loki-mode 11.2.1 → 11.3.0

package/autonomy/provider-offer.sh

@@ -401,10 +401,10 @@ _provider_gate_emit_blocked() {
 
 # render_provider_availability: print the "Provider Availability" doctor section.
 #
-# WHY IT LIVES HERE. `loki doctor` stdout is compared byte for byte between the
-# bash route and the Bun route (tests/test-doctor-blocker-parity.sh, and the
-# bun-parity workflow). Two independent renderers drift; one shared renderer
-# cannot. This is the same parity-by-construction seam the install offer and the
+# WHY IT LIVES HERE. The provider priority order lives in ONE bash function;
+# doctor (the Bun implementation, loki-ts/src/commands/doctor.ts) calls this
+# rather than carrying a second copy. Two independent renderers drift; one shared
+# renderer cannot. This is the same parity-by-construction seam the install offer and the
 # detect-sdk probe already use, so doctor.ts calls this instead of reimplementing
 # the priority list in TypeScript.
 #

package/bin/loki

@@ -537,6 +537,20 @@ if [ "${1:-}" = "doctor" ]; then
             exec "$BASH_CLI" "$@"
         fi
     done
+    # FC-DUP: bun is the single doctor. A crashing or missing Bun route must not
+    # leave the user with a stack trace and no verdict, so preflight it here and
+    # fall to bash, whose cmd_doctor prints the minimal diagnostic and exits 1.
+    # Uses the _loki_bun resolver (PATH, then @oven/bun-*), not bare `command -v`.
+    _doctor_bun="$(_loki_bun)"
+    if [ -z "$_doctor_bun" ] || [ -z "${BUN_CLI:-}" ]; then
+        exec "$BASH_CLI" "$@"
+    fi
+    _doctor_t=$(command -v timeout || command -v gtimeout || true)
+    if [ -n "$_doctor_t" ]; then
+        "$_doctor_t" -k 1 5 "$_doctor_bun" "$BUN_CLI" version >/dev/null 2>&1 || exec "$BASH_CLI" "$@"
+    else
+        "$_doctor_bun" "$BUN_CLI" version >/dev/null 2>&1 || exec "$BASH_CLI" "$@"
+    fi
 fi
 
 # CLI consolidation (Phase B): `report kpis` is the canonical form of the

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "11.2.1"
+__version__ = "11.3.0"
 
 # Expose the control app for easy import
 try:

package/docs/CLI-REFERENCE.md

@@ -1,6 +1,6 @@
 # CLI reference
 
-Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.2.1. Do not edit by hand.
+Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.3.0. Do not edit by hand.
 Hidden and legacy-only commands are omitted; see `docs/v10/CLI-MODERN.md` for the full inventory.
 
 | Command | Description |

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 The flagship product of [Autonomi](https://www.autonomi.dev/). Loki Mode is a spec-driven autonomous builder with a built-in trust layer that takes any spec to a deployed product and verifies completion with evidence (quality gates plus a completion council), not just a "done" claim. Complete installation instructions for all platforms and use cases.
 
-**Version:** v11.2.1
+**Version:** v11.3.0
 
 **Engine note:** `loki "<task>"`, `loki owner/repo#N` and `loki quick` run the Loki 10 engine. `loki start` still routes to the legacy engine, which is being removed (planned work resumes 2026-10-07); prefer `loki owner/repo#N`. See [docs/v10/GUIDE.md](v10/GUIDE.md).
 

package/docs/KNOWN-ISSUES.md

@@ -11,7 +11,6 @@ autonomy/loki: line 14066: status: command not found
 **Not user-affecting, and not a JSON defect.** stdout is 5176 bytes of valid
 JSON; only stderr is polluted. Every `doctor --json` assertion in the repo
 discards stderr (`tests/test-airgap-commands.sh:50`,
-`tests/test-doctor-blocker-parity.sh:129,132`,
 `tests/test-doctor-ci-gateable.sh:46,84,86`).
 `tests/test-e2e-features.sh:104` was the lone outlier using `2>&1` and has been
 brought into line.

