loki-mode 11.3.2 → 11.3.4

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: An autonomous software factory that knows what it is supposed to deliver, and proves it did. Use when the user says Loki Mode or asks to build, fix or verify software autonomously.
 ---
 
-# Loki Mode v11.3.2
+# Loki Mode v11.3.4
 
 **Current entry points (Loki 10 engine):** `loki "<task>"`, `loki owner/repo#N` and `loki quick "<task>"` run the Loki 10 engine and end with a signed receipt (`loki verify`). `loki backlog owner/repo --all` runs many issues in parallel. Guide: `docs/v10/GUIDE.md`. The skill instructions below, and `loki start`, describe the previous bash loop. PRD-file starts (`loki start ./prd.md`) and the opencode provider still run on it until FC38-SWEEP ports them; the legacy-engine command and the LOKI_ENGINE switch remain removed. Prefer `loki owner/repo#N` for issues.
 
@@ -483,4 +483,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v11.3.2 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**
+**v11.3.4 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**

package/VERSION

@@ -1 +1 @@
-11.3.2
+11.3.4

package/autonomy/loki

@@ -1820,6 +1820,7 @@ show_help() {
     echo "  --no-dashboard   Disable web dashboard"
     echo "  --isolation LVL  Per-run isolation dial: none (default) | worktree | docker"
     echo "  --skip-memory    Skip loading memory context at startup"
+    echo "  --spec FILE      Run against an edited spec (written by 'loki plan <task> --spec'; see also --spec-first)"
     echo "  --fresh-prd      Regenerate the PRD from the codebase (no-PRD runs; ignores the reusable generated PRD)"
     echo "  --compliance PRESET  Enable compliance mode (default|healthcare|fintech|government)"
     echo "  --budget USD     Set cost budget limit (display in dashboard/status)"
@@ -2584,6 +2585,8 @@ cmd_start() {
                 echo "  --attempts N          Run N (1-5, default 1) independent attempts in separate git worktrees;"
                 echo "                        the most executed passing checks wins, losers are recorded on the receipt"
                 echo "  --skip-memory         Skip loading memory context at startup"
+                echo "  --spec FILE           Run against an edited .loki/specs/<slug>.md (from 'loki plan <task> --spec')"
+                echo "  --spec-first          Write .loki/specs/<slug>.md for you to edit, then stop"
                 echo "  --fresh-prd           Regenerate the PRD from the codebase on a no-PRD run"
                 echo "                        (ignores the reusable generated PRD; aliases: --regen-prd,"
                 echo "                        --regenerate-prd, --regen, or LOKI_PRD_REGEN=1)"
@@ -20691,6 +20694,7 @@ cmd_plan() {
                 echo ""
                 echo "Options:"
                 echo "  --json        Machine-readable JSON output"
+                echo "  --spec        With a task: write the acceptance criteria to .loki/specs/<slug>.md for you to edit"
                 echo "  --verbose     Show detailed per-iteration breakdown"
                 echo "  --help, -h    Show this help"
                 echo ""
@@ -24398,6 +24402,9 @@ except Exception as e:
             echo "  dedupe            Remove duplicate entries"
             echo "  clear [type]      Clear learnings (all or specific type)"
             echo "  compound [cmd]    Compound-solutions knowledge store (was: loki compound)"
+            echo "  lessons [--json]  PR review lessons with their uses and outcomes"
+            echo "  learn <o/r#PR>    Learn lessons from a merged PR's review comments"
+            echo "  forget <prl-id>   Delete one PR lesson and print its text"
             echo ""
             echo "Memory System Commands:"
             echo "  index [rebuild]   Show or rebuild the memory index layer"

package/completions/_loki

@@ -26,6 +26,12 @@ function _loki {
                 memory)
                     _loki_memory
                     ;;
+                plan)
+                    _loki_plan
+                    ;;
+                export)
+                    _arguments '--sarif[Write findings.sarif for a run]'
+                    ;;
                 config)
                     _loki_config
                     ;;
@@ -264,6 +270,8 @@ function _loki_start {
         '--no-dashboard[Disable web dashboard]' \
         '--sandbox[Run in Docker sandbox]' \
         '--skip-memory[Skip loading memory context]' \
+        '--spec[Run against an edited spec file]:spec file:_files' \
+        '--spec-first[Write an editable spec, then stop]' \
         '--yes[Skip confirmation prompts]' \
         '-y[Skip confirmation prompts]' \
         '--budget[Cost budget limit in USD]:amount:' \
@@ -321,6 +329,14 @@ function _loki_provider {
     _describe -t cmds 'provider subcommand' cmds
 }
 
+function _loki_plan {
+    _arguments \
+        '--json[Machine-readable JSON output]' \
+        '--verbose[Detailed per-iteration breakdown]' \
+        '--spec[Write editable acceptance criteria to .loki/specs/<slug>.md]' \
+        '*:prd file:_files'
+}
+
 function _loki_memory {
     local -a cmds
     cmds=(

package/completions/loki.bash

@@ -27,7 +27,7 @@ _loki_completion() {
 
             # If the word starts with a dash, show flags
             if [[ "$cur" == -* ]]; then
-                local flags="--provider --max-iterations --parallel --background --bg --simple --complex --github --no-dashboard --sandbox --skip-memory --yes --budget --attempts --help"
+                local flags="--provider --max-iterations --parallel --background --bg --simple --complex --github --no-dashboard --sandbox --skip-memory --spec --spec-first --yes --budget --attempts --help"
                 COMPREPLY=( $(compgen -W "${flags}" -- "$cur") )
                 return 0
             fi
@@ -142,6 +142,20 @@ _loki_completion() {
             fi
             ;;
 
