loki-mode 11.17.52 → 11.17.54

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: An autonomous software factory that knows what it is supposed to deliver, and proves it did. Use when the user says Loki Mode or asks to build, fix or verify software autonomously.
 ---
 
-# Loki Mode v11.17.52
+# Loki Mode v11.17.54
 
 **Current entry points (Loki 10 engine):** `loki "<task>"`, `loki owner/repo#N` and `loki quick "<task>"` run the Loki 10 engine and end with a signed receipt (`loki verify`). `loki backlog owner/repo --all` runs many issues in parallel. Guide: `docs/v10/GUIDE.md`. The skill instructions below, and `loki start`, describe the previous bash loop. PRD-file starts (`loki start ./prd.md`) and the opencode provider still run on it until FC38-SWEEP ports them; the legacy-engine command and the LOKI_ENGINE switch remain removed. Prefer `loki owner/repo#N` for issues.
 
@@ -483,4 +483,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v11.17.52 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**
+**v11.17.54 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**

package/VERSION

@@ -1 +1 @@
-11.17.52
+11.17.54

package/autonomy/lib/secure-scan.py

@@ -18,7 +18,7 @@ The scanner is honest by construction:
     .git, vendor, bundled dist of dependencies) and oversized files, so it is
     cheap and deterministic.
 
-The v1 rules (rules 6, 7 and 8 added later) (see internal/LOOP4-SECURE-BY-DEFAULT-PLAN.md):
+The v1 rules (rules 6, 7, 8, 9 and 10 added later) (see internal/LOOP4-SECURE-BY-DEFAULT-PLAN.md):
   1. private-key-committed   (HIGH)   a PEM private-key block in any text file
   2. secret-in-client-file   (HIGH)   a real secret literal in a browser-served file
   3. world-open-datastore    (HIGH)   a literal world-open datastore rule
@@ -47,7 +47,7 @@ import re
 import subprocess
 import sys
 
-RULES_VERSION = "1.4"
+RULES_VERSION = "1.7"
 
 # --- scan limits -----------------------------------------------------------
 # Cap per-file size so a giant generated bundle cannot stall the gate. 2 MiB is
@@ -133,6 +133,12 @@ _SECRET_PATTERNS = [
     ("stripe-key", re.compile(r"(?<![A-Za-z0-9])[sr]k_live_[A-Za-z0-9]{24,}")),
     # SendGrid API key: SG.<22>.<43>
     ("sendgrid-key", re.compile(r"(?<![A-Za-z0-9])SG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}")),
+    # AWS temporary (STS) access key id
+    ("aws-sts-key", re.compile(r"\bASIA[0-9A-Z]{16}\b")),
+    # Azure storage connection string account key: 86 base64 chars + ==
+    ("azure-account-key", re.compile(r"AccountKey=[A-Za-z0-9+/]{86}==")),
+    # Twilio API key SID: SK + 32 hex
+    ("twilio-key", re.compile(r"(?<![A-Za-z0-9])SK[0-9a-f]{32}(?![A-Za-z0-9])")),
 ]
 
 # Placeholder / example markers. If the matched secret (or its surrounding
@@ -461,6 +467,42 @@ def _shell_injection_hit(text, node_file):
     return qualified or node_file
 
 
+# ---------------------------------------------------------------------------
+# rule 9: unsafe deserialization (Python files)
+# ---------------------------------------------------------------------------
+# pickle.load/loads (also cPickle, _pickle), marshal.load/loads, and yaml.load
+# without a Safe loader on the same line. yaml.safe_load and
+# yaml.load(..., Loader=yaml.SafeLoader) are never flagged. Same path
+# exclusions as rules 6 and 7. Python files only (.py).
+_UNSAFE_DESERIALIZE = re.compile(
+    r"""\b(?:c?[pP]ickle|_pickle|marshal)\.loads?\s*\("""
+)
+_YAML_LOAD = re.compile(r"""\byaml\.load(?:_all)?\s*\(""")
+_YAML_SAFE_LOADER = re.compile(r"""\bC?SafeLoader\b""")
+
+
+def _deserialize_hit(text):
+    if _UNSAFE_DESERIALIZE.search(text):
+        return True
+    return bool(_YAML_LOAD.search(text) and not _YAML_SAFE_LOADER.search(text))
+
+
+# ---------------------------------------------------------------------------
+# rule 10: SQL built by string formatting and passed to execute() (Python)
+# ---------------------------------------------------------------------------
+# .execute( / .executemany( whose first argument is an interpolated f-string
+# (with a {placeholder}), a string literal followed by % or +, or a string
+# literal followed by .format(. A literal followed by a comma (parameter
+# tuple or list) is the safe form and is never flagged. Same line only; same
+# path exclusions as rules 6, 7 and 9. Python files only (.py).
+_SQL_EXEC_FORMATTED = re.compile(
+    r"""\.execute(?:many)?\s*\(\s*(?:"""
+    r"""[rR]?[fF]"[^"]*\{|[rR]?[fF]'[^']*\{"""
+    r"""|[rR]?"[^"]*"\s*(?:%|\+|\.format\s*\()"""
+    r"""|[rR]?'[^']*'\s*(?:%|\+|\.format\s*\())"""
+)
+
+
 # ---------------------------------------------------------------------------
 # rule 8: committed real env file with a secret assignment
 # ---------------------------------------------------------------------------
@@ -578,6 +620,8 @@ def _scan_file(rel_path, lines, secrets_everywhere=False, env_tracked=None):
     env_in_git = env_tracked is not None
     if real_envfile and env_in_git and rel_path not in env_tracked:
         real_envfile = False
+    deser_scan = shell_scan and rel_path.lower().endswith(".py")
+    sqli_scan = deser_scan
     node_file = shell_scan and any(_NODE_CP_FILE.search(t) for _, t in lines)
 
     # rule 3 / rule 5 need whole-file context for the AND conditions.
@@ -723,6 +767,30 @@ def _scan_file(rel_path, lines, secrets_everywhere=False, env_tracked=None):
                 "interpolate input into a command string.",
             ))
 
+        # --- rule 9: unsafe deserialization ------------------------------
+        if (deser_scan and not _COMMENT_OR_DOC_LINE.match(text)
+                and _deserialize_hit(text)):
+            findings.append(_finding(
+                "unsafe-deserialization", rel_path, lineno, "HIGH",
+                "Untrusted bytes or YAML passed to pickle, marshal or an "
+                "unsafe yaml.load can execute arbitrary code on load.",
+                "Use yaml.safe_load (or Loader=yaml.SafeLoader) and a data "
+                "format such as JSON; never unpickle or unmarshal data from "
+                "an untrusted source.",
+            ))
+
+        # --- rule 10: SQL built by string formatting ---------------------
+        if (sqli_scan and not _COMMENT_OR_DOC_LINE.match(text)
+                and _SQL_EXEC_FORMATTED.search(text)):
+            findings.append(_finding(
+                "sql-string-formatting", rel_path, lineno, "HIGH",
+                "SQL built with an f-string, % formatting, .format or "
+                "concatenation and passed to execute() is open to SQL "
+                "injection.",
+                "Pass values as bound parameters: "
+                "cursor.execute(\"... WHERE id = %s\", (value,)).",
+            ))
+
         # --- rule 8: committed real env file with a secret value ---------
         if real_envfile:
             env_name = _env_secret_assignment(text)

package/autonomy/loki

@@ -2915,7 +2915,7 @@ cmd_start() {
                 echo "                        and, with --deploy, the flag --github runs loki github publish after a good deploy"
                 echo ""
                 echo "Issue-mode options (used when input is an ISSUE-REF or a --brief):"
-                echo "  --dry-run             Preview generated PRD without starting"
+                echo "  --dry-run             Validate flags, run the preflight and print the provider, model and cost cap without starting (issue mode: preview the PRD)"
                 echo "  --no-start            Generate PRD but don't start execution"
                 echo "  --output FILE         Save generated PRD to custom path"
                 echo "  --worktree, -w        Git worktree isolation (separate branch)"
@@ -3549,7 +3549,18 @@ cmd_start() {
         # SUPPORTED_PROVIDERS but missing from the older lists.
         local _pf_installed=""
         local _pf_p
-        for _pf_p in claude codex cline aider opencode; do
+        # Single source: SUPPORTED_PROVIDERS in providers/loader.sh.
+        local _pf_known
+        _pf_known="$(sed -n 's/^SUPPORTED_PROVIDERS=(\(.*\))$/\1/p' "$_LOKI_SCRIPT_DIR/../providers/loader.sh" 2>/dev/null | tr -d '"' | head -1)"
+        [ -n "$_pf_known" ] || _pf_known="claude codex cline aider opencode"
+        case " $_pf_known " in
+            *" $_pf_explicit "*) ;;
+            *)
+                echo -e "${RED}Error: unknown provider '$_pf_explicit' (use one of: ${_pf_known// /, })${NC}" >&2
+                exit 1
+                ;;
+        esac
+        for _pf_p in $_pf_known; do
             if command -v "$_pf_p" >/dev/null 2>&1; then
                 _pf_installed="${_pf_installed:+$_pf_installed }$_pf_p"
             fi

package/bin/loki

@@ -434,7 +434,7 @@ _loki_start_needs_bash() {
             |--fast|--repo-fast|--full|--repo-full \
             |--bmad-project|--openspec \
             |--mirofish|--mirofish-docker|--mirofish-rounds|--mirofish-timeout|--mirofish-bg \
-            |--issue|--dry-run|--no-start|--output|--worktree|-w|--pr|--ship|--detach|-d)
+            |--issue|--no-start|--output|--worktree|-w|--pr|--ship|--detach|-d)
                 return 0 ;;
             --isolation)
                 # value follows; only worktree/docker/sandbox divert (none stays Bun).
@@ -455,7 +455,7 @@ _loki_start_needs_bash() {
 }
 _loki_attempts_refuse() {
     if _loki_start_needs_bash "$@"; then
-        echo "loki: 'loki start --attempts' runs only the Loki 10 engine; an option or provider in this command (for example --parallel, --github, --sandbox, --issue, --dry-run, or --detach) was only honored by the removed legacy loop. Remove it, or use a task string, an issue ref or a PRD path." >&2
+        echo "loki: 'loki start --attempts' runs only the Loki 10 engine; an option or provider in this command (for example --parallel, --github, --sandbox, --issue, or --detach) was only honored by the removed legacy loop. Remove it, or use a task string, an issue ref or a PRD path." >&2
         exit 2
     fi
     case "${LOKI_PROVIDER:-claude}" in
@@ -514,6 +514,19 @@ if [ "${1:-}" = "start" ]; then
     unset _loki_sp_a
 fi
 
