Gap: preflight.ts checks only `rev-parse --is-inside-work-tree` and the git identity; first_run_repo.ts:11 even tells a non-empty folder user to run `git init` first, which leaves exactly this state |
-| TEN-STABILITY-36 | enhancement: preflight has no free-disk check, so a full volume fails mid-run in worktree or event-log writes; warn under 2 GB free and refuse under 200 MB on the repo volume with a message naming the volume, reuse statfsSync like the doctor disk check; chain after TEN-STABILITY-35 | loki-ts/src/engine10/preflight.ts, loki-ts/tests/engine10/preflight.test.ts | MEDIUM | red: `cd loki-ts && bun test tests/engine10/preflight.test.ts -t "low disk"` fails (no warning, injected statfs ignored); green: passes, normal disk prints nothing | ready | Gap: no statfs in src/engine10; doctor.ts:405 already computes it for `loki doctor`; thresholds overridable by LOKI_MIN_FREE_MB; chain after TEN-STABILITY-35 (same file) |
-| TEN-SPEED-14 | enhancement: checkPreflight awaits `rev-parse` before it starts the two `git config` reads; start all three together and re-run the work-tree check only when auto-init ran, saving one git spawn on every `loki start`; chain after TEN-STABILITY-36 | loki-ts/src/engine10/preflight.ts, loki-ts/tests/engine10/preflight.test.ts | LOW | red: `cd loki-ts && bun test tests/engine10/preflight.test.ts -t "parallel git reads"` fails (spawn order is serial); green: passes, every existing preflight verdict and message unchanged | ready | Gap: preflight.ts `let wt0 = await git(...)` then `Promise.all([Promise.resolve(wt0), git(name), git(email)])`; chain after TEN-STABILITY-36 (same file) |
-| TEN-SPEED-13 | enhancement: buildTestMap walks the whole tree with readdirSync minus a skip list, which is slow on a large monorepo; take the file list from `git ls-files` (safe_git) with the walk as the fallback outside a repo, same sorted output | loki-ts/src/engine10/testmap.ts, loki-ts/tests/engine10/testmap.test.ts | MEDIUM | red: `cd loki-ts && bun test tests/engine10/testmap.test.ts -t "tracked files only"` fails (an ignored node_modules-like dir is walked); green: passes, existing fixtures give the same map | ready | Gap: testmap.ts:66 carries the author note "full recursive walk ... use git ls-files if a huge monorepo makes this slow"; untracked-but-ignored dirs not in SKIP_DIRS are walked today |
-| TEN-STABILITY-37 | fix: engine10 supervisor main() pushes every unrecognised token into the task words, so `loki "fix the bug" --no-prr` or `--dry-run` becomes part of the paid task text; reject unknown dash-leading tokens with a usage line and exit 2, and honour `--` as the end of options | loki-ts/src/engine10/supervisor.ts, loki-ts/tests/engine10/spec_first_intent.test.ts | MEDIUM | red: `cd loki-ts && bun test tests/engine10/spec_first_intent.test.ts -t "unknown flag"` fails (task contains the flag); green: passes, tasks without flags and `-- -weird task` unchanged | ready | Gap: supervisor.ts:255-262 final `else words.push(a)`; the start route (engineArgv) only emits known flags, so the direct `loki "<task>"` entry is the exposed one |
-| TEN-UX-33 | fix: supervisor `--provider` with no value or a flag-shaped value keeps the env provider or takes the next flag as the provider name; print "--provider needs a value" and exit 2; chain after TEN-STABILITY-37 | loki-ts/src/engine10/supervisor.ts, loki-ts/tests/engine10/spec_first_intent.test.ts | LOW | red: `cd loki-ts && bun test tests/engine10/spec_first_intent.test.ts -t "provider needs a value"` fails; green: passes, `--provider codex` unchanged | ready | Gap: supervisor.ts:254 `provider = args[++i] ?? provider`; chain after TEN-STABILITY-37 (same file) |
-| TEN-STABILITY-38 | fix: supervisor treats any token starting with `--max-cost` as the cap flag, so `--max-costly` or `--max-cost5` slices garbage (`a.slice(11)`) or swallows the next token; match `--max-cost` exactly or `--max-cost=`; chain after TEN-UX-33 | loki-ts/src/engine10/supervisor.ts, loki-ts/tests/engine10/spec_first_intent.test.ts | LOW | red: `cd loki-ts && bun test tests/engine10/spec_first_intent.test.ts -t "max-cost prefix"` fails; green: passes, `--max-cost 5` and `--max-cost=5` unchanged | ready | Gap: supervisor.ts:253 `a.startsWith("--max-cost")`; chain after TEN-UX-33 (same file) |