+        export)
+            if [[ "$cur" == -* ]]; then
+                COMPREPLY=( $(compgen -W "--sarif --help" -- "$cur") )
+                return 0
+            fi
+            ;;
+
+        plan)
+            if [[ "$cur" == -* ]]; then
+                COMPREPLY=( $(compgen -W "--json --verbose --spec --help" -- "$cur") )
+                return 0
+            fi
+            ;;
+
         issue)
             if [[ "$cur" == -* ]]; then
                 COMPREPLY=( $(compgen -W "--repo --start --dry-run --output --help" -- "$cur") )

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "11.3.2"
+__version__ = "11.3.4"
 
 # Expose the control app for easy import
 try:

package/docs/CLI-REFERENCE.md

@@ -1,6 +1,6 @@
 # CLI reference
 
-Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.3.2. Do not edit by hand.
+Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.3.4. Do not edit by hand.
 Hidden and legacy-only commands are omitted; see `docs/v10/CLI-MODERN.md` for the full inventory.
 
 | Command | Description |

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 Loki Mode, by [Autonomi](https://www.autonomi.dev/), turns a spec or an issue into a verified pull request with a receipt you can check. This page covers installing it, a first run, and the options around it.
 
-**Version:** v11.3.2
+**Version:** v11.3.4
 
 **Engine note:** `loki "<task>"`, `loki owner/repo#N` and `loki quick` run the Loki 10 engine. `loki start` still routes to the older engine, which is being removed; prefer `loki owner/repo#N`. See the [user guide](v10/GUIDE.md).
 

package/docs/v10/DECISIONS.md

@@ -792,3 +792,8 @@ Founder: "you are taking hours long for releases, I wanted 3 releases to 10 rele
 5. Slices are 20-40 minutes of build, one concern, with a user-visible line on the card. Large features ship as a sequence of small flag-gated slices.
 6. HIGH reviews run in pair mode. A TL reviews LOW and MEDIUM with the machine gate, and merge-gate is the hard check. There is no serial review queue.
 7. Every tick reports merge-to-`next` minutes for each release and releases per hour.
+
+## D98 (2026-10-08, CTO ruling relayed by steering at 19:22Z, RM records): guard review standard and the HIGH review round limit
+1. A guard (a test that fails a build on a shape it detects) blocks a merge only on findings that a realistic change would trigger: an ordinary workflow edit or an ordinary contributor mistake. A realistic finding always blocks.
+2. Contrived adversarial bypasses (exit 256, eval rc=0, writes hidden in arithmetic or through an indirect name, deliberately obfuscated shell) are logged as LOW follow-up rows in FAILURE-CLASSES.md and do not block. These guards protect against our own mistakes; an attacker who controls workflow files is covered by branch protection and review.
+3. HIGH reviews have a 2-round limit. Round 3 escalates to the CTO with the finding list, and the CTO decides. Reason: opus share was about 50% against the 30% budget (D13).