+# TEN-UX-45: `loki start ... --dry-run` is the Bun start command's preview (flags, preflight,
+# provider, model, cap; nothing runs). Issue refs and bash-only flags keep the legacy route,
+# where --dry-run previews the generated PRD.
+if [ "${1:-}" = "start" ]; then
+    _loki_dry=0
+    for _loki_da in "${@:2}"; do [ "$_loki_da" = "--dry-run" ] && _loki_dry=1; done
+    if [ "$_loki_dry" = "1" ] && ! _loki_start_needs_bash "${@:2}"; then
+        _loki_dry_bun="$(_loki_bun)"
+        [ -n "$_loki_dry_bun" ] && exec "$_loki_dry_bun" "$BUN_CLI" "$@"
+    fi
+    unset _loki_dry _loki_da _loki_dry_bun
+fi
+
 # OC-ROUTE: normalize flags before the engine decision so argument order and input form
 # never change the engine (autonomy/route.sh; `loki route ...` and --explain-route print it).
 _R_APPLIED=0

package/completions/_loki

@@ -405,6 +405,7 @@ function _loki_start {
         '--skip-memory[Skip loading memory context]' \
         '--spec[Run against an edited spec file]:spec file:_files' \
         '--spec-first[Write an editable spec, then stop]' \
+        '--dry-run[Validate flags and preflight, print provider, model and cap, spend nothing]' \
         '--yes[Skip confirmation prompts]' \
         '-y[Skip confirmation prompts]' \
         '--budget[Cost budget limit in USD]:amount:' \

package/completions/loki.bash

@@ -28,7 +28,7 @@ _loki_completion() {
             # If the word starts with a dash, show flags
             # Rule: list every flag bin/loki routes (Bun/engine10 ones such as --model, --max-cost, --spec, --no-pr too), not only cmd_start's own.
             if [[ "$cur" == -* ]]; then
-                local flags="--provider --max-iterations --parallel --background --bg --simple --complex --github --no-dashboard --sandbox --skip-memory --cost --spec --spec-first --yes --budget --attempts --model --isolation --max-cost --no-pr --explain-route --brief --worktree --pr --ship --detach --workspace --deploy --health-url --auto-rollback --destination --canary --domain --env-file --resume --help"
+                local flags="--provider --max-iterations --parallel --background --bg --simple --complex --github --no-dashboard --sandbox --skip-memory --cost --spec --spec-first --dry-run --yes --budget --attempts --model --isolation --max-cost --no-pr --explain-route --brief --worktree --pr --ship --detach --workspace --deploy --health-url --auto-rollback --destination --canary --domain --env-file --resume --help"
                 COMPREPLY=( $(compgen -W "${flags}" -- "$cur") )
                 return 0
             fi

package/dashboard/__init__.py

@@ -7,6 +7,6 @@ Modules:
     control: Session control helpers (status, atomic writes, origin check)
 """
 
-__version__ = "11.17.52"
+__version__ = "11.17.54"
 
 __all__ = ["__version__"]

package/docs/CLI-REFERENCE.md

@@ -1,6 +1,6 @@
 # CLI reference
 
-Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.17.52. Do not edit by hand.
+Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.17.54. Do not edit by hand.
 Hidden and legacy-only commands are omitted; see `docs/v10/CLI-MODERN.md` for the full inventory.
 
 | Command | Description |
@@ -30,6 +30,7 @@ Hidden and legacy-only commands are omitted; see `docs/v10/CLI-MODERN.md` for th
 | `loki rollback show` | Show a checkpoint |
 | `loki rollback to` | Restore a checkpoint |
 | `loki rollback latest` | Restore the latest checkpoint |
+| `loki rollback deploy` | Print the provider rollback command for the last deploy (read-only) |
 | `loki backup` | Back up dashboard state (audit log, checkpoint) with a sha256 manifest |
 | `loki restore` | Restore dashboard state from a verified backup archive |
 | `loki proof` (alias: `receipt`) | Inspect and share proof-of-run receipts |
@@ -64,6 +65,10 @@ Hidden and legacy-only commands are omitted; see `docs/v10/CLI-MODERN.md` for th
 | `loki trust` | Trust trajectory from proof history |
 | `loki trust detail` | Trust metrics detail |
 | `loki crash` | Inspect or submit scrubbed crash reports |
+| `loki crash list` | List stored crash reports |
+| `loki crash show` | Show one scrubbed crash report |
+| `loki crash submit` | Submit a scrubbed crash report |
+| `loki crash help` | Show crash usage |
 | `loki contract` | Print the spec delivery contract |
 | `loki start` | Run the autonomous build (a `jira:KEY` or `linear:KEY` ref also writes the outcome back to that ticket, see docs/trackers.md) |
 | `loki slack` | Slack inbound handler |

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 Loki Mode, by [Autonomi](https://www.autonomi.dev/), turns a spec or an issue into a verified pull request with a receipt you can check. This page covers installing it, a first run, and the options around it.
 
-**Version:** v11.17.52
+**Version:** v11.17.54
 
 **Engine note:** `loki start` is the primary command. `loki start`, `loki "<task>"`, `loki owner/repo#N` and `loki quick` all run the Loki 10 engine, whatever the flag order or input form (PRD file, issue ref, task or one-word brief). The previous loop runs only on `--engine legacy`, `LOKI_ENGINE=legacy`, or for one call when a flag Loki 10 cannot honor is present. See the [user guide](v10/GUIDE.md) and the [5-minute quickstart](QUICKSTART.md).
 