-| TEN-UX-30 | fix: `loki stats --bogus` is ignored and prints stats with exit 0 on the TS route and in bash; reject unknown flags with one line and exit 2 on both routes (--json, --efficiency, --help stay) | loki-ts/src/commands/stats.ts, loki-ts/tests/commands/stats.test.ts | LOW | red: `cd loki-ts && bun test tests/commands/stats.test.ts -t "unknown flag"` fails (exit 0); green: passes and `bun test tests/commands/stats.test.ts` stays green; if a bash-parity test pins the old exit 0, update it in the same change | ready | Gap: stats.ts:473 comment "unknown flags ignored to match bash behavior"; observed `loki stats --bogus` prints the session table and exits 0; a mistyped --json silently gives text |
-| TEN-UX-31 | fix: `loki version --bogus` prints the version and exits 0; reject an unknown flag with a usage line and exit 2 (--json, --help, -h, help stay) | loki-ts/src/commands/version.ts, loki-ts/tests/commands/version.test.ts | LOW | red: `cd loki-ts && bun test tests/commands/version.test.ts -t "unknown flag"` fails (exit 0); green: passes, plain output byte identical | ready | Gap: version.ts:17-27 reads only --json and the help words; observed `loki version --bogus` prints `Loki Mode v11.17.46` exit 0; seed from the sibling sweep of TEN-UX-20 |
-| TEN-UX-36 | fix: `loki status run-a run-b` reports "unknown flag run-b" for a second run id and the usage line omits [run-id]; print "too many arguments: expected one run id" with the full usage and exit 1 | loki-ts/src/commands/run_status.ts, loki-ts/tests/commands/run_status.test.ts | LOW | red: `cd loki-ts && bun test tests/commands/run_status.test.ts -t "second run id"` fails (message says unknown flag); green: passes, one run id and --json unchanged | ready | Gap: run_status.ts:143 shares one else branch for extra positionals and flags and prints `Usage: loki status [--json]` |
-| TEN-UX-34 | fix: `loki answer --text` with no value silently falls through to the saved Control Plane answer (or "no answer"), so a forgotten value answers with stale text; print "--text needs a value" and exit 2 | loki-ts/src/features/blocked_answer.ts, loki-ts/tests/features/blocked_answer.test.ts | LOW | red: `cd loki-ts && bun test tests/features/blocked_answer.test.ts -t "text needs a value"` fails; green: passes, `--text "x"`, `--text=x` and the file path unchanged | ready | Gap: blocked_answer.ts:63 `text = args[++i]` stores undefined, then `text ?? readAnswerFile(...)` at :70 |
-| TEN-SECURITY-12 | fix: loadSigningKey returns null with no word when LOKI_RECEIPT_SIGNING_KEY_FILE points at an unreadable file, a malformed PEM or a non-ed25519 key, so the run seals an UNSIGNED receipt and the user never learns why; return a reason (file unreadable, not a PEM, not ed25519) that the seal step prints on one stderr line, never the key bytes, and keep the receipt UNSIGNED, never invent a signature | loki-ts/src/util/receipt_signer.ts, loki-ts/tests/engine10/seal_verify_roundtrip.test.ts | HIGH | red: `cd loki-ts && bun test tests/engine10/seal_verify_roundtrip.test.ts -t "unusable signing key names the reason"` fails (no reason, no stderr line); green: passes, the default generated key and a valid explicit key sign exactly as before | ready | Gap: receipt_signer.ts:57-59 outer `catch { return null; }` and :50 `k.asymmetricKeyType === "ed25519" ? k : null` collapse every failure into the same UNSIGNED result; HIGH because it is the Seal; reviewers must confirm no key material reaches the message |
-| TEN-SPEED-15 | enhancement: collectToolchain spawns `node`, `python3` and `git --version` serially with spawnSync on every seal; memoize the result per process (tools do not change inside one run) and run the probes together, receipt body unchanged; chain after TEN-SECURITY-12 | loki-ts/src/util/receipt_signer.ts, loki-ts/tests/engine10/seal_verify_roundtrip.test.ts | MEDIUM | red: `cd loki-ts && bun test tests/engine10/seal_verify_roundtrip.test.ts -t "toolchain probed once"` fails (probe called per seal); green: passes, toolchain fields identical in the receipt | ready | Gap: receipt_signer.ts:75-80 toolVersion uses spawnSync with a 5s timeout per tool and collectToolchain has no cache; chain after TEN-SECURITY-12 (same file) |
