loki-mode 11.3.1 → 11.3.2

package/SKILL.md

@@ -3,9 +3,9 @@ name: loki-mode
 description: An autonomous software factory that knows what it is supposed to deliver, and proves it did. Use when the user says Loki Mode or asks to build, fix or verify software autonomously.
 ---
 
-# Loki Mode v11.3.1
+# Loki Mode v11.3.2
 
-**Current entry points (Loki 10 engine):** `loki "<task>"`, `loki owner/repo#N` and `loki quick "<task>"` run the Loki 10 engine and end with a signed receipt (`loki verify`). `loki backlog owner/repo --all` runs many issues in parallel. Guide: `docs/v10/GUIDE.md`. The skill instructions below, and `loki start`, describe the legacy engine, which still ships and is being removed (`loki start owner/repo#N` still routes to it; prefer `loki owner/repo#N`).
+**Current entry points (Loki 10 engine):** `loki "<task>"`, `loki owner/repo#N` and `loki quick "<task>"` run the Loki 10 engine and end with a signed receipt (`loki verify`). `loki backlog owner/repo --all` runs many issues in parallel. Guide: `docs/v10/GUIDE.md`. The skill instructions below, and `loki start`, describe the previous bash loop. PRD-file starts (`loki start ./prd.md`) and the opencode provider still run on it until FC38-SWEEP ports them; the legacy-engine command and the LOKI_ENGINE switch remain removed. Prefer `loki owner/repo#N` for issues.
 
 **You are an autonomous agent. You make decisions. You do not ask questions. You do not stop.**
 
@@ -200,7 +200,7 @@ This protocol governs **skill module** loading -- task-scoped instruction files
 <!-- generated:commands -->
 Commands (generated from `loki-ts/src/cli/registry.ts`; full reference in `docs/CLI-REFERENCE.md`):
 
-`version`, `status`, `doctor`, `provider`, `memory`, `rollback`, `proof`, `wiki`, `control`, `kpis`, `report`, `trust`, `crash`, `contract`, `start`, `slack`, `queue`, `answer`, `engine10`, `help`, `quick`, `quickstart`, `init`, `template`, `verify`, `keys`, `review`, `dashboard`, `config`, `mcp`, `acp`, `stop`, `pause`, `resume`, `why`, `next`, `logs`, `ship`, `deploy`, `import`, `github`, `issue`, `ci`, `modernize`, `share`, `assets`, `export`, `notify`, `tour`, `welcome`, `onboard`, `setup-skill`, `self-update`, `remote`, `cockpit`, `code`, `context`, `secrets`, `api`, `sandbox`, `docker`, `web`, `preview`, `telemetry`, `syslog`, `explain`, `docs`, `test`, `bench`, `voice`, `own`, `secure`, `compliance`, `enterprise`, `projects`, `audit`, `cost`, `metrics`, `sentrux`, `magic`
+`version`, `status`, `doctor`, `provider`, `memory`, `rollback`, `proof`, `wiki`, `control`, `kpis`, `report`, `trust`, `crash`, `contract`, `start`, `slack`, `queue`, `issues`, `undo`, `verify-pr`, `answer`, `engine10`, `help`, `quick`, `quickstart`, `init`, `template`, `verify`, `keys`, `review`, `dashboard`, `config`, `mcp`, `acp`, `stop`, `pause`, `resume`, `why`, `next`, `logs`, `ship`, `deploy`, `import`, `github`, `issue`, `ci`, `modernize`, `share`, `assets`, `export`, `notify`, `tour`, `welcome`, `onboard`, `setup-skill`, `self-update`, `remote`, `cockpit`, `code`, `context`, `secrets`, `api`, `sandbox`, `docker`, `web`, `preview`, `telemetry`, `syslog`, `explain`, `docs`, `test`, `bench`, `voice`, `own`, `secure`, `compliance`, `enterprise`, `projects`, `audit`, `cost`, `metrics`, `sentrux`, `magic`
 <!-- /generated -->
 
 ---
@@ -483,4 +483,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v11.3.1 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**
+**v11.3.2 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**

package/VERSION

@@ -1 +1 @@
-11.3.1
+11.3.2

package/autonomy/lib/efficiency_cost.py

@@ -192,6 +192,9 @@ def collect_efficiency(loki_dir):
     # real observation, and nulling it would be its own dishonesty (existing
     # contract: test_genuine_zero_cost_stays_zero_not_null). What is unknown is a
     # record that never carried the field at all.
+    # FC-44: a record flagged tokens_measured:false (an ambiguous resumed session) carries no usage keys. One of them makes every
+    # token total NOT RECORDED (None); the flag keys are added only then, so a complete run's dict is unchanged.
+    _unmeasured_tokens = sum(1 for r in _records if r.get("tokens_measured") is False)
     _any_cost = any("cost_usd" in r for r in _records)
     _missing_cost = sum(1 for r in _records if "cost_usd" not in r)
     if collected and _observed:
@@ -208,6 +211,11 @@ def collect_efficiency(loki_dir):
             # Some records priced, others not: the total is a LOWER BOUND.
             cost["cost_partial"] = _missing_cost > 0
             cost["cost_unpriced_records"] = _missing_cost
+        if _unmeasured_tokens:
+            for key in ("input_tokens", "output_tokens", "cache_read_tokens", "cache_creation_tokens"):
+                cost[key] = None
+            cost["tokens_partial"] = True
+            cost["tokens_unmeasured_records"] = _unmeasured_tokens
     else:
         # No record means unavailable, never an observed zero.
         for key in (