package/docs/v10/FAILURE-CLASSES.md

@@ -592,3 +592,171 @@ L0 review rule (ENGINE-LAWS.md L0): a fix that adds an `if` or a regex about the
 - Mechanism: the test strips one trailing slash from TMPDIR before mktemp.
 - Fixture: tests/test-caveman-flags.sh section 5c is the regression (red on macOS before the strip).
 - Note: the other two Nightly 37790534786 reds (doctor hint, onboard) were already fixed by FC-53 (0c0069df3, in this train); re-verified green here (bun test gate-failures-cap-parity 3 pass; test-onboard-command.sh 11/11).
+
+## FC-63 A subprocess test pinned PATH so tightly the product under test never ran, and its host-dependent counter had no host-independent fixture (NR-DOCTOR)
+- User saw: the macOS bun Nightly leg (run 37790534786 on a0d599d0c) reported `doctor per-provider install hint goes to STDERR` "Expected: <= 1, Received: 2"; locally the same test passed, so the red looked unreproducible.
+- Law: evidence or it did not happen; an assertion must exercise the property it names; a green that cannot go red is not a gate.
+- Cause (measured): the red assertion was the bare "Install:" counter already fixed by FC-53 (0c0069df3 is not in a0d599d0c; HEAD f22648a11 contains it and the test passes). Remaining defect: the test ran `bin/loki doctor` with PATH=/usr/bin:/bin, which hides bun on hosts where bun lives elsewhere (here ~/.bun/bin), so the shim printed its minimal "Bun doctor is unavailable" report and the test passed vacuously; it only ran the real doctor where bun sat on the system PATH. On this host python3.12 is installed under /opt/homebrew, so the python hint never printed and the CI condition could not be reproduced.
+- Siblings swept: other loki-ts tests that spawn bin/loki with a pinned PATH were not found to assert on doctor output; only this test counted install hints.
+- Mechanism: the PATH keeps /usr/bin:/bin (providers stay absent) plus dirname(process.execPath) so the real Bun doctor always runs; the counting moved into providerInstallLines.
+- Fixture: gate-failures-cap-parity.test.ts "provider install-hint counter ignores the unrelated Python 3.12 hint" replays the CI stdout shape (python hint + claude fallback): the old bare counter yields 2 (red, asserted in the test), providerInstallLines yields 1 (green), and a leaked codex hint yields 2.
+
+## FC-64 A test piped a large captured value into grep -q under pipefail and died of SIGPIPE (NR-PIPE)
+- User saw: Nightly 37790534786 (a0d599d0c) full-suite shard 1 red. Raw: `tests/test-onboard-command.sh: line 51: echo: write error: Broken pipe`, then "Missing package manager detection" (rc 141 from `echo "$output" | grep -q npm`).
+- Law: an assertion must fail only on the property it names; a pipeline whose exit status depends on how fast the reader exits is not an assertion.
+- Cause (measured): grep -q exits at the first match while echo is still writing a value larger than the pipe buffer; pipefail reports 141. Reproduced deterministically with a 400KB value: legacy form rc=141, here-string rc=0 (tests/test-sigpipe-guard.sh section 1). The onboard fix itself was already in this train (FC-53, 0c0069df3).
+- Siblings swept: 1789 occurrences of the legacy form across pipefail suites (test-v10-pulse.sh 319, test-branch-lifecycle.sh 79, test-compound-cli.sh 65 ...); only commands with large output can trip it, and the onboard family is now zero. The rest are bounded outputs and are held by a ceiling, not bulk-rewritten.
+- Mechanism: grep -q ... <<<"$var" (no pipe, no writer to break). tests/test-sigpipe-guard.sh enforces it in test-onboard-*.sh and ratchets the repo-wide count (lower the ceiling as suites convert; never raise it).
+- Fixture: tests/test-sigpipe-guard.sh (red against the pre-fix test-onboard-command.sh from a0d599d0c: 11 legacy lines; green on this tree).
+
+## FC-57 A continue-on-error job hides a real failure from the workflow conclusion and the D90 gate (NIGHTLY-TRUTH)
+- User saw: Nightly run 37780519439 (a0d599d0c, 2026-10-08) concluded SUCCESS while "Bun tests on macos-latest bun=1.3.13 (nightly)" and "bun=latest" both FAILED on `gate-failures cap head/tail parity (W4 L1) > doctor per-provider install hint goes to STDERR`; the same legs failed again in run 37790534786. release.yml required-ci and D90 read the run conclusion, so the release gate saw green on a deterministic failure.
+- Law: evidence or it did not happen; a red leg must reach the verdict that gates releases. Informational is a per-leg decision about upstream drift, never a job-wide switch over pinned code.
+- Cause (measured): nightly.yml job `bun-tests-nightly` had job-level `continue-on-error: true` (header lines 13-14: "informational so a macOS or bun=latest flake cannot hold a release"). It covered the pinned bun 1.3.13 macOS leg, whose failure is a product/test defect, not drift. first-run-gate (stub, pinned bun, no network) had the same switch. The test itself was fixed separately in FC-53 (0c0069df3: macOS python 3.9 adds an unrelated "Install:" line).
+- Siblings swept (continue-on-error, `|| true` on test commands, pipes without pipefail, always() aggregators, matrix legs outside the verdict) across all 13 workflows: integrity-audit.yml "Run shell tests" step had continue-on-error with only an outcome printout, so the weekly audit could never fail on the shell suite (fixed: now blocking). test.yml and security-audit.yml "Reuse a train run's verdict" steps: fail-safe by design (failure means reuse=false, full run). security-audit.yml pip-audit requirements step: findings baseline, followed by a step asserting a parseable report for every manifest. release.yml Docker Hub description: cosmetic after a successful publish. post-release-smoke.yml notify (`if: always()`): notifier only, the smoke jobs it reads fail the run themselves. `!cancelled()` job conditions in test.yml and security-audit.yml are run gates, not aggregators. full-suite.yml and release.yml required-ci have no masking pattern (`|| true` only on API lookups that fail closed into a pending/blocked verdict).