package/docs/v10/BOARD.md

@@ -434,7 +434,7 @@ set is declared to avoid overlap with those and with each other.
 | Q18-11 | group.started/group.unit events and createGroupRenderer (D61-14) have no producer or caller; emit from backlog launcher callbacks and attach the renderer to group runs | loki-ts/src/features/speed/group_grid.ts, loki-ts/src/features/speed/group_output.ts, loki-ts/tests/engine10/output_group.test.ts | MEDIUM | `cd loki-ts && bun test tests/engine10/output_group.test.ts tests/features/speed/group_output.test.ts`; `cd loki-ts && bunx tsc --noEmit` | released@2026-10-17T02:57Z | merge 326cf3402; TL APPROVE cb3e92fca (real-spawn onOut tap untested, follow-up). PO refill 2026-10-17, grep-checked not shipped: Architect confirms file set apart from Q18-08 first; else hold until Q18-08 merges. v11.17.13 npm next 11.17.13 |
 | Q18-03c | P9 allowToken guard residuals from Q18-03b r2: named re-export with as (export { safeGitEnv as x } from safe_git), indirect calls (const f = safeGitEnv; .apply; spread args), and a shadowed args default in a pinned file all give F=0 | tests/moat/p9-rule-of-two.sh | HIGH | bash tests/moat/run.sh | parked@2026-10-17T01:55Z | Shipped via Q18-03d merge 98611351a. D98 2 rounds used: r2 head 2b3421402 closes all r1 bypasses but its comment strip misses regex literals and template nesting, a regression vs main; continued as Q18-03d on top of 2b3421402. r1 BLOCK (HIGH), r2 fix in progress. Source: Q18-03b HIGH r2 notes 1, 2 and 4. Obfuscated key escapes (unicode escapes, computed concatenation) cannot be closed by grep; record as accepted residual. |
 | Q18-03d | P9 allowToken guard: comma, import and indirect scans fail if either raw or comment-stripped text trips them (strip misses regex literals and template nesting); add regex-literal, template-nesting, barrel-of-barrel and strip-only positive controls | tests/moat/p9-rule-of-two.sh | HIGH | bash tests/moat/run.sh | released@2026-10-17T02:57Z | merge 98611351a (includes Q18-03c r2 commits); HIGH APPROVE ec6e0adfd, 4 mutations red, P9 PROVEN. Built on Q18-03c r2 head 2b3421402 (branch q18-03c). HIGH r2 repro payloads: const re = /\/*/; safeGitEnv(process.env, true); // */ and const re = /"/; then const u = "//"; safeGitEnv(...). Fresh review rounds. v11.17.13 npm next 11.17.13 |
-| Q18-03e | P9 allowToken guard: strip helper treats regex literals as opaque (or a regex-aware third pass), so a regex plus a quote inside a comment cannot hide a call from both passes | tests/moat/p9-rule-of-two.sh | HIGH | bash tests/moat/run.sh | ready (reslice 4: 4 BLOCK rounds, last 339fe02ad in wf_d85b02bd-e63; hand-rolled regex/division disambiguation is unfixable (export default /re/, if (a) /re/ vs (4) / 2). ADOPT OSS: find calls with the TypeScript compiler API from loki-ts/node_modules/typescript (ts.createSourceFile plus a CallExpression walk), so comments, strings, regex and JSX are parsed by the real grammar; keep every existing control plus probe-default, probe-extends, probe-mixed; fail closed on parse diagnostics) | Pre-existing gap found by Q18-03d HIGH review (also on main): after the safe_git import, const re = /\/*/; safeGitEnv(process.env /* ' */, true); is MISSED and runs under node. Add it as a positive control. |
+| Q18-03e | P9 allowToken guard: strip helper treats regex literals as opaque (or a regex-aware third pass), so a regex plus a quote inside a comment cannot hide a call from both passes | tests/moat/p9-rule-of-two.sh | HIGH | bash tests/moat/run.sh | released v11.17.54 | Pre-existing gap found by Q18-03d HIGH review (also on main): after the safe_git import, const re = /\/*/; safeGitEnv(process.env /* ' */, true); is MISSED and runs under node. Add it as a positive control. |
 | Q18-05b | AI-BOM filter gaps: secret filter misses github_pat_, glpat-, AIza, npm_, hf_, ASIA, sk_live_ and is case-sensitive; SAFE_NAME drops provider/model ids with one interior slash; hooks.sealed receives the live receipt (pass a frozen clone) | loki-ts/src/engine10/ai_bom.ts, loki-ts/src/engine10/stages/seal.ts, loki-ts/tests/engine10/ai_bom.test.ts | MEDIUM | cd loki-ts && bun test tests/engine10/ai_bom.test.ts tests/engine10/seal.test.ts | released@2026-10-17T02:57Z | merge ae90c2875 dist 0eb48d905; TL APPROVE 82058ff97 (102 pass, 4 mutations red). Test file is tests/features/ai_bom.test.ts. Source: Q18-05 HIGH review notes. Keep engine10 core net zero. v11.17.13 npm next 11.17.13 |
 | COST-WALL-f | Partial cost read as complete outside benchmarks: trust_trajectory cost_per_accepted_usd ignores cost.cost_partial; check cost-summary.py and proof-generator.py the same way, routing through one partial check | autonomy/lib/trust_trajectory.py, autonomy/lib/cost-summary.py, autonomy/lib/proof-generator.py, tests/test_efficiency_cost_availability.py | HIGH | python3 -m pytest tests/test_efficiency_cost_availability.py -q | released@2026-10-17T02:57Z | merge 3d0587f4f dist 7919f31ca; HIGH r2 APPROVE ef9979ad8 (53 pytest, 11 cost-cli, 33 bun pass; 5 of 6 mutations red). Follow-ups: template costIsPartial JS harness, dashboard series partial marker, cost-summary Avg/iter label. r1 BLOCK (HIGH), r2 fix in progress. Source: COST-WALL-e HIGH r1 note 4 (FC-COST-PARTIAL-b siblings). v11.17.13 npm next 11.17.13 |
 | Q17-06 | COST-6 offline half: `attribution.py` dry-run prints a cost-per-accepted-task table with the ratio against raw Claude Code and against the 0.5x target, using existing result files, so the paid `--execute` run only has to plug in numbers. | benchmarks/bench/attribution.py, benchmarks/bench/test_attribution.py | MEDIUM | `python3 -I benchmarks/bench/attribution.py --dry-run`; `python3 -m pytest benchmarks/bench -k attribution -q` | released@2026-10-17T03:50Z | Merged fe3a4e252 (6b9bd03d6; line-828 mutation caught: 1 failed 93 passed, restored 94 passed). COST-6 is parked as a paid eval needing a spend go. This re-slice needs no spend. Cost audit 2026-10-16: best measured run is 0.68x of raw, none reaches 0.5x. Report both floors (attribution.py:778). Confirm the test file name by `ls`. Shipped in npm 11.17.15 (latest+next) or 11.17.16 (Release run success on e3d445460). |
@@ -1306,3 +1306,93 @@ Source: ~/git/autonomi-dev/research/2026-09-30-adoption/SWARM-PROMPT-ADOPTION.md
 | TEN-QUALITY-30 | fix: an invalid LOKI_E10_REPOMAP_MAX_FILES (abc, 0, -5, 1.5) silently falls back to 2000; print one stderr note naming the bad value and the default | loki-ts/src/engine10/repomap.ts, loki-ts/tests/engine10/repomap.test.ts | LOW | red: cd loki-ts && bun test tests/engine10/repomap.test.ts -t "bad max files note" fails; green: passes, cap value unchanged | released v11.17.50 | Gap: repomap.ts:19 maxFilesCap returns 2000 for any non-positive-integer with no warning. |
 | TEN-QUALITY-31 | fix: a non-numeric LOKI_E10_SNAPSHOT_MAX makes `st.size > NaN` false, so the intake snapshot hashes every untracked file however large; fall back to the 50 MB default when the value is not a positive finite number | loki-ts/src/e10ext/preexisting_dirty.ts, loki-ts/tests/e10ext/preexisting_dirty.test.ts (new: no test owns snapshotUntracked, only incidental use in seal.test.ts and machine.test.ts) | LOW | red: cd loki-ts && bun test tests/e10ext/preexisting_dirty.test.ts -t "bad snapshot max" fails; green: passes | released v11.17.50 | Gap: preexisting_dirty.ts:38 st.size > Number(process.env.LOKI_E10_SNAPSHOT_MAX ?? 50e6) with no finite check. |
 | TEN-ADOPTION-27 | enhancement: LOKI_AI_MARKING only turns on for the exact string 1; accept 1, true and yes (any case) like the other opt-in flags, so the compliance marking users set as true is not silently off | loki-ts/src/engine10/pr_body.ts, loki-ts/tests/engine10/ai_marking.test.ts | LOW | red: cd loki-ts && bun test tests/engine10/ai_marking.test.ts -t "true enables" fails; green: passes, unset and 0 stay off | released v11.17.50 | Gap: pr_body.ts:5 env["LOKI_AI_MARKING"] === "1". |
+| TEN-COST-51 | enhancement: cost_claim.py point ratio uses every row of each arm while the CI uses only paired tasks, so arms covering different task sets give a ratio the CI does not describe; add a NOT PROVEN reason "tasks: arms cover different task sets" | benchmarks/bench/cost_claim.py, benchmarks/bench/tests/test_cost_claim.py | MEDIUM | red: pytest benchmarks/bench/tests/test_cost_claim.py -q -k task_set_mismatch fails; green: passes and the rest of the file stays green | released v11.17.53 | Gap: cost_claim.py:78-80 point ratio from _cpa(loki_rows)/_cpa(floor_rows) over all rows vs CI over paired tasks, no reason emitted. Chain COST-51, COST-52, COST-53 (same files). Serialize after TEN-COST-50 (board row is stale, code already built) |
+| TEN-COST-52 | feature: cost_claim.py refuses a proven verdict when rows lack cost_source or an arm mixes sources (claude_json.total_cost_usd vs loki.efficiency_cost), because mixed accounting makes the 2x claim unprovable | benchmarks/bench/cost_claim.py, benchmarks/bench/tests/test_cost_claim.py | MEDIUM | red: pytest benchmarks/bench/tests/test_cost_claim.py -q -k cost_source fails; green: passes | released v11.17.53 | Gap: attribution.py:589 and :636 stamp cost_source but no grep hit for cost_source in cost_claim.py. Serialize after TEN-COST-51 |
+| TEN-COST-53 | fix: cost_claim.py _cpa treats a missing, None, NaN or negative cost_usd as 0.0 so a broken row makes Loki look cheaper; require finite cost >= 0 or add a NOT PROVEN reason | benchmarks/bench/cost_claim.py, benchmarks/bench/tests/test_cost_claim.py | MEDIUM | red: pytest benchmarks/bench/tests/test_cost_claim.py -q -k bad_cost_row fails; green: passes | released v11.17.53 | Gap: cost_claim.py:28-34 float(r.get("cost_usd") or 0.0). Serialize after TEN-COST-52 |
+| TEN-SECURITY-16 | enhancement: redactSecrets also strips AWS temporary ASIA keys and Azure AccountKey= connection strings, both already recognised by export_sarif | loki-ts/src/util/redact.ts, loki-ts/tests/util/redact.test.ts | HIGH | red: cd loki-ts && bun test tests/util/redact.test.ts -t "asia and azure" fails; green: passes | released v11.17.53 | Gap: redact.ts:3-27 RULES has no ASIA or AccountKey rule; export_sarif.ts SECRET_PATTERNS lines 11-27 knows both |
+| TEN-SECURITY-17 | enhancement: export_sarif SECRET_PATTERNS also flags PyPI pypi-AgEI, Docker dckr_pat_, DigitalOcean dop_v1_, Google OAuth ya29., Shopify shpat_ and Postman PMAK- tokens | loki-ts/src/commands/export_sarif.ts, loki-ts/tests/commands/export_sarif.test.ts | HIGH | red: cd loki-ts && bun test tests/commands/export_sarif.test.ts -t "more token shapes" fails; green: passes | released v11.17.53 | Gap: export_sarif.ts:11-27 has none of the six shapes |
+| TEN-SECURITY-18 | enhancement: secure-scan.py _SECRET_PATTERNS also matches AWS ASIA keys, Azure AccountKey= and Twilio SK keys, and RULES_VERSION bumps | autonomy/lib/secure-scan.py, tests/test-secure-scan.sh | HIGH | red: bash tests/test-secure-scan.sh fails on the new fixtures; green: bash tests/test-secure-scan.sh passes | released v11.17.53 | Gap: secure-scan.py:111-136 lacks all three. Chain SECURITY-18, -19, -20 (same files) |