package/autonomy/lib/engine10-push.sh

@@ -1,7 +1,8 @@
 #!/usr/bin/env bash
 # Loki 10 engine P4 push child (ENGINE.md sections 6 and 7).
 #
-#   engine10-push.sh push-pr <repo-dir> <branch> <title> <body-file> [--draft]
+#   engine10-push.sh push-pr <repo-dir> <branch> <title> <body-file> [--draft] [--base <branch>]
+#   engine10-push.sh check-origin   (exit 0 when the pinned origin is acceptable to push-pr, else the refusal; no network)
 #   engine10-push.sh comment <pr-number> <body-file>
 #   engine10-push.sh issue-comment <issue-ref> <body-file>
 #   engine10-push.sh status  <sha> <pending|success|failure|error> <description>
@@ -111,13 +112,26 @@ _e10_gh() { _loki_with_github_tokens _loki_run_neutral "$_e10_repo" command gh "
 mode="${1:-}"
 shift || true
 case "$mode" in
+    check-origin)
+        # The origin validation above already ran and died on a refusal; reaching here means push-pr would accept it.
+        exit 0
+        ;;
     push-pr)
-        [ "$#" -ge 4 ] && [ "$#" -le 5 ] || die "usage: push-pr <repo-dir> <branch> <title> <body-file> [--draft]"
-        dir="$1" branch="$2" title="$3" body="$4" draft=()
-        if [ "$#" -eq 5 ]; then
-            [ "$5" = "--draft" ] || die "unknown flag: $5"
-            draft=(--draft)
-        fi
+        [ "$#" -ge 4 ] && [ "$#" -le 7 ] || die "usage: push-pr <repo-dir> <branch> <title> <body-file> [--draft] [--base <branch>]"
+        dir="$1" branch="$2" title="$3" body="$4" draft=() base=()
+        shift 4
+        # MASS-2: --base stacks the PR on a parent slice's branch; a name git would not accept is refused.
+        while [ "$#" -gt 0 ]; do
+            case "$1" in
+                --draft) draft=(--draft); shift ;;
+                --base)
+                    [ "$#" -ge 2 ] || die "--base needs a branch"
+                    case "$2" in -* | '') die "invalid base branch: $2" ;; esac
+                    git check-ref-format --branch "$2" >/dev/null 2>&1 || die "invalid base branch: $2"
+                    base=(--base "$2"); shift 2 ;;
+                *) die "unknown flag: $1" ;;
+            esac
+        done
         [ -f "$body" ] || die "body file not found: $body"
         if [ -n "$_e10_local" ]; then
             _e10_local_push "$dir" "$branch" || die "push refused or failed (rc=$?)"
@@ -128,7 +142,7 @@ case "$mode" in
         url="$(_e10_gh pr list --repo "$_e10_repo" --head "$branch" --state open --json url --jq '.[0].url')" \
             || die "gh pr list failed"
         if [ -z "$url" ] || [ "$url" = "null" ]; then
-            url="$(_e10_gh pr create --repo "$_e10_repo" --head "$branch" --title "$title" --body-file "$body" "${draft[@]}")" \
+            url="$(_e10_gh pr create --repo "$_e10_repo" --head "$branch" --title "$title" --body-file "$body" "${draft[@]}" "${base[@]}")" \
                 || die "gh pr create failed"
             url="$(printf '%s\n' "$url" | tail -n 1)"
         fi

package/autonomy/loki

@@ -1691,6 +1691,22 @@ _help_answer() {
     echo "and sets LOKI_NO_BROWSER=1."
 }
 