-| TEN-GATES-25 | fix: `loki verify --bogus` and `loki verify run-a run-b` treat the first token as the run id, so a typo yields a misleading "no such receipt" style verdict and extra ids are ignored; reject unknown dash-leading flags and more than one positional with a usage line and exit 2, never change any verdict exit code | loki-ts/src/engine10/verify_cmd.ts, loki-ts/tests/engine10/verify_cmd.test.ts | HIGH | red: `cd loki-ts && bun test tests/engine10/verify_cmd.test.ts -t "unknown flag and extra id"` fails; green: passes and the whole verify_cmd suite stays green (exit 0/1/2/3/4/66 mapping unchanged) | ready | Gap: verify_cmd.ts verifyMain strips known flags then uses `args[0] ?? latestRunId(...)` with no leftover check; HIGH because it is the verifier front door and a wrong exit here is a false-green risk |
-| TEN-GATES-26 | feature: `loki verify [run-id] --json` printing {run, verdict, receipt_sha256, reasons, agent_independent:{k,of}} on stdout so CI can gate without scraping text; exit codes unchanged and the text output stays byte identical without the flag; chain after TEN-GATES-25 | loki-ts/src/engine10/verify_cmd.ts, loki-ts/tests/engine10/verify_cmd.test.ts | HIGH | red: `cd loki-ts && bun test tests/engine10/verify_cmd.test.ts -t "verify json"` fails (unknown flag); green: passes, golden text output unchanged | ready | Gap: verify_cmd.ts has no --json (verify-pr has one, TEN-GATES-21); independentLine() already computes k and the pass count; chain after TEN-GATES-25 (same file) |
-| TEN-ADOPTION-24 | feature: `loki wiki show --json` printing {section, content} (or all sections) so tooling can read the generated wiki without parsing text; text output unchanged | loki-ts/src/commands/wiki.ts, loki-ts/tests/commands/wiki.test.ts | LOW | red: `cd loki-ts && bun test tests/commands/wiki.test.ts -t "show json"` fails (unknown option); green: passes, text golden unchanged | ready | Gap: wiki.ts:55 rejects every dash token except --help and there is no json path; wiki.ts has 0 --json occurrences |
-| TEN-ADOPTION-26 | feature: `loki issues run --dry-run --json` printing the triage decision per issue (number, decision, reason, covered_by_pr) so CI can review the plan before any paid run | loki-ts/src/commands/issues_run.ts, loki-ts/tests/commands/issues_run.test.ts | LOW | red: `cd loki-ts && bun test tests/commands/issues_run.test.ts -t "dry run json"` fails (unexpected argument: --json); green: passes, the text table unchanged | ready | Gap: issues_run.ts:82-99 arg loop has no --json; triage results (`t.decision`, `t.reason`) and coveredIssues() already exist at :262-290 and :104 |
+| TEN-QUALITY-27 | test: the "corrupt budget state rebuilds used from efficiency records" case in budget.test.ts asserts only budget_used; also assert limit, budget_limit and exceeded for BUDGET_LIMIT unset, below the cap and at the cap, so a rebuild can never silently disarm the cap | loki-ts/tests/runner/budget.test.ts | LOW | red: mutate rebuildBudgetState to return `exceeded: false` and `limit: 0` and run `cd loki-ts && bun test tests/runner/budget.test.ts -t "rebuilds"`, it fails; green: restored source passes | released v11.17.48 | Gap: budget.test.ts:278-290 checks `.budget_used` only; budget.ts:316-325 computes limit, budget_limit and exceeded with no test; seed from the TEN-COST-39 review |
+| TEN-QUALITY-28 | test: control.test.ts has only the missing-value cases for `backfill --repo`; add the positive `backfill --repo DIR` case (ships DIR, not cwd) and the bare `backfill DIR` case, with an injected env so nothing is sent | loki-ts/tests/commands/control.test.ts | LOW | red: mutate control.ts:235 to ignore `--repo` and run `cd loki-ts && bun test tests/commands/control.test.ts -t "backfill repo DIR"`, it fails; green: restored source passes | released v11.17.48 | Gap: control.test.ts:171-180 is the only backfill block and covers only exit 2; the positive path is unpinned; seed from the TEN-STABILITY-26 review |
+| TEN-COST-42 | fix: the bash readers of default_max_cost_usd (run.sh `_loki_budget_default`, autonomy/loki `loki_budget_default_usd`) fall back to 100 with no word when model-pricing.json is present but unreadable or has no parsable key; print one stderr warning naming the file, as the TS side does (TEN-COST-40), and keep the 100 fallback | autonomy/run.sh, autonomy/loki, tests/test-pricing-parity.sh | MEDIUM | red: add a case in tests/test-pricing-parity.sh that points the reader at an unreadable copy and expects a warning on stderr; `bash tests/test-pricing-parity.sh` fails; green: passes and a healthy file prints nothing extra | released v11.17.48 | Gap: run.sh:571 `sed ... 2>/dev/null` then `case '' ) 100.00`; autonomy/loki:79 `[ -f ... ] && sed` with no else branch; absent-file stays silent (that is the documented fallback), unreadable or keyless must warn |
