loki-mode 11.17.78 → 11.17.80

package/README.md

@@ -56,7 +56,7 @@ loki chat                                    # interactive alternative: Plan and
 
 Every run starts from a delivery contract derived from your task, writes checks from the task alone before touching code, implements, verifies, and ends in exactly one outcome: VERIFIED, ALREADY_SATISFIED, FAILED, BUDGET_STOP, BLOCKED or STALLED ([exit codes](docs/exit-codes.md)). If the contract cannot be satisfied as written, the run stops and asks one question instead of guessing.
 
-- **A pull request** written for a quick review: what the issue asked, what changed, how it was tested, and what was NOT PROVEN. A run that did not verify opens a draft.
+- **A pull request** written for a quick review: what the issue asked, what changed, how it was tested, and what was NOT PROVEN. Only a VERIFIED run pushes its branch and opens a PR; any other outcome keeps the branch local and prints where it is.
 - **A signed receipt** at `.loki/runs/<run-id>/receipt.json`, signed with a local Ed25519 key created on first run.
 - **A specialist review** when the review council runs: it selects reviewers from a specialist pool (`agents/types.json`, scored by `run.sh:FOCUS_KEYWORDS`) by matching the changed files and diff against each reviewer's keywords.
 

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: An autonomous software factory that knows what it is supposed to deliver, and proves it did. Use when the user says Loki Mode or asks to build, fix or verify software autonomously.
 ---
 
-# Loki Mode v11.17.78
+# Loki Mode v11.17.80
 
 **Current entry points (Loki 10 engine):** `loki "<task>"`, `loki owner/repo#N` and `loki quick "<task>"` run the Loki 10 engine and end with a signed receipt (`loki verify`). `loki backlog owner/repo --all` runs many issues in parallel. Guide: `docs/v10/GUIDE.md`. The skill instructions below, and `loki start`, describe the previous bash loop. PRD-file starts (`loki start ./prd.md`) and the opencode provider still run on it until FC38-SWEEP ports them; the legacy-engine command and the LOKI_ENGINE switch remain removed. Prefer `loki owner/repo#N` for issues.
 
@@ -483,4 +483,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v11.17.78 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**
+**v11.17.80 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**

package/VERSION

@@ -1 +1 @@
-11.17.78
+11.17.80

package/dashboard/__init__.py

@@ -7,6 +7,6 @@ Modules:
     control: Session control helpers (status, atomic writes, origin check)
 """
 
-__version__ = "11.17.78"
+__version__ = "11.17.80"
 
 __all__ = ["__version__"]

package/docs/CLI-REFERENCE.md

@@ -1,6 +1,6 @@
 # CLI reference
 
-Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.17.78. Do not edit by hand.
+Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.17.80. Do not edit by hand.
 Hidden and legacy-only commands are omitted; see `docs/v10/CLI-MODERN.md` for the full inventory.
 
 | Command | Description |

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 Loki Mode, by [Autonomi](https://www.autonomi.dev/), turns a spec or an issue into a verified pull request with a receipt you can check. This page covers installing it, a first run, and the options around it.
 
-**Version:** v11.17.78
+**Version:** v11.17.80
 
 **Engine note:** `loki start` is the primary command. `loki start`, `loki "<task>"`, `loki owner/repo#N` and `loki quick` all run the Loki 10 engine, whatever the flag order or input form (PRD file, issue ref, task or one-word brief). The previous loop runs only on `--engine legacy`, `LOKI_ENGINE=legacy`, or for one call when a flag Loki 10 cannot honor is present. See the [user guide](v10/GUIDE.md) and the [5-minute quickstart](QUICKSTART.md).
 

