loki-mode 11.17.98 → 11.17.99

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: An autonomous software factory that knows what it is supposed to deliver, and proves it did. Use when the user says Loki Mode or asks to build, fix or verify software autonomously.
 ---
 
-# Loki Mode v11.17.98
+# Loki Mode v11.17.99
 
 **Current entry points (Loki 10 engine):** `loki "<task>"`, `loki owner/repo#N` and `loki quick "<task>"` run the Loki 10 engine and end with a signed receipt (`loki verify`). `loki backlog owner/repo --all` runs many issues in parallel. Guide: `docs/v10/GUIDE.md`. The skill instructions below, and `loki start`, describe the previous bash loop. PRD-file starts (`loki start ./prd.md`) and the opencode provider still run on it until FC38-SWEEP ports them; the legacy-engine command and the LOKI_ENGINE switch remain removed. Prefer `loki owner/repo#N` for issues.
 
@@ -483,4 +483,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v11.17.98 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**
+**v11.17.99 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**

package/VERSION

@@ -1 +1 @@
-11.17.98
+11.17.99

package/autonomy/run.sh

@@ -16575,6 +16575,26 @@ _dispatch_reviewer() {
                     _cr_provider_env+=("-u" "$_cr_secret_name")
                 done
             fi
+            # FC-REVIEWER-GIT-CONFIG-EXEC: the shared review allowlist grants git
+            # status/diff/show/log, and git runs programs named in the target repo's
+            # own config (core.fsmonitor, diff drivers, textconv, diff.external). The
+            # TS reviewerGitEnv (util/safe_git.ts) is the one mechanism; this adds its
+            # GIT_* env to the provider env. Fail-closed: no env, no allowlisted review.
+            if type loki_review_allowlist_enabled >/dev/null 2>&1 && loki_review_allowlist_enabled; then
+                local _rv_git_kv
+                local _rv_git_env_file
+                _rv_git_env_file="$(mktemp 2>/dev/null)" || _rv_git_env_file=""
+                if [ -z "$_rv_git_env_file" ] || [ ! -x "${_cr_root}/bin/loki" ] \
+                   || ! "${_cr_root}/bin/loki" internal reviewer-git-env > "$_rv_git_env_file" 2>/dev/null; then
+                    log_warn "reviewer git hardening unavailable; reviewer not dispatched (fail-closed)"
+                    [ -z "$_rv_git_env_file" ] || rm -f "$_rv_git_env_file"
+                    return 125
+                fi
+                while IFS= read -r -d '' _rv_git_kv; do
+                    _cr_provider_env+=("$_rv_git_kv")
+                done < "$_rv_git_env_file"
+                rm -f "$_rv_git_env_file"
+            fi
             # v8 RAW-SDK REVIEWER PATH (opt-in LOKI_SDK_CODE_REVIEW=1). Run the
             # reviewer via the pure-HTTPS @anthropic-ai/sdk bridge (no claude
             # binary) and re-materialize the SAME legacy VERDICT/FINDINGS text
@@ -16770,7 +16790,7 @@ _dispatch_reviewer() {
                 _cr_text_cap=$(_loki_review_deadline_remaining "$_review_deadline_ms") || return 124
             fi
             _loki_with_deadline_stdin_text "$_cr_text_cap" "$prompt_text" \
-                env CAVEMAN_DEFAULT_MODE=off claude "${_rv_argv[@]}" -p \
+                "${_cr_provider_env[@]}" CAVEMAN_DEFAULT_MODE=off claude "${_rv_argv[@]}" -p \
                 --output-format text > "$review_output"
             ;;
         codex)

package/dashboard/__init__.py

@@ -7,6 +7,6 @@ Modules:
     control: Session control helpers (status, atomic writes, origin check)
 """
 
-__version__ = "11.17.98"
+__version__ = "11.17.99"
 
 __all__ = ["__version__"]

package/docs/CLI-REFERENCE.md

@@ -1,6 +1,6 @@
 # CLI reference
 
-Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.17.98. Do not edit by hand.
+Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.17.99. Do not edit by hand.
 Hidden and legacy-only commands are omitted; see `docs/v10/CLI-MODERN.md` for the full inventory.
 
 | Command | Description |

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 Loki Mode, by [Autonomi](https://www.autonomi.dev/), turns a spec or an issue into a verified pull request with a receipt you can check. This page covers installing it, a first run, and the options around it.
 