+- Mechanism: nightly.yml pinned legs block; only matrix legs with `experimental: true` (bun=latest) use `continue-on-error: ${{ matrix.experimental == true }}`; first-run-gate blocks. tests/test-workflow-no-masked-failures.sh parses every workflow and fails on an unconditional continue-on-error outside a justified allowlist, an experimental pinned leg, `|| true` or an un-pipefailed pipe on a test command, and an unlisted `if: always()` job.
+- Fixture: tests/test-workflow-no-masked-failures.sh. Red on the train-1132 workflows (3 findings: nightly bun-tests-nightly, nightly first-run-gate, integrity-audit shell tests), green after; 5 single-rule mutations each go red.
+
+## FC-65 (LOW follow-up to FC-57) Contrived shell bypasses of the masked-failure guard (NIGHTLY-TRUTH)
+- User saw: nothing; found by adversarial review of tests/test-workflow-no-masked-failures.sh. No realistic workflow edit triggers these; each needs a deliberate hiding of the exit status.
+- Law: a guard blocks on what a realistic edit would do; the rest is tracked, not built (CTO ruling, round 7).
+- Cause (measured): the guard is a lexical interpreter of the `||` handler, not a shell. Covered and red: Y01 to Y11 shapes below the allowlist (echo, printf without -v, true, `:`, cat, grep between a `VAR=$?` capture and its exit; any other command voids the capture), grouped tests, redirections, exit codes 1..255.
+- Not covered (open): TEST_CMD is lexical, so a test hidden behind a function (Y18 `t() { <test>; }; t || true`), a variable (Y19 `C="<test>"; $C || true`) or an unlisted runner (M16 `bun run test || true`) is not seen; `eval` of a string that holds the test; `trap 'exit 0' EXIT`; `set +e`; a dead-branch `exit "$rc"`.
+- Siblings swept: Y01, Y02, Y04 to Y09 (writes hidden in `$(( ))`, `printf -v` or `read` through an indirect name, a function that writes rc), exit 256, eval: all fail closed inside a capture-to-exit window and are red self-tests.
+- Mechanism: none planned. Revisit only if a real workflow edit triggers one; the structural fix would be running the step under a shell with `set -e -o pipefail` and asserting on exit status in a fixture instead of reading source.
+- Fixture: Y01, Y02, Y04, Y05, Y08, Y09, Y10, Y11, X09, X20, X05 self-tests in tests/test-workflow-no-masked-failures.sh.
+
+## FC-66 A fixture pushed the real .gitleaksignore as new content and gitleaks flagged one of its own comments (PP-GITLEAKS-FIXTURE)
+- User saw: Tests red on main 103278fe8 (run 37833691425, shard 1), deterministic and local: tests/test-pre-push-gitleaks.sh case c8 `FATAL: setup_push_clone's base push failed ... RuleID: generic-api-key File: .gitleaksignore Line: 123`.
+- Law: a guard's own config must pass the guard; evidence or it did not happen (the red was latent, not a train regression).
+- Cause (measured): setup_clone, setup_push_clone and the case-26 clone copied the real .gitleaksignore, comments included, into a fixture repo and pushed it as new content. Line 123 (a comment that quoted the default receipt key file path) matches generic-api-key. `.gitleaksignore`, `.githooks/pre-push` and the suite are byte-identical between 75bbbb946 and 103278fe8, so the red is latent; the suite only ran once diff selection picked it.
+- Siblings swept: `gitleaks dir .gitleaksignore` over every other comment and fingerprint line: line 123 was the only finding. The three fixture copy sites all go through one helper now.
+- Mechanism: (1) the comment is reworded so it no longer trips a rule; (2) copy_real_gitleaksignore copies fingerprint lines only (comments carry no suppression), so a future prose comment cannot break fixtures; (3) a guard case scans the real .gitleaksignore with the pinned gitleaks and fails on any finding. No fingerprint added, hook untouched.
+- Fixture: tests/test-pre-push-gitleaks.sh "FC-66: the real .gitleaksignore scans clean as content". Red before the fix (suite rc=1 at c8, gitleaks reports 1 leak at line 123), green after.
+
+## FC-68 A release can drop a verification check silently and still smoke green (WALL-SMOKE-GUARD)
+- User saw: 11.3.2 receipts carried 1 executed check instead of 2. The Wall test was authored, then discarded before verify ("wall base run not_run: 1", "wall test discarded: loki_wall_sum.test.js (not_run)"). Nothing asserted the count, so the release and its smoke stayed green.
+- Law: evidence or it did not happen; a green that cannot go red is not a gate. Guard class: the root cause is FC-67 (WALL-NOTRUN holds that row); this row is the detection layer.
+- Siblings: any other check a receipt could lose without a failing exit (lint, mutation proof, cross review) is not yet counted; the guard asserts only checks[] executed >= 2 and the Wall test.
+- Mechanism: scripts/assert-wall-executed.sh reads the keys seal.ts writes (checks[].result, wall.files, wall.passed, not_proven[]). scripts/real-run.sh applies it to scenarios with SC_WALL_EXECUTED=1 (trivial-sum, two-bug). Post-Release Smoke npm-smoke runs it as a blocking step.
+- Limit: the real trivial-sum and two-bug runs are billed and CI has no provider key, so Post-Release Smoke cannot run them unattended; the blocking step proves the guard logic on the released commit and runs the real scenario when a key is supplied.
+- Fixture: tests/test-wall-executed-guard.sh (11.3.1 shape passes, 11.3.2 shape fails, each leg alone fails).
+
+## FC-70 The bump-only allowlist drifted from the files scripts/release.sh bumps (BUMP-REUSE; number may renumber at merge)
