loki-mode 11.17.55 → 11.17.56

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: An autonomous software factory that knows what it is supposed to deliver, and proves it did. Use when the user says Loki Mode or asks to build, fix or verify software autonomously.
 ---
 
-# Loki Mode v11.17.55
+# Loki Mode v11.17.56
 
 **Current entry points (Loki 10 engine):** `loki "<task>"`, `loki owner/repo#N` and `loki quick "<task>"` run the Loki 10 engine and end with a signed receipt (`loki verify`). `loki backlog owner/repo --all` runs many issues in parallel. Guide: `docs/v10/GUIDE.md`. The skill instructions below, and `loki start`, describe the previous bash loop. PRD-file starts (`loki start ./prd.md`) and the opencode provider still run on it until FC38-SWEEP ports them; the legacy-engine command and the LOKI_ENGINE switch remain removed. Prefer `loki owner/repo#N` for issues.
 
@@ -483,4 +483,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v11.17.55 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**
+**v11.17.56 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**

package/VERSION

@@ -1 +1 @@
-11.17.55
+11.17.56

package/dashboard/__init__.py

@@ -7,6 +7,6 @@ Modules:
     control: Session control helpers (status, atomic writes, origin check)
 """
 
-__version__ = "11.17.55"
+__version__ = "11.17.56"
 
 __all__ = ["__version__"]

package/docs/CLI-REFERENCE.md

@@ -1,6 +1,6 @@
 # CLI reference
 
-Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.17.55. Do not edit by hand.
+Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.17.56. Do not edit by hand.
 Hidden and legacy-only commands are omitted; see `docs/v10/CLI-MODERN.md` for the full inventory.
 
 | Command | Description |

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 Loki Mode, by [Autonomi](https://www.autonomi.dev/), turns a spec or an issue into a verified pull request with a receipt you can check. This page covers installing it, a first run, and the options around it.
 
-**Version:** v11.17.55
+**Version:** v11.17.56
 
 **Engine note:** `loki start` is the primary command. `loki start`, `loki "<task>"`, `loki owner/repo#N` and `loki quick` all run the Loki 10 engine, whatever the flag order or input form (PRD file, issue ref, task or one-word brief). The previous loop runs only on `--engine legacy`, `LOKI_ENGINE=legacy`, or for one call when a flag Loki 10 cannot honor is present. See the [user guide](v10/GUIDE.md) and the [5-minute quickstart](QUICKSTART.md).
 

