loki-mode 11.17.80 → 11.17.82

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: An autonomous software factory that knows what it is supposed to deliver, and proves it did. Use when the user says Loki Mode or asks to build, fix or verify software autonomously.
 ---
 
-# Loki Mode v11.17.80
+# Loki Mode v11.17.82
 
 **Current entry points (Loki 10 engine):** `loki "<task>"`, `loki owner/repo#N` and `loki quick "<task>"` run the Loki 10 engine and end with a signed receipt (`loki verify`). `loki backlog owner/repo --all` runs many issues in parallel. Guide: `docs/v10/GUIDE.md`. The skill instructions below, and `loki start`, describe the previous bash loop. PRD-file starts (`loki start ./prd.md`) and the opencode provider still run on it until FC38-SWEEP ports them; the legacy-engine command and the LOKI_ENGINE switch remain removed. Prefer `loki owner/repo#N` for issues.
 
@@ -483,4 +483,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v11.17.80 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**
+**v11.17.82 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**

package/VERSION

@@ -1 +1 @@
-11.17.80
+11.17.82

package/dashboard/__init__.py

@@ -7,6 +7,6 @@ Modules:
     control: Session control helpers (status, atomic writes, origin check)
 """
 
-__version__ = "11.17.80"
+__version__ = "11.17.82"
 
 __all__ = ["__version__"]

package/docs/CLI-REFERENCE.md

@@ -1,6 +1,6 @@
 # CLI reference
 
-Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.17.80. Do not edit by hand.
+Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.17.82. Do not edit by hand.
 Hidden and legacy-only commands are omitted; see `docs/v10/CLI-MODERN.md` for the full inventory.
 
 | Command | Description |

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 Loki Mode, by [Autonomi](https://www.autonomi.dev/), turns a spec or an issue into a verified pull request with a receipt you can check. This page covers installing it, a first run, and the options around it.
 
-**Version:** v11.17.80
+**Version:** v11.17.82
 
 **Engine note:** `loki start` is the primary command. `loki start`, `loki "<task>"`, `loki owner/repo#N` and `loki quick` all run the Loki 10 engine, whatever the flag order or input form (PRD file, issue ref, task or one-word brief). The previous loop runs only on `--engine legacy`, `LOKI_ENGINE=legacy`, or for one call when a flag Loki 10 cannot honor is present. See the [user guide](v10/GUIDE.md) and the [5-minute quickstart](QUICKSTART.md).
 

package/docs/v10/FAILURE-CLASSES.md

@@ -1242,6 +1242,7 @@ L0 review rule (ENGINE-LAWS.md L0): a fix that adds an `if` or a regex about the
 - Siblings swept: the supervisor pr step and modernize/ship.ts shipWave (which pushed draft PRs for unverified waves; now refuses unless the wave verified and every unit is PROVEN) are the callers of the push scripts (engine10-push.sh, engine10-push-gitlab.sh); ALREADY_SATISFIED already opened none; the E-67 backstop commit still lands locally on a killed worker; cancelled and tampered runs already skip it.
 - Mechanism: one gate in supervisor.ts, `verdict === "VERIFIED"`; every other verdict with a diff prints "branch loki/<runId> stays local (not pushed)" with the repo path. Supersedes the A-110 and E-67 draft-PR-on-unverified behaviour (tests updated in the same change).
 - Fixture: loki-ts/tests/engine10/supervisor_backstop.test.ts "FC-NO-PUSH-UNVERIFIED" (SPEC_CONFLICT, PARTIAL, FAILED call pr 0 times; VERIFIED once) and loki-ts/tests/engine10/modernize/ship.test.ts "FC-NO-PUSH-UNVERIFIED" (unverified wave pushes 0 times). Red before the fix, green after.
+- Moat fixture: tests/moat/p9-rule-of-two.sh seeds a real pytest test and a project .venv (python and ruff shims) so its default, auto-pr and opt-out legs seal VERIFIED and Loki's own push and PR fire; its "unverified" leg removes the ruff shim, seals PARTIAL, and asserts "stays local (not pushed)" with no Loki push or PR.
 