+- User saw: release run 37837110730 (v11.3.3, eee891534) required-ci printed `normalizer: not on the allowlist: deploy/helm/autonomi/Chart.yaml`, then "Not eligible for parent reuse", then failed on Tests@eee891534 = failed although parent 54a519a22 had Tests success.
+- Law: a bump-only commit inherits its parent's Tests verdict; evidence or it did not happen.
+- Cause (measured): `git diff --name-only 54a519a22 eee891534` lists 21 paths; four were missing from ALLOWLIST (helm/loki-mode/Chart.yaml, deploy/helm/autonomi/Chart.yaml, deploy/helm/control-plane/Chart.yaml, docs/CLI-REFERENCE.md), all written by scripts/generate-stale-zero.sh, which bump_all_version_files runs (SZ-01) after the allowlist was last edited. Because test.yml's gate uses the same allowlist, its heavy jobs also ran at the bump SHA, and that completed failure then beat the parent reuse (has_conclusion failure is checked before parent reuse, by design: only a missing/cancelled run falls through).
+- Siblings swept: release.sh bump_all_version_files slots and generate-stale-zero.sh targets (README.md facts block carries no version and is unchanged by a bump; SKILL.md, Chart.yaml appVersion, CLI-REFERENCE.md generated line are the only generated version carriers). Both copies of the allowlist (release.yml STEP 1, scripts/ci/version-bump-only.sh) updated; they are byte-compared by tests/test-version-bump-only.sh.
+- Mechanism: one derivation, not two lists. tests/test-version-bump-only.sh now derives the version-bearing paths from scripts/release.sh (update_version_slot targets) and scripts/generate-stale-zero.sh (Chart.yaml and CLI-REFERENCE targets) and asserts each is in the allowlist of both copies.
+- Fixture: tests/test-version-bump-only.sh "FC-70" cases (static subset check, per-file chart/cli-ref pure-bump fixtures, and a replay of 54a519a22 -> eee891534 when both objects exist). Red before the fix (ALLOWLIST lacks the four paths), green after.
+
+## FC-71 Promote blocked on a green legacy-titled Post-Release Smoke (PROMOTE-SMOKE-SHA)
+- User-visible vs raw: user-visible. Promote run 37838898754 printed "Post-Release Smoke for 75bbbb9... is none" and refused 11.3.2 although smoke run 37833604487 at that head_sha concluded success.
+- Law broken: evidence or it did not happen; a gate must read the evidence that exists, not only the newest title format.
+- Sibling sweep: the nightly and Tests gates in promote.yml already match by head_sha; only the smoke gate matched by display_title alone.
+- Shared mechanism: the smoke gate also accepts a completed workflow_run-event smoke run whose head_sha equals the released commit; newest matching run decides, API error stays fail closed.
+- Fixture: tests/test-promote-smoke-sha.sh (legacy-titled green passes, newer red blocks, no match blocks, API error blocks).
+
+## FC-72 A release named new commands and flags in its CHANGELOG that never reached `loki help` or Tab completion (HELP-DRIFT)
+- User saw: 11.3.2 listed `loki plan --spec`, `loki start --spec` and `loki memory forget` in the CHANGELOG, but none appeared in the 11.3.2 help output or in bash/zsh completion. (Number may renumber at merge.)
+- Law: every shipped command or flag appears in help and in Tab completion; a feature a user cannot find does not exist to them.
+- Cause (measured): the bash help text, `loki memory help` and both completion files are hand-maintained; tests/test-help-discoverability.sh checks top-level commands only, so subcommands and flags drifted. The Bun route help in loki-ts/src/cli.ts already listed them.
+- Siblings swept: `loki export --sarif` (11.3.2) was also missing from completion; added to bash and zsh, along with `plan` flag completion and `memory lessons|learn|forget` in `loki memory help`.
+- Mechanism: tests/test-help-changelog-drift.sh reads backticked `loki ...` invocations from the newest 2 CHANGELOG sections and fails when a subcommand or flag is absent from `loki help` / `loki <cmd> --help` / `loki <cmd> help`, or a flag is absent from completions/loki.bash. Prose is never read.
+- Fixture: tests/test-help-changelog-drift.sh. Red on origin/main (6 failures: memory forget, plan --spec, start --spec, their completions, export --sarif completion), green after (11 passed, 0 failed).
+
+## FC-73 Release-commit R0 guard selection ran suites with no green baseline (RELGATE-REDS)
+- User saw: Tests red on main eee891534 (run 37837111102, shards 0, 3, 8, 11): test-quick-receipt-order rc=124, test-autonomy-and-stop OPTOUT_FAIL, test-watch-command stale "v6.33.0", test-manifest-truncation.js run under bash (rc=2), node_lint web-app rc=127.
+- Law: evidence or it did not happen; a gate may only select checks that are green on an unchanged tree.
+- Cause (measured): guards_for() greps tests/ for the literal path and basename of every R0 path. For VERSION and package.json that selects every test that mentions the word (fixtures, prose), including suites absent from tests/run-all-tests.sh that nobody runs, plus one registered suite over the 100s item limit. The package.json glob also returned a .js test that shell_test ran with bash. node_lint ran `npm run lint` in a shard that never installed web-app deps. A genuine eslint error in ProjectWorkspace.tsx was hidden behind that.
+- Siblings swept: all 179 G rows of the release plan checked against the full-suite registry (3 unregistered .sh: test-watch-command, test-magic-rarv, test-manifest-truncation.js); other node_lint and pytest rows; the other shard-8 and shard-11 items.
+- Mechanism: guards_for keeps the grep as a candidate set filtered by has_baseline (run by the full suite, local-ci or nightly), skips the grep for the ROOT VERSION, package.json and requirements* whose guards are the explicit lists (nested manifests keep the exact-path grep, dropping only the shared basename grep), emits .js guards as node_test, and node_lint installs the target's locked deps when the linter binary is absent.