package/docs/v10/ADOPTION-PLAN.md

@@ -235,11 +235,11 @@ Architect: opus. Source: the founder directive (2026-09-30, from building to pro
   - The last line is exactly one of:
     - `Ready: <provider> (<model>), receipts signed (kid <8>)`
     - the one blocking reason.
-- Files: loki-ts/src/commands/doctor.ts, autonomy/loki (cmd_doctor only, for bash parity), loki-ts/tests/commands/doctor.test.ts, tests/test-doctor-providers.sh, tests/test-doctor-optional-skill-not-blocking.sh, tests/test-doctor-blocker-parity.sh.
+- Files: loki-ts/src/commands/doctor.ts, autonomy/loki (cmd_doctor only, for bash parity), loki-ts/tests/commands/doctor.test.ts, tests/test-doctor-providers.sh, tests/test-doctor-optional-skill-not-blocking.sh, tests/test-doctor-single-impl.sh (replaces the deleted tests/test-doctor-blocker-parity.sh).
 - Wall check:
   - A HOME with a broken ~/.cline skill symlink and LOKI_PROVIDER=claude: doctor exits 0 and prints one Ready line.
   - With claude missing, it exits non-zero and names the blocker.
-- Commands: `cd loki-ts && bun test tests/commands/doctor.test.ts && cd .. && bash tests/test-doctor-providers.sh && bash tests/test-doctor-optional-skill-not-blocking.sh && bash tests/test-doctor-blocker-parity.sh`
+- Commands: `cd loki-ts && bun test tests/commands/doctor.test.ts && cd .. && bash tests/test-doctor-providers.sh && bash tests/test-doctor-optional-skill-not-blocking.sh && bash tests/test-doctor-single-impl.sh`
 - Tier: MEDIUM. Budget: net 0 or less.
 - Depends: A-122 (doctor.ts, autonomy/loki). Wave 3.
 

package/docs/v10/FAILURE-CLASSES.md

@@ -344,6 +344,9 @@ L0 review rule (ENGINE-LAWS.md L0): a fix that adds an `if` or a regex about the
 - Siblings: swept every place Loki writes an install-time path. Provider skill links ~/.claude, ~/.codex, ~/.cline, ~/.aider skills/loki-mode (all four covered by the shared mechanism); `cmd_remote` ln -sf of the Claude skill link in autonomy/loki (only creates when SKILL.md is absent, covered by the same repair on the next run); shell completions via `completion --postinstall` and the shim (already self-healing, stamped by VERSION in ~/.loki/completions-version); no PATH shims or bin links are written by Loki (the package manager owns bin/loki). Real directories and foreign links are deliberately left to doctor.
 - Mechanism of the fix: autonomy/lib/skill-link-heal.sh `loki_skill_link_heal` repoints a symlink only when its target is a Loki install path (node_modules/loki-mode or a Homebrew loki-mode dir) that is missing or is a different install than the running one, and only when the running root is itself an install path. Atomic temp link plus rename, one stderr line, silent no-op when correct, LOKI_NO_SKILL_LINK_HEAL=1 opts out. Called from bin/loki-postinstall.js (install and upgrade) and the bin/loki shim (first run).
 - Fixture: tests/test-skill-link-heal.sh (dangling, other install, real dir, foreign link, correct link, opt-out, dev checkout), red before autonomy/lib/skill-link-heal.sh existed.
+- Amendment (FC30-DURABLE): the repair repointed to WHATEVER install was running, so a one-off `npx loki-mode@x` or a scratch-prefix install would hijack the user's link to a path that later disappears and dangles again. Rule: repoint only when the running install is durable (under `npm root -g`, the bun global dir, or a Homebrew prefix). An npx cache (_npx), a temp dir or any other prefix is refused with one stderr line and the link is left untouched. The rule lives only in autonomy/lib/skill-link-heal.sh (`_loki_skill_root_durable`); there is no TS copy, and bin/loki-postinstall.js and the bin/loki shim both call it. The check runs only on the repair path, so the steady state stays subprocess-free.
+- Amendment siblings swept: other Loki writers that derive a user-owned path from the running install location: `cmd_remote` ln -sf of the Claude skill link (creates only when SKILL.md is absent; shares the same later repair, no repoint from the running root); shell completions (stamped by VERSION, content not install-path dependent); no PATH shim or bin link is written by Loki. No other self-repair writes from the running root.
+- Amendment fixture: tests/test-skill-link-heal.sh cases 8-12 (npx cache refused, temp or arbitrary prefix refused, brew prefix healed, bun global healed, foreign link untouched), red on the npx and temp cases before the fix (11 passed, 2 failed), with npm stubbed and HOME and HOMEBREW_PREFIX faked.
 