package/docs/v10/BOARD.md

@@ -1396,3 +1396,8 @@ Source: ~/git/autonomi-dev/research/2026-09-30-adoption/SWARM-PROMPT-ADOPTION.md
 | TEN-GATES-31 | fix: policyGate with LOKI_POLICY_REQUIRE_NODE=0 and no node says policy was NOT evaluated in the allow reason so prGate output shows it | loki-ts/src/util/run_outputs.ts, loki-ts/tests/engine10/policy_gate.test.ts | HIGH | red: cd loki-ts && bun test tests/engine10/policy_gate.test.ts -t "policy not evaluated" fails; green: passes | released v11.17.55 | Gap: run_outputs.ts:449 returns allow when the env opt-out is set and node is missing; the reason is easy to miss. Chain GATES-31, 32 (same file); serialize after none |
 | TEN-GATES-32 | fix: policyGate reports a check.js timeout as a timeout, not as node being unavailable | loki-ts/src/util/run_outputs.ts, loki-ts/tests/engine10/policy_gate.test.ts | HIGH | red: cd loki-ts && bun test tests/engine10/policy_gate.test.ts -t "policy timeout reason" fails; green: passes | released v11.17.55 | Gap: run_outputs.ts:452-453 spawnSync timeout 30000 sets r.error and the deny reason says node is unavailable. Chain GATES-31, 32; serialize after GATES-31 |
 | TEN-ADOPTION-36 | fix: loki issues run --limit and --parallel accept only plain decimal digits (reject 1e1 and 0x10) | loki-ts/src/commands/issues_run.ts, loki-ts/tests/commands/issues_run.test.ts | LOW | red: cd loki-ts && bun test tests/commands/issues_run.test.ts -t "strict int flags" fails; green: passes | released v11.17.55 | Gap: issues_run.ts:96 Number(val()) accepts 1e1 and 0x10 as integers. Serialize after TEN-STABILITY-54 (same file) |
+| TEN-QUALITY-41 | fix: outOfRepoTarget flags a string literal such as "/home/user/project/.git" that holds no home-derived value; a literal absolute path with no homedir, HOME or expanduser value must not flag | loki-ts/src/project_model/conventions.ts, loki-ts/tests/engine10/fc23_wall_conventions.test.ts | LOW | red: cd loki-ts && bun test tests/engine10/fc23_wall_conventions.test.ts -t "literal path not flagged" fails; green: passes | ready@2026-10-19T07:00Z | Budget LOW 15m. Gap: conventions.ts:84 the home regex matches any quoted /(Users\|home\|root)/ literal, so a fixture path with no runtime home value is rejected and re-asked. Keep real homedir()/$HOME/~/ joins flagging. Generic, engine10 TypeScript. Chain QUALITY-41, 42 (same file); serialize after none |
+| TEN-QUALITY-42 | fix: outOfRepoTarget treats a file that assigns HOME anywhere as sandboxed and never flags it; narrow the exemption to lines after the assignment, or to a sandboxed (tmpdir-derived) HOME only | loki-ts/src/project_model/conventions.ts, loki-ts/tests/engine10/fc23_wall_conventions.test.ts | LOW | red: cd loki-ts && bun test tests/engine10/fc23_wall_conventions.test.ts -t "home exemption scoped" fails; green: passes | ready@2026-10-19T07:00Z | Budget LOW 15m. Gap: conventions.ts:78 returns null for the whole file on any HOME assignment, so homedir() joined into an import before the assignment passes. Chain QUALITY-41, 42; serialize after QUALITY-41 |
+| TEN-COST-63 | fix: the Wall rewrite (re-ask) session for out-of-repo files runs without checking the remaining run budget, so a run at its cap still spends a model session; skip the re-ask when the budget is spent and discard the rejected files | loki-ts/src/engine10/stages/wall.ts, loki-ts/tests/engine10/fc23_wall_conventions.test.ts | MEDIUM | red: cd loki-ts && bun test tests/engine10/fc23_wall_conventions.test.ts -t "re-ask respects budget" fails; green: passes | ready@2026-10-19T07:00Z | Budget MEDIUM 30m. Gap: wall.ts:162 ctx.sessions.run for the -oor rewrite is gated only on bad1.length and signal.aborted; reuse the existing budget check other stages use rather than a new helper. Chain COST-63, QUALITY-43 (same file); serialize after none |
+| TEN-QUALITY-43 | enhancement: inside wallAuthor a local model variable shadows the outer one; rename it, no behaviour change | loki-ts/src/engine10/stages/wall.ts, loki-ts/tests/engine10/wall.test.ts | LOW | red: none (pure rename); green: cd loki-ts && bun test tests/engine10/wall.test.ts tests/engine10/fc23_wall_conventions.test.ts passes and bunx tsc --noEmit is clean | ready@2026-10-19T07:00Z | Budget LOW 15m. Gap: wall.ts:146 const model shadows the outer model; the rename must leave emitted data.model and the WallAuthored.model field unchanged. Chain COST-63, QUALITY-43; serialize after COST-63 |
+| TEN-QUALITY-44 | fix: the implement-stage bug-repro test is not covered by the outOfRepoTarget check, so a repro test that imports the code under test from the user home goes unflagged; apply the same check and re-ask path (sibling of FC-WALL-OUT-OF-REPO-TARGET) | loki-ts/src/engine10/stages/implement.ts, loki-ts/tests/engine10/implement.test.ts | MEDIUM | red: cd loki-ts && bun test tests/engine10/implement.test.ts -t "repro test out of repo" fails; green: passes | ready@2026-10-19T07:00Z | Budget MEDIUM 30m. Gap: implement.ts:38 REPRO_LINE asks for a new reproducing test but nothing checks its target; reuse outOfRepoTarget from project_model/conventions.ts, add the row to docs/v10/FAILURE-CLASSES.md sibling sweep. Serialize after QUALITY-41 and 42 |