+# `loki help verify-pr`: a Bun-only command (loki-ts), so its help lives here.
+_help_verify_pr() {
+    echo -e "${BOLD}loki verify-pr${NC} - Verify a PR against its linked issue (experimental, LOKI_VERIFY_PR=1)"
+    echo ""
+    echo "Usage: loki verify-pr <https://github.com/o/r/pull/N | o/r#N> [--out DIR]"
+    echo ""
+    echo "Derives a check from the PR's linked issue (Check: \`cmd\` or a loki-check fence)."
+    echo "VERIFIED only if the check fails on the PR base, passes on its head, and the"
+    echo "touched packages' suites pass. A PR with no linked issue, no check, a removed"
+    echo "test or a non-discriminating check is NOT PROVEN. Writes verify-pr-result.json."
+    echo "PR code runs only in the container sandbox (scripts/verify-pr-sandbox.sh); set"
+    echo "LOKI_VPR_IMAGE to a locally present image."
+    echo ""
+    echo "Exit codes: 0 verified, 2 usage or sandbox blocked, 4 not proven."
+}
+
 # Appended to `loki help verify`: the v10 DSSE export flag (docs/exit-codes.md).
 _help_verify_dsse() {
     echo ""
@@ -1763,6 +1779,7 @@ show_help() {
     echo "  review [opts]    Standalone code review with quality gates"
     echo "  ultracode \"task\" Run a task as a native Claude Code Dynamic Workflow (opt-in, Claude-only)"
     echo "  trust [cmd]      Visible trust trajectory; 'trust detail' for metrics"
+    echo "  undo <run> [--plan]  Plan or apply (LOKI_UNDO=1) an undo of a run; verifies the receipt"
     echo ""
     echo "Observe:"
     echo "  dashboard [cmd]  Operations UI server (start|stop|status|url|open)"
@@ -1798,13 +1815,9 @@ show_help() {
     echo ""
     echo "Options for 'start':"
     echo "  --provider NAME  AI provider: claude (default), codex, cline, aider, opencode"
-    echo "  --parallel       Enable parallel mode with git worktrees"
-    echo "  --bg, --background  Run in background mode"
     echo "  --simple         Force simple complexity tier (3 phases)"
     echo "  --complex        Force complex complexity tier (8 phases)"
-    echo "  --github         Enable GitHub issue import"
     echo "  --no-dashboard   Disable web dashboard"
-    echo "  --sandbox        Run in Docker sandbox for isolation (default: off; requires Docker)"
     echo "  --isolation LVL  Per-run isolation dial: none (default) | worktree | docker"
     echo "  --skip-memory    Skip loading memory context at startup"
     echo "  --fresh-prd      Regenerate the PRD from the codebase (no-PRD runs; ignores the reusable generated PRD)"
@@ -1824,8 +1837,6 @@ show_help() {
     echo "  loki start ./prd.md           # Start with PRD file"
     echo "  loki start owner/repo#123     # GitHub issue (auto-fetches)"
     echo "  loki start PROJ-456           # Jira issue"
-    echo "  loki start --bg ./prd.md      # Start in background"
-    echo "  loki start --parallel ./prd.md   # Parallel mode (git worktrees)"
     echo "  loki quick \"add dark mode\"  # Single-task mode (Loki 10 engine)"
     echo "  loki tour                     # See a real sample result (no provider, no key, no spend)"
     echo "  loki demo                     # Build a sample todo app end to end"
@@ -1898,7 +1909,7 @@ show_help() {
     echo "  merge resume review rollback run sandbox secrets secure self-update sentrux"
     echo "  serve setup-skill share ship spec start state stats status steer stop"
     echo "  syslog telemetry template test tour trigger trust trust-metrics"
-    echo "  ultracode update verify version voice watch watchdog web welcome why"
+    echo "  ultracode undo update verify version voice watch watchdog web welcome why"
     echo "  wiki workspace worktree (wt)"
     echo "  control"
     echo ""
@@ -2563,17 +2574,13 @@ cmd_start() {
                 echo "                        Token from LOKI_REMOTE_TOKEN / LOKI_REMOTE_TOKEN_FILE"
                 echo "                        (never an argument). Env: LOKI_REMOTE_URL."
                 echo "  --provider NAME       AI provider: claude (default), codex, cline, aider, opencode"
-                echo "  --parallel            Enable parallel mode with git worktrees"
                 echo "  --allow-haiku         Enable Haiku model for the fast tier (default: disabled)"
-                echo "  --bg, --background    Run in background mode"
                 echo "  --simple              Force simple complexity tier (3 phases)"
                 echo "  --complex             Force complex complexity tier (8 phases)"
-                echo "  --github              Enable GitHub issue import"
                 echo "  --no-dashboard        Disable web dashboard"
                 echo "  --api                 Start dashboard API server alongside the build"
-                echo "  --sandbox             Run in Docker sandbox (default: off; requires Docker)"
                 echo "  --isolation LEVEL     Per-run isolation: none (default) | worktree | docker."
-                echo "                        Unified dial; --parallel = worktree, --sandbox = docker."
+                echo "                        Unified dial."
                 echo "  --attempts N          Run N (1-5, default 1) independent attempts in separate git worktrees;"
                 echo "                        the most executed passing checks wins, losers are recorded on the receipt"
                 echo "  --skip-memory         Skip loading memory context at startup"
@@ -2608,7 +2615,6 @@ cmd_start() {
                 echo "  --worktree, -w        Git worktree isolation (separate branch)"
                 echo "  --pr                  Worktree + auto-create PR"
                 echo "  --ship                Worktree + PR + auto-merge"
-                echo "  --detach, -d          Run in background"
                 echo ""
                 echo "Preview without spending (any input mode):"
                 echo "  loki plan <PRD>       Analyze a spec WITHOUT executing: complexity,"
@@ -2637,7 +2643,6 @@ cmd_start() {
                 echo "  loki start 123                          # ISSUE mode (current repo GitHub issue)"
                 echo "  loki start PROJ-456                     # ISSUE mode (Jira)"
                 echo "  loki start owner/repo#789               # ISSUE mode (GitHub specific repo)"
-                echo "  loki start --prd ./prd.md --parallel    # Explicit PRD, parallel mode"
                 echo "  loki start --issue 123 --ship           # Explicit issue, full automation"
                 echo "  loki start --provider codex             # Use OpenAI Codex CLI"
                 echo "  loki start --bmad-project ./my-project  # Start from BMAD artifacts"
@@ -6424,22 +6429,35 @@ except Exception:
         fi
     fi
 