-**Version:** v11.17.98
+**Version:** v11.17.99
 
 **Engine note:** `loki start` is the primary command. `loki start`, `loki "<task>"`, `loki owner/repo#N` and `loki quick` all run the Loki 10 engine, whatever the flag order or input form (PRD file, issue ref, task or one-word brief). The previous loop runs only on `--engine legacy`, `LOKI_ENGINE=legacy`, or for one call when a flag Loki 10 cannot honor is present. See the [user guide](v10/GUIDE.md) and the [5-minute quickstart](QUICKSTART.md).
 

package/docs/image-provenance.md

@@ -13,8 +13,13 @@ delivers is worse than none, because it is exactly what an auditor will test.
 
 | Artifact | Signature | SBOM |
 |---|---|---|
-| Container image (`asklokesh/loki-mode`) | first release after v8.5.2 | first release after v8.5.2 |
-| npm tarball (`loki-mode`) | v7.4.10 and later | v7.4.10 and later |
+| Container image (`asklokesh/loki-mode`) | first release after v8.5.2 | first release after v8.5.2 through v11.17.98 |
+| npm tarball (`loki-mode`) | v7.4.10 and later | v7.4.10 through v11.17.98 |
+
+**Releases after v11.17.98 ship no SBOM.** The release workflow was cut to the
+minimum that publishes (so every channel is live within minutes of a version
+bump), and SBOM generation and attestation were removed with it. The image is
+still signed. Generate an SBOM yourself with `syft` (see below) if you need one.
 
 **Images published up to and including v8.5.2 are not signed and have no SBOM.** A signing
 workflow existed from v7.4.10 but was triggered on `release: published`, and
@@ -61,6 +66,10 @@ name `release.yml` in this repository.
 
 ## Verify and read the SBOM
 
+Applies to images through v11.17.98 only; later images carry no SBOM
+attestation, so this command fails for them by design. For those, run `syft`
+against the digest (shown at the end of this section).
+
 The SBOM is attached to the image as a CycloneDX attestation. Note this is a
 *separate* artifact from the npm SBOM published on the GitHub Release: the
 image carries an OS layer, a Python runtime and system packages that the npm

package/docs/v10/FAILURE-CLASSES.md

@@ -1261,6 +1261,14 @@ L0 review rule (ENGINE-LAWS.md L0): a fix that adds an `if` or a regex about the
 - Mechanism: one `naNote`/`naText` pair in package_suite.ts (the "n/a: " prefix travels in the existing notProven Set) and one `deepGaps` in util/check_result.ts. A package without tests is N/A only when a real suite ran AND (the diff is not in that package OR a passing Wall or holdout check whose test file lies inside THAT package proves it: the package root owns the file, root "." owns any file inside no other package, and a Wall that failed anywhere voids the proof; round 2 closed the cross-package leak); an unknown diff, or changed files it owns with no Wall proof, stay NOT PROVEN. N/A notes reach the receipt as the additive `not_applicable` field and a "### N/A" section; they never enter verdictOf. Tier-skipped deep checks read "not selected by risk tier: X" there; a selected-but-unrun check stays NOT PROVEN; an executed full suite is dropped.
 - Fixture: loki-ts/tests/engine10/monorepo_cwd.test.ts (package without tests: N/A, owned-by-diff stays NOT PROVEN with and without proofFiles, an in-package proof makes it N/A, a proof in another package does not, root package with plugins/** diff stays N/A, unknown diff fail-safe; verify wiring describe mutates proofFiles, wallProofOf and the not_proven filter), seal.test.ts describe "FC-SEAL-NA-AS-UNPROVEN" (N/A section, low and high tier, executed full suite dropped, no-risk fail-safe, real gap still downgrades), tests/util/check_result.test.ts deepGaps, tests/util/app_probe.test.ts (empty repo n/a, missing Docker runtime stays not_run), deep.test.ts (n/a boot, no runner). Red before the fix, green after.
 