+| TEN-SECURITY-19 | feature: secure-scan.py rule 9 flags unsafe deserialization (pickle.loads, yaml.load without a safe loader, marshal.loads) in added lines | autonomy/lib/secure-scan.py, tests/test-secure-scan.sh | HIGH | red: bash tests/test-secure-scan.sh fails on the rule 9 fixtures; green: passes | released v11.17.53 | Gap: grep for pickle, yaml.load, eval in secure-scan.py returns 0 hits; rules stop at 8. Serialize after TEN-SECURITY-18 |
+| TEN-SECURITY-20 | feature: secure-scan.py rule 10 flags SQL built by f-string, % formatting or concatenation passed to execute() | autonomy/lib/secure-scan.py, tests/test-secure-scan.sh | HIGH | red: bash tests/test-secure-scan.sh fails on the rule 10 fixtures; green: passes | released v11.17.53 | Gap: no execute(f"...") or concatenation shape anywhere in secure-scan.py. Serialize after TEN-SECURITY-19 |
+| TEN-SECURITY-21 | fix: safe_git driverKeys and netCommandOverrides run git config with no timeout, so a hung git blocks the safe-git guard; add a timeout that still fails closed | loki-ts/src/util/safe_git.ts, loki-ts/tests/util/fc25_safe_git.test.ts | HIGH | red: cd loki-ts && bun test tests/util/fc25_safe_git.test.ts -t "hung git config" fails; green: passes | released v11.17.53 | Gap: safe_git.ts:63 and :95 spawnSync("git", ... config ...) without timeout; both already throw on r.error so a timeout error fails closed |
+| TEN-GATES-30 | fix: a negative LOKI_MUTATION_PROOF_TIMEOUT_S passes the || 30 fallback and makes the mutation proof deadline already past, so the verifier gate fails every run; accept only positive finite seconds | loki-ts/src/util/mutation_proof.ts, loki-ts/tests/engine10/mutation_proof.test.ts | released v11.17.53 | red: cd loki-ts && bun test tests/engine10/mutation_proof.test.ts -t "negative timeout" fails; green: passes | ready@2026-10-17T12:00Z | Gap: mutation_proof.ts:36 Number(... ?? 30) || 30 keeps negatives |
+| TEN-STABILITY-49 | fix: a negative LOKI_E10_NOTIFY_TIMEOUT_MS makes the Slack notify race resolve at once and drops the event; accept only positive values | loki-ts/src/util/slack_events.ts, loki-ts/tests/engine10/slack_events.test.ts | LOW | red: cd loki-ts && bun test tests/engine10/slack_events.test.ts -t "negative notify timeout" fails; green: passes | released v11.17.53 | Gap: slack_events.ts:27 Number(env.LOKI_E10_NOTIFY_TIMEOUT_MS) || 5000 |
+| TEN-STABILITY-50 | fix: the PR stage runs the push and pr-ready scripts with spawnSync and no timeout, so one hung push blocks the run; add a bounded timeout surfaced as the stage failure | loki-ts/src/engine10/stages/pr.ts, loki-ts/tests/engine10/pr.test.ts | MEDIUM | red: cd loki-ts && bun test tests/engine10/pr.test.ts -t "hung push script" fails; green: passes | released v11.17.53 | Gap: pr.ts:68, :76, :80, :129 spawnSync("bash", [...]) without timeout; script path injectable via scriptPath |
+| TEN-STABILITY-51 | fix: the runner push-pr spawn has no timeout while the check-origin spawn has 30s; a hung gh push stalls the attempt | loki-ts/src/runner/attempts.ts, loki-ts/tests/runner/attempts-push-pr.test.ts | MEDIUM | red: cd loki-ts && bun test tests/runner/attempts-push-pr.test.ts -t "hung push" fails; green: passes | released v11.17.53 | Gap: attempts.ts:376 spawnSync without timeout vs attempts.ts:292 timeout 30_000 |
+| TEN-STABILITY-52 | fix: recordFailures reads the failures file then rewrites existing + lines, so two concurrent runs lose lines; append atomically instead | loki-ts/src/util/failure_memory.ts, loki-ts/tests/e10ext/repomemory.test.ts | MEDIUM | red: cd loki-ts && bun test tests/e10ext/repomemory.test.ts -t "concurrent recordFailures" fails; green: passes | released v11.17.53 | Gap: failure_memory.ts:47 writeFileSync(failuresPath(dir), existing + lines); line 115 already uses temp file plus rename for another file |
+| TEN-STABILITY-53 | fix: pr_lessons push spawnSync has no timeout, so a hung push blocks pr respond forever; add a bounded timeout | loki-ts/src/util/pr_lessons.ts, loki-ts/tests/util/pr_lessons.test.ts | LOW | red: cd loki-ts && bun test tests/util/pr_lessons.test.ts -t "hung push" fails; green: passes | released v11.17.53 | Gap: pr_lessons.ts:348 spawnSync without timeout (LOKI_PR_RESPOND_MAX at :370 is already guarded at :386, not a gap) |
+| TEN-STABILITY-54 | fix: issues run shells out to gh with spawnSync and no timeout, so one hung gh call stalls the whole issue batch; add a bounded timeout returned as a nonzero rc | loki-ts/src/commands/issues_run.ts, loki-ts/tests/commands/issues_run.test.ts | MEDIUM | red: cd loki-ts && bun test tests/commands/issues_run.test.ts -t "hung gh" fails; green: passes | released v11.17.53 | Gap: issues_run.ts:533 spawnSync("gh", ...) without timeout |
+| TEN-STABILITY-55 | enhancement: verify pr gh helper uses execFileSync with no timeout; add a bounded timeout so a stalled gh yields the existing fetch error | loki-ts/src/commands/verify_pr.ts, loki-ts/tests/commands/verify_pr.test.ts | LOW | red: cd loki-ts && bun test tests/commands/verify_pr.test.ts -t "gh timeout" fails; green: passes | released v11.17.53 | Gap: verify_pr.ts:57 execFileSync("gh", args, {...}) without timeout |
+| TEN-UX-40 | enhancement: loki control with a mistyped subcommand prints "Did you mean" using suggestWord, like crash and wiki do | loki-ts/src/commands/control.ts, loki-ts/tests/commands/control.test.ts | LOW | red: cd loki-ts && bun test tests/commands/control.test.ts -t "did you mean" fails; green: passes | released v11.17.53 | Gap: control.ts:248-250 default case prints unknown command plus HELP only |
+| TEN-UX-41 | enhancement: loki queue with an unknown subcommand names the bad word and suggests the closest one before the usage | loki-ts/src/commands/queue.ts, loki-ts/tests/commands/queue.test.ts | LOW | red: cd loki-ts && bun test tests/commands/queue.test.ts -t "unknown subcommand hint" fails; green: passes | released v11.17.53 | Gap: queue.ts:529-531 default case prints QUEUE_USAGE without the offending word. Chain UX-41, UX-44 |
+| TEN-UX-42 | enhancement: loki undo unknown flag suggests the closest known flag | loki-ts/src/commands/undo.ts, loki-ts/tests/commands/undo.test.ts | LOW | red: cd loki-ts && bun test tests/commands/undo.test.ts -t "flag hint" fails; green: passes | released v11.17.53 | Gap: undo.ts:221 err("unknown flag X (see loki undo --help)") with no suggestion although known set is at :219 |
+| TEN-UX-43 | enhancement: loki memory unknown flag suggests the closest allowed flag | loki-ts/src/commands/memory.ts, loki-ts/tests/commands/memory.test.ts | LOW | red: cd loki-ts && bun test tests/commands/memory.test.ts -t "flag hint" fails; green: passes | released v11.17.53 | Gap: memory.ts:112 unknownFlag writes the error without using the allowed list for a suggestion |
+| TEN-UX-44 | enhancement: loki queue run unknown argument suggests the closest valid argument | loki-ts/src/commands/queue.ts, loki-ts/tests/commands/queue.test.ts | LOW | red: cd loki-ts && bun test tests/commands/queue.test.ts -t "run arg hint" fails; green: passes | released v11.17.53 | Gap: queue.ts:284 d.err(unknown argument) with no suggestion. Serialize after TEN-UX-41 |
+| TEN-ADOPTION-28 | feature: registry lists crash subcommands list, show, submit, help so shell completion offers them | loki-ts/src/cli/registry.ts, docs/v10/CLI-MODERN.md, loki-ts/tests/cli/registry_guard.test.ts | LOW | red: cd loki-ts && bun test tests/cli/registry_guard.test.ts -t "crash subcommands" fails; green: passes after bun loki-ts/scripts/gen-cli-modern-doc.ts | released v11.17.53 | Gap: registry.ts:170 crash has no subcommands; crash.ts:258 CRASH_SUBCOMMANDS. Chain ADOPTION-28 to -33 (same files) |
+| TEN-ADOPTION-29 | feature: registry rollback lists the deploy subcommand and the list --json flag | loki-ts/src/cli/registry.ts, docs/v10/CLI-MODERN.md, loki-ts/tests/cli/registry_guard.test.ts | LOW | red: cd loki-ts && bun test tests/cli/registry_guard.test.ts -t "rollback deploy" fails; green: passes | released v11.17.53 | Gap: registry.ts:118-125 rollback has list, show, to, latest only; rollback.ts:33 documents list [--json]. Serialize after TEN-ADOPTION-28 |
+| TEN-ADOPTION-30 | feature: registry control status lists the --json flag | loki-ts/src/cli/registry.ts, docs/v10/CLI-MODERN.md, loki-ts/tests/cli/registry_guard.test.ts | LOW | red: cd loki-ts && bun test tests/cli/registry_guard.test.ts -t "control status json" fails; green: passes | released v11.17.53 | Gap: registry.ts:147-153 status has no flags; control.ts:25 and :226 accept status --json. Serialize after TEN-ADOPTION-29 |
+| TEN-ADOPTION-31 | feature: registry trust lists the --json flag | loki-ts/src/cli/registry.ts, docs/v10/CLI-MODERN.md, loki-ts/tests/cli/registry_guard.test.ts | LOW | red: cd loki-ts && bun test tests/cli/registry_guard.test.ts -t "trust json" fails; green: passes | released v11.17.53 | Gap: registry.ts:169 trust has only detail; trust.ts:106 handles --json. Serialize after TEN-ADOPTION-30 |
+| TEN-ADOPTION-32 | feature: registry undo lists the --list and --dry-run flags | loki-ts/src/cli/registry.ts, docs/v10/CLI-MODERN.md, loki-ts/tests/cli/registry_guard.test.ts | LOW | red: cd loki-ts && bun test tests/cli/registry_guard.test.ts -t "undo flags" fails; green: passes | released v11.17.53 | Gap: registry.ts:182 undo flags omit --list and --dry-run; undo.ts:219 known set includes both. Serialize after TEN-ADOPTION-31 |
+| TEN-ADOPTION-33 | feature: registry memory list and memory lessons list the --json flag | loki-ts/src/cli/registry.ts, docs/v10/CLI-MODERN.md, loki-ts/tests/cli/registry_guard.test.ts | LOW | red: cd loki-ts && bun test tests/cli/registry_guard.test.ts -t "memory json" fails; green: passes | released v11.17.53 | Gap: registry.ts:104-117 list and lessons have no flags; memory.ts:126 and :155 accept --json. Serialize after TEN-ADOPTION-32 |
+| TEN-DEPLOY-24 | fix: rollback deploy hint matches only the first token, so flyctl deploy, npx vercel --prod and bunx wrangler get no rollback command; skip npx, bunx, pnpm dlx, yarn dlx wrappers and alias flyctl to fly | loki-ts/src/commands/rollback.ts, loki-ts/tests/commands/rollback.test.ts | LOW | red: cd loki-ts && bun test tests/commands/rollback.test.ts -t "wrapped deploy" fails; green: passes | released v11.17.53 | Gap: rollback.ts printDeployRollback const first = command.split(/\s+/)[0] then DEPLOY_ROLLBACKS.find(r => r.prefix === first). Chain DEPLOY-24, DEPLOY-25 |
+| TEN-DEPLOY-25 | feature: loki rollback deploy accepts --json and prints the matched rollback command as a JSON object | loki-ts/src/commands/rollback.ts, loki-ts/tests/commands/rollback.test.ts | LOW | red: cd loki-ts && bun test tests/commands/rollback.test.ts -t "deploy json" fails; green: passes | released v11.17.53 | Gap: rollback.ts:65 allowed flags are [] for deploy. Serialize after TEN-DEPLOY-24 |
+| TEN-SPEED-17 | feature: engine10 intake reuses the tree-keyed repomap and testmap cache (cachedRepoMap and cachedTestMap) instead of rebuilding both on every run, so a second run on an unchanged tree skips the repo walk and test detection | loki-ts/src/engine10/stages/intake.ts, loki-ts/tests/engine10/intake.test.ts | MEDIUM | red: cd loki-ts && bun test tests/engine10/intake.test.ts -t "tree cache" fails; green: passes | released v11.17.54 | Gap: cache.ts:66-67 defines cachedRepoMap and cachedTestMap but no src caller exists outside cache.ts; intake.ts:93-95 calls buildRepoMap and ctx.tests.detect every run; sizing.ts:40 and context.ts:46 read repomap2-<tree>.json that nothing writes |
