loki-mode 11.17.73 → 11.17.75

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: An autonomous software factory that knows what it is supposed to deliver, and proves it did. Use when the user says Loki Mode or asks to build, fix or verify software autonomously.
 ---
 
-# Loki Mode v11.17.73
+# Loki Mode v11.17.75
 
 **Current entry points (Loki 10 engine):** `loki "<task>"`, `loki owner/repo#N` and `loki quick "<task>"` run the Loki 10 engine and end with a signed receipt (`loki verify`). `loki backlog owner/repo --all` runs many issues in parallel. Guide: `docs/v10/GUIDE.md`. The skill instructions below, and `loki start`, describe the previous bash loop. PRD-file starts (`loki start ./prd.md`) and the opencode provider still run on it until FC38-SWEEP ports them; the legacy-engine command and the LOKI_ENGINE switch remain removed. Prefer `loki owner/repo#N` for issues.
 
@@ -483,4 +483,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v11.17.73 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**
+**v11.17.75 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**

package/VERSION

@@ -1 +1 @@
-11.17.73
+11.17.75

package/dashboard/__init__.py

@@ -7,6 +7,6 @@ Modules:
     control: Session control helpers (status, atomic writes, origin check)
 """
 
-__version__ = "11.17.73"
+__version__ = "11.17.75"
 
 __all__ = ["__version__"]

package/docs/CLI-REFERENCE.md

@@ -1,6 +1,6 @@
 # CLI reference
 
-Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.17.73. Do not edit by hand.
+Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.17.75. Do not edit by hand.
 Hidden and legacy-only commands are omitted; see `docs/v10/CLI-MODERN.md` for the full inventory.
 
 | Command | Description |

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 Loki Mode, by [Autonomi](https://www.autonomi.dev/), turns a spec or an issue into a verified pull request with a receipt you can check. This page covers installing it, a first run, and the options around it.
 
-**Version:** v11.17.73
+**Version:** v11.17.75
 
 **Engine note:** `loki start` is the primary command. `loki start`, `loki "<task>"`, `loki owner/repo#N` and `loki quick` all run the Loki 10 engine, whatever the flag order or input form (PRD file, issue ref, task or one-word brief). The previous loop runs only on `--engine legacy`, `LOKI_ENGINE=legacy`, or for one call when a flag Loki 10 cannot honor is present. See the [user guide](v10/GUIDE.md) and the [5-minute quickstart](QUICKSTART.md).
 