 ## FC-LINT-PRE-RED: a lint check excused as failing on base still named the run's failure
 - User-visible vs raw: user-visible. A run whose only failing check was a lint check also failing on base (cc#81826, shellcheck SC2181 on both) printed `Reason: lint:shellcheck failed` and listed it under Failures in HANDOFF.md, so the founder read a base-relative pass as a blocker.
@@ -1250,3 +1251,18 @@ L0 review rule (ENGINE-LAWS.md L0): a fix that adds an `if` or a regex about the
 - Siblings swept: seal verdict (already honours pre_red_checks), failures_grouped and fix brief (already exclude), reasonOf and handoff Failures (fixed); commands/export_sarif.ts receiptFindings (reads pre_red_checks from the run events), util/failure_memory.ts failedCheckNames (engine10/supervisor.ts now passes verify's pre_red_checks), e10ext/select.ts lintFails via AttemptCandidate.preRedChecks (all fixed through the one `isBlockingFail` in util/failure_memory.ts). features/attempts.ts now fills `preRedChecks` through the optional `AttemptOps.preRed(i)`, but stays inert until `score()`'s caller supplies preRed (the real treeswapOps runs no lint). Open: supervisor.ts must pass verify `pre_red_checks` as failedCheckNames' second argument. Other linters share the same path (ruff, eslint via excuseLint; unparseable output stays fail-closed with the existing reason).
 - Mechanism: `pre_red_checks` read in `reasonOf`; `composeHandoff` tags failing checks in it `pre_red`, `renderHandoff` moves them to "Already failing on base".
 - Fixture: tests/engine10/output.test.ts and tests/util/run_summary.test.ts, "FC-LINT-PRE-RED". Red before the fix, green after.
+
+## FC-SEAL-NA-AS-UNPROVEN A package with no test command, a repo with no app, and deep checks the risk tier never asked for were listed NOT PROVEN, so a fully proven run ended PARTIAL or carried phantom gaps (SEAL-NA-AS-UNPROVEN)
+- User-visible vs raw: user-visible. `loki start anthropics/claude-code#81826` on loki 11.17.78 (run e10-20261019T064138Z-a7ca) ended PARTIAL solely because verify.not_proven held "full suite: package claude-code-repo defines no test command", while the full-suite runs for the other packages and the Wall test passed. Raw: a package without a test command has nothing to run; it is not applicable, not unproven. Every receipt also listed "full suite", "app boot", "council" and "security scan" as NOT PROVEN even when the risk tier never selected them or verify had run the full suite.
+- Law: NOT PROVEN lists what was needed and not shown; what does not apply is disclosed separately and never hidden; unknown stays unproven (fail-safe); a real gap never becomes VERIFIED.
+- Cause (measured): project_model/package_suite.ts added the no-test-command note unconditionally; util/app_probe.ts returned not_run when app-runner reported "no application detected"; seal.ts spread the static DEEP_NOT_PROVEN constant into every receipt without reading risk.checks_deferred. The only N/A filter was a prefix match on "full suite (no test runner" in verify.ts.
+- Siblings swept: package_suite.ts runPackageSuites (fixed); deep.ts runFullSuite legacy "full suite (no test runner detected)" (now N/A, listed); verify.ts not_proven filter (one naNote helper replaces the prefix match); app_probe.ts "app boot" and "http probe" (n/a only when app-runner itself said no application detected; a Docker project with the daemon down, an unsafe command or a throw stay not_run); deep.ts runAppBoot and the addendum not_proven; seal.ts DEEP_NOT_PROVEN (now deepGaps from risk.checks_selected and checks_deferred, fail-safe to the full list when risk is absent or malformed); supply, review, contract and wall not_proven are real gaps and untouched.
+- Mechanism: one `naNote`/`naText` pair in package_suite.ts (the "n/a: " prefix travels in the existing notProven Set) and one `deepGaps` in util/check_result.ts. A package without tests is N/A only when a real suite ran AND (the diff is not in that package OR a passing Wall or holdout check whose test file lies inside THAT package proves it: the package root owns the file, root "." owns any file inside no other package, and a Wall that failed anywhere voids the proof; round 2 closed the cross-package leak); an unknown diff, or changed files it owns with no Wall proof, stay NOT PROVEN. N/A notes reach the receipt as the additive `not_applicable` field and a "### N/A" section; they never enter verdictOf. Tier-skipped deep checks read "not selected by risk tier: X" there; a selected-but-unrun check stays NOT PROVEN; an executed full suite is dropped.
+- Fixture: loki-ts/tests/engine10/monorepo_cwd.test.ts (package without tests: N/A, owned-by-diff stays NOT PROVEN with and without proofFiles, an in-package proof makes it N/A, a proof in another package does not, root package with plugins/** diff stays N/A, unknown diff fail-safe; verify wiring describe mutates proofFiles, wallProofOf and the not_proven filter), seal.test.ts describe "FC-SEAL-NA-AS-UNPROVEN" (N/A section, low and high tier, executed full suite dropped, no-risk fail-safe, real gap still downgrades), tests/util/check_result.test.ts deepGaps, tests/util/app_probe.test.ts (empty repo n/a, missing Docker runtime stays not_run), deep.test.ts (n/a boot, no runner). Red before the fix, green after.
+
+## FC-CHANGED-PATH-QUOTED A non-ASCII changed path came back from git as a quoted octal escape, so no consumer of changedFiles could match it to a package, Wall file or test
+- User-visible vs raw: user-visible. A diff in `frontend/src/café.ts` made the test-less frontend package read as not owned by the diff, its note became N/A, not_proven was empty and the run could seal VERIFIED with the frontend edit unproven (HIGH re-review of FC-SEAL-NA-AS-UNPROVEN r2).
+- Law broken: a git path must be the real path; an unresolvable path must fail safe, never read as "not in the package".
+- Siblings swept: every consumer of changedFiles/diffFiles (package ownership, uncoveredChanged, risk tier, impacted tests, lint selection); diffFiles numstat and name-status keyed by the same path (fixed together); secure_scan.ts already used quotePath=false.
+- Mechanism: `changedFiles` uses `-c core.quotePath=false` and `-z` (NUL split) for both git calls, diffFiles numstat and name-status use `-z` with `--no-renames` (simple NUL records, so a name holding a quote, backslash, tab or newline is never escaped); `--no-renames` on the changedFiles diff too, because a rename listed only its new path and hid the source package; the package ownership check treats a changed path packageOf cannot resolve, or one that starts with a quote, as owned (stays NOT PROVEN).
+- Fixture: loki-ts/tests/util/check_result.test.ts and tests/engine10/monorepo_cwd.test.ts, "FC-CHANGED-PATH-QUOTED" (non-ASCII path in changedFiles; git mv across packages keeps the source path; diffFiles on a name with a double quote; verify with a non-ASCII frontend file and a backend Wall stays NOT PROVEN; unresolvable path fail-safe). Red before the fix, green after.