+## FC-WALL-PROOF-PACKAGE-BLIND A passing Wall at the repo root that drives a test-less package's changed files by path never credited that package, so a multi-root run sealed PARTIAL instead of VERIFIED
+- User-visible vs raw: user-visible. `loki start anthropics/claude-code#81826` on loki 11.17.97 sealed PARTIAL: the diff changed plugins/ralph-wiggum/hooks/stop-hook.sh and scripts/setup-ralph-loop.sh, the Project Model (LLM generated, nondeterministic) declared a package `plugins` with no test command, and the Wall (always at the repo root since 11.17.95, red on base, green on head, driving both scripts by path) never matched it. The note "full suite: package plugins defines no test command" stayed NOT PROVEN, the verdict went PARTIAL before crossReview ran (xreview.ts only reviews VERIFIED), and "one reviewer" was also reported NOT PROVEN. The previous run, whose model had no `plugins` package, sealed VERIFIED. Raw: proof credit was decided by where the proof file lives, not by what it exercises.
+- Law: a passing proof proves what it exercises; credit follows the code under test, never the proof's location or the model's nondeterministic package split. Unknown stays unproven (fail-safe).
+- Cause (measured): runPackageSuites credited a test-less package only when a proof file's packageOf(...).root equalled the package root.
+- Siblings swept: package_suite.ts runPackageSuites is the only consumer of proofFiles for package credit (grep proofFiles, packageOf over loki-ts/src: deep.ts and verify.ts only forward the list; verify.ts wallProofOf only decides whether the Wall passed; seal.ts and check_result.ts deepGaps consume the resulting note prefix, not the proof). No other place credits proof by package root or location, so there is nothing else to fix.
+- Mechanism: execution evidence, never proof text (a text or path match is gameable, and the real Wall locates scripts by basename search, never naming a path). One `execProves` plus `wallRedOnBaseOf` in package_suite.ts, fed by verify.ts through the existing runFullSuite opts (`wallBaseRed` from wall.base_run). A test-less package is N/A when (a) the Wall was red on base (base_run.fail > 0; missing, all not_run or green never credits), (b) it passed on head (proofFiles non-empty from wallProofOf, which already needs every Wall and holdout check to pass), and (c) the diff is known, non-empty after dropping this run's own Wall files, has no quoted path, and every remaining file is owned by that package. A red-on-base, green-on-head Wall over a diff confined to one package necessarily exercised that package's change. A diff spanning packages gets no credit from this rule; the in-package proof rule is kept.
+- Fixture: loki-ts/tests/engine10/monorepo_cwd.test.ts describe "FC-WALL-PROOF-PACKAGE-BLIND" (credited with base red and a single-package diff; NOT PROVEN with base green, base_run missing, a two-package diff, unknown, empty or quoted diff, Wall failed on head; wallRedOnBaseOf cases). Red before the fix, green after.
+
 ## FC-CHANGED-PATH-QUOTED A non-ASCII changed path came back from git as a quoted octal escape, so no consumer of changedFiles could match it to a package, Wall file or test
 - User-visible vs raw: user-visible. A diff in `frontend/src/café.ts` made the test-less frontend package read as not owned by the diff, its note became N/A, not_proven was empty and the run could seal VERIFIED with the frontend edit unproven (HIGH re-review of FC-SEAL-NA-AS-UNPROVEN r2).
 - Law broken: a git path must be the real path; an unresolvable path must fail safe, never read as "not in the package".