package/docs/environment-variables.md

@@ -50,7 +50,7 @@ interact and why hitting one is a failure rather than a success.
 | `LOKI_SUMMARY_JSON` | unset | `1` prints the end-of-run summary as one JSON line on the previous loop. |
 | `LOKI_TIER` | `oss` | **Not a model setting.** The open-core licensing seam. Leave it unset. |
 | `LOKI_E10_STABLE_PREFIX` | on | Engine10 sessions send the `claude_code` preset with `excludeDynamicSections: true`, so the system prompt is byte-identical across stages and runs and hits the prompt cache. `0` restores the previous preset. `LOKI_E10_PREFIX=lean` still wins when set. |
-| `LOKI_E10_INSTALL` | on | Up-front dependency install at intake. `0` disables it (same as `verify.install_deps: false` in loki.yaml); the run then reports the missing dependencies as NOT PROVEN. When on, each package whose dependencies are absent is installed once per run before the baseline, using the lockfile-frozen form when the package has a lockfile: `npm ci`, `pnpm install --frozen-lockfile`, `yarn install --immutable` (Yarn Berry) or `--frozen-lockfile`, `bun install --frozen-lockfile`, `uv sync --locked`, `poetry install` (already lock-honoring, kept as written), `pipenv install --deploy`, `cargo fetch --locked`, `BUNDLE_FROZEN=true bundle install`, `composer install`. These never rewrite the lockfile. A lockfile governs a package only when it sits in the package directory, or in an ancestor that declares a workspace containing it (package.json `workspaces`, pnpm-workspace.yaml, Cargo `[workspace]`, uv `tool.uv.workspace`); a standalone sub-project beside a root lockfile keeps its own install command. The install command is rewritten only if it is simple enough to reason about without a shell parser; otherwise it is left as written and recorded `locked: false`: a `||` anywhere (lock_note "fallback masks install failure"); any character outside letters, digits, space, tab and `_./=:@+,%~-` besides the separators `&&`, `;` and newline, or anything before the first install other than `cd <path>`, `export VAR=value` or plain VAR=value assignments, or any PATH assignment (lock_note "unparsed shell construct"); and an install followed by a `;` or newline command, which would mask its failure (lock_note "later command masks install failure"), so after the install only `&&` is allowed. If the locked install fails (for example the lockfile is out of sync with the manifest), the run reports NOT PROVEN with the real error and does not retry with a mutating install. With no lockfile, or no matching rule, the project's own install command runs and the receipt records `locked: false`. The project's own install scripts (for example npm postinstall) run just as they do for a developer, so disable the install for a repo you do not trust. |
+| `LOKI_E10_INSTALL` | on | Up-front dependency install at intake. `0` disables it (same as `verify.install_deps: false` in loki.yaml); the run then reports the missing dependencies as NOT PROVEN. When on, each package whose dependencies are absent is installed once per run before the baseline, using the lockfile-frozen form when the package has a lockfile: `npm ci`, `pnpm install --frozen-lockfile`, `yarn install --immutable` (Yarn Berry) or `--frozen-lockfile`, `bun install --frozen-lockfile`, `uv sync --locked`, `poetry install` (already lock-honoring, kept as written), `pipenv install --deploy`, `cargo fetch --locked`, `BUNDLE_FROZEN=true bundle install`, `composer install`. These never rewrite the lockfile. A lockfile governs a package only when it sits in the package directory, or in an ancestor that declares a workspace containing it (package.json `workspaces`, pnpm-workspace.yaml, Cargo `[workspace]`, uv `tool.uv.workspace`); a standalone sub-project beside a root lockfile keeps its own install command. The install command is rewritten only if it is simple enough to reason about without a shell parser; otherwise it is left as written and recorded `locked: false`: a `||` anywhere (lock_note "fallback masks install failure"); any character outside letters, digits, space, tab and `_./=:@+,%~-` besides the separators `&&`, `;` and newline, or anything before the first install other than `cd <path>`, `export VAR=value` or plain VAR=value assignments, or any assignment to PATH, NODE_OPTIONS, BASH_ENV or ENV (lock_note "unparsed shell construct"); and an install followed by a `;` or newline command, which would mask its failure (lock_note "later command masks install failure"), so after the install only `&&` is allowed. If the locked install fails (for example the lockfile is out of sync with the manifest), the run reports NOT PROVEN with the real error and does not retry with a mutating install. With no lockfile, or no matching rule, the project's own install command runs and the receipt records `locked: false`. The project's own install scripts (for example npm postinstall) run just as they do for a developer, so disable the install for a repo you do not trust. |
 | `LOKI_REPO_BASELINE` | unset | `0` skips the intake repo profile and baseline test run (see docs/HARNESS-INTELLIGENCE-PLAN.md). |
 | `LOKI_ALLOW_CLAUDE_SIDECALLS` | unset | `1` (exactly) lets PRD enrichment, done recognition, the council voters, the USAGE.md refresh and the quickstart intent check prompt the `claude` CLI under a non-claude provider; `loki doctor --airgap` then reports that as required egress to Anthropic. |
 