-    # v7.82: completion-aware one-liner. When a finished run left a completion
-    # record, show its outcome and point at \`loki why\` for the full story. Reads
-    # the persisted completion.json (no recompute); silent when absent.
-    if [ -f "$LOKI_DIR/state/completion.json" ]; then
-        local last_outcome
-        last_outcome=$(_LOKI_CJ="$LOKI_DIR/state/completion.json" python3 -c "
-import json, os
+    # 133-F4: newest sealed receipt's verdict, read from the receipt field only
+    # (never recomputed). Missing, empty or unparseable receipts never read as
+    # VERIFIED. This replaces the old completion.json one-liner (Bun never had it).
+    local receipt_line
+    receipt_line=$(_LOKI_RUNS="$LOKI_DIR/runs" python3 -c "
+import json, os, re
+runs = os.environ['_LOKI_RUNS']
 try:
-    d = json.load(open(os.environ['_LOKI_CJ']))
-    print(d.get('outcome', '') or '')
+    ids = sorted(d for d in os.listdir(runs) if os.path.isdir(os.path.join(runs, d)))
 except Exception:
-    print('')" 2>/dev/null)
-        if [ -n "$last_outcome" ]; then
-            echo -e "${DIM}Last run: ${last_outcome} - run 'loki why' for details${NC}"
-        fi
-    fi
+    ids = []
+if not ids:
+    print('Last run: no receipt (verdict NOT AVAILABLE)')
+else:
+    try:
+        d = json.load(open(os.path.join(runs, ids[-1], 'receipt.json')))
+        v = d['verdict']
+        h = d['receipt_sha256']
+        if not (isinstance(v, str) and re.fullmatch(r'[A-Z_]+', v) and isinstance(h, str)):
+            raise ValueError
+        h = h[7:] if h.startswith('sha256:') else h
+        if not re.fullmatch(r'[0-9a-f]{12,}', h):
+            raise ValueError
+        print('Last run: %s (receipt sha256:%s)' % (v, h[:12]))
+    except Exception:
+        print('Last run: receipt unreadable')
+" 2>/dev/null)
+    [ -n "$receipt_line" ] || receipt_line="Last run: receipt unreadable"
+    echo -e "${DIM}${receipt_line}${NC}"
 
     echo ""
     echo -e "${DIM}  Tip: loki analyze context show   - detailed token breakdown${NC}"
@@ -12394,6 +12412,9 @@ cmd_export() {
             echo "  csv        Task queue as CSV"
             echo "  timeline   Iteration timeline as JSON"
             echo ""
+            echo "Flags:"
+            echo "  --sarif [run-id]   Write .loki/runs/<id>/findings.sarif (SARIF 2.1.0; needs bun)"
+            echo ""
             echo "Examples:"
             echo "  loki export json                         # Print to stdout"
             echo "  loki export json session-export.json     # Save to file"
@@ -12416,6 +12437,10 @@ cmd_export() {
             require_jq || return 1
             _export_timeline "$output_path"
             ;;
+        --sarif)
+            echo -e "${RED}loki export --sarif needs bun (https://bun.sh).${NC}" >&2
+            return 1
+            ;;
         *)
             echo -e "${RED}Unknown format: $format${NC}"
             echo "Supported: json, markdown, csv, timeline"
@@ -21201,6 +21226,11 @@ main() {
         mcp)
             cmd_mcp "$@"
             ;;
+        undo)
+            # UNDO-1: Bun-only (verifies the receipt with the Bun verifier); bin/loki routes here only when bun is absent.
+            echo "loki undo needs the Bun runtime (install bun, then re-run: loki undo <run-id> --plan)" >&2
+            exit 2
+            ;;
         acp)
             # ACP agent over stdio; stdout is protocol-only. See docs/acp-editors.md.
             LOKI_ACP_LOKI="${LOKI_ACP_LOKI:-$_LOKI_SCRIPT_DIR/loki}" exec python3 "$_LOKI_SCRIPT_DIR/acp-agent.py"
@@ -21413,6 +21443,8 @@ main() {
                             show_help
                         elif [ "$_help_target" = "answer" ]; then
                             _help_answer
+                        elif [ "$_help_target" = "verify-pr" ]; then
+                            _help_verify_pr
                         else
                             LOKI_HELP_ONLY=1 "$0" "$_help_target" --help "$@"
                             local _help_rc=$?
@@ -30164,7 +30196,7 @@ except: pass
 
     # Detect shell scripts
     local shell_count=0
-    shell_count=$(find "$target_path" -maxdepth 2 -name "*.sh" -type f 2>/dev/null | wc -l | tr -d ' ')
+    shell_count=$(find "$target_path" -maxdepth 2 -name "*.sh" -type f 2>/dev/null | wc -l | tr -d ' ' || true)
     if [ "$shell_count" -gt 0 ]; then
         languages="$languages Bash"
     fi
@@ -30602,7 +30634,7 @@ Files: $src_count source, $test_count test, $doc_count docs"
                 if [ -d "$target_path/$dir" ]; then
                     # Count files in directory
                     local dir_count
-                    dir_count=$(echo "$tree_output" | grep "^${dir}/" | wc -l | tr -d ' ')
+                    dir_count=$(echo "$tree_output" | grep "^${dir}/" | wc -l | tr -d ' ' || true)
                     output="$output
 $dir/    ($dir_count files)"
                 else

package/bin/loki

@@ -467,6 +467,21 @@ if [ "${1:-}" = "start" ]; then
     unset _loki_att_args _loki_att_n _loki_att_skip _loki_att_a
 fi
 