+| TEN-COST-44 | enhancement: readEfficiencyDir skips malformed efficiency records silently, so a rebuilt budget undercounts spend with no hint; count the skipped files and have rebuildBudgetState include the count in its existing one-line warning; chain after TEN-QUALITY-27 | loki-ts/src/runner/budget.ts, loki-ts/tests/runner/budget.test.ts | MEDIUM | red: `cd loki-ts && bun test tests/runner/budget.test.ts -t "skipped malformed"` fails (warning has no count); green: passes, the returned records and the 4-decimal cost are unchanged | released v11.17.48 | Gap: budget.ts:280-286 `catch { // ignore malformed file }`; budget.ts:320 warns only with the record count; chain after TEN-QUALITY-27 (same test file) |
+| TEN-COST-45 | fix: `loki estimate --provider bogus` and `--model nosuchmodel` are accepted and priced through whatever the resolver returns, while `loki start` rejects an unknown provider with exit 2; validate against the same provider list and print one error line naming the fix, exit 1 | loki-ts/src/runner/router/cost_preview.ts, loki-ts/tests/runner/cost_preview.test.ts | LOW | red: `cd loki-ts && bun test tests/runner/cost_preview.test.ts -t "unknown provider"` fails (exit 0); green: passes, claude, codex and a known model unchanged | released v11.17.48 | Gap: cost_preview.ts:151 stores any `--provider` value; start.ts:272 is the validating counterpart (VALID_PROVIDERS); confirm the run-history fixture prints a number for a bogus provider before filing the fix |
+| TEN-STABILITY-32 | fix: a set but unparseable LOKI_E10_CAP_S ("abc", "0", "-5") or loki.yaml budgets.run_cap_s is dropped by envCapS and yamlRunCapS and the 900s default silently applies in four readers; make the one helper return a warning once on stderr naming the bad value and the default used (never loosen the cap) | loki-ts/src/engine10/types.ts, loki-ts/src/util/run_cap.ts, loki-ts/tests/engine10/cap.test.ts | MEDIUM | red: `cd loki-ts && bun test tests/engine10/cap.test.ts -t "invalid cap warns"` fails (no output); green: passes, valid values and the unset case print nothing | released v11.17.48 | Gap: types.ts:23 `Number.isFinite(n) && n > 0 ? n : null` with no diagnostic; consumers worker.ts:41, supervisor.ts:163, run_cap.ts:60 all read it; sibling of TEN-STABILITY-27 which covered only LOKI_E10_STALL_S |
+| TEN-STABILITY-33 | fix: `loki start ./prd.md --brief --yes` (and --prd, --completion-promise, --aider-model, --aider-flags, --cline-model) takes the next flag token as the value, so a forgotten value becomes a paid run on the text "--yes"; a value that starts with "-" or is empty must print one error naming the flag and exit 2 (use `--flag=-x` for a dash-leading value) | loki-ts/src/commands/start.ts, loki-ts/tests/commands/start.test.ts | MEDIUM | red: `cd loki-ts && bun test tests/commands/start.test.ts -t "value flag swallows flag"` fails (parse succeeds with brief "--yes"); green: passes and `cd loki-ts && bunx tsc --noEmit` exits 0 | released v11.17.48 | Gap: start.ts:29 argVal returns args[i+1] with no flag-shape check; TEN-COST-36 only covered the six numeric flags; chain before TEN-UX-32 |
+| TEN-UX-32 | fix: `loki start ./a.md --prd ./b.md --brief "x"` silently picks --prd and drops the others; when two or more of positional spec, --prd and --brief are given with different values, print which one wins or refuse with exit 2 naming all of them; chain after TEN-STABILITY-33 | loki-ts/src/commands/start.ts, loki-ts/tests/commands/start.test.ts | MEDIUM | red: `cd loki-ts && bun test tests/commands/start.test.ts -t "conflicting spec sources"` fails (exit 0); green: passes, a single source and `--prd` equal to the positional are unchanged | released v11.17.48 | Gap: start.ts `prdFlag ?? briefFlag ?? spec` precedence with no conflict check; chain after TEN-STABILITY-33 (same file) |
+| TEN-COST-43 | fix: `loki start prd.md --budget-limit 5 --budget 50` reads the first flag and silently drops the second, so the cap the user meant last can be the one ignored; differing values must print one error naming both flags and exit 2; chain after TEN-UX-32 | loki-ts/src/commands/start.ts, loki-ts/tests/commands/start.test.ts | MEDIUM | red: `cd loki-ts && bun test tests/commands/start.test.ts -t "conflicting budget flags"` fails (cap 5 applied, no message); green: passes, equal values and a single flag unchanged | released v11.17.48 | Gap: start.ts `posNum(argVal(args, "--budget-limit") ?? argVal(args, "--budget"))`; chain after TEN-UX-32 (same file) |