package/docs/v10/PROGRESS.md

@@ -2614,3 +2614,9 @@ v11.17.21 published (Release success on 462fbc40a; npm latest 11.17.21, next 11.
 
 ## 2026-10-19T08:06Z (CoS) v11.17.80
 - 11.17.80: fix-forward for Tests run 39215298360 on c6db3c019 (D50-F4 backstop expectation, plan brief golden; 32 pass 0 fail) plus supervisor pre_red_checks wiring 411fdaf63 (red 106/1 -> green 107/0; 172 pass 0 fail incl. budget). P9 moat fixture ccccfc82f under HIGH review, ships next.
+
+## 2026-10-19T08:15Z (CoS) v11.17.81
+- 11.17.81: P9 fixture 990270f12 + 466d55a4e (HIGH APPROVE; fast-gate.sh p9 rc=0, 5 PASS; no-pytest wrapper gives the prerequisite message, gate rc=1). Fixes Release gate P9 red on c6db3c019/c5358b462.
+
+## 2026-10-19T08:43Z (CoS) v11.17.82
+- 11.17.82: FC-SEAL-NA-AS-UNPROVEN + FC-CHANGED-PATH-QUOTED (96d0c22db..9eb4bddd8; HIGH APPROVE after 3 BLOCK rounds; reviewer edge probes for renames, copies, T type change, tab/newline/quote names, status-letter names all pass; main targeted 622 pass 0 fail incl budget). Full engine10 gate timed out at 560s under load; ship_hook alone 2 pass 0 fail in 5s.