+# SPEC-FIRST-INTENT: `start --spec FILE` and `start --spec-first` are parsed by the Bun start command,
+# which forwards them to engine10; they never reach the positional-task route or the legacy loop.
+if [ "${1:-}" = "start" ]; then
+    for _loki_sp_a in "${@:2}"; do
+        case "$_loki_sp_a" in
+            --spec|--spec=*|--spec-first)
+                _lb=$(_loki_bun)
+                [ -n "$_lb" ] || { echo "loki: --spec needs bun (install from https://bun.sh)." >&2; exit 1; }
+                exec "$_lb" "$BUN_CLI" "$@"
+                ;;
+        esac
+    done
+    unset _loki_sp_a
+fi
+
 # Loki 10 engine (D29, the only engine from 11.0.0). Routes `loki "<task>"`,
 # `loki owner/repo#N`, `loki quick "<task>"`, `keys` and `verify --pubkey` to engine10.
 # shellcheck disable=SC2194
@@ -477,6 +492,13 @@ case "v10" in
         _e10_args=("$@")
         case "${1:-}" in
             keys) _e10=1; _e10_hard=1 ;;
+            # SARIF-2: `export --sarif` has no bash implementation; it runs on bun only.
+            export)
+                for _sa in "$@"; do
+                    case "$_sa" in --sarif) _e10=1; _e10_hard=1; _e10_args=(export-sarif "${@:2}") ;; esac
+                done
+                unset _sa
+                ;;
             status|verify|dashboard)
                 if [ "$1" = "verify" ]; then
                     for _pk in "$@"; do
@@ -495,6 +517,13 @@ case "v10" in
                     unset _r10 _p10 _d
                 fi
                 ;;
+            # SPEC-FIRST-INTENT: only `plan ... --spec` is a v10 command; every other plan call stays on the legacy CLI.
+            plan)
+                for _pa in "$@"; do
+                    [ "$_pa" = "--spec" ] && { _e10=1; _e10_hard=1; }
+                done
+                unset _pa
+                ;;
             ""|-*) _e10=0 ;;
             # quick: the lean small path, no PR (legacy quick never opened one). A flag-first
             # call (--help, -v) stays on the legacy quick.
@@ -710,7 +739,7 @@ fi
 # Two-token routes (provider show/list, memory list/index) match on the first
 # token only; the Bun dispatcher handles subcommand routing internally.
 case "${1:-}" in
-    version|--version|-v|status|stats|doctor|provider|memory|rollback|internal|kpis|trust|proof|receipt|wiki|crash|control|contract|slack|queue|answer|completion|__complete)
+    version|--version|-v|status|stats|doctor|provider|memory|rollback|internal|kpis|trust|proof|receipt|wiki|crash|control|contract|slack|queue|issues|answer|undo|verify-pr|completion|__complete)
         # v7.5.2: rollback added (wires loki-ts/src/commands/rollback.ts).
         # v7.5.3: internal added for autonomy/run.sh phase1-hooks calls.
         # v7.5.28: kpis added (Phase K MVP: read-only KPI snapshot).

package/completions/_loki

@@ -209,7 +209,10 @@ function _loki_commands {
         'otel:OpenTelemetry management'
         'wiki:Wiki commands'
         'answer:Resume a BLOCKED run with an answer'
+        'verify-pr:Verify a PR against its linked issue in a sandbox'
         'queue:Overnight issue queue with a morning digest'
+        'issues:Run every open issue in a repo and open PRs'
+        'undo:Show what undoing a run would do (read-only plan)'
         'control:Control plane (preview, LOKI_CONTROL=1)'
         'workspace:Multi-project workspaces (preview, LOKI_WORKSPACES=1)'
         'backlog:Run every matching open issue, N in parallel'
@@ -337,6 +340,9 @@ function _loki_memory {
         'pattern:Manage patterns'
         'skill:Manage skills'
         'vectors:Vector search'
+        'lessons:List PR lessons (--json)'
+        'learn:Learn from a merged PR'
+        'forget:Delete a PR lesson'
         'help:Memory help'
     )
     _describe -t cmds 'memory subcommand' cmds

package/completions/loki.bash

@@ -5,7 +5,7 @@ _loki_completion() {
     _init_completion || return
 
     # Main subcommands (must match autonomy/loki main case statement)
-    local main_commands="start backlog quick monitor demo tour welcome init stop pause resume steer status next ship dashboard web serve api sandbox notify import github issue intent config provider reset memory compound checkpoint council dogfood projects enterprise secrets cockpit secure own handoff doctor watchdog audit metrics syslog onboard share proof receipt outcomes explain plan report cost estimate kpis stats test ci watch telemetry agent context ctx code run export review optimize heal modernize migrate cluster worktree wt trigger failover remote deploy docker mcp magic assets analyze compliance crash control workspace open otel preview quickstart rc rollback merge self-update sentrux setup-skill spec state template trust trust-metrics ultracode update verify voice why wiki bench cleanup logs grill docs cp version completions help keys answer queue acp"
+    local main_commands="start backlog quick monitor demo tour welcome init stop pause resume steer status next ship dashboard web serve api sandbox notify import github issue intent config provider reset memory compound checkpoint council dogfood projects enterprise secrets cockpit secure own handoff doctor watchdog audit metrics syslog onboard share proof receipt outcomes explain plan report cost estimate kpis stats test ci watch telemetry agent context ctx code run export review optimize heal modernize migrate cluster worktree wt trigger failover remote deploy docker mcp magic assets analyze compliance crash control workspace open otel preview quickstart rc rollback merge self-update sentrux setup-skill spec state template trust trust-metrics ultracode update verify voice why wiki bench cleanup logs grill docs cp version completions help keys answer queue issues undo acp verify-pr"
 