+| TEN-SPEED-18 | feature: verify runs the selected test files with bounded concurrency (LOKI_E10_VERIFY_JOBS, default 1 so behavior is unchanged) and records checks in the original failed-first order; protect, cwd and interpreter handling stay per test | loki-ts/src/engine10/stages/verify.ts, loki-ts/tests/engine10/verify.test.ts | HIGH | red: cd loki-ts && bun test tests/engine10/verify.test.ts -t "verify jobs" fails; green: passes | released v11.17.54 | Gap: verify.ts:284 `for (const t of tests) { await runCheck(...) }` runs one test process at a time; no jobs knob exists. Serialize after any open verify.ts row |
+| TEN-SPEED-19 | feature: the Wall base-tree test run executes wall test files with bounded concurrency (LOKI_E10_BASE_JOBS, default 1) with the same pass/fail/not_run counts and lastNotRunFiles order | loki-ts/src/engine10/stages/wall.ts, loki-ts/tests/engine10/wall_runner.test.ts | HIGH | red: cd loki-ts && bun test tests/engine10/wall_runner.test.ts -t "base jobs" fails; green: passes | released v11.17.54 | Gap: wall.ts:39 `for (const f of files)` with a synchronous spawnSync per file in RealBaseTestRunner.run, one process at a time |
+| TEN-SPEED-20 | feature: a group suite-fix unit reuses the failing-suite output integrate already captured instead of re-running the whole suite (up to 600s) just to build the fix brief | loki-ts/src/features/speed/fix_units.ts, loki-ts/src/engine10/integrate.ts, loki-ts/tests/features/speed/fix_units.test.ts | MEDIUM | red: cd loki-ts && bun test tests/features/speed/fix_units.test.ts -t "suite fix reuses output" fails; green: passes | released v11.17.54 | Gap: fix_units.ts:41 suiteTail does spawnSync of the full test command (timeout 600000) after integrate already ran it; integrate.ts:22 IntegrateResult has no output field. Chain TEN-QUALITY-36, TEN-SPEED-20 (same test file); serialize after TEN-QUALITY-36 |
+| TEN-UX-45 | feature: loki start --dry-run parses and validates every flag, runs the preflight and prints the provider, model and cost cap it would use, then exits 0 without spending a token | loki-ts/src/commands/start.ts, loki-ts/tests/commands/start.test.ts | MEDIUM | red: cd loki-ts && bun test tests/commands/start.test.ts -t "dry-run" fails; green: passes | released v11.17.54 | Gap: grep -n "dry-run" loki-ts/src/commands/start.ts returns nothing, so --dry-run is an unknown flag today (start.ts:229 error); a first-run user cannot check setup without a paid run. Chain TEN-UX-48, TEN-UX-50, TEN-DEPLOY-26, TEN-UX-47, TEN-UX-46, TEN-UX-45 (same files); serialize after TEN-UX-46 |
+| TEN-UX-46 | feature: loki start unknown-flag error suggests the closest valid flag (suggestWord) and stops naming LOKI_SDK_LOOP internals to first-run users | loki-ts/src/commands/start.ts, loki-ts/tests/commands/start.test.ts | LOW | red: cd loki-ts && bun test tests/commands/start.test.ts -t "unknown flag suggestion" fails; green: passes | released v11.17.54 | Gap: start.ts:229 prints "flag --bogus is not supported by the Bun (LOKI_SDK_LOOP) runner ... run without LOKI_SDK_LOOP" (reproduced with parseStartArgs(["x","--bogus"])); cli/registry.ts:346 exports suggestWord and start does not use it. Serialize after TEN-UX-47 |
+| TEN-COST-54 | feature: LOKI_PRICE_TABLE=<json file> overrides or extends PRICE_TABLE entries so a stale vendor price is fixable without a release; invalid file falls back to the built-in table | loki-ts/src/providers/price_table.ts, loki-ts/tests/providers/price_table.test.ts (new: no test file owns price_table.ts, grep of tests for priceFor and usdFor finds none) | LOW | red: cd loki-ts && bun test tests/providers/price_table.test.ts -t "price table override" fails; green: passes | released v11.17.54 | Gap: price_table.ts:7 comment says "Update as vendors publish new prices" and the table is a frozen constant (line 8) with no env override. Chain TEN-COST-56, TEN-COST-58, TEN-COST-54 (same files); serialize after TEN-COST-58 |
+| TEN-COST-55 | feature: opencode runs get a size-estimate cost record (estimated=true, cost_basis size-estimate) when the model id is priced, instead of an unmeasured cost, so the cost cap and loki cost cover all 5 providers | loki-ts/src/providers/provider_cost.ts, loki-ts/tests/engine10/budget_cap.test.ts | MEDIUM | red: cd loki-ts && bun test tests/engine10/budget_cap.test.ts -t "opencode estimate" fails; green: passes | released v11.17.54 | Gap: provider_cost.ts:71 ESTIMATED_PROVIDERS is codex, cline, aider only, so buildProviderCost returns null for opencode (line 86); provider_opencode.ts:5-7 states cost is not measured |
+| TEN-QUALITY-32 | feature: impactedRefs maps a changed Python package __init__.py and Rust mod.rs to the package directory name so tests that import the package are selected | loki-ts/src/engine10/testmap.ts, loki-ts/tests/engine10/testmap.test.ts | HIGH | red: cd loki-ts && bun test tests/engine10/testmap.test.ts -t "package init maps to directory" fails; green: passes | released v11.17.54 | Gap: reproduced on a repo with pkg/search/__init__.py and tests/test_search.py (from pkg.search import a): buildTestMap yields sourceRefs {search:[tests/test_search.py]} and impactedRefs(map,["pkg/search/__init__.py"]) returns []; testmap.ts:178 keys on basename of the file. Chain TEN-QUALITY-39, TEN-QUALITY-32, TEN-SPEED-22 (same files); serialize after TEN-QUALITY-39 |
+| TEN-STABILITY-56 | feature: the supervisor forwards SIGHUP (terminal closed) to the detached worker process group, the same way it forwards SIGINT and SIGTERM, so closing the terminal does not orphan a paid worker | loki-ts/src/runner/worker_proc.ts, loki-ts/tests/engine10/supervisor_signal.test.ts | MEDIUM | red: cd loki-ts && bun test tests/engine10/supervisor_signal.test.ts -t "sighup" fails; green: passes | released v11.17.54 | Gap: grep -rn SIGHUP loki-ts/src returns nothing; worker_proc.ts:35-36 registers only SIGINT and SIGTERM and spawns the worker detached (line 17) so a SIGHUP kills the supervisor and leaves the worker group running |
+| TEN-SPEED-21 | enhancement: the 30-second session heartbeat lists untracked files once and shares the list between the shortstat and the signature | loki-ts/src/engine10/session.ts, loki-ts/tests/engine10/session.test.ts | LOW | red: cd loki-ts && bun test tests/engine10/session.test.ts -t "heartbeat single ls-files" fails; green: passes | released v11.17.54 | Gap: session.ts:88 (diffShortstat) and session.ts:104 (diffSignature) each run safeGit ls-files -z --others --exclude-standard on the same tick |
+| TEN-SPEED-22 | enhancement: buildTestMap reads each JS test file once (the node:test probe and the reference scan share one read) and stops probing for node:test once node is marked | loki-ts/src/engine10/testmap.ts, loki-ts/tests/engine10/testmap.test.ts | LOW | red: cd loki-ts && bun test tests/engine10/testmap.test.ts -t "single read per test file" fails; green: passes | released v11.17.54 | Gap: testmap.ts:115 readText(full) for every JS test file in the first loop and testmap.ts:143 readText(join(root, t.path)) again in the tests loop. Serialize after TEN-QUALITY-32 |
+| TEN-SPEED-23 | enhancement: repomap topLevelSymbols reads only the first MAX_SCAN_BYTES bytes of each file instead of the whole file | loki-ts/src/engine10/repomap.ts, loki-ts/tests/engine10/repomap.test.ts | LOW | red: cd loki-ts && bun test tests/engine10/repomap.test.ts -t "bounded read" fails; green: passes | released v11.17.54 | Gap: repomap.ts:44 `readFileSync(absPath, "utf8").slice(0, MAX_SCAN_BYTES)` loads the full file (and decodes it) before slicing |
+| TEN-QUALITY-33 | enhancement: enable noImplicitReturns in loki-ts/tsconfig.json and fix the one violation | loki-ts/tsconfig.json, loki-ts/src/contrib/slack_inbound.ts | LOW | red: cd loki-ts && bun run --bun tsc --noEmit --noImplicitReturns fails (exit non-zero); green: cd loki-ts && bun run typecheck && bun test tests/features/slack_inbound.test.ts passes | released v11.17.54 | Gap: tsc --noImplicitReturns reports exactly 1 error, slack_inbound.ts(217,10) TS7030 in the slackPoster async lambda; tsconfig.json has strict and noUncheckedIndexedAccess (line 9) but not noImplicitReturns. Chain TEN-QUALITY-33, TEN-QUALITY-34 (same file) |
+| TEN-QUALITY-34 | enhancement: handleSlackEvent takes payload as unknown and narrows it, removing the any | loki-ts/src/contrib/slack_inbound.ts, loki-ts/tests/features/slack_inbound.test.ts | LOW | red: cd loki-ts && bun test tests/features/slack_inbound.test.ts -t "malformed payload" fails; green: passes | released v11.17.54 | Gap: slack_inbound.ts:100 `payload: any`. Serialize after TEN-QUALITY-33 |
+| TEN-QUALITY-35 | enhancement: add optional stderrTail to SessionResult and drop the double-cast at both call sites | loki-ts/src/engine10/types.ts, loki-ts/src/engine10/stages/implement.ts, loki-ts/src/engine10/stages/plan.ts | LOW | red: cd loki-ts && grep -c "as unknown as { stderrTail" src/engine10/stages/implement.ts src/engine10/stages/plan.ts prints non-zero counts; green: both counts are 0 and cd loki-ts && bun run typecheck && bun test tests/engine10/implement.test.ts tests/engine10/plan.test.ts passes | released v11.17.54 | Gap: implement.ts:180 and plan.ts:101 cast `session as unknown as { stderrTail?: string }`; types.ts:98 SessionResult lacks the field that session.ts:176 returns |
+| TEN-UX-47 | enhancement: loki start unknown --provider error lists the valid providers, as loki estimate already does | loki-ts/src/commands/start.ts, loki-ts/tests/commands/start.test.ts | LOW | red: cd loki-ts && bun test tests/commands/start.test.ts -t "unknown provider lists valid" fails; green: passes | released v11.17.54 | Gap: start.ts:292 prints only "unknown --provider 'gemini'"; cost_preview.ts:144 exports VALID_PROVIDERS and cost_preview.ts:161 lists them. Serialize after TEN-DEPLOY-26 |
+| TEN-QUALITY-36 | enhancement: characterization tests for fix_units effectiveDag, integrateWithFixes and fixEnabled (conflict fix, suite fix, MAX_FIX_UNITS cap, LOKI_GROUP_FIX_UNITS=0) | loki-ts/tests/features/speed/fix_units.test.ts (new: no test file imports fix_units.ts) | MEDIUM | red: cd loki-ts && test -f tests/features/speed/fix_units.test.ts fails; green: bun test tests/features/speed/fix_units.test.ts passes | released v11.17.54 | Gap: fix_units.ts has no direct test; only the LOKI_GROUP_FIX_UNITS name appears in seal_group.test.ts. Chain TEN-QUALITY-36, TEN-SPEED-20 |
+| TEN-QUALITY-37 | enhancement: unit tests for compound_match linkedHits (compound keyword, suffix word rejected, vendored path skipped, import line required) | loki-ts/tests/e10ext/compound_match.test.ts (new: no test file imports compound_match.ts) | LOW | red: cd loki-ts && test -f tests/e10ext/compound_match.test.ts fails; green: bun test tests/e10ext/compound_match.test.ts passes | released v11.17.54 | Gap: compound_match.ts:45 linkedHits is covered only indirectly through already_done tests |