@@ -1332,3 +1340,19 @@ L0 review rule (ENGINE-LAWS.md L0): a fix that adds an `if` or a regex about the
 - Siblings swept: DENIED_TOOLS in packages/control-plane/src/ask/policy.ts (the only copy that was stale; fixed); autonomy/lib/claude-flags.sh (byte-identical mirror, already updated in 11.17.96); loki-ts consumers (stages/xreview.ts, stages/deep.ts, runner/quality_gates.ts, council) import the exported constant, no copy; no other mirror of REVIEW_GUARD_DENYLIST or REVIEW_ALLOWLIST_NO_GIT exists under packages/ or tests/ (grep of the whole tree excluding node_modules and dist). tests/test-control-plane.sh (CP-04) runs the control-plane tests as one bun process, so it was red from this same drift and no other cause.
 - Mechanism: the control-plane package ships alone (Docker image has no loki-ts), so a cross-package import is not allowed; DENIED_TOOLS keeps a literal copy of every REVIEW_GUARD_DENYLIST token and the parity test now asserts `missing` is empty, so a failure lists every absent token at once instead of the first.
 - Fixture: packages/control-plane/test/server/ask_policy.test.ts "the deny list covers every token of the loki-ts REVIEW denylist". Red before (missing "Bash(git --exec-path:*)" and the later tokens), green after.
+
+## FC-REVIEWER-GIT-CONFIG-EXEC A reviewer child with the shared Bash allowlist (git status, diff, show, log) runs programs named in the target repo's own git config
+- User-visible vs raw: user-visible as integrity, not output. A HIGH reviewer reproduced it: a plain `git status` in a reviewer child executed the repo's core.fsmonitor script and rewrote `.loki/runs/<id>/events.jsonl`; `git diff` did the same through diff.external and diff.<driver>.command / textconv (selected by .gitattributes or .git/info/attributes). Raw claude has no allowlist, so no new exposure there; the allowlist narrowed the tools but left a repo-controlled exec path inside Loki's own trust gate.
+- Law broken: the repo under review is untrusted input (safe_git.ts FC-25); the evidence a reviewer reads must not be producible or mutable by the code under review.
+- Cause (measured): safe_git hardens only Loki's own git calls (argv `-c` flags, blanked driver keys). A reviewer model builds its own git argv, and REVIEW_ALLOWLIST_TOKEN grants `Bash(git ...:*)` with no flag restriction, so nothing hardened the child's git. The only lever that reaches a model-built command is the child's env.
+- Siblings swept (every spawn of claude or another provider CLI that can run git):
+  - council voters and devil's advocate, loki-ts/src/council/voter_agents.ts defaultClaudeRunner: the only TS consumer of reviewAllowlistArgv. Fixed.
+  - quality_gates code review, loki-ts/src/runner/quality_gates.ts (structured and text claude spawns): denylist only, no allowlist, but Bash is otherwise open so git status/diff is reachable. Fixed with the same env.
+  - bash reviewer dispatch, autonomy/run.sh _dispatch_reviewer claude arm (the other consumer of loki_review_allowlist, three spawn sites): fixed through `loki internal reviewer-git-env`, fail-closed (no env, no allowlisted review).
+  - run.sh codex, cline, aider and opencode reviewer arms: no shared git allowlist (that token is a claude CLI flag); their reviewers get a diff in the prompt. Not changed, recorded here as swept.
+  - engine10 stages xreview.ts and deep.ts council session (providers.ts sessions): different mechanism (read-only disallowedTools on a session that already has exec); owned by the FC-XREVIEW-BLIND-TOOLS row and another engineer, not touched.
