loki-mode 11.17.95 → 11.17.96

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: An autonomous software factory that knows what it is supposed to deliver, and proves it did. Use when the user says Loki Mode or asks to build, fix or verify software autonomously.
 ---
 
-# Loki Mode v11.17.95
+# Loki Mode v11.17.96
 
 **Current entry points (Loki 10 engine):** `loki "<task>"`, `loki owner/repo#N` and `loki quick "<task>"` run the Loki 10 engine and end with a signed receipt (`loki verify`). `loki backlog owner/repo --all` runs many issues in parallel. Guide: `docs/v10/GUIDE.md`. The skill instructions below, and `loki start`, describe the previous bash loop. PRD-file starts (`loki start ./prd.md`) and the opencode provider still run on it until FC38-SWEEP ports them; the legacy-engine command and the LOKI_ENGINE switch remain removed. Prefer `loki owner/repo#N` for issues.
 
@@ -483,4 +483,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v11.17.95 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**
+**v11.17.96 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**

package/VERSION

@@ -1 +1 @@
-11.17.95
+11.17.96

package/autonomy/lib/claude-flags.sh

@@ -331,7 +331,7 @@ loki_review_guard_denylist() {
     # Comma-separated single token. Bash(cmd:*) is command-prefix matching.
     # The `git -C:*` / `git --git-dir:*` / `git -c:*` entries close the
     # global-flag-before-subcommand evasion of the bare git-mutation rules.
-    printf '%s' "Edit,Write,NotebookEdit,Bash(git commit:*),Bash(git reset:*),Bash(git push:*),Bash(git checkout:*),Bash(git clean:*),Bash(git rm:*),Bash(git stash:*),Bash(git -C:*),Bash(git --git-dir:*),Bash(git -c:*)"
+    printf '%s' "Edit,Write,NotebookEdit,Bash(git commit:*),Bash(git reset:*),Bash(git push:*),Bash(git checkout:*),Bash(git clean:*),Bash(git rm:*),Bash(git stash:*),Bash(git -C:*),Bash(git --git-dir:*),Bash(git -c:*),Bash(git --exec-path:*),Bash(git diff --output:*),Bash(git diff --output=:*),Bash(git diff --ext-diff:*),Bash(git diff --no-index:*),Bash(git log --output:*),Bash(git log --output=:*),Bash(git log --ext-diff:*),Bash(git show --output:*),Bash(git show --output=:*),Bash(git show --ext-diff:*),Bash(git blame --output:*),Bash(git blame --output=:*),Bash(rg --pre:*),Bash(rg --pre=:*),Bash(rg --pre-glob:*),Bash(rg --pre-glob=:*),Bash(rg --hostname-bin:*),Bash(rg --hostname-bin=:*),Bash(find -delete:*),Bash(find -exec:*),Bash(find -execdir:*),Bash(find -ok:*),Bash(find -fprint:*),Bash(find -fprintf:*),Bash(find -fls:*),Bash(git * --output*),Bash(git * --ext-diff*),Bash(git * --no-index*),Bash(rg * --pre*),Bash(rg * --hostname-bin*),Bash(rg --pre*),Bash(rg --hostname-bin*),Bash(find * -delete*),Bash(find * -exec*),Bash(find * -execdir*),Bash(find * -fprint*),Bash(find * -fls*),Bash(find * -ok*)"
 }
 
 # EMBED 3b (v7.35.0, GitHub #167) -- --allowedTools POSITIVE ALLOWLIST for the

package/dashboard/__init__.py

@@ -7,6 +7,6 @@ Modules:
     control: Session control helpers (status, atomic writes, origin check)
 """
 
-__version__ = "11.17.95"
+__version__ = "11.17.96"
 
 __all__ = ["__version__"]

package/docs/CLI-REFERENCE.md

@@ -1,6 +1,6 @@
 # CLI reference
 
-Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.17.95. Do not edit by hand.
+Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.17.96. Do not edit by hand.
 Hidden and legacy-only commands are omitted; see `docs/v10/CLI-MODERN.md` for the full inventory.
 
 | Command | Description |

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 Loki Mode, by [Autonomi](https://www.autonomi.dev/), turns a spec or an issue into a verified pull request with a receipt you can check. This page covers installing it, a first run, and the options around it.
 