+| TEN-QUALITY-38 | enhancement: unit tests for buildOpencodeArgv (default cli, LOKI_OPENCODE_CLI, LOKI_OPENCODE_MODEL, LOKI_OPENCODE_FLAGS whitespace split, commit hygiene prefix) | loki-ts/tests/runner/provider_opencode.test.ts (new: no test file imports provider_opencode.ts) | LOW | red: cd loki-ts && test -f tests/runner/provider_opencode.test.ts fails; green: bun test tests/runner/provider_opencode.test.ts passes | released v11.17.54 | Gap: provider_opencode.ts:25 buildOpencodeArgv is documented "unit-testable without spawning" yet grep of loki-ts/tests and tests/ finds no reference |
+| TEN-QUALITY-39 | fix: impactedRefs returns no tests for a changed index.ts/index.js because the source is keyed as "index" while tests import the directory name | loki-ts/src/engine10/testmap.ts, loki-ts/tests/engine10/testmap.test.ts | HIGH | red: cd loki-ts && bun test tests/engine10/testmap.test.ts -t "index source maps to directory" fails; green: passes | released v11.17.54 | Gap: reproduced on a repo with src/search/index.ts and tests/search.test.ts (import from "../src/search"): buildTestMap finds the bun runner and the test, impactedRefs(map,["src/search/index.ts"]) returns []; testmap.ts:178 uses basename(rel, extname(rel)) = "index", so the verifier under-selects tests. Chain TEN-QUALITY-39, TEN-QUALITY-32, TEN-SPEED-22 (same files) |
+| TEN-COST-56 | fix: usdFor returns NaN for non-finite or negative tokens and bills cached tokens in full when cached exceeds input; clamp to finite non-negative and cap cached at input | loki-ts/src/providers/price_table.ts, loki-ts/tests/providers/price_table.test.ts (new: see TEN-COST-54) | MEDIUM | red: cd loki-ts && bun test tests/providers/price_table.test.ts -t "usdFor clamps" fails; green: passes | released v11.17.54 | Gap: reproduced usdFor("gpt-5",NaN,10) = NaN and usdFor("gpt-5",100,0,500) = 0.000063 (500 cached tokens billed against 100 input); price_table.ts:40-45; provider_cost.ts:94 feeds it. Chain TEN-COST-56, TEN-COST-58, TEN-COST-54 (same files) |
+| TEN-COST-57 | fix: loki estimate --model followed by another flag swallows that flag as the model id, and --model= (empty) is accepted; require a non-empty value that does not start with a dash | loki-ts/src/runner/router/cost_preview.ts, loki-ts/tests/runner/cost_preview.test.ts | LOW | red: cd loki-ts && bun test tests/runner/cost_preview.test.ts -t "model needs a value" fails; green: passes | released v11.17.54 | Gap: reproduced runEstimate(["--provider","codex","--model","--json"]) returns 0 and prints text (--json consumed as the model); runEstimate(["--provider","codex","--model="]) returns 0; cost_preview.ts:155 `args[++i]` only rejects an absent value, line 157 has no empty check |
+| TEN-COST-58 | fix: PRICE_TABLE prices gpt-4o-mini, gpt-4.1-mini, gpt-4.1-nano, gpt-5-mini and gpt-5-nano at the full gpt-4o, gpt-4.1 and gpt-5 rates, overstating cost and tripping the cost cap early; add their own entries from the vendor price page (cite the page in a comment) | loki-ts/src/providers/price_table.ts, loki-ts/tests/providers/price_table.test.ts (new: see TEN-COST-54) | LOW | red: cd loki-ts && bun test tests/providers/price_table.test.ts -t "mini and nano priced separately" fails; green: passes | released v11.17.54 | Gap: priceFor uses longest-substring match (price_table.ts:28-32) and the table (lines 11-13) has no mini or nano keys, so "gpt-5-mini" resolves to the "gpt-5" entry. Chain TEN-COST-56, TEN-COST-58, TEN-COST-54; serialize after TEN-COST-56 |
+| TEN-UX-48 | fix: loki start --provider, --session-model, --cost and --spec with a missing or empty value are silently ignored and the run starts with defaults; fail with "needs a value" like the text flags | loki-ts/src/commands/start.ts, loki-ts/tests/commands/start.test.ts | LOW | red: cd loki-ts && bun test tests/commands/start.test.ts -t "value flags need a value" fails; green: passes | released v11.17.54 | Gap: reproduced parseStartArgs(["x","--provider"]), ["x","--session-model"], ["x","--cost"], ["x","--spec"] all return {prdPath:"x"} with no error and ["x","--provider=","--simple"] yields provider ""; start.ts:57 TEXT_VALUE_FLAGS lists only 6 free-text flags. First in the start.ts chain |
+| TEN-UX-50 | fix: a PRD path containing a space (for example "My Docs/prd.md") that does not exist is treated as a brief and starts a paid run; treat a slash-containing token ending in a doc extension as a path even with spaces | loki-ts/src/commands/start.ts, loki-ts/tests/commands/start.test.ts | MEDIUM | red: cd loki-ts && bun test tests/commands/start.test.ts -t "spaced prd path" fails; green: passes | released v11.17.54 | Gap: reproduced missingPrdMessage(["My Docs/prd.md"],"My Docs/prd.md",()=>false) = null while "docs/spec.pdf" and "prd.md" give "PRD file not found"; start.ts:384 pathShaped rejects any \s. Serialize after TEN-UX-48 |
+| TEN-DEPLOY-26 | fix: loki start --health-url, --domain, --destination and --env-file given with no value pass deployFlagError silently, so the deploy step is skipped or runs without the setting; report a missing value before the paid build | loki-ts/src/commands/start.ts, loki-ts/tests/commands/start.test.ts | MEDIUM | red: cd loki-ts && bun test tests/commands/start.test.ts -t "deploy flag missing value" fails; green: passes | released v11.17.54 | Gap: reproduced deployFlagError(["x","--health-url"]), ["x","--destination"], ["x","--env-file"] and ["x","--domain","--simple"] all return null; start.ts:437-447 val() returns undefined for an absent or dash-leading value and the checks only run when val is defined. Serialize after TEN-UX-50 |
+| TEN-UX-51 | fix: a first-run folder that holds only .DS_Store (macOS Finder) is refused as non-empty; ignore .DS_Store and other OS metadata files when deciding the folder is empty | loki-ts/src/util/first_run_repo.ts, loki-ts/tests/engine10/preflight.test.ts | LOW | red: cd loki-ts && bun test tests/engine10/preflight.test.ts -t "ds_store only folder" fails; green: passes | released v11.17.54 | Gap: reproduced initEmptyRepo(dirWithOnly.DS_Store) returns {fatal:"not a git repository ... "}; first_run_repo.ts:12 `readdirSync(dir).length === 0` counts dotfiles |
+| TEN-STABILITY-57 | fix: appendRunOutcome is a read-modify-write, so two concurrent runs on one repo lose an outcome; serialize with a lock file or append-only records | loki-ts/src/runner/router/history_store.ts, loki-ts/tests/runner/router_history.test.ts | MEDIUM | red: cd loki-ts && bun test tests/runner/router_history.test.ts -t "concurrent append keeps all" fails; green: passes | released v11.17.54 | Gap: history_store.ts:70 reads the history, appends in memory, then renames a pid-named temp file over the target (lines 73-77); the atomic rename prevents truncation but not a lost update between two processes |
+| TEN-SECURITY-22 | fix: secure-scan silently skips untracked files larger than 1 MB, so a secret in a large new file passes the gate unreported; scan them line by line up to a hard cap and list anything above the cap as an explicit skipped file | loki-ts/src/util/secure_scan.ts, loki-ts/tests/util/secure_scan.test.ts | HIGH | red: cd loki-ts && bun test tests/util/secure_scan.test.ts -t "oversized untracked file" fails; green: passes | released v11.17.54 | Gap: secure_scan.ts:49 MAX_ADDED_FILE_BYTES = 1_000_000 and secure_scan.ts:237 `if (!st.isFile() \|\| st.size > MAX_ADDED_FILE_BYTES) continue;` drops the file with no finding, no error and no skipped count; grep for skipped or unscanned in the file finds nothing |
+| TEN-COST-59 | fix: parseCapUsd accepts ".5" and "5." as dollar caps instead of returning null (which silently drops the cap to the default) | loki-ts/src/e10ext/budget_cap.ts, loki-ts/tests/engine10/budget_cap.test.ts | MEDIUM | red: cd loki-ts && bun test tests/engine10/budget_cap.test.ts -t "bare decimal cap" fails; green: passes | ready@2026-10-17T12:00Z | Gap: budget_cap.ts parseCapUsd regex ^\$?\d+(\.\d+)?$ rejects .5 and 5.; probed: both return null. Chain COST-59, COST-60 (same file); serialize after none |
+| TEN-COST-60 | fix: hasApiKey also counts OPENROUTER_API_KEY and LOKI_MODEL_API_KEY so a run billed through a model route gets a cap instead of source subscription with usd 0 (no cap) | loki-ts/src/e10ext/budget_cap.ts, loki-ts/tests/engine10/budget_cap.test.ts | MEDIUM | red: cd loki-ts && bun test tests/engine10/budget_cap.test.ts -t "route key cap" fails; green: passes | ready@2026-10-17T12:00Z | Gap: budget_cap.ts hasApiKey checks only ANTHROPIC_API_KEY and OPENAI_API_KEY; model_routes.ts:17 and :49 read the other two token vars; probed: only OPENROUTER_API_KEY set resolves {usd:0, source:subscription}. Chain COST-59, COST-60 (same file); serialize after COST-59 |
+| TEN-COST-61 | fix: resolveRunCapS reads the first loki.yaml/loki.yml like resolveCap and cost.profile do, not the last | loki-ts/src/util/run_cap.ts, loki-ts/tests/engine10/fc21_cap.test.ts | MEDIUM | red: cd loki-ts && bun test tests/engine10/fc21_cap.test.ts -t "yaml precedence" fails; green: passes | ready@2026-10-17T12:00Z | Gap: run_cap.ts resolveRunCapS uses texts[texts.length-1] while resolveCap and start.ts cost.profile use the first, so one repo with both files gets two different caps |
+| TEN-COST-62 | feature: priorFor returns a cost prior for opus models so the pre-run estimate is shown for opus-routed runs instead of nothing | loki-ts/src/runner/router/cost_preview.ts, loki-ts/tests/runner/cost_preview.test.ts | MEDIUM | red: cd loki-ts && bun test tests/runner/cost_preview.test.ts -t "opus prior" fails; green: passes | ready@2026-10-17T12:00Z | Gap: cost_preview.ts:38 tier is only haiku or sonnet, else null, so a start with an opus model prints no estimate |
+| TEN-SECURITY-23 | fix: redact GOOGLE_KEY rule requires the AIza prefix shape so ordinary identifiers starting with AI are not rewritten in logs and receipts | loki-ts/src/util/redact.ts, loki-ts/tests/util/redact.test.ts | HIGH | red: cd loki-ts && bun test tests/util/redact.test.ts -t "google key shape" fails; green: passes | ready@2026-10-17T12:00Z | Gap: redact.ts GOOGLE_KEY /AI[a-zA-Z0-9_-]{30,}/g matches any 32+ char identifier starting AI (over-redaction corrupts evidence). Chain SECURITY-23, 24, 25 (same file); serialize after none |
+| TEN-SECURITY-24 | feature: redact adds Slack webhook URLs, sk_test_ and rk_ Stripe keys, and whsec_ webhook secrets | loki-ts/src/util/redact.ts, loki-ts/tests/util/redact.test.ts | HIGH | red: cd loki-ts && bun test tests/util/redact.test.ts -t "slack stripe redact" fails; green: passes | ready@2026-10-17T12:00Z | Gap: redact.ts RULES has no pattern for hooks.slack.com/services, sk_test_, or whsec_; a pasted token reaches events and receipts unredacted. Chain SECURITY-23, 24, 25; serialize after SECURITY-23 |
+| TEN-SECURITY-25 | feature: redact masks the value of key=value and key: value assignments for password, secret, token and api_key names | loki-ts/src/util/redact.ts, loki-ts/tests/util/redact.test.ts | HIGH | red: cd loki-ts && bun test tests/util/redact.test.ts -t "assignment redact" fails; green: passes | ready@2026-10-17T12:00Z | Gap: redact.ts RULES match only token-shaped literals; password=hunter2 passes through unchanged. Chain SECURITY-23, 24, 25; serialize after SECURITY-24 |