+- Fixture: tests/test-fast-gate.sh "FC-73" cases (release plan of VERSION, package.json, dist; loki-ts/package.json keeps test-sdk-version-sync.sh; a fixture tree proves an unregistered suite is dropped, mutating `} | has_baseline` to `} | cat` goes red). Red before (selects unregistered suites and quick-receipt-order), green after. Stale tests fixed at the root: watch help assertion, autonomy opt-out needs the claude binary, eslint no-unused-expressions.
+
+## FC-74 Large source-body captures piped into grep -q under pipefail died of SIGPIPE (RELGATE-REDS)
+- User saw: Tests red on main eee891534 (run 37837111102, shard 8): tests/test-verify-runner-selection.sh `printf: write error: Broken pipe`.
+- Law: a test must not depend on producer/consumer timing; same class as FC-64.
+- Cause (measured): `printf '%s' "$_gate_body" | grep -q ...` under `set -o pipefail`; grep -q exits at the first match, printf of a large captured function body gets SIGPIPE, the pipeline reports failure. Five sites in the suite. Not reproducible on the fast local machine (the pipe buffer absorbs it), so the mechanism is proven by test-sigpipe-guard section 1 and the static pattern.
+- Siblings swept: the FC-64 ratchet covers the repo-wide count; this suite now joins the enforced family.
+- Mechanism: here-strings (`grep -q ... <<<"$var"`) at all five sites; tests/test-sigpipe-guard.sh section 2 now enforces the suite.
+- Fixture: tests/test-sigpipe-guard.sh against the pre-fix copy of the suite fails (5 legacy lines, 3 passed 1 failed); against the fixed suite 4 passed 0 failed.
+## FC-69 FORCE_COLOR in the user's env colored the test output and the Wall base run read no counts (WALL-COLOR)
+- User saw: with FORCE_COLOR=3 (node v26) `loki start "sum() skips the first element; fix it" --no-pr` sealed NOT PROVEN "wall base run not_run: 1, wall test discarded" with 1 executed check instead of 2. With FORCE_COLOR unset the same base run is {pass:0, fail:1} and the Wall works. Reproduced 3x by a peer session on 11.3.2; likely present in 11.3.1 and earlier.
+- Law: a parser reads what the tool said, not how it was painted; a user's environment must not change a verdict; a Wall test that did not execute is never silent and never VERIFIED (L3 evidence).
+- Cause (measured): harness-run test commands inherited process.env, so the runner emitted ANSI. stages/wall.ts classify (nodeIsRed `^(?:#|ℹ) fail [1-9]`, pytest, jest/vitest/bun counters) tested the raw output, so the escape prefix hid the counter, classify returned not_run and the Wall test was discarded. classifyCheck and testCount already stripped ANSI; wall.ts classify, load_owner and the quality_gates strip (CSI only) each had their own or no stripping. Separately, seal listed a not_run Wall only as a count with no reason named.
+- Siblings swept: stages/wall.ts RealBaseTestRunner (Wall base run; also the mutation proof via seal.ts and F2P), stages/wall.ts classify, stages/verify.ts runOnce (verify checks, flaky retry, already-done base run in subtractBase), runner/load_owner.ts runOnBase, runner/quality_gates.ts summaryFailedCount (attempts scoring). project_model/install.ts is a dependency install with no parsed output, unchanged.
+- Mechanism: util/check_result.ts plainTestEnv() (FORCE_COLOR=0, NO_COLOR=1, CLICOLOR_FORCE removed, CI untouched) for every harness-run test or verify child, no per-runner special case; the single exported stripAnsi() at capture and at classify entry (belt and braces). stages/seal.ts names every not_run Wall file as "Wall test not executed: <file>: <reason>" on the receipt and the console NOT PROVEN line. The verdict still comes from the checks that executed; an unexecuted Wall test is disclosed, not a downgrade.
+- Fixture: loki-ts/tests/engine10/fc69_ansi.test.ts (real node --test base run under FORCE_COLOR=3; raw ANSI node spec, TAP, jest, pytest), loki-ts/tests/engine10/fc69_wall_e2e.test.ts (stub-claude engine run under FORCE_COLOR=1 and 3, always-run via scripts/global-guards.tsv), seal.test.ts "FC-69 not_run Wall". Red before the fix (base run not_run:1, Wall file discarded, wall.files 0), green after.
+## FC-55 Intake discovery session retried or hung on a repo with nothing to discover (INTAKE-FAST)
+- User saw: intake taking 10-44s (median 28s) on a trivial repo, one replay hanging 120s, before any work began. Raw: the Project Model discovery session is almost all of intake; a no-UI repo answers `ui: {present: false, cite: []}` and validateAnswer rejects it with "packages[0].ui.cite: needs at least one citation", which spends the one retry (a second full session).
+- Law: evidence or it did not happen; a validator may demand evidence only for a claim the answer makes; a stage must be bounded by a recorded fallback, never a stall.
+- Cause (measured): schema.ts demanded a non-empty ui.cite whether or not ui.present was true. Separately, a repo whose every tracked file is at the root has no package below the root to learn, yet still paid a full session, and nothing bounded a session that never returned.
+- Siblings swept: every other optional field in validateAnswer (commands.* null, ui.boot null, install, dependsOn) already accepts its empty form; ui.cite was the only citation demanded for an absent claim. Consumers of an unknown model (loadProjectApi in verify, wall packageOf, implement, run_cap, visual evidence, testmap, before_after) all resolve to null and keep repo-root behavior; commandFor takes its runner command from the harness, and a root-only model never changes it.