+| TEN-DEPLOY-21 | fix: `loki start prd.md --deploy --destination prod`, `--auto-rollback` or `--health-match` without `--health-url`, and `--canary` with a non-production destination are only rejected by `loki deploy` AFTER the paid build finishes; reject them in deployFlagError before the run; chain after TEN-COST-43 | loki-ts/src/commands/start.ts, loki-ts/tests/commands/start.test.ts | MEDIUM | red: `cd loki-ts && bun test tests/commands/start.test.ts -t "deploy flags fail before build"` fails (returns null for each case); green: passes, valid combinations unchanged | released v11.17.48 | Gap: start.ts deployFlagError checks only --health-url, --domain and --env-file; the destination enum, health-url requirement and canary rule live at autonomy/loki:11176-11256 and run after cmd_start (autonomy/loki:2733); chain after TEN-COST-43 (same file) |
+| TEN-DEPLOY-22 | fix: the bash `start` parser (autonomy/loki `_ps_*`) has the same late validation for `--destination`, `--health-match`/`--auto-rollback` without `--health-url`, and `--canary` with a non-production destination; copy the three checks next to the existing "apply only with --deploy" guard so the bash route fails before cmd_start | autonomy/loki, tests/test-deploy.sh | MEDIUM | red: add cases to tests/test-deploy.sh that run `loki start --deploy --destination prod` and expect exit 2 before any start output; `bash tests/test-deploy.sh` fails; green: passes | released v11.17.48 | Gap: autonomy/loki:2696 checks only that deploy flags need --deploy; enum and pairing checks sit in cmd_deploy at 11176 and 11245-11256; message text must match cmd_deploy so one doc covers both |
+| TEN-STABILITY-34 | fix: `loki queue list --bogus`, `queue clear extra` and `queue run --bogus` ignore unknown flags and extra args (queueRun only looks for --no-pr and --max-total-cost); reject with the usage line and exit 2, so a mistyped --no-pr cannot open PRs | loki-ts/src/commands/queue.ts, loki-ts/tests/commands/queue.test.ts | LOW | red: `cd loki-ts && bun test tests/commands/queue.test.ts -t "unknown flag"` fails (exit 0); green: passes, valid forms unchanged | released v11.17.48 | Gap: queue.ts:262 `args.includes("--no-pr")` with no allow-list; queueList(d) and queueClear(d) are called without their args at queue.ts:475-481; sibling of TEN-DEPLOY-16 |
+| TEN-ADOPTION-25 | feature: `loki queue list --json` printing the queued refs as a JSON array so scripts and editors can read the queue; plain output stays byte identical; chain after TEN-STABILITY-34 | loki-ts/src/commands/queue.ts, loki-ts/tests/commands/queue.test.ts | LOW | red: `cd loki-ts && bun test tests/commands/queue.test.ts -t "list json"` fails (unknown flag); green: passes, text output golden unchanged | released v11.17.48 | Gap: queue.ts has no --json for list (the only --json at :353 is the usage governor call); chain after TEN-STABILITY-34 (same file) |
+| TEN-STABILITY-35 | fix: preflight passes a git repo with no commits (git init, nothing committed) and the run then dies inside worktree creation with a raw "invalid reference: HEAD"; add a HEAD check and the fatal line `repository has no commits; run: git add . && git commit -m init` | loki-ts/src/engine10/preflight.ts, loki-ts/tests/engine10/preflight.test.ts | MEDIUM | red: `cd loki-ts && bun test tests/engine10/preflight.test.ts -t "no commits"` fails (fatal is null); green: passes, a repo with one commit and the empty-folder auto-init path unchanged | released v11.17.48 | Gap: preflight.ts checks only `rev-parse --is-inside-work-tree` and the git identity; first_run_repo.ts:11 even tells a non-empty folder user to run `git init` first, which leaves exactly this state |
+| TEN-STABILITY-36 | enhancement: preflight has no free-disk check, so a full volume fails mid-run in worktree or event-log writes; warn under 2 GB free and refuse under 200 MB on the repo volume with a message naming the volume, reuse statfsSync like the doctor disk check; chain after TEN-STABILITY-35 | loki-ts/src/engine10/preflight.ts, loki-ts/tests/engine10/preflight.test.ts | MEDIUM | red: `cd loki-ts && bun test tests/engine10/preflight.test.ts -t "low disk"` fails (no warning, injected statfs ignored); green: passes, normal disk prints nothing | released v11.17.48 | Gap: no statfs in src/engine10; doctor.ts:405 already computes it for `loki doctor`; thresholds overridable by LOKI_MIN_FREE_MB; chain after TEN-STABILITY-35 (same file) |