 ## FC-31 A slice gate skips the suites that guard its own files, and main goes red in Tier B
 - User saw: main 27447cf46 failed Tier B on tests/test-doctor-blocker-parity.sh (run 37697291383). The slice R1-20 (8ff988516) changed loki-ts/src/commands/doctor.ts and gated only on tsc and bun test. The local-ci fast tier had timed out (rc=124) on a loaded host, so no shell suite ran.
@@ -360,3 +363,21 @@ L0 review rule (ENGINE-LAWS.md L0): a fix that adds an `if` or a regex about the
 - Mechanism (this slice, minimal): the parity test discovers greps with `type -ap grep ggrep` (no absolute paths); the three files are added to Dockerfile.control-plane. 11.2.2 follow-up (root fix): replace the hand-maintained COPY list with a directory COPY or a generated list, make CP-04 build the image and import the bundle, and extend scripts/select-tests.sh so a touched tests/*.sh selects the hardcoded-path and structural-checks suites and a loki-ts/src file reachable from packages/control-plane selects CP-04.
 - Siblings swept: tests/test-no-hardcoded-paths.sh scans every tests/ file (3 passed, 0 failed after the fix); the CP-04 closure guard covers every loki-ts/src value import (25 passed, 0 failed); no other hits.
 - Fixture: the two existing guards, red on 6a01413bd and green here.
+
+## FC-33 Duplicate implementations kept in sync by tests (FC-DUP)
+- User saw: `loki doctor` printed different checks, counts and verdicts depending on the route (bash vs bun), which `bin/loki` picks from bun on PATH, LOKI_LEGACY_BASH, a missing dist, LOKI_TS_ENTRY or `--airgap`. Two parity tests (test-doctor-blocker-parity.sh, test-doctor-install-integrity-parity.sh) existed only to keep the two copies equal, and each new doctor check had to be written twice. Raw Claude Code has one doctor.
+- Law: L2 (one verdict has one author), L0 (the harness must not hold two answers to one question).
+- Siblings (twin sweep):
+  - Command twins and their guards: version, provider, memory (loki-ts/tests/all-ported.test.ts); stats (tests/test-bash-bun-parity.sh check 6); proof verify (loki-ts/tests/proof_verify_parity.test.ts); crash (crash.test.ts:308); status (status.test.ts:398); rollback, trust, wiki (unguarded).
+  - Runner twins: run.sh vs loki-ts/src/runner, guarded by test-bash-bun-parity.sh, test-parity-*.sh, the gate-failures-cap parity test and test-pricing-parity. goal_score.ts vs run.sh has NO guard. These collapse when the D57 default-loop flip lands.
+- Mechanism: `_loki_bun_delegate <cmd> "$@"` in autonomy/loki (bun resolved PATH then @oven/bun-*, dist then src, `version` preflight under 5s, then exec). Doctor is the first command moved onto it; bash keeps only a minimal "bun route unavailable" diagnostic. `cmd_control` is the precedent. Remaining twins move onto the same helper as their slices land.
+- Known gap: the delegate preflight only runs `<cli> version`. A throw inside doctor.ts AFTER the CLI loads (during the doctor run itself) is not covered by the preflight and surfaces as that crash, not the minimal fallback.
+- Fixture: tests/test-doctor-single-impl.sh.
+
+## FC-34 Test imports a temp copy of src in-process under bun --coverage
+- User saw: Tier B on main 83109bc1a failed in "Bun tests on ubuntu-latest bun=1.3.13" (`cd loki-ts && bun test --coverage`): every test printed (pass), no (fail) line and no summary, the output stopped mid coverage table and the job ended "exit code 1". The table was full of /tmp/loki-rmx-*/src/... rows. Raw view: a green test list with a dead process.
+- Law: L2 (a verdict must be produced by the runner, not lost with it), L0 (the harness must not depend on a reporter surviving deleted files).
+- Cause (measured): loki-ts/tests/engine10/route_matrix_mutation.test.ts (e49c7d29f) copies src into a mkdtemp dir 31 times and route_matrix_lib.ts matrixViolations(root) dynamically imports those copies in the test process; afterAll removes the dirs before the coverage reporter reads them. macOS exits 0 but prints 2170 loki-rmx rows; Linux died after 4 dirs.
+- Siblings swept: grep of loki-ts/tests and loki-ts/test for in-process dynamic imports from tmp/mkdtemp roots and for cpSync tests that import. Only route_matrix_lib.ts (lines 57-60, 178-179) imports from a variable root. graph.test.ts and providers.test.ts copy fixtures, not src; providers.test.ts imports real src inside a spawned script. route_matrix.test.ts passes the real src dir, which coverage tracks normally. No other hits.
+- Mechanism: the mutation test evaluates each copy through `Bun.spawn([process.execPath, route_matrix_child.ts, root])` (no --coverage), reading violations as JSON. A non-zero exit or unparsable output throws, so a crashed child can never pass a red case or the control case vacuously.
+- Fixture: the "FC-34 guard" describe block in loki-ts/tests/engine10/route_matrix_mutation.test.ts (red when the file imports route_matrix_lib in-process or does `await import(join(root` against a temp root; verified red by reverting the fix locally).