package/docs/v10/BOARD.md

@@ -1372,7 +1372,7 @@ Source: ~/git/autonomi-dev/research/2026-09-30-adoption/SWARM-PROMPT-ADOPTION.md
 | TEN-COST-62 | feature: priorFor returns a cost prior for opus models so the pre-run estimate is shown for opus-routed runs instead of nothing | loki-ts/src/runner/router/cost_preview.ts, loki-ts/tests/runner/cost_preview.test.ts | MEDIUM | red: cd loki-ts && bun test tests/runner/cost_preview.test.ts -t "opus prior" fails; green: passes | released v11.17.55 | Gap: cost_preview.ts:38 tier is only haiku or sonnet, else null, so a start with an opus model prints no estimate |
 | TEN-SECURITY-23 | fix: redact GOOGLE_KEY rule requires the AIza prefix shape so ordinary identifiers starting with AI are not rewritten in logs and receipts | loki-ts/src/util/redact.ts, loki-ts/tests/util/redact.test.ts | HIGH | red: cd loki-ts && bun test tests/util/redact.test.ts -t "google key shape" fails; green: passes | released v11.17.55 | Gap: redact.ts GOOGLE_KEY /AI[a-zA-Z0-9_-]{30,}/g matches any 32+ char identifier starting AI (over-redaction corrupts evidence). Chain SECURITY-23, 24, 25 (same file); serialize after none |
 | TEN-SECURITY-24 | feature: redact adds Slack webhook URLs, sk_test_ and rk_ Stripe keys, and whsec_ webhook secrets | loki-ts/src/util/redact.ts, loki-ts/tests/util/redact.test.ts | HIGH | red: cd loki-ts && bun test tests/util/redact.test.ts -t "slack stripe redact" fails; green: passes | released v11.17.55 | Gap: redact.ts RULES has no pattern for hooks.slack.com/services, sk_test_, or whsec_; a pasted token reaches events and receipts unredacted. Chain SECURITY-23, 24, 25; serialize after SECURITY-23 |
-| TEN-SECURITY-25 | feature: redact masks the value of key=value and key: value assignments for password, secret, token and api_key names | loki-ts/src/util/redact.ts, loki-ts/tests/util/redact.test.ts | HIGH | red: cd loki-ts && bun test tests/util/redact.test.ts -t "assignment redact" fails; green: passes | ready@2026-10-17T12:00Z | Gap: redact.ts RULES match only token-shaped literals; password=hunter2 passes through unchanged. Chain SECURITY-23, 24, 25; serialize after SECURITY-24 |
+| TEN-SECURITY-25 | feature: redact masks the value of key=value and key: value assignments for password, secret, token and api_key names | loki-ts/src/util/redact.ts, loki-ts/tests/util/redact.test.ts | HIGH | red: cd loki-ts && bun test tests/util/redact.test.ts -t "assignment redact" fails; green: passes | released v11.17.56 | Gap: redact.ts RULES match only token-shaped literals; password=hunter2 passes through unchanged. Chain SECURITY-23, 24, 25; serialize after SECURITY-24 |
 | TEN-STABILITY-58 | fix: yamlKey reads flow-style maps such as budgets: { per_run: 5 } instead of ignoring them (the default 100 dollar cap then applies silently) | loki-ts/src/util/yaml_key.ts, loki-ts/tests/util/yaml_key.test.ts | MEDIUM | red: cd loki-ts && bun test tests/util/yaml_key.test.ts -t "flow style" fails; green: passes | released v11.17.55 | Gap: yaml_key.ts yamlKey handles block style only; probed: flow style returns undefined so resolve falls to the default cap |
 | TEN-STABILITY-59 | fix: loki undo validates the run id before the LOKI_UNDO gate so a bad id reports usage, not the gate message | loki-ts/src/commands/undo.ts, loki-ts/tests/commands/undo.test.ts | MEDIUM | red: cd loki-ts && bun test tests/commands/undo.test.ts -t "undo id before gate" fails; green: passes | released v11.17.55 | Gap: undo.ts runUndo checks the LOKI_UNDO gate (line 239) before loadPlan validates the run id (isRunId, line 44) |
 | TEN-STABILITY-60 | enhancement: pauseTimeoutMs warns once on stderr when the pause timeout env is set but not a positive number, then uses the default | loki-ts/src/util/run_control.ts, loki-ts/tests/util/run_control.test.ts | MEDIUM | red: cd loki-ts && bun test tests/util/run_control.test.ts -t "pause timeout warn" fails; green: passes | released v11.17.55 | Gap: run_control.ts pauseTimeoutMs falls back silently on garbage. Chain STABILITY-60, 61 (same file); serialize after none |

package/docs/v10/PROGRESS.md

@@ -2545,3 +2545,6 @@ v11.17.21 published (Release success on 462fbc40a; npm latest 11.17.21, next 11.
 
 ## 2026-10-17T14:50Z (CoS) v11.17.55
 - Wave AR released (29 rows, 19 chains, reviewer APPROVE by SHA, ancestry checked; TEN-SECURITY-25 held at BLOCK 30fd64ba8 for a fix round). Combined checks in ~/loki-ci-logs/ar-check.log: build OK, bun test 533 pass 1 fail (known engine10 core budget, fix in flight), drift guards rc=0, control-plane 33 pass; tsc red on queue.ts:75 fixed in a2a21c137 (tsc OK, queue.test.ts 29 pass 0 fail).
+
+## 2026-10-17T14:55Z (CoS) v11.17.56
+- TEN-SECURITY-25 released after round 2 (BLOCK 30fd64ba8 flag-form leak fixed; opus HIGH APPROVE c0c17580a: 75-case leak diff vs b12355488, 160000-combination idempotency sweep, new rule linear at 13ms or less on 100KB). Main checks: tsc OK, bun test tests/util 434 pass 0 fail. Reviewer N1 (pre-existing URL userinfo ReDoS, 2.8s on 100KB) dispatched as TEN-SECURITY-26.