+| TEN-SPEED-14 | enhancement: checkPreflight awaits `rev-parse` before it starts the two `git config` reads; start all three together and re-run the work-tree check only when auto-init ran, saving one git spawn on every `loki start`; chain after TEN-STABILITY-36 | loki-ts/src/engine10/preflight.ts, loki-ts/tests/engine10/preflight.test.ts | LOW | red: `cd loki-ts && bun test tests/engine10/preflight.test.ts -t "parallel git reads"` fails (spawn order is serial); green: passes, every existing preflight verdict and message unchanged | released v11.17.48 | Gap: preflight.ts `let wt0 = await git(...)` then `Promise.all([Promise.resolve(wt0), git(name), git(email)])`; chain after TEN-STABILITY-36 (same file) |
+| TEN-SPEED-13 | enhancement: buildTestMap walks the whole tree with readdirSync minus a skip list, which is slow on a large monorepo; take the file list from `git ls-files` (safe_git) with the walk as the fallback outside a repo, same sorted output | loki-ts/src/engine10/testmap.ts, loki-ts/tests/engine10/testmap.test.ts | MEDIUM | red: `cd loki-ts && bun test tests/engine10/testmap.test.ts -t "tracked files only"` fails (an ignored node_modules-like dir is walked); green: passes, existing fixtures give the same map | released v11.17.48 | Gap: testmap.ts:66 carries the author note "full recursive walk ... use git ls-files if a huge monorepo makes this slow"; untracked-but-ignored dirs not in SKIP_DIRS are walked today |
+| TEN-STABILITY-37 | fix: engine10 supervisor main() pushes every unrecognised token into the task words, so `loki "fix the bug" --no-prr` or `--dry-run` becomes part of the paid task text; reject unknown dash-leading tokens with a usage line and exit 2, and honour `--` as the end of options | loki-ts/src/engine10/supervisor.ts, loki-ts/tests/engine10/spec_first_intent.test.ts | MEDIUM | red: `cd loki-ts && bun test tests/engine10/spec_first_intent.test.ts -t "unknown flag"` fails (task contains the flag); green: passes, tasks without flags and `-- -weird task` unchanged | released v11.17.48 | Gap: supervisor.ts:255-262 final `else words.push(a)`; the start route (engineArgv) only emits known flags, so the direct `loki "<task>"` entry is the exposed one |
+| TEN-UX-33 | fix: supervisor `--provider` with no value or a flag-shaped value keeps the env provider or takes the next flag as the provider name; print "--provider needs a value" and exit 2; chain after TEN-STABILITY-37 | loki-ts/src/engine10/supervisor.ts, loki-ts/tests/engine10/spec_first_intent.test.ts | LOW | red: `cd loki-ts && bun test tests/engine10/spec_first_intent.test.ts -t "provider needs a value"` fails; green: passes, `--provider codex` unchanged | released v11.17.48 | Gap: supervisor.ts:254 `provider = args[++i] ?? provider`; chain after TEN-STABILITY-37 (same file) |
+| TEN-STABILITY-38 | fix: supervisor treats any token starting with `--max-cost` as the cap flag, so `--max-costly` or `--max-cost5` slices garbage (`a.slice(11)`) or swallows the next token; match `--max-cost` exactly or `--max-cost=`; chain after TEN-UX-33 | loki-ts/src/engine10/supervisor.ts, loki-ts/tests/engine10/spec_first_intent.test.ts | LOW | red: `cd loki-ts && bun test tests/engine10/spec_first_intent.test.ts -t "max-cost prefix"` fails; green: passes, `--max-cost 5` and `--max-cost=5` unchanged | released v11.17.48 | Gap: supervisor.ts:253 `a.startsWith("--max-cost")`; chain after TEN-UX-33 (same file) |
+| TEN-UX-30 | fix: `loki stats --bogus` is ignored and prints stats with exit 0 on the TS route and in bash; reject unknown flags with one line and exit 2 on both routes (--json, --efficiency, --help stay) | loki-ts/src/commands/stats.ts, loki-ts/tests/commands/stats.test.ts | LOW | red: `cd loki-ts && bun test tests/commands/stats.test.ts -t "unknown flag"` fails (exit 0); green: passes and `bun test tests/commands/stats.test.ts` stays green; if a bash-parity test pins the old exit 0, update it in the same change | released v11.17.48 | Gap: stats.ts:473 comment "unknown flags ignored to match bash behavior"; observed `loki stats --bogus` prints the session table and exits 0; a mistyped --json silently gives text |