package/docs/v10/ENGINE.md

@@ -171,7 +171,7 @@ After the session:
 - any modified or deleted pre-existing test file is restored from base and listed in `tests_reverted`;
 - any Wall file whose sha256 no longer matches is restored from `<runDir>/wall/` and listed.
 
-A spec conflict leads to Seal with verdict SPEC_CONFLICT: a DRAFT PR if the diff is non-empty, otherwise no PR.
+A spec conflict leads to Seal with verdict SPEC_CONFLICT: no PR and no push: the branch stays local and its location is printed.
 
 **Fast verify:**
 - Changed files: impacted tests from the test map, plus changed test files, plus Wall tests, plus lint/typecheck of the changed files only (eslint/tsc for TS/JS, ruff or flake8 for Python, `bash -n`/shellcheck for shell).
@@ -199,7 +199,7 @@ A spec conflict leads to Seal with verdict SPEC_CONFLICT: a DRAFT PR if the diff
 It then appends a PR comment and a signed receipt addendum, and sets `loki/deep-verify` to success or failure. A refused or unavailable check is NOT PROVEN, never red.
 
 **Hard cap:**
-- At 14:00 elapsed, the machine aborts the running stage (process-group kill), commits whatever diff exists, seals with verdict PARTIAL and the missing checks as NOT PROVEN, and opens a DRAFT PR.
+- At 14:00 elapsed, the machine aborts the running stage (process-group kill), commits whatever diff exists, seals with verdict PARTIAL and the missing checks as NOT PROVEN, and keeps the branch local (only VERIFIED pushes).
 - The cap is 900s by default. `LOKI_E10_CAP_S` exists for tests only.
 - `--deep` or auto-escalation raises it to 45 minutes and logs an `escalated` event (section 13).
 