+  - autonomy/grill.sh and engine10 worker sessions: no review allowlist; worker sessions already have full exec by design.
+- Mechanism: one helper, `reviewerGitEnv` in loki-ts/src/util/safe_git.ts, reusing driverKeys (the DRIVER_KEY_RE enumeration). It sets GIT_CONFIG_NOSYSTEM and command-scope GIT_CONFIG_COUNT entries (core.fsmonitor blank, core.hooksPath and core.attributesFile /dev/null, core.pager cat, protocol.ext.allow never, every repo filter and textconv key blanked, every diff.<driver>.command pointed at a plain `diff -u` shim) and replaces GIT_EXTERNAL_DIFF with the same shim. Route chosen over dropping git from the allowlist: council prompts and reviewers rely on git diff and git show to read the change, and removing them would blind the reviewers (the FC-XREVIEW-BLIND-TOOLS class); env hardening keeps the capability and closes the exec path. A blank diff.external or driver command makes git die ("external diff died"), hence the shim instead of a blank.
+- Fixture: loki-ts/tests/util/safe_git_extdiff.test.ts describe "FC-REVIEWER-GIT-CONFIG-EXEC reviewerGitEnv" (control: plain git fires fsmonitor, diff.external and the driver command; with the real builder none fire and status, diff, show -p and log -p still return real patches; wiring check on both TS spawns). Mutation-checked: dropping the driver-key enumeration, the fsmonitor entry or the GIT_EXTERNAL_DIFF override each turns the fixture red.
+- Round 2 (HIGH review block): the same mechanism now also covers gpg exec (log.showSignature=false and gpg.program, gpg.openpgp.program, gpg.ssh.program, gpg.x509.program set to false), partial-clone lazy fetch firing core.sshCommand (GIT_NO_LAZY_FETCH=1 plus repo network command keys enumerated with NET_CMD_KEY_RE and blanked), a shim that ends options with `--` so a file named `-n` is a path, textconv blanked to `cat` (a blank one dies on log -p), and GIT_PAGER=cat. reviewerGitEnv takes a required base, and the two TS reviewer spawns pass tokenFreeEnv(process.env); full_env_spawn_guard.test.ts flags a reviewerGitEnv call with no base or a non-token-free base in the spawning reviewers. Fixtures in safe_git_extdiff.test.ts (gpg, lazy fetch, `-n`, textconv) and the guard test; each mutation (drop gpg entries, drop GIT_NO_LAZY_FETCH, drop `--`, textconv to blank, non-token-free base) turns its fixture red.
+- Round 3: remote.<n>.uploadpack/receivepack are first-value-wins, so a repo-local value beats an env blank. reviewerGitEnv therefore throws when the repo sets either key, and throws on a partial clone (extensions.partialClone) when git is older than 2.44 (GIT_NO_LAZY_FETCH is ignored there); both fixtures are mutation-checked. The spawn guard now requires tokenFreeEnv( on every reviewerGitEnv call (per call, not per file); the only raw process.env base is the cli.ts reviewer-git-env print, an explicit file-and-line row that fails the guard when stale.

package/docs/v10/PROGRESS.md

@@ -2668,3 +2668,6 @@ v11.17.21 published (Release success on 462fbc40a; npm latest 11.17.21, next 11.
 
 ## 2026-10-19T14:48Z (CoS) v11.17.98
 - 11.17.98: FC-CP-DENYLIST-DRIFT 6d8767316 (main CI red since 11.17.96: control-plane ask_policy parity + CP-04). TL APPROVE; control-plane package 539 pass 0 fail, tests/test-control-plane.sh 33 passed 0 failed.
+
+## 2026-10-19T16:47Z (CoS) v11.17.99
+- 11.17.99: one batched release per founder directive. FC-WALL-PROOF-PACKAGE-BLIND (opus APPROVE r2), FC-REVIEWER-GIT-CONFIG-EXEC (opus APPROVE r3), engine10 budget fix, plus CI pruned to release.yml (1fc608f34). Targeted suites 203 pass 0 fail; tests/util 476/0; tsc clean. Full bun suite hung past 1700s (no verdict).