     # 1. If we are on the first argument (subcommand)
     if [[ $cword -eq 1 ]]; then
@@ -57,7 +57,7 @@ _loki_completion() {
             ;;
 
         memory)
-            local memory_cmds="list show search stats export clear dedupe index timeline consolidate economics retrieve episode pattern skill vectors help"
+            local memory_cmds="list show search stats export clear dedupe index timeline consolidate economics retrieve lessons learn forget episode pattern skill vectors help"
             COMPREPLY=( $(compgen -W "${memory_cmds}" -- "$cur") )
             ;;
 

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "11.3.1"
+__version__ = "11.3.2"
 
 # Expose the control app for easy import
 try:

package/dashboard/server.py

@@ -7889,6 +7889,9 @@ def _compute_cost_snapshot() -> dict:
     cost_recorded = False
     # Tokens were measured (tracker fallback) but no USD figure was recorded.
     cost_unknown = False
+    # FC-44: sessions whose usage could not be recorded (efficiency record flagged tokens_measured:false). Any of them makes
+    # every token and dollar total NOT RECORDED; the response key appears only then.
+    unmeasured_sessions = 0
 
     # Read efficiency files (one JSON file per iteration/task).
     # Use the iteration-*.json pattern so this reader sees the same
@@ -7906,6 +7909,9 @@ def _compute_cost_snapshot() -> dict:
                 if not isinstance(data, dict):
                     continue
                 measured = _record_is_measured(data)
+                rec_unmeasured = data.get("tokens_measured") is False
+                if rec_unmeasured:
+                    unmeasured_sessions += 1
                 if measured:
                     cost_recorded = True
                 # Tokens are measured apart from cost: a record that priced an
@@ -7941,17 +7947,18 @@ def _compute_cost_snapshot() -> dict:
                 for bucket, name in ((by_phase, phase), (by_model, model)):
                     if name not in bucket:
                         bucket[name] = {"input_tokens": 0, "output_tokens": 0, "cost_usd": 0.0,
-                                        "measured": False, "tokens_measured": False}
+                                        "measured": False, "tokens_measured": False, "unmeasured": False}
                     bucket[name]["input_tokens"] += inp
                     bucket[name]["output_tokens"] += out
                     bucket[name]["cost_usd"] += cost
                     bucket[name]["measured"] = bucket[name]["measured"] or measured
                     bucket[name]["tokens_measured"] = bucket[name]["tokens_measured"] or tokens_measured
+                    bucket[name]["unmeasured"] = bucket[name]["unmeasured"] or rec_unmeasured
             except (json.JSONDecodeError, KeyError, TypeError, AttributeError):
                 pass
 
     # Fallback: read from context tracking if efficiency files have no token data
-    if total_input == 0 and total_output == 0:
+    if total_input == 0 and total_output == 0 and not unmeasured_sessions:
         ctx_file = loki_dir / "context" / "tracking.json"
         if ctx_file.exists():
             try:
@@ -8024,25 +8031,26 @@ def _compute_cost_snapshot() -> dict:
     # set of measured records that genuinely sums to zero still renders 0.0 --
     # the direction that would otherwise blank real data (the v8.72.0 trap).
     return {
-        "total_input_tokens": total_input if cost_recorded else None,
-        "total_output_tokens": total_output if cost_recorded else None,
-        "total_cache_read_tokens": total_cache_read if cost_recorded else None,
-        "total_cache_creation_tokens": total_cache_creation if cost_recorded else None,
+        **({"unmeasured_sessions": unmeasured_sessions} if unmeasured_sessions else {}),
+        "total_input_tokens": total_input if cost_recorded and not unmeasured_sessions else None,
+        "total_output_tokens": total_output if cost_recorded and not unmeasured_sessions else None,
+        "total_cache_read_tokens": total_cache_read if cost_recorded and not unmeasured_sessions else None,
+        "total_cache_creation_tokens": total_cache_creation if cost_recorded and not unmeasured_sessions else None,
         "total_tokens": (
             total_input + total_output + total_cache_read + total_cache_creation
-        ) if cost_recorded else None,
+        ) if cost_recorded and not unmeasured_sessions else None,
         "cache_hit_ratio": round(total_cache_read / _read_in, 4) if _read_in > 0 else None,
-        "estimated_cost_usd": round(estimated_cost, 6) if cost_recorded and not cost_unknown else None,
+        "estimated_cost_usd": round(estimated_cost, 6) if cost_recorded and not cost_unknown and not unmeasured_sessions else None,
         "cost_recorded": cost_recorded,
         "by_phase": {k: {
-            "input_tokens": v["input_tokens"] if v.get("tokens_measured") else None,
-            "output_tokens": v["output_tokens"] if v.get("tokens_measured") else None,
-            "cost_usd": round(v["cost_usd"], 6) if v.get("measured") else None,
+            "input_tokens": v["input_tokens"] if v.get("tokens_measured") and not v.get("unmeasured") else None,
+            "output_tokens": v["output_tokens"] if v.get("tokens_measured") and not v.get("unmeasured") else None,
+            "cost_usd": round(v["cost_usd"], 6) if v.get("measured") and not v.get("unmeasured") else None,
         } for k, v in by_phase.items()},
         "by_model": {k: {
-            "input_tokens": v["input_tokens"] if v.get("tokens_measured") else None,
-            "output_tokens": v["output_tokens"] if v.get("tokens_measured") else None,
-            "cost_usd": round(v["cost_usd"], 6) if v.get("measured") else None,
+            "input_tokens": v["input_tokens"] if v.get("tokens_measured") and not v.get("unmeasured") else None,
+            "output_tokens": v["output_tokens"] if v.get("tokens_measured") and not v.get("unmeasured") else None,
+            "cost_usd": round(v["cost_usd"], 6) if v.get("measured") and not v.get("unmeasured") else None,
         } for k, v in by_model.items()},
         "budget_limit": budget_limit,
         "budget_used": round(budget_used, 6) if budget_limit is not None and budget_used is not None else None,