-**Version:** v11.17.95
+**Version:** v11.17.96
 
 **Engine note:** `loki start` is the primary command. `loki start`, `loki "<task>"`, `loki owner/repo#N` and `loki quick` all run the Loki 10 engine, whatever the flag order or input form (PRD file, issue ref, task or one-word brief). The previous loop runs only on `--engine legacy`, `LOKI_ENGINE=legacy`, or for one call when a flag Loki 10 cannot honor is present. See the [user guide](v10/GUIDE.md) and the [5-minute quickstart](QUICKSTART.md).
 

package/docs/v10/FAILURE-CLASSES.md

@@ -1311,3 +1311,10 @@ L0 review rule (ENGINE-LAWS.md L0): a fix that adds an `if` or a regex about the
 - Siblings swept: Wall author (fixed: brief names the destination, re-ask names the cause); implement bug-repro test and fix stage (an in-repo session whose cwd is the repo, so the file location is the author's own choice; nothing blind); verify changed set (fixed: a loki_wall_* path not installed by this run's Wall is dropped; the commit stage already excludes the prefix); holdout files are staged later by stageHoldout and unaffected.
 - Mechanism: buildWallBrief takes the destination from wallTargetDir (the value installCore copies to); phantomReason(miss, repoFiles, testDir, pkgRoot) names "your test is copied to X/, __dirname is that directory, not the repo root; Y exists relative to the repo root" when the phantom is testDir joined with a path real at the repo or package root; util/check_result.ts withoutStaleWall filters verify's changed list.
 - Fixture: loki-ts/tests/engine10/fc23_wall_conventions.test.ts describe "FC-WALL-LOCATION-BLIND" (brief, reason, end-to-end re-ask with the run's file shape, stale file excluded, own file kept). Red before the fix (4 of 6), green after.
+
+## FC-XREVIEW-BLIND-TOOLS The seal cross-reviewer is given no shell and a prompt that asks it to check behaviour, so it reports "my tool output came back empty" as a review flag and reviews blind
+- User-visible vs raw: user-visible. Run e10-20261019T124856Z-0c36 (anthropics/claude-code#81826, 11.17.93) sealed with two NOT PROVEN cross-review flags: "My tool output came back empty, so I could not confirm..." and "Acceptance lines, traced by hand because the shell output was not visible".
+- Law broken: a reviewer is told what it can and cannot do; a limit of its own sandbox is never reported to the user as a defect of the work (evidence or it did not happen).
+- Cause (REAL ROOT CAUSE, corrected after HIGH review of 54ffc9f0c): `leanReviewerFlags()` emitted `--tools=`, which disables ALL tools in Claude CLI 2.1.303 (stream-json init shows `"tools":[]` for the old and the first-fix argv alike), so allowlist and denylist were moot and the Bash deny was a red herring. Original observation: reviewArgv for claude passed `--allowedTools Read,Grep,Glob --disallowedTools Write,Edit,NotebookEdit,Bash`, so the reviewer had no shell at all; the prompt (acceptance block: "Check the diff against each line") invites running commands. Repro with the exact flags (haiku, `a.sh` containing `echo hi`): "This session has no shell tool ... there is no bash output", permission_denials empty. The process-group spawn (11.17.92) and cwd/env are not involved; the reviewer ran and returned a verdict.
+- Siblings swept: council voters (council/voter_agents.ts) and quality_gates reviewers already use the shared REVIEW_ALLOWLIST_TOKEN (read-only git/cat/ls/grep/rg/find/head/tail/wc) plus REVIEW_GUARD_DENYLIST (mutations only), so they can inspect; seal xreview was the one reviewer with a blanket Bash deny. Codex xreview runs in its read-only sandbox with a shell, unaffected.