package/docs/v10/DECISIONS.md

@@ -870,7 +870,7 @@ FC-AGENT-PROOF: a run whose only executed passing check is a test file the same
 1. The founder kept the intake dependency install shipped in 11.17.68 (intakeDeps installs each package whose dependencies are absent, before the baseline and the Wall base run) and asked that it meet industry-standard, enterprise practice. This supersedes the "only when a selected check fails" wording of FOUNDER-QUEUE row 19 part (b); the evidence-triggered path stays as well.
 2. Locked: install.ts `lockedInstall` maps (package root contents, model command) to the ecosystem's frozen form through one table. Lockfile to form: package-lock.json or npm-shrinkwrap.json `npm ci`; pnpm-lock.yaml `pnpm install --frozen-lockfile`; yarn.lock `yarn install --immutable` (Berry: .yarnrc.yml or packageManager yarn@>=2) else `--frozen-lockfile`; bun.lock or bun.lockb `bun install --frozen-lockfile`; uv.lock `uv sync --locked`; poetry.lock `poetry install` (already lock-honoring, kept as written); Pipfile.lock `pipenv install --deploy`; Cargo.lock `cargo fetch --locked`; Gemfile.lock `BUNDLE_FROZEN=true bundle install`; composer.lock `composer install`. A lockfile governs a package only if it is in the package directory or in an ancestor that declares a workspace containing the package (package.json workspaces for npm, yarn and bun; pnpm-workspace.yaml; Cargo [workspace] members; uv tool.uv.workspace members); otherwise the command is kept and recorded unlocked. A `cd X` segment moves the lookup to X. An already-locked model command is kept byte for byte; flags are kept; a command that names packages, a missing lockfile or no matching rule keeps the model command and the check records `locked: false` with `lock_note`.
 3. poetry: `poetry install` already honors poetry.lock and is kept unchanged. `--no-root` is deliberately not added (it skips installing the project itself and breaks src-layout imports) and neither is `--sync` (it removes environment packages the lock lacks).
-4. Fail closed: a locked install that fails (for example a lockfile out of sync with its manifest) is a harness-owned NOT PROVEN with the real output excerpt; the harness never falls back to a mutating install. A command containing a `||` anywhere is left entirely as written (every install in it, `locked: false`, lock_note "fallback masks install failure"), because the shell reads `a && b || c` as `(a && b) || c` and the fallback masks a failure in any earlier segment; so is any command outside an allowlist (lock_note "unparsed shell construct"), since there is no shell parser: after trimming trailing whitespace and `;`/newline separators and joining `\<newline>` continuations, the command may contain only [A-Za-z0-9 _./=:@+,%~-], tabs and the separators `&&`, `;` and newline (so no quotes, backticks, parens, braces, `$`, redirects, `|` or lone `&`), every segment before the first install must be `cd <path>`, `export VAR=value` or pure VAR=value assignments (so set, pushd, trap, function, alias, shopt, eval, source, exec and the like are refused), and any assignment to PATH, bare, exported or as an install prefix, is refused. A command that passes is rewritten only where each install and every segment after it are joined by `&&`: runDetached runs `bash -c` without -e, so a later `;` or newline command (for example `npm install; echo done`) would mask a failed locked install, and the whole command is then left as written with `locked: false` and lock_note "later command masks install failure". Separators before the install (`cd x; npm install`) are fine. pnpm `--no-frozen-lockfile` is dropped when `--frozen-lockfile` is added.
+4. Fail closed: a locked install that fails (for example a lockfile out of sync with its manifest) is a harness-owned NOT PROVEN with the real output excerpt; the harness never falls back to a mutating install. A command containing a `||` anywhere is left entirely as written (every install in it, `locked: false`, lock_note "fallback masks install failure"), because the shell reads `a && b || c` as `(a && b) || c` and the fallback masks a failure in any earlier segment; so is any command outside an allowlist (lock_note "unparsed shell construct"), since there is no shell parser: after trimming trailing whitespace and `;`/newline separators and joining `\<newline>` continuations, the command may contain only [A-Za-z0-9 _./=:@+,%~-], tabs and the separators `&&`, `;` and newline (so no quotes, backticks, parens, braces, `$`, redirects, `|` or lone `&`), every segment before the first install must be `cd <path>`, `export VAR=value` or pure VAR=value assignments (so set, pushd, trap, function, alias, shopt, eval, source, exec and the like are refused), and any assignment to PATH, NODE_OPTIONS, BASH_ENV or ENV, bare, exported or as an install prefix, is refused. A command that passes is rewritten only where each install and every segment after it are joined by `&&`: runDetached runs `bash -c` without -e, so a later `;` or newline command (for example `npm install; echo done`) would mask a failed locked install, and the whole command is then left as written with `locked: false` and lock_note "later command masks install failure". Separators before the install (`cd x; npm install`) are fine. pnpm `--no-frozen-lockfile` is dropped when `--frozen-lockfile` is added.
 5. Visible: the install check and the deps.install event carry `cmd` (what ran), `locked`, `lock_note` and, when rewritten, `model_cmd`.
 6. The project's own install scripts (for example npm postinstall) run exactly as they do for a developer; opt-out is LOKI_E10_INSTALL=0 or loki.yaml `verify.install_deps: false`, documented in docs/environment-variables.md.
 - Amendment (D99): uv uses `uv sync --locked` (fails on an out-of-sync uv.lock; `--frozen` is replaced) and pipenv uses `pipenv install --deploy` (fails on an out-of-date Pipfile.lock; `pipenv sync` is replaced); pnpm-workspace.yaml is read in inline-list, block and unindented-block forms with `!` exclusions.