package/docs/AGENT-CHANGE-RECEIPT.md

@@ -13,8 +13,8 @@ An Agent Change Receipt is the JSON file a Loki 10 run seals at `.loki/runs/<run
 - `not_proven`: list of strings naming what the run did not prove.
 - `verdict`: one of `VERIFIED`, `PARTIAL`, `ALREADY_SATISFIED`, `SPEC_CONFLICT`, `FAILED` (`types.ts:44`).
 - `evidence`: list of strings (search hits and citation for an ALREADY_SATISFIED verdict).
-- `cost`: `{ usd (number or null), input_tokens, output_tokens, measured_sessions, total_sessions, partial_usd, source? }`.
-- `time`: `{ wall_s, stages }`.
+- `cost`: `{ usd (number or null), input_tokens, output_tokens, cache_read_tokens?, cache_creation_tokens?, sdk_duration_ms?, measured_sessions, total_sessions, partial_usd, source? }`.
+- `time`: `{ wall_s, total_s?, stages, stage_s? }`. `stages` is a disjoint partition of `total_s`: `setup` (first event to machine start), each stage, a parallel group as one bucket (for example `plan+wall`), `orchestration` gaps and `seal`, so a consumer may simply add them. `stage_s` holds each stage's own seconds (parallel members overlap, so they can add to more than their bucket). `wall_s` is the stage buckets without setup, orchestration and seal. `total_s` is elapsed seconds from the run's first event to seal (PR stage excluded); treat it as NOT RECORDED unless every bucket is a non-negative number and they sum to it within 1%. `total_s`, `stage_s` and the cache token keys are additive: older receipts omit them, which reads NOT RECORDED, never 0.
 - `events_sha256`: digest of the run event log.
 - `receipt_sha256`: sha256 of the canonical JSON with `verification` and `receipt_sha256` removed (`loki-ts/src/engine10/verify_cmd.ts:19`).
 - `verification`: `{ jwt, kid }`. `jwt` is a compact EdDSA (Ed25519) token binding the receipt hash; both are null when the receipt is unsigned (`stages/seal.ts:92-95`).

package/docs/CLI-REFERENCE.md

@@ -1,6 +1,6 @@
 # CLI reference
 
-Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.3.1. Do not edit by hand.
+Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.3.2. Do not edit by hand.
 Hidden and legacy-only commands are omitted; see `docs/v10/CLI-MODERN.md` for the full inventory.
 
 | Command | Description |
@@ -61,6 +61,10 @@ Hidden and legacy-only commands are omitted; see `docs/v10/CLI-MODERN.md` for th
 | `loki queue add` | Queue issue refs |
 | `loki queue list` | Show the queue |
 | `loki queue run` | Process the queue |
+| `loki issues` | Run every open issue in a repo and open PRs |
+| `loki issues run` | Triage and run open issues; split too-large ones into stacked PRs |
+| `loki undo` | Plan or apply an undo of a run |
+| `loki verify-pr` | Verify a PR against its linked issue in a sandbox |
 | `loki answer` | Resume a BLOCKED run with an answer |
 | `loki engine10` | v10 engine router |
 | `loki engine10 run` | Run the v10 engine |

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 Loki Mode, by [Autonomi](https://www.autonomi.dev/), turns a spec or an issue into a verified pull request with a receipt you can check. This page covers installing it, a first run, and the options around it.
 
-**Version:** v11.3.1
+**Version:** v11.3.2
 
 **Engine note:** `loki "<task>"`, `loki owner/repo#N` and `loki quick` run the Loki 10 engine. `loki start` still routes to the older engine, which is being removed; prefer `loki owner/repo#N`. See the [user guide](v10/GUIDE.md).
 

