loki-mode 11.17.81 → 11.17.83

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: An autonomous software factory that knows what it is supposed to deliver, and proves it did. Use when the user says Loki Mode or asks to build, fix or verify software autonomously.
 ---
 
-# Loki Mode v11.17.81
+# Loki Mode v11.17.83
 
 **Current entry points (Loki 10 engine):** `loki "<task>"`, `loki owner/repo#N` and `loki quick "<task>"` run the Loki 10 engine and end with a signed receipt (`loki verify`). `loki backlog owner/repo --all` runs many issues in parallel. Guide: `docs/v10/GUIDE.md`. The skill instructions below, and `loki start`, describe the previous bash loop. PRD-file starts (`loki start ./prd.md`) and the opencode provider still run on it until FC38-SWEEP ports them; the legacy-engine command and the LOKI_ENGINE switch remain removed. Prefer `loki owner/repo#N` for issues.
 
@@ -483,4 +483,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v11.17.81 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**
+**v11.17.83 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**

package/VERSION

@@ -1 +1 @@
-11.17.81
+11.17.83

package/dashboard/__init__.py

@@ -7,6 +7,6 @@ Modules:
     control: Session control helpers (status, atomic writes, origin check)
 """
 
-__version__ = "11.17.81"
+__version__ = "11.17.83"
 
 __all__ = ["__version__"]

package/docs/CLI-REFERENCE.md

@@ -1,6 +1,6 @@
 # CLI reference
 
-Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.17.81. Do not edit by hand.
+Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.17.83. Do not edit by hand.
 Hidden and legacy-only commands are omitted; see `docs/v10/CLI-MODERN.md` for the full inventory.
 
 | Command | Description |

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 Loki Mode, by [Autonomi](https://www.autonomi.dev/), turns a spec or an issue into a verified pull request with a receipt you can check. This page covers installing it, a first run, and the options around it.
 
-**Version:** v11.17.81
+**Version:** v11.17.83
 
 **Engine note:** `loki start` is the primary command. `loki start`, `loki "<task>"`, `loki owner/repo#N` and `loki quick` all run the Loki 10 engine, whatever the flag order or input form (PRD file, issue ref, task or one-word brief). The previous loop runs only on `--engine legacy`, `LOKI_ENGINE=legacy`, or for one call when a flag Loki 10 cannot honor is present. See the [user guide](v10/GUIDE.md) and the [5-minute quickstart](QUICKSTART.md).
 