package/docs/v10/FAILURE-CLASSES.md

@@ -1203,3 +1203,15 @@ L0 review rule (ENGINE-LAWS.md L0): a fix that adds an `if` or a regex about the
 - Fixture: loki-ts/tests/engine10/fc22_install.test.ts "absentDepRoots and intakeDeps (FC-DEPS-NOT-INSTALLED)"; loki-ts/tests/engine10/runner_errors.test.ts FC-DEPS-NOT-INSTALLED case.
 - Budget change: the intake stage limit is now STAGE_BUDGETS.intake.limitS + INSTALL_CAP_MS/1000 + SUITE_BASELINE_BUDGET_S (120s), so a repo that needs an install or a per-command baseline gets that extra time at intake; a repo with nothing absent and no suites spends none of it.
 - Hardening (D106, founder 2026-10-19): the intake install is the lockfile-frozen form when a lockfile exists (install.ts lockedInstall, one table for npm, pnpm, yarn, bun, uv, poetry, pipenv, cargo, bundler, composer), fails closed as harness-owned NOT PROVEN with no mutating fallback, and records `locked`, `lock_note` and `model_cmd` on the check. Fixture: fc22_install.test.ts "lockedInstall (locked, reproducible install)".
+
+
+## FC-ZERO-ON-BASE An impacted test that is a deliberate skip on base too was listed as NOT PROVEN for the change (ZERO-ON-BASE)
+- User-visible vs raw: user-visible. In FireLater#20 run e10-20261019T020704Z-103b verify selected `backend/tests/integration/request-approval-race.test.ts`, a deliberate `describe.skip` (needs a real DB), so it executed zero tests and the run carried "not run: vitest:backend/tests/integration/request-approval-race.test.ts" in NOT PROVEN although the change never touched it and the pristine base executes zero tests there too.
+- Law broken: a result the change did not cause is never charged to the change (the same base-comparison contract as A-112); zero-executed stays fail-closed whenever it could be about the change.
+- Siblings: any runner whose file-level skip, todo or empty file yields "no tests executed" (vitest, jest, pytest, node:test, go); Wall, task-named (relevant), holdout and edited test files, and a run that edited test configuration, are never exempt; the package and full-suite not_run lines (a suite is a command, not a file) keep their own handling.
+- Mechanism: verify.ts subtractBase (the A-112 pristine detached base worktree) reruns an untouched, non-Wall, non-relevant zero-executed check once and classifies it with the same classifyCheck; zero on base too puts the name in `skipped_on_base` (verify data, plus a `test.skipped_on_base` event "skipped on base: <check>"), and seal omits only those names from its "not run:" NOT PROVEN lines. Any other base outcome (tests ran, failed, missing, timed out) keeps NOT PROVEN. The rerun happens only in this case, and the check's installed node_modules or .venv are linked into the base worktree, never copied.
+- Fixture: loki-ts/tests/engine10/verify_prered.test.ts describe "FC-ZERO-ON-BASE" (untouched skip listed; edited file, Wall file and tests-ran-on-base all stay fail-closed) and loki-ts/tests/engine10/seal.test.ts "FC-ZERO-ON-BASE".
+- Hardening (HIGH review of 4e449d487): linking the head checkout's node_modules into the base worktree lets a workspace link (node_modules/shared -> ../shared, pnpm/npm/yarn workspaces) or an editable install (.venv with pip -e) resolve to HEAD sources, so the base rerun could execute the run's own edits and report a false zero-on-base. Choice: the excusal applies only when the run changed nothing but test files (`changed.every(isTestFile)`) and no test configuration, so no head source, manifest or lockfile exists for any link to expose; deps stay linked because base has none of its own. A run that edits any source keeps zero-executed as NOT PROVEN. Residual: edits made inside a gitignored node_modules or .venv are not in `changed`. Seal also writes one informational line "skipped on base (excused): <check>" next to the retained pre red lines (never downgrades). Regression fixture: verify_prered.test.ts "workspace link" (red before the rule).
+- Hardening 2 (HIGH re-review of 9a4267335, D99): a changed TEST file can also be reached through a workspace link (node_modules/shared/helper.test.js), so test-files-only is not enough. depsSeeHead (util/base_guard.ts) withholds the excusal whenever the dependency dirs the base rerun would link can see head sources: any top-level or @scope/* node_modules entry that is a symlink whose realpath is inside the repo, or a .venv holding a .pth, *.egg-link or direct_url.json that names the repo; an unreadable dependency dir counts as seeing head. This gate is in addition to the test-files-only gate. Fixture: verify_prered.test.ts "reviewer repro 2" (red before the guard).
+- Hardening 3 (round 3 HIGH review, D99): depsSeeHead now walks node_modules and .venv recursively without following symlinks (so node_modules/foo/node_modules/shared -> ../../../shared is seen), inspects every symlink target, and withholds when a target is inside the repo but outside the dependency dir it lives in (an npm .bin link or a pnpm store link stays self-contained). The repo is compared as given and as realpath (/var vs /private/var, a symlinked repo dir). Editable-install files (.pth, .egg-link, direct_url.json with its file:// URL decoded by fileURLToPath so %20 matches, and __editable___*_finder.py) are checked for the repo path, each named path also by realpath. The walk is bounded at 50000 entries; exceeding it or any read error other than a missing dir withholds. The helper logic lives in util/base_guard.ts (zeroOnBase, depsSeeHead), outside the engine core cap. A pnpm workspace package links to a path inside the repo but outside node_modules, so workspace pnpm repos are withheld; that is fail-safe, and the excusal is effectively inert wherever workspace links or editable installs exist.
+- Stated plainly: the motivating incident (FireLater#20, a run that edits source) stays NOT PROVEN by design. The excusal only fires for runs that changed test files alone with dependencies that cannot see head; Seal accuracy outranks delivered accuracy.