+| TEN-STABILITY-58 | fix: yamlKey reads flow-style maps such as budgets: { per_run: 5 } instead of ignoring them (the default 100 dollar cap then applies silently) | loki-ts/src/util/yaml_key.ts, loki-ts/tests/util/yaml_key.test.ts | MEDIUM | red: cd loki-ts && bun test tests/util/yaml_key.test.ts -t "flow style" fails; green: passes | ready@2026-10-17T12:00Z | Gap: yaml_key.ts yamlKey handles block style only; probed: flow style returns undefined so resolve falls to the default cap |
+| TEN-STABILITY-59 | fix: loki undo validates the run id before the LOKI_UNDO gate so a bad id reports usage, not the gate message | loki-ts/src/commands/undo.ts, loki-ts/tests/commands/undo.test.ts | MEDIUM | red: cd loki-ts && bun test tests/commands/undo.test.ts -t "undo id before gate" fails; green: passes | ready@2026-10-17T12:00Z | Gap: undo.ts runUndo checks the LOKI_UNDO gate (line 239) before loadPlan validates the run id (isRunId, line 44) |
+| TEN-STABILITY-60 | enhancement: pauseTimeoutMs warns once on stderr when the pause timeout env is set but not a positive number, then uses the default | loki-ts/src/util/run_control.ts, loki-ts/tests/util/run_control.test.ts | MEDIUM | red: cd loki-ts && bun test tests/util/run_control.test.ts -t "pause timeout warn" fails; green: passes | ready@2026-10-17T12:00Z | Gap: run_control.ts pauseTimeoutMs falls back silently on garbage. Chain STABILITY-60, 61 (same file); serialize after none |
+| TEN-STABILITY-61 | enhancement: runControlBoundary records reason timeout_abandon on the cancel event when a pause expires, distinct from a user cancel | loki-ts/src/util/run_control.ts, loki-ts/tests/util/run_control.test.ts | MEDIUM | red: cd loki-ts && bun test tests/util/run_control.test.ts -t "timeout abandon event" fails; green: passes | ready@2026-10-17T12:00Z | Gap: run_control.ts runControlBoundary emits identical cancel events for a user cancel and a timeout abandon. Chain STABILITY-60, 61; serialize after STABILITY-60 |
+| TEN-STABILITY-62 | fix: queue add rejects issue number 0 for owner/repo#0 and bare 0 | loki-ts/src/commands/queue.ts, loki-ts/tests/commands/queue.test.ts | LOW | red: cd loki-ts && bun test tests/commands/queue.test.ts -t "queue zero issue" fails; green: passes | ready@2026-10-17T12:00Z | Gap: queue.ts accepts queue add 0 and a/b#0; probed: both exit 0 and enqueue an unrunnable item |
+| TEN-STABILITY-63 | fix: engine10 supervisor main exits 2 with a usage line when --spec or --max-cost has no value, instead of treating it as an empty string | loki-ts/src/engine10/supervisor.ts, loki-ts/tests/engine10/supervisor_signal.test.ts | MEDIUM | red: cd loki-ts && bun test tests/engine10/supervisor_signal.test.ts -t "missing flag value" fails; green: passes | ready@2026-10-17T12:00Z | Gap: supervisor.ts main arg parser turns --spec and --max-cost with a missing value into ""; the git-repo check then runs before resolveCap so the user sees an unrelated error |
+| TEN-STABILITY-65 | fix: internal handoff requires an explicit positive consecutive-failure count instead of defaulting a missing count to 0 | loki-ts/src/commands/internal_phase1.ts, loki-ts/tests/commands/internal_phase1.test.ts | LOW | red: cd loki-ts && bun test tests/commands/internal_phase1.test.ts -t "handoff count" fails; green: passes | ready@2026-10-17T12:00Z | Gap: internal_phase1.ts runHandoff: parseInt(argv[1] ?? "0") makes a missing count 0 and Number.isFinite accepts it and negatives |
+| TEN-UX-52 | fix: loki provider show with an unknown provider exits 2 and lists valid providers | loki-ts/src/commands/provider.ts, loki-ts/tests/commands/provider.test.ts | LOW | red: cd loki-ts && bun test tests/commands/provider.test.ts -t "unknown provider" fails; green: passes | ready@2026-10-17T12:00Z | Gap: provider.ts runProviderShow accepts an unknown provider with exit 0 |
+| TEN-UX-53 | enhancement: loki --version and loki version reject extra positional arguments with exit 2 | loki-ts/src/commands/version.ts, loki-ts/tests/commands/version.test.ts | LOW | red: cd loki-ts && bun test tests/commands/version.test.ts -t "version extra args" fails; green: passes | ready@2026-10-17T12:00Z | Gap: version.ts ignores extra positionals; probed: loki version bogus prints the version and exits 0 |
+| TEN-UX-54 | fix: loki stats writes the Unknown option message to stderr, not stdout, so --json consumers get clean output | loki-ts/src/commands/stats.ts, loki-ts/tests/commands/stats.test.ts | LOW | red: cd loki-ts && bun test tests/commands/stats.test.ts -t "stats unknown to stderr" fails; green: passes | ready@2026-10-17T12:00Z | Gap: stats.ts computeStats returns the Unknown option text as stdout with exitCode 2 (lines 491-497) |
+| TEN-UX-55 | feature: preflight fails early with a one-line fix when the repo directory is not writable | loki-ts/src/engine10/preflight.ts, loki-ts/tests/engine10/preflight.test.ts | MEDIUM | red: cd loki-ts && bun test tests/engine10/preflight.test.ts -t "repo writable" fails; green: passes | ready@2026-10-17T12:00Z | Gap: preflight.ts checkPreflight has no writability probe, so a read-only checkout fails mid-run on the first write. Chain ADOPTION-34, UX-55 (same file); serialize after ADOPTION-34 |
+| TEN-ADOPTION-34 | feature: preflight probes login state for codex, cline, aider and opencode like it does for claude, so loki start names the missing login before spending | loki-ts/src/engine10/preflight.ts, loki-ts/tests/engine10/preflight.test.ts | MEDIUM | red: cd loki-ts && bun test tests/engine10/preflight.test.ts -t "provider login probe" fails; green: passes | ready@2026-10-17T12:00Z | Gap: preflight.ts checkPreflight has login probes only for claude. Chain ADOPTION-34, UX-55; serialize after none |
+| TEN-UX-56 | fix: loki start rejects a repeated single-value flag (--cap, --provider) with exit 2 instead of silently using the first | loki-ts/src/commands/start.ts, loki-ts/tests/commands/start.test.ts | MEDIUM | red: cd loki-ts && bun test tests/commands/start.test.ts -t "duplicate flag" fails; green: passes | ready@2026-10-17T12:00Z | Gap: start.ts argVal is first-occurrence-wins, so loki start p.md --cap 1 --cap 50 runs with 1 and says nothing. Serialize after the AQ start.ts chain (TEN-UX-48, 50, DEPLOY-26, UX-47, 46, 45) |
+| TEN-SPEED-24 | enhancement: run_status pickRun orders runs by events.jsonl mtime and reads only the newest, instead of reading every run's events file | loki-ts/src/commands/run_status.ts, loki-ts/tests/commands/run_status.test.ts | MEDIUM | red: cd loki-ts && bun test tests/commands/run_status.test.ts -t "pickRun mtime" fails; green: passes | ready@2026-10-17T12:00Z | Gap: run_status.ts pickRun reads every run's events.jsonl, so loki status gets slower with each run |
+| TEN-UX-57 | fix: loki status rejects unknown flags that follow a valid one (--json --bogus) with exit 1 like a leading unknown flag | loki-ts/src/commands/status.ts, loki-ts/tests/commands/status.test.ts | LOW | red: cd loki-ts && bun test tests/commands/status.test.ts -t "status trailing flag" fails; green: passes | ready@2026-10-17T12:00Z | Gap: status.ts runStatus returns on the first recognised flag (lines 1038-1047), so later flags are never checked |
+| TEN-ADOPTION-35 | enhancement: doctor --fix seeds the default provider from the first installed provider CLI instead of hardcoding claude | loki-ts/src/commands/doctor_fix.ts, loki-ts/tests/commands/doctor.test.ts | MEDIUM | red: cd loki-ts && bun test tests/commands/doctor.test.ts -t "seed provider" fails; green: passes | ready@2026-10-17T12:00Z | Gap: doctor_fix.ts step 2 writes {provider: claude} even when only codex is installed. Chain ADOPTION-35, UX-58 (same file); serialize after none |
+| TEN-UX-58 | enhancement: doctor --fix backs up an invalid .loki/config/settings.json and rewrites defaults when consent is given, instead of only printing a manual line | loki-ts/src/commands/doctor_fix.ts, loki-ts/tests/commands/doctor.test.ts | MEDIUM | red: cd loki-ts && bun test tests/commands/doctor.test.ts -t "repair settings" fails; green: passes | ready@2026-10-17T12:00Z | Gap: doctor_fix.ts lines 120-124 push a manual line for invalid JSON and never repair it. Chain ADOPTION-35, UX-58; serialize after ADOPTION-35 |
+| TEN-QUALITY-40 | enhancement: doctor.ts uses one shared version comparator instead of three copies | loki-ts/src/commands/doctor.ts, loki-ts/tests/commands/doctor.test.ts | LOW | red: cd loki-ts && bun test tests/commands/doctor.test.ts -t "one semver compare" fails; green: passes | ready@2026-10-17T12:00Z | Gap: doctor.ts has three hand-rolled comparators (lines 98, 318, 567); extend-never-duplicate. Serialize after ADOPTION-35, UX-58 (shared doctor.test.ts) |
+| TEN-SPEED-25 | fix: resolveLatest caches a failed registry fetch for a short period so an offline machine does not wait on the network every command | loki-ts/src/util/update_check.ts, loki-ts/tests/util/update_check.test.ts | LOW | red: cd loki-ts && bun test tests/util/update_check.test.ts -t "negative cache" fails; green: passes | ready@2026-10-17T12:00Z | Gap: update_check.ts resolveLatest returns null at the failed fetch without writeCache (line 129-130), so offline runs retry each time. Chain SPEED-25, DEPLOY-27 (same file); serialize after none |
+| TEN-DEPLOY-27 | feature: updateCommandFor returns pnpm and yarn global upgrade hints for pnpm and yarn installs | loki-ts/src/util/update_check.ts, loki-ts/tests/util/update_check.test.ts | LOW | red: cd loki-ts && bun test tests/util/update_check.test.ts -t "pnpm yarn hint" fails; green: passes | ready@2026-10-17T12:00Z | Gap: update_check.ts updateCommandFor knows brew, bun and npm paths only; pnpm and yarn installs get the bun hint. Chain SPEED-25, DEPLOY-27; serialize after SPEED-25 |
+| TEN-GATES-31 | fix: policyGate with LOKI_POLICY_REQUIRE_NODE=0 and no node says policy was NOT evaluated in the allow reason so prGate output shows it | loki-ts/src/util/run_outputs.ts, loki-ts/tests/engine10/policy_gate.test.ts | HIGH | red: cd loki-ts && bun test tests/engine10/policy_gate.test.ts -t "policy not evaluated" fails; green: passes | ready@2026-10-17T12:00Z | Gap: run_outputs.ts:449 returns allow when the env opt-out is set and node is missing; the reason is easy to miss. Chain GATES-31, 32 (same file); serialize after none |
+| TEN-GATES-32 | fix: policyGate reports a check.js timeout as a timeout, not as node being unavailable | loki-ts/src/util/run_outputs.ts, loki-ts/tests/engine10/policy_gate.test.ts | HIGH | red: cd loki-ts && bun test tests/engine10/policy_gate.test.ts -t "policy timeout reason" fails; green: passes | ready@2026-10-17T12:00Z | Gap: run_outputs.ts:452-453 spawnSync timeout 30000 sets r.error and the deny reason says node is unavailable. Chain GATES-31, 32; serialize after GATES-31 |
+| TEN-ADOPTION-36 | fix: loki issues run --limit and --parallel accept only plain decimal digits (reject 1e1 and 0x10) | loki-ts/src/commands/issues_run.ts, loki-ts/tests/commands/issues_run.test.ts | LOW | red: cd loki-ts && bun test tests/commands/issues_run.test.ts -t "strict int flags" fails; green: passes | ready@2026-10-17T12:00Z | Gap: issues_run.ts:96 Number(val()) accepts 1e1 and 0x10 as integers. Serialize after TEN-STABILITY-54 (same file) |