+- Mechanism: (1) ui.cite is checked only when ui.present is true (a supplied cite is still verified). (2) discoverProjectModel returns unknownModel("", "single-directory repo") with no session when shallowDirs is exactly ["."], after the committed and cached checks. (3) Each discovery session is raced against its limit plus 5s; a hang aborts the session, emits `project_model.fallback`, and returns an unknown model with owner=provider and no retry. Session ceiling 120s to 60s.
+- Fixture: loki-ts/tests/project_model/intake_fast.test.ts. Red on origin/main (3 of 7 fail incl. the hang case), green after.
+
+## FC-82 A live-server E2E suite failed collection on a CI runner without its client libraries (RED-PURPLE)
+- User saw: Tests red on main 082cd57a4 (run 37848611813, shard 4): `FAIL rc=2: py_test tests/docker/test_purple_lab.py`, `ModuleNotFoundError: No module named 'requests'`.
+- Law: a test needing an optional dependency or a live service must skip honestly, never error at collection (same family as FC-73 baseline rule).
+- Cause (measured): the Purple Lab server still exists (web-app/server.py, autonomy/loki 'loki web', deprecated v7.44.0), so the suite is not stale. It hit `import requests` at module top on a runner without requests, and would also need a server on localhost:57375 that CI never starts.
+- Siblings swept: tests/docker/test_polling.py imports checked, no unguarded optional import of this kind.
+- Mechanism: pytest.importorskip for pytest_asyncio, requests, websockets plus a module-level skip when BASE_URL is unreachable.
+- Fixture: `python3 -m pytest -q tests/docker/test_purple_lab.py` with no server exits 0 reporting a skip; before the fix it exited 2 on a runner without requests.
+- r2 (main 4511d9f32): the module-level skip (importorskip / skip(allow_module_level=True)) collected zero tests, so pytest exited rc=5 (no tests collected) and the fast gate reported `FAIL rc=5: py_test`. The skip is now per-test: imports are guarded with try/except, the module collects all tests, and a pytestmark skipif (same reasons) skips each one, giving N skipped with rc=0. Assertions are unchanged and the tests run when deps and server are present.
+
+## FC-84 A demo non-TTY test depended on a provider CLI being installed on the host (RED-PLAN)
+- User saw: Tests red on main 082cd57a4 (shard 9): tests/test-plan-command.sh `[FAIL] demo non-TTY refuse -- exit=2 (124=timeout/hang)`, 26 passed 1 failed. The exit was 2, not a hang; the label is misleading.
+- Law: a test must not depend on host state it did not set up (same class as the "assumed host state" and "autonomy opt-out needs the claude binary" fixes).
+- Cause (measured): `loki demo` without --dry-run runs provider_offer_gate before the estimate. With no provider CLI on PATH (CI runner) it prints "No AI provider CLI found" and exits 2, so the case's grep for the estimate and the confirmation message failed while the exit code matched. A dev host with claude installed passes. Reproduced with PATH=/usr/bin:/bin:/usr/sbin:/sbin: rc=2, no estimate.
+- Siblings swept: the dry-run case skips the gate (verified passing without a provider); the other provider-gated suites (test-provider-preflight.sh) already build stub PATHs.
+- Mechanism: the case now puts a stub claude on PATH so the refusal path under test is reached on every host.
+- Fixture: tests/test-plan-command.sh test 25; red with the stub removed on a provider-less PATH, green with it.
+
+## FC-80 Shard-coverage watch fails when a guessed duration row displaces LPT packing (MAIN-REDS-1134)
+- User saw: Tests red on main 082cd57a4 (run 37848611813, Structural guards and shard 8): tests/test-shard-coverage.sh "expected 5 watched suites in 5 distinct shards", trust-core and E2e Features both in shard 1.
+- Law: a data table that drives a deterministic packer must hold measured values; a guessed row silently reshuffles the packing.
+- Cause (measured): the HELP-DRIFT merge added the row "help drift (CHANGELOG loki invocations in help and completion)" at 25s; the suite runs in 3.0s locally. The inflated row shifted the LPT rotation so two watched heavy suites landed together. Deterministic.
+- Siblings swept: every registered run_test name has a row in tests/shard-durations.tsv (0 missing); the other rows added this train (1, 3, 8s) are small and did not move the watched five.
+- Mechanism: row set to the measured 3s; test-shard-coverage passes 19/0.
+- Fixture: tests/test-shard-coverage.sh T5 (red at 25, green at 3).
+
+## FC-81 Scanner invoked in a test inherits stdin and reads the CI plan instead of _NM_FILES (MAIN-REDS-1134)
+- User saw: Tests red on main 082cd57a4 (shard 11): tests/test-nomock-data-render.sh "extension resolution must be deterministic across Python hash seeds", 67 passed 1 failed.
+- Law: a probe must use the transport the product uses; an inherited stdin is an input.
+- Cause (measured): no_mock_scan.py reads stdin first and falls back to _NM_FILES. The seed loop passed only _NM_FILES, so under the fast-gate runner loop (`done <"$plan"`) the scanner consumed plan lines as the changed-file list, found no hit and printed PASS. Hash seeds were never the cause. Reproduced locally: running the suite with a non-empty file on stdin gave exactly 67/1; with stdin from the terminal it passed.
+- Siblings swept: verify.sh and completion-council.sh already pipe the list on stdin; the three stdin-shape probes in the same suite already set stdin explicitly.
+- Mechanism: the seed loop feeds the list via here-string on stdin (the production transport). The scanner's extension order is already an explicit tuple.
+- Fixture: tests/test-nomock-data-render.sh run with `< nonempty-file`: 67/1 before, 68/0 after.
+
+## FC-85 FC-71 changed the promote smoke contract but left the older sibling test stale (RED-NEXTTAG)
+- User saw: CI Tests red on main 082cd57a4, suite "release publishes to npm next; promote.yml gates latest on the first-run gate (A-01)": 3 failed, 60 passed in tests/test_release_next_tag.py.