+- Mechanism: xreview claude argv passes `leanReviewerFlags({ tools: "Read,Grep,Glob,Bash" })` = `--tools=Read,Grep,Glob,Bash` (one argument, so the variadic option cannot swallow the prompt), Bash narrowed by the shared allowlist; the prompt (REVIEW_TOOLS_NOTE) lists only the tools the reviewer has and tells it to say so when it could not inspect something (it is never told to hide an inspection failure). Write escapes under the allowlist (reproduced: `rg --pre rm`, `git diff --output=f`) are closed in REVIEW_GUARD_DENYLIST (TS and autonomy/lib/claude-flags.sh, byte-identical): `rg --pre/--pre-glob`, `--output`/`--ext-diff`/`--no-index` on git diff/log/show/blame, `git --exec-path`, `find -delete/-exec/-execdir/-ok/-fprint/-fls`, each as a prefix form and a mid-argument glob form (`Bash(git * --output*)`; live probe confirmed `git diff HEAD~1 --output=pwned.txt` and `rg one --pre rm a.txt` are denied). This also hardens council voters and quality_gates, which share the list. Sibling sweep: `leanReviewerFlags` default (`--tools=`) is unchanged for its other caller, quality_gates claudeReviewer (haiku-routed text-only reviewer, no allowlist, diff in prompt; blind by design, not the bug); council voters do not use it. Live init line (haiku, real argv, stream-json): `"tools":["Bash","Glob","Grep","Read"]`. Round 2 (HIGH review of e4e690dce): allowed `git status/diff/show/log` execute programs named by the repo `.git/config` and attributes (core.fsmonitor, diff drivers, textconv) and so can rewrite the worktree before seal hashes it; xreview therefore uses `REVIEW_ALLOWLIST_NO_GIT` (shared allowlist minus every `Bash(git` entry; the diff is already in the prompt) and the note says no git commands are available. Repo settings: with `--setting-sources project` a repo `.claude/settings.json` can carry `permissions.allow` or `defaultMode`, and the machine user `defaultMode: auto` made `touch marker.txt` run in a live haiku probe (settings-source-dependent, not proven for a trusted repo offline), so xreview now passes `--setting-sources user` plus `--permission-mode dontAsk`; probe with those flags: `cat f.txt` ran, `touch marker.txt` was denied and no marker was created even with a repo settings file allowing touch and bypassPermissions. Round 3 correction: `--setting-sources user` was itself a hole (user `permissions.allow` such as Bash(python3:*) pre-approves under dontAsk, user hooks fire in every review child, and the user CLAUDE.md added about 4,331 cache-creation tokens per review). xreview now passes `--setting-sources ""` (no source loads; the CLI accepts the empty value, "none" is rejected): live probe with the real argv, `python3 -c "print(6*7)"` denied, `cat f.txt` ran, 0 hook events (vs 12 with `user`), init tools `["Bash","Glob","Grep","Read"]`. Also closed: `rg --hostname-bin` (runs a program). A leading `rg --pre=CMD` form slipped past both `Bash(rg --pre=:*)` (prefix rules need a word boundary) and `Bash(rg * --pre*)` (needs an argument before it); live probe confirmed it ran until `Bash(rg --pre*)` and `Bash(rg --hostname-bin*)` were added, then denied. The new test records the argv the stub reviewer CLI really receives. Sibling note: council voters and quality_gates share the git allowlist and are exposed to repo-config driver execution; follow-up slice FC-REVIEWER-GIT-CONFIG-EXEC (not fixed here). Fixture: loki-ts/tests/engine10/xreview.test.ts describe "FC-XREVIEW-BLIND-TOOLS" (red before, green after).

package/docs/v10/PROGRESS.md

@@ -2659,3 +2659,6 @@ v11.17.21 published (Release success on 462fbc40a; npm latest 11.17.21, next 11.
 
 ## 2026-10-19T13:43Z (CoS) v11.17.95
 - 11.17.95: FC-WALL-LOCATION-BLIND c3fbc4f4c+10226edf6 (from ff9d5c9d3+9807b3401; field run e10-20261019T130749Z-f11c FireLater#20). HIGH APPROVE round 2: 7 repro cases, 5 mutations red, 838 pass 0 fail; merged-tree gate 789 pass 0 fail.
+
+## 2026-10-19T13:53Z (CoS) v11.17.96
+- 11.17.96: FC-XREVIEW-BLIND-TOOLS bf2b129d8..2a08304d5 (from 54ffc9f0c..74ac1f558; field run #81826 NOT PROVEN 'tool output came back empty'). HIGH APPROVE round 4: python3/curl denied, cat ok, empty-source tokens equal project baseline, 3 mutations red; merged-tree gate 856 pass 0 fail, tsc clean.