package/docs/v10/FAILURE-CLASSES.md

@@ -1230,3 +1230,23 @@ L0 review rule (ENGINE-LAWS.md L0): a fix that adds an `if` or a regex about the
 - Siblings swept: Wall author (fixed); implement brief repro-test line (implementer-written tests are not statically checked; with an in-repo Wall the implementer has no reason to touch runner config); fix and plan stages write no tests.
 - Mechanism: one `outOfRepoTarget` detector in project_model/conventions.ts (homedir, Path.home, $HOME, ~/, absolute /Users|/home|/root; comments ignored); wallAuthor re-asks once with the precise reason, a file still failing is discarded (sealed copy only, listed in `discarded`); one sentence in the cache-stable Wall brief.
 - Fixture: loki-ts/tests/engine10/fc23_wall_conventions.test.ts describe "FC-WALL-OUT-OF-REPO-TARGET" (rejected, re-asked, discarded; repo-relative and tmpdir pass). Red before the fix, green after.
+## FC-OUT-OF-REPO A request whose change has no target in the repository ran every stage before ending BLOCKED (OUT-OF-REPO-INTAKE)
+- User-visible vs raw: user-visible. `loki start anthropics/claude-code#21527` (a feature whose code lives in a hosted Slack/web service) on 11.17.60 to 11.17.74 spent plan, wall, implement and fix before ending BLOCKED. Raw: the plan session had nothing to name, but plan-scope.json with zero files was read as "no scope", so the flow continued into implement.
+- Law: cheap checks run before expensive stages; a run that cannot succeed says so at the first stage that knows; BLOCKED names the question, never a bare failure.
+- Siblings swept: intake already_satisfied (short-circuits to the tail, unchanged), intent_declined (returns before wall/implement), a missing or malformed plan-scope.json (unknown, deliberately NOT out-of-repo), a skipped plan on small tasks (no signal, implementer still decides).
+- Mechanism: one reader `planOutOfRepo` (util/run_cap.ts) fires only when plan-scope.json parses and names zero files, taking the planner's `out_of_repo` sentence as the reason; plan.ts records `out_of_repo` plus `spec_conflict_reason: "out-of-repo: <reason>"`; machine.ts seeds implement.exit = spec_conflict and jumps to the tail, so seal, outcomeOf, EXIT (4), the BLOCKED question comment and the receipt reuse the existing spec-conflict path (no new outcome). conflictReasonOf also reads the plan stage.
+- Fixture: loki-ts/tests/engine10/plan.test.ts "FC-OUT-OF-REPO" (named files never fire; missing or malformed scope never fires) and loki-ts/tests/engine10/machine.test.ts "FC-OUT-OF-REPO machine" (implement, verify and fix do not run; positive control runs them). Red before the fix, green after.
+## FC-NO-PUSH-UNVERIFIED A run that did not end verified pushed its loki/e10-* branch to the user's remote (NO-PUSH-UNVERIFIED)
+- User-visible vs raw: user-visible. BLOCKED runs of anthropics/claude-code#21527 pushed loki/e10-* branches and opened draft PRs on the user's fork asklokesh/claude-code. Raw: supervisor.ts gated the pr step on `verdict !== "ALREADY_SATISFIED" && hasDiff`, so FAILED, PARTIAL and SPEC_CONFLICT with any diff left the machine.
+- Law: only a verified success leaves the machine; unverified work stays local as evidence.
+- Siblings swept: the supervisor pr step and modernize/ship.ts shipWave (which pushed draft PRs for unverified waves; now refuses unless the wave verified and every unit is PROVEN) are the callers of the push scripts (engine10-push.sh, engine10-push-gitlab.sh); ALREADY_SATISFIED already opened none; the E-67 backstop commit still lands locally on a killed worker; cancelled and tampered runs already skip it.
+- Mechanism: one gate in supervisor.ts, `verdict === "VERIFIED"`; every other verdict with a diff prints "branch loki/<runId> stays local (not pushed)" with the repo path. Supersedes the A-110 and E-67 draft-PR-on-unverified behaviour (tests updated in the same change).
+- Fixture: loki-ts/tests/engine10/supervisor_backstop.test.ts "FC-NO-PUSH-UNVERIFIED" (SPEC_CONFLICT, PARTIAL, FAILED call pr 0 times; VERIFIED once) and loki-ts/tests/engine10/modernize/ship.test.ts "FC-NO-PUSH-UNVERIFIED" (unverified wave pushes 0 times). Red before the fix, green after.
+
+## FC-LINT-PRE-RED: a lint check excused as failing on base still named the run's failure
+- User-visible vs raw: user-visible. A run whose only failing check was a lint check also failing on base (cc#81826, shellcheck SC2181 on both) printed `Reason: lint:shellcheck failed` and listed it under Failures in HANDOFF.md, so the founder read a base-relative pass as a blocker.
+- Law: a check verify excused as pre-existing (`pre_red_checks`, TEN-QUALITY-03) is never the stated reason, never a Failure; it is shown separately as already failing on base.
+- Cause (measured from .loki/runs events): verify judged lint base-relative correctly in all three rounds (`pre_red_checks: ["lint:shellcheck"]`, fix briefs excluded it, seal skipped it); only `reasonOf` (engine10/output.ts) and the handoff renderer (util/run_summary.ts) re-read raw `checks[].result` and ignored `pre_red_checks`.
+- Siblings swept: seal verdict (already honours pre_red_checks), failures_grouped and fix brief (already exclude), reasonOf and handoff Failures (fixed); commands/export_sarif.ts receiptFindings (reads pre_red_checks from the run events), util/failure_memory.ts failedCheckNames (engine10/supervisor.ts now passes verify's pre_red_checks), e10ext/select.ts lintFails via AttemptCandidate.preRedChecks (all fixed through the one `isBlockingFail` in util/failure_memory.ts). features/attempts.ts now fills `preRedChecks` through the optional `AttemptOps.preRed(i)`, but stays inert until `score()`'s caller supplies preRed (the real treeswapOps runs no lint). Open: supervisor.ts must pass verify `pre_red_checks` as failedCheckNames' second argument. Other linters share the same path (ruff, eslint via excuseLint; unparseable output stays fail-closed with the existing reason).
+- Mechanism: `pre_red_checks` read in `reasonOf`; `composeHandoff` tags failing checks in it `pre_red`, `renderHandoff` moves them to "Already failing on base".
+- Fixture: tests/engine10/output.test.ts and tests/util/run_summary.test.ts, "FC-LINT-PRE-RED". Red before the fix, green after.