package/docs/v10/PROGRESS.md

@@ -2593,3 +2593,9 @@ v11.17.21 published (Release success on 462fbc40a; npm latest 11.17.21, next 11.
 
 ## 2026-10-19T03:12Z (CoS) v11.17.73
 - 11.17.73: P0 fix-forward for D106 install masking (live in 71/72). af838b55 commits 2bb2f0194..279f1ac5d cherry-picked as 2599744de..20cf84915 plus D106 wording fix. HIGH a1168a6d: BLOCK x5 (||, quoted separators, later ; list, trap/function/alias, set -n), APPROVE round 6 at 279f1ac5d: fc22_install+intake+budget 145 pass 0 fail, real npm stale-lock probes all rc=1 on rewritten shapes.
+
+## 2026-10-19T03:16Z (CoS) v11.17.74
+- 11.17.74: D106 follow-up, NODE_OPTIONS/BASH_ENV/ENV refused like PATH. af838b55 4284ae1fb cherry-picked. HIGH a1168a6d round 7 APPROVE: 4 files 5+/5-, probes 8 refused, no over-match, fc22_install+intake+budget 145 pass 0 fail; red 56/1 with source reverted.
+
+## 2026-10-19T03:20Z (CoS) v11.17.75
+- 11.17.75: FC-ZERO-ON-BASE. a849c264 commits 9a4267335..58bb86a73 cherry-picked as 2a52da847..13b0b64c6 plus unused-import drop. HIGH a6dc6f16: BLOCK x4 (workspace link, nested links, venv spellings, spelled-target exemption), APPROVE round 5: attack set 11/0, verify_prered+seal+verify+budget 209/0. On main after cherry-pick: same 4 suites 209 pass 0 fail, tsc no engine10/base_guard errors.