package/docs/v10/CLI-MODERN.md

@@ -11,7 +11,7 @@ Classes: KEEP-MODERN (v10-native or engine-neutral), UPDATE (live but needs mode
 - DROP-LEGACY: 31
 - DELETE: 14
 - Total rows: 141
-- Registry paths (commands and nested subcommands): 204
+- Registry paths (commands and nested subcommands): 209
 
 ## Commands
 

package/docs/v10/FAILURE-CLASSES.md

@@ -1097,3 +1097,10 @@ L0 review rule (ENGINE-LAWS.md L0): a fix that adds an `if` or a regex about the
 - Siblings: swept 24 bash commands with `<cmd> frobnicate`; only config and api (fixed here) returned 0, plus `loki voice`, a stub with no subcommands that prints a planned-feature notice (left as is).
 - Mechanism: explicit help|--help|-h arm, default arm prints `loki <cmd>: unknown subcommand` to stderr and returns 2.
 - Fixture: tests/test-help-discoverability.sh; restoring the old default arm turns the frobnicate assertions red.
+
+## FC-TEN-STABILITY-50 A credentialed push/pr-ready child is spawned with spawnSync and no timeout, so one hung script blocks the run (UNBOUNDED-PUSH-CHILD)
+- User-visible vs raw: user-visible. A hung engine10-push.sh froze the PR stage with no failure surfaced.
+- Law broken: every child process is bounded and a timeout is a named stage failure.
+- Sibling sweep: pr.ts push-pr, push-mr, pr-ready and status now share spawnBounded (LOKI_PR_PUSH_TIMEOUT_MS, default 50s). Still unbounded: src/util/pr_lessons.ts:348, src/runner/attempts.ts:376, src/engine10/supervisor.ts:374.
+- One shared mechanism: spawnBounded and failReason in loki-ts/src/engine10/stages/pr.ts.
+- Regression fixture: loki-ts/tests/engine10/pr.test.ts "hung push script".

package/docs/v10/PROGRESS.md

@@ -2536,3 +2536,9 @@ v11.17.21 published (Release success on 462fbc40a; npm latest 11.17.21, next 11.
 
 ## 2026-10-17T13:34Z (CoS) v11.17.52
 - TEN-COST-49 and TEN-COST-50 released; evidence: test_cost_claim.py 37 passed, reviewer mutations red then restored.
+
+## 2026-10-17T13:56Z (CoS) v11.17.53
+- Wave AP released (30 rows, 19 chains, each reviewer APPROVE by SHA); evidence in ~/loki-ci-logs/ap-check.log (tsc, bun test, secure-scan, drift guards, cost_claim pytest).
+
+## 2026-10-17T14:35Z (CoS) v11.17.54
+- Wave AQ released (30 rows, 19 chains, every reviewer APPROVE by SHA, ancestry checked) plus Q18-03e (opus round 5 APPROVE e41ef40b2 after 5 BLOCK rounds); evidence in ~/loki-ci-logs/aq-check.log.