package/docs/v10/FAILURE-CLASSES.md

@@ -1251,3 +1251,26 @@ L0 review rule (ENGINE-LAWS.md L0): a fix that adds an `if` or a regex about the
 - Siblings swept: seal verdict (already honours pre_red_checks), failures_grouped and fix brief (already exclude), reasonOf and handoff Failures (fixed); commands/export_sarif.ts receiptFindings (reads pre_red_checks from the run events), util/failure_memory.ts failedCheckNames (engine10/supervisor.ts now passes verify's pre_red_checks), e10ext/select.ts lintFails via AttemptCandidate.preRedChecks (all fixed through the one `isBlockingFail` in util/failure_memory.ts). features/attempts.ts now fills `preRedChecks` through the optional `AttemptOps.preRed(i)`, but stays inert until `score()`'s caller supplies preRed (the real treeswapOps runs no lint). Open: supervisor.ts must pass verify `pre_red_checks` as failedCheckNames' second argument. Other linters share the same path (ruff, eslint via excuseLint; unparseable output stays fail-closed with the existing reason).
 - Mechanism: `pre_red_checks` read in `reasonOf`; `composeHandoff` tags failing checks in it `pre_red`, `renderHandoff` moves them to "Already failing on base".
 - Fixture: tests/engine10/output.test.ts and tests/util/run_summary.test.ts, "FC-LINT-PRE-RED". Red before the fix, green after.
+
+## FC-SEAL-NA-AS-UNPROVEN A package with no test command, a repo with no app, and deep checks the risk tier never asked for were listed NOT PROVEN, so a fully proven run ended PARTIAL or carried phantom gaps (SEAL-NA-AS-UNPROVEN)
+- User-visible vs raw: user-visible. `loki start anthropics/claude-code#81826` on loki 11.17.78 (run e10-20261019T064138Z-a7ca) ended PARTIAL solely because verify.not_proven held "full suite: package claude-code-repo defines no test command", while the full-suite runs for the other packages and the Wall test passed. Raw: a package without a test command has nothing to run; it is not applicable, not unproven. Every receipt also listed "full suite", "app boot", "council" and "security scan" as NOT PROVEN even when the risk tier never selected them or verify had run the full suite.
+- Law: NOT PROVEN lists what was needed and not shown; what does not apply is disclosed separately and never hidden; unknown stays unproven (fail-safe); a real gap never becomes VERIFIED.
+- Cause (measured): project_model/package_suite.ts added the no-test-command note unconditionally; util/app_probe.ts returned not_run when app-runner reported "no application detected"; seal.ts spread the static DEEP_NOT_PROVEN constant into every receipt without reading risk.checks_deferred. The only N/A filter was a prefix match on "full suite (no test runner" in verify.ts.
+- Siblings swept: package_suite.ts runPackageSuites (fixed); deep.ts runFullSuite legacy "full suite (no test runner detected)" (now N/A, listed); verify.ts not_proven filter (one naNote helper replaces the prefix match); app_probe.ts "app boot" and "http probe" (n/a only when app-runner itself said no application detected; a Docker project with the daemon down, an unsafe command or a throw stay not_run); deep.ts runAppBoot and the addendum not_proven; seal.ts DEEP_NOT_PROVEN (now deepGaps from risk.checks_selected and checks_deferred, fail-safe to the full list when risk is absent or malformed); supply, review, contract and wall not_proven are real gaps and untouched.
+- Mechanism: one `naNote`/`naText` pair in package_suite.ts (the "n/a: " prefix travels in the existing notProven Set) and one `deepGaps` in util/check_result.ts. A package without tests is N/A only when a real suite ran AND (the diff is not in that package OR a passing Wall or holdout check whose test file lies inside THAT package proves it: the package root owns the file, root "." owns any file inside no other package, and a Wall that failed anywhere voids the proof; round 2 closed the cross-package leak); an unknown diff, or changed files it owns with no Wall proof, stay NOT PROVEN. N/A notes reach the receipt as the additive `not_applicable` field and a "### N/A" section; they never enter verdictOf. Tier-skipped deep checks read "not selected by risk tier: X" there; a selected-but-unrun check stays NOT PROVEN; an executed full suite is dropped.
+- Fixture: loki-ts/tests/engine10/monorepo_cwd.test.ts (package without tests: N/A, owned-by-diff stays NOT PROVEN with and without proofFiles, an in-package proof makes it N/A, a proof in another package does not, root package with plugins/** diff stays N/A, unknown diff fail-safe; verify wiring describe mutates proofFiles, wallProofOf and the not_proven filter), seal.test.ts describe "FC-SEAL-NA-AS-UNPROVEN" (N/A section, low and high tier, executed full suite dropped, no-risk fail-safe, real gap still downgrades), tests/util/check_result.test.ts deepGaps, tests/util/app_probe.test.ts (empty repo n/a, missing Docker runtime stays not_run), deep.test.ts (n/a boot, no runner). Red before the fix, green after.
+
+## FC-CHANGED-PATH-QUOTED A non-ASCII changed path came back from git as a quoted octal escape, so no consumer of changedFiles could match it to a package, Wall file or test
+- User-visible vs raw: user-visible. A diff in `frontend/src/café.ts` made the test-less frontend package read as not owned by the diff, its note became N/A, not_proven was empty and the run could seal VERIFIED with the frontend edit unproven (HIGH re-review of FC-SEAL-NA-AS-UNPROVEN r2).
+- Law broken: a git path must be the real path; an unresolvable path must fail safe, never read as "not in the package".
+- Siblings swept: every consumer of changedFiles/diffFiles (package ownership, uncoveredChanged, risk tier, impacted tests, lint selection); diffFiles numstat and name-status keyed by the same path (fixed together); secure_scan.ts already used quotePath=false.
+- Mechanism: `changedFiles` uses `-c core.quotePath=false` and `-z` (NUL split) for both git calls, diffFiles numstat and name-status use `-z` with `--no-renames` (simple NUL records, so a name holding a quote, backslash, tab or newline is never escaped); `--no-renames` on the changedFiles diff too, because a rename listed only its new path and hid the source package; the package ownership check treats a changed path packageOf cannot resolve, or one that starts with a quote, as owned (stays NOT PROVEN).
+- Fixture: loki-ts/tests/util/check_result.test.ts and tests/engine10/monorepo_cwd.test.ts, "FC-CHANGED-PATH-QUOTED" (non-ASCII path in changedFiles; git mv across packages keeps the source path; diffFiles on a name with a double quote; verify with a non-ASCII frontend file and a backend Wall stays NOT PROVEN; unresolvable path fail-safe). Red before the fix, green after.
+
+## FC-WALL-PHANTOM-PATH A Wall check located the code under test at a repo path that does not exist, and the implementer added a symlink to make it resolve (PR carried a link instead of the change)
+- User-visible vs raw: user-visible. `loki start anthropics/claude-code#81826` on loki 11.17.77: the issue names the plugin "ralph-loop", the repo directory is plugins/ralph-wiggum. Raw: the Wall wrote `join(ROOT, 'plugins', 'ralph-loop')` (absent) and the implementer committed `plugins/ralph-loop -> ralph-wiggum` to satisfy it.
+- Law: a Wall check names code that exists in the base tree or that the plan creates; a change never satisfies a check by adding an alias for a path.
+- Cause (measured): FC-WALL-OUT-OF-REPO-TARGET validated only home-derived targets; nothing resolved repo-relative literals against the base tree, and seal looked at no added-symlink signal (E-55 covers only base-side typechanges of test files).
+- Siblings swept: Wall author (fixed); implement stage (nothing to forbid in-brief; the diff is judged at seal); fix and plan stages write no Wall tests; seal diff checks (weakened test, runner config) did not look at mode 120000 on the head side (fixed).
+- Mechanism: `phantomRepoPaths` in project_model/conventions.ts evaluates join/resolve chains rooted at the test dir or cwd (const assignments followed) and reports missing paths the plan does not name; wallAuthor folds it into the existing single re-ask (reason plus same-named files from the repo map) and discards a file still failing. The detector resolves process.cwd() against both the test's nearest package root and the repo root, and skips paths the test creates, git ignores, or the plan names WITH its parent (plugins/ralph-loop; never a bare segment or basename). `process.env.X ?? Y` and `|| Y` evaluate as Y (the real #81826 file used `process.env.REPO_ROOT ?? process.cwd()`); the two cwd runs pair calls by source line and text, not array index. `addedSymlinkNotes` (util/base_guard.ts, folded into seal's rcNotes) makes an added symlink (status A, or T from a regular file; never M) or added submodule pointer a NOT PROVEN item that blocks VERIFIED unless the plan asks for one by the word symlink or submodule, un-negated; alias is not an escape.
+- Fixture: loki-ts/tests/engine10/fc23_wall_conventions.test.ts describe "FC-WALL-PHANTOM-PATH" (reported, existing passes, plan-created passes, re-ask, discard); loki-ts/tests/engine10/seal.test.ts "FC-WALL-PHANTOM-PATH" (added symlink, plan-requested, deletion, modified link, negated plan, submodule). Round 2 adds monorepo cwd, created-path, ignored-path, plan-parent, split-call and same-name-directory cases, and a fixture built from the real #81826 Wall file. Red before the fix, green after.