+| TEN-UX-31 | fix: `loki version --bogus` prints the version and exits 0; reject an unknown flag with a usage line and exit 2 (--json, --help, -h, help stay) | loki-ts/src/commands/version.ts, loki-ts/tests/commands/version.test.ts | LOW | red: `cd loki-ts && bun test tests/commands/version.test.ts -t "unknown flag"` fails (exit 0); green: passes, plain output byte identical | released v11.17.48 | Gap: version.ts:17-27 reads only --json and the help words; observed `loki version --bogus` prints `Loki Mode v11.17.46` exit 0; seed from the sibling sweep of TEN-UX-20 |
+| TEN-UX-36 | fix: `loki status run-a run-b` reports "unknown flag run-b" for a second run id and the usage line omits [run-id]; print "too many arguments: expected one run id" with the full usage and exit 1 | loki-ts/src/commands/run_status.ts, loki-ts/tests/commands/run_status.test.ts | LOW | red: `cd loki-ts && bun test tests/commands/run_status.test.ts -t "second run id"` fails (message says unknown flag); green: passes, one run id and --json unchanged | released v11.17.48 | Gap: run_status.ts:143 shares one else branch for extra positionals and flags and prints `Usage: loki status [--json]` |
+| TEN-UX-34 | fix: `loki answer --text` with no value silently falls through to the saved Control Plane answer (or "no answer"), so a forgotten value answers with stale text; print "--text needs a value" and exit 2 | loki-ts/src/features/blocked_answer.ts, loki-ts/tests/features/blocked_answer.test.ts | LOW | red: `cd loki-ts && bun test tests/features/blocked_answer.test.ts -t "text needs a value"` fails; green: passes, `--text "x"`, `--text=x` and the file path unchanged | released v11.17.48 | Gap: blocked_answer.ts:63 `text = args[++i]` stores undefined, then `text ?? readAnswerFile(...)` at :70 |
+| TEN-SECURITY-12 | fix: loadSigningKey returns null with no word when LOKI_RECEIPT_SIGNING_KEY_FILE points at an unreadable file, a malformed PEM or a non-ed25519 key, so the run seals an UNSIGNED receipt and the user never learns why; return a reason (file unreadable, not a PEM, not ed25519) that the seal step prints on one stderr line, never the key bytes, and keep the receipt UNSIGNED, never invent a signature | loki-ts/src/util/receipt_signer.ts, loki-ts/tests/engine10/seal_verify_roundtrip.test.ts | HIGH | red: `cd loki-ts && bun test tests/engine10/seal_verify_roundtrip.test.ts -t "unusable signing key names the reason"` fails (no reason, no stderr line); green: passes, the default generated key and a valid explicit key sign exactly as before | released v11.17.48 | Gap: receipt_signer.ts:57-59 outer `catch { return null; }` and :50 `k.asymmetricKeyType === "ed25519" ? k : null` collapse every failure into the same UNSIGNED result; HIGH because it is the Seal; reviewers must confirm no key material reaches the message |
+| TEN-SPEED-15 | enhancement: collectToolchain spawns `node`, `python3` and `git --version` serially with spawnSync on every seal; memoize the result per process (tools do not change inside one run) and run the probes together, receipt body unchanged; chain after TEN-SECURITY-12 | loki-ts/src/util/receipt_signer.ts, loki-ts/tests/engine10/seal_verify_roundtrip.test.ts | MEDIUM | red: `cd loki-ts && bun test tests/engine10/seal_verify_roundtrip.test.ts -t "toolchain probed once"` fails (probe called per seal); green: passes, toolchain fields identical in the receipt | released v11.17.48 | Gap: receipt_signer.ts:75-80 toolVersion uses spawnSync with a 5s timeout per tool and collectToolchain has no cache; chain after TEN-SECURITY-12 (same file) |
+| TEN-GATES-25 | fix: `loki verify --bogus` and `loki verify run-a run-b` treat the first token as the run id, so a typo yields a misleading "no such receipt" style verdict and extra ids are ignored; reject unknown dash-leading flags and more than one positional with a usage line and exit 2, never change any verdict exit code | loki-ts/src/engine10/verify_cmd.ts, loki-ts/tests/engine10/verify_cmd.test.ts | HIGH | red: `cd loki-ts && bun test tests/engine10/verify_cmd.test.ts -t "unknown flag and extra id"` fails; green: passes and the whole verify_cmd suite stays green (exit 0/1/2/3/4/66 mapping unchanged) | released v11.17.48 | Gap: verify_cmd.ts verifyMain strips known flags then uses `args[0] ?? latestRunId(...)` with no leftover check; HIGH because it is the verifier front door and a wrong exit here is a false-green risk |