package/docs/v10/PROGRESS.md

@@ -2608,3 +2608,9 @@ v11.17.21 published (Release success on 462fbc40a; npm latest 11.17.21, next 11.
 
 ## 2026-10-19T06:50Z (CoS) v11.17.78
 - 11.17.78: main CI guard fixes (L0 project_model names, never_below_raw AST matcher, M1 anchor, modernize producer scan). Engineer chain 21187a2c7..9e17b7f75; HIGH review BLOCK x4 then APPROVE (134/0, 23 parent shapes still caught + 7 new, shipped source zero violations).
+
+## 2026-10-19T07:19Z (CoS) v11.17.79
+- 11.17.79: FC-OUT-OF-REPO + FC-NO-PUSH-UNVERIFIED (#21527 bugs b/c; HIGH BLOCK x2 then APPROVE) and FC-LINT-PRE-RED (TL BLOCK x2 then APPROVE, mutation 16/1 -> 88/0). Budget fold f5a1685b5: 383 pass 0 fail.
+
+## 2026-10-19T08:06Z (CoS) v11.17.80
+- 11.17.80: fix-forward for Tests run 39215298360 on c6db3c019 (D50-F4 backstop expectation, plan brief golden; 32 pass 0 fail) plus supervisor pre_red_checks wiring 411fdaf63 (red 106/1 -> green 107/0; 172 pass 0 fail incl. budget). P9 moat fixture ccccfc82f under HIGH review, ships next.