package/docs/v10/PROGRESS.md

@@ -2617,3 +2617,9 @@ v11.17.21 published (Release success on 462fbc40a; npm latest 11.17.21, next 11.
 
 ## 2026-10-19T08:15Z (CoS) v11.17.81
 - 11.17.81: P9 fixture 990270f12 + 466d55a4e (HIGH APPROVE; fast-gate.sh p9 rc=0, 5 PASS; no-pytest wrapper gives the prerequisite message, gate rc=1). Fixes Release gate P9 red on c6db3c019/c5358b462.
+
+## 2026-10-19T08:43Z (CoS) v11.17.82
+- 11.17.82: FC-SEAL-NA-AS-UNPROVEN + FC-CHANGED-PATH-QUOTED (96d0c22db..9eb4bddd8; HIGH APPROVE after 3 BLOCK rounds; reviewer edge probes for renames, copies, T type change, tab/newline/quote names, status-letter names all pass; main targeted 622 pass 0 fail incl budget). Full engine10 gate timed out at 560s under load; ship_hook alone 2 pass 0 fail in 5s.
+
+## 2026-10-19T08:48Z (CoS) v11.17.83
+- 11.17.83: FC-WALL-PHANTOM-PATH r1-r3 (298fddf96..82233dad0; HIGH APPROVE after 2 BLOCK rounds; full real #81826 Wall file against base ef7bfdc reports plugins/ralph-loop; 3 round-3 mutations each red). Main targeted 662 pass 0 fail incl budget.