+| TEN-GATES-26 | feature: `loki verify [run-id] --json` printing {run, verdict, receipt_sha256, reasons, agent_independent:{k,of}} on stdout so CI can gate without scraping text; exit codes unchanged and the text output stays byte identical without the flag; chain after TEN-GATES-25 | loki-ts/src/engine10/verify_cmd.ts, loki-ts/tests/engine10/verify_cmd.test.ts | HIGH | red: `cd loki-ts && bun test tests/engine10/verify_cmd.test.ts -t "verify json"` fails (unknown flag); green: passes, golden text output unchanged | released v11.17.48 | Gap: verify_cmd.ts has no --json (verify-pr has one, TEN-GATES-21); independentLine() already computes k and the pass count; chain after TEN-GATES-25 (same file) |
+| TEN-ADOPTION-24 | feature: `loki wiki show --json` printing {section, content} (or all sections) so tooling can read the generated wiki without parsing text; text output unchanged | loki-ts/src/commands/wiki.ts, loki-ts/tests/commands/wiki.test.ts | LOW | red: `cd loki-ts && bun test tests/commands/wiki.test.ts -t "show json"` fails (unknown option); green: passes, text golden unchanged | released v11.17.48 | Gap: wiki.ts:55 rejects every dash token except --help and there is no json path; wiki.ts has 0 --json occurrences |
+| TEN-ADOPTION-26 | feature: `loki issues run --dry-run --json` printing the triage decision per issue (number, decision, reason, covered_by_pr) so CI can review the plan before any paid run | loki-ts/src/commands/issues_run.ts, loki-ts/tests/commands/issues_run.test.ts | LOW | red: `cd loki-ts && bun test tests/commands/issues_run.test.ts -t "dry run json"` fails (unexpected argument: --json); green: passes, the text table unchanged | released v11.17.48 | Gap: issues_run.ts:82-99 arg loop has no --json; triage results (`t.decision`, `t.reason`) and coveredIssues() already exist at :262-290 and :104 |
 | TEN-COST-35 | fix: `loki start --budget-limit=5` (and --provider=, --session-model=, --prd=, --brief=) is accepted by the flag validator then silently ignored, so the default $100 cap and default provider apply; read the `=` form everywhere argVal reads a flag | loki-ts/src/commands/start.ts, loki-ts/tests/commands/start.test.ts | MEDIUM | red: bun test tests/commands/start.test.ts -t "equals form" fails (cap stays default); green: same test passes and `cd loki-ts && bunx tsc --noEmit` exits 0 | released v11.17.44 | Gap: start.ts:23 argVal matches only exact args via indexOf; start.ts:212 validator splits on "=" so the form is accepted; only --cost and --attempts parse "=" |
 | TEN-COST-36 | fix: `loki start --budget-limit abc`, `--max-iterations -1`, `--budget-limit 0x` and a trailing value flag with no value are silently dropped so the default cap applies; print one error line naming the flag and exit 2 | loki-ts/src/commands/start.ts, loki-ts/tests/commands/start.test.ts | MEDIUM | red: bun test tests/commands/start.test.ts -t "invalid numeric" fails (exit 0, no message); green: passes, valid values unchanged | released v11.17.44 | Gap: start.ts:123 posNum returns undefined for non-numeric, zero or negative with no diagnostic; chain after TEN-COST-35 |
 | TEN-STABILITY-21 | fix: control `--port` with no value or a non-numeric value silently falls back to the default port; reject with a usage line and exit 2 | loki-ts/src/commands/control.ts, loki-ts/tests/commands/control.test.ts | LOW | red: bun test tests/commands/control.test.ts -t "port without value" fails; green: passes and existing control tests stay green | released v11.17.44 | Gap: control.ts:33 flag() returns args[i+1] unchecked (undefined or the next flag) and callers fall through to the default |

package/docs/v10/PROGRESS.md

@@ -2521,3 +2521,6 @@ v11.17.21 published (Release success on 462fbc40a; npm latest 11.17.21, next 11.
 
 ## 2026-10-17T11:59Z (CoS) v11.17.47
 - Released TEN-GATES-15 and Q17-05b (wave AH redo, opus APPROVE 708682ea2 and 0112c4fcc) plus a tsc fix-forward in redact.test.ts (325df1f44). Q18-03e blocked after 3 rounds; reslice to a real tokenizer. Combined: tsc rc 0; loki-ts bun 557/0; control-plane server 335/0. Board refill wave AN (bda2ee54d) included.
+
+## 2026-10-17T12:36Z (CoS) v11.17.48
+- Wave AN shipped: 30 of 30 TEN rows APPROVE and merged in 19 chains (one test import conflict resolved by hand, union of both import sets). Checks: tsc rc=0; bun test changed files plus spawn_env_guard, engine10/budget and tests/util 1026 pass 0 fail; test-deploy, test-help-start-flags, test-pricing-parity rc=0; help-changelog-drift 51 passed 0 failed after the completion fix. Main Tests red on cbded2759 (shard-durations row for TEN-ADOPTION-15 plus shell and bun shards) has a P0 fix-forward agent running. Q18-03e reslice 4 (TypeScript compiler API) building.