package/docs/OTEL-COLLECTOR.md

@@ -0,0 +1,24 @@
+# Loki traces in Grafana, Honeycomb and Datadog
+
+Loki exports OTLP/HTTP JSON traces to `LOKI_OTEL_ENDPOINT` (path `/v1/traces`). With `LOKI_OTEL_GENAI=1` the engine10 events map to `gen_ai` spans: `invoke_agent loki` for the run, `stage <name>` per stage, `execute_tool <name>` per tool call. Prompt and completion content never reach a span, and unknown token usage is absent, not 0.
+
+The collector config `config/otel-collector/loki-collector.yaml` fans those spans out to three backends.
+
+## Use it
+
+1. Set the credentials for the vendors you use (the config reads them from the environment, nothing is stored in the file):
+   - Grafana Cloud: `GRAFANA_OTLP_ENDPOINT`, `GRAFANA_OTLP_AUTH` (the full header value, `Basic <base64 instanceId:token>`).
+   - Honeycomb: `HONEYCOMB_API_KEY` (ingest key).
+   - Datadog: `DD_API_KEY`, `DD_SITE` (for example `datadoghq.com`). Needs a collector build that includes the Datadog exporter (collector-contrib).
+2. Start the collector: `otelcol-contrib --config config/otel-collector/loki-collector.yaml`.
+3. Point Loki at it: `LOKI_OTEL_ENDPOINT=http://localhost:4318 LOKI_OTEL_GENAI=1 loki start ...`.
+
+To use a subset of vendors, edit only `service.pipelines.traces.exporters` and list the vendors you use. The collector validates every defined exporter even when it is not listed, so the required fields of the other vendors carry inert defaults (`https://unset.invalid` for the Grafana endpoint, `unset` for the Datadog key, `datadoghq.com` for the Datadog site). Those defaults are never used by a vendor that is not in the list, and are not credentials. A listed vendor with its variables unset sends to the inert default and fails at export time, so set the variables for every vendor you list.
+
+## Receipt link
+
+When tracing was on, the receipt carries a signed `trace_id` (see `docs/AGENT-CHANGE-RECEIPT.md`). Search for that id in the backend to open the run's trace.
+
+## Offline check
+
+`bash tests/test-otel-collector-config.sh` parses the config, asserts the receiver, processor, exporters and traces pipeline, asserts every credential is an `${env:NAME}` placeholder (an optional `:-default` is allowed and must not be key-shaped), asserts that every required field still resolves to a non-empty default when a vendor's variables are unset, and maps the deterministic fixture in `tests/fixtures/otel/` (fixed run id and timestamps) to the golden span list. It makes no network call. When `otelcol-contrib` is on PATH it also runs `otelcol-contrib validate` with only `HONEYCOMB_API_KEY` set; that step is skipped, not passed, when the binary is absent. It does not contact a vendor; import into each vendor UI is not tested.

package/docs/ROUTING-EVIDENCE.md

@@ -0,0 +1,32 @@
+# Routing evidence
+
+Measurements cited by provider and routing code. Each entry records the number,
+its source and the date it was taken. Code comments point here instead of
+carrying the figures.
+
+## Cost parity: MiniMax M2.5 vs Claude Opus 4.6
+
+Status: a SINGLE internal run, not re-measured. Do not use it to drive routing
+or in any external claim until it is re-derived (issue 210).
+
+- Benchmark: SWE-bench, uniform scaffold.
+- Harness: mini-swe-agent v2.0.0.
+- Date: 2026-02-17.
+- MiniMax M2.5: resolved 75.8 at $36.64 total.
+- Claude Opus 4.6: resolved 75.6 at $275.76 total.
+- Derived: an open model matching frontier accuracy at ~7.5x lower cost.
+- Source: cited from the cost-context comment that previously lived in
+  providers/opencode.sh; competitive context in docs/COMPETITIVE-INTEL-2026-09.md
+  item 3.
+
+## opencode viability
+
+Date verified: 2026-07-29/30.
+
+- Source opencode.ai/docs/providers documents 75+ providers and custom
+  OpenAI-compatible endpoints.
+- Source anomalyco/opencode: 190,871 stars, release v1.18.9 (2026-07-28),
+  pushed the same week.
+- Source aider: last release v0.86.0 from 2025-08-09.
+- Roo Code is archived; Continue is read-only.
+- CLI surface checked against the installed opencode v1.17.9.

package/docs/environment-variables.md

@@ -135,6 +135,7 @@ banners you might expect. These variables control the remaining `[INFO]` and
 | `LOKI_DURABLE_STATE` | `0` | `1` enables durable state **and** the richer process-exit contract that lets Kubernetes distinguish a deterministic failure from a crash. See [exit codes](./exit-codes.md). |
 | `LOKI_SDK_LOOP` | unset | Routes the run through the Bun/TypeScript runner instead of bash. Both implement the same exit contract. |
 | `LOKI_ALLOW_AGENT_GITHUB_TOKEN` | unset | By default `GH_TOKEN`, `GITHUB_TOKEN`, `GH_ENTERPRISE_TOKEN`, and `GITHUB_ENTERPRISE_TOKEN` are withheld from agent sessions. The two routes differ: on the bash route (`autonomy/run.sh`) the withheld tokens are re-granted only for Loki's own trusted calls, namely the `gh()` CLI wrapper, the `_loki_net` helper used by the optional local-PR path in `on_run_complete()`, the session-end `create_session_pr` call, and `autonomy/lib/proof-check.sh`'s network probe. On the Bun route (`loki-ts/src/runner/github_token.ts`'s `withholdGithubTokens()`) the tokens are dropped from the process outright, with no re-grant and no push/PR step of its own. Exactly `1` lets the agent inherit the tokens as before, on either route; that is a Rule of Two exposure, and a one-line stderr warning is printed. |
+| `LOKI_AI_MARKING` | unset (off) | `1` (exactly) adds machine-readable trailers to the Loki commit (`AI-Generated: true`, `AI-Provider`, `AI-Model`, `Loki-Receipt`, after `Loki-Run`) and one `AI-Generated: true (...)` marker line under the verdict in the PR body. Values are single-line and bounded. Off, the commit and PR body are byte-identical to before. |
 
 `LOKI_DURABLE_STATE=1` is the one to set in a Job or task definition. Without
 it every failure collapses to exit 1 and the platform cannot tell "re-running