+- Law: a contract change updates every test that pins the old contract; a guard is rewritten to the new contract, never deleted or weakened.
+- Cause (measured): FC-71 (04905f46c) intentionally taught promote.yml's smoke gate to also accept a workflow_run-event run whose head_sha equals the released commit. Three tests still asserted the old rule (head_sha is never a key; untitled workflow_run runs fail closed; no ".head_sha" in the select). The PROMOTE-SMOKE-SHA merge ran only its own direct suite (test-promote-smoke-sha.sh); the sibling pytest was already registered in tests/run-all-tests.sh and tests/shard-durations.tsv, so the full-suite CI Tests was the first to report it.
+- Siblings swept: nightly and Tests gates in promote.yml (structure tests PromoteNightlyGate unchanged and green); no other test greps promote.yml for ".head_sha".
+- Mechanism: the tests now assert the new contract: head_sha counts only with event == "workflow_run" and equality to the released commit; dispatch, push and schedule events, a different head_sha, and an empty list still fail closed; the reader test requires exactly one .head_sha, inside the workflow_run clause.
+- Fixture: tests/test_release_next_tag.py. Mutation: removing the event restriction in promote.yml turns 3 tests red; restored it is 64 passed.
+
+## FC-83 A privacy test spawned real runners and a dashboard install, riding its caps until the shard timed out (RED-FUNNEL)
+- User saw: Tests red on main 082cd57a4 (shard 9): tests/test-funnel-privacy.sh FAIL rc=124 past the item limit (est 8s); the log shows three 26s gaps (telemetry-off, DO_NOT_TRACK, analytics-off), a 13s gap on bare `loki`, then `rm: cannot remove .../fx/.loki: Directory not empty`.
+- Law: a test must not depend on the host's login state, network or a detached process; every child it starts must exit by its own means, not by the cap.
+- Cause (measured): (1) the stub `claude` exited 1 for every call, so on Linux the login state is "unknown" (fails open) and `loki start` entered the real runner, a retry loop that ignores SIGTERM: timeout -k 5 20 = 25s per case (reproduced locally with LOKI_SKIP_AUTH_PREFLIGHT=1: rc=137 elapsed=25s; the macOS keychain made the preflight refuse in 1s and hid it). The runner also bootstrapped caveman through npx (network). (2) bare `loki` runs cmd_ui: control serve, then the classic dashboard with a venv pip install on the fresh HOME and a detached dashboard server (rc=124 at the 20s cap, server left behind, racing the sandbox rm -rf). (3) the Bun route case rides its cap by design.
+- Siblings swept: every cap_command and run_cli call site in the suite (3 telemetry cases, disclosure_start, once, route_bash all go through the stub; route_bash already refuses at the preflight).
+- Mechanism: the stub `claude` answers `auth status` with loggedIn false so the preflight refuses at once on every platform; run_cli sets LOKI_CONTROL=0 and LOKI_UI_NO_CLASSIC=1 so bare loki starts nothing; cap_command takes CAP_SECS and the Bun route case uses 8s.
+- Fixture: tests/test-funnel-privacy.sh itself. Measured locally: bare loki rc=124 at 20s before, 0s after; suite 51s before, 19-20s after (3 runs, rc=0).
+
+## FC-86 A plan far above the shard cap overflowed every shard with no fail-safe (PLAN-OVERFLOW)
+- User saw: main red. Tests runs 37852209020 (4f8b6386b) and 37851435720 (4511d9f32) lost "Impacted suites" shards 6, 8 and 10 to the job's timeout-minutes: 6 ("The operation was canceled"); shard 8 was about 60% through its pytest run. The plan log read "fast-gate: base=v11.3.2 head=HEAD files=85 planned=1086".
+- Law: a bounded resource needs a fail-safe path when the input exceeds the bound; an over-capacity plan must go FULL, never be packed into shards that cannot finish.
+- Cause (measured): the packer sets n = min(MAX_SHARDS=12, ceil(total/SHARD_TARGET_S=60)). When total is far above 12*60s the min silently clamps n, so every shard carries more than the target and overflows the 6 minute job cap. Nothing in the plan path checked the clamp.
+- Siblings swept: the other plan bounds each already have a FULL row (unparseable-diff, empty-diff, too-many-files at 150, selector-failed, selector-answered-R0, global-guards-unreadable) and the plan step timeout forces full=true on a nonzero rc; the shard count was the one bounded quantity without one.
+- Mechanism: in the python packer, ceil(total/target) > maxs writes the single row "FULL\tplan-over-capacity\t0\t0" (write_matrix then emits full=true and full-suite.yml runs) and prints total, target and maxs on stderr. Timeouts, MAX_SHARDS and SHARD_TARGET_S defaults are unchanged.
+- Fixture: tests/test-fast-gate.sh PLAN-OVERFLOW (FAST_GATE_MAX_SHARDS=1, FAST_GATE_SHARD_TARGET_S=1 gives FULL and full=true; default env on the same diff gives no FULL).
+
+## FC-87 A guard keyed on literal text missed a helper wrapping the same behavior (ENVGUARD-PLAINENV)
+- User saw: main red. Full suite / Bun tests failed loki-ts/tests/util/full_env_spawn_guard.test.ts on 9fcd59459 with mismatched [runner/load_owner.ts, engine10/stages/verify.ts, engine10/stages/wall.ts].
+- Law: a guard that detects a behavior by its literal spelling must also recognize every helper that performs the same behavior, and the helper must itself enforce the property the guard protects; a refactor to a helper must not make the guard blind.
+- Cause (measured): 34fea2c3f (FC-69, WALL-COLOR) replaced `env: process.env` and `...process.env` with `plainTestEnv()` at one spawn site in each of the 3 files. plainTestEnv copied the full parent env (token family and SSH_AUTH_SOCK included) and the bareParent regex did not match it, so counts fell below the allowlist counts. Second defect found: the SAFE test ran over a 15 line window, so a later call's safe helper excused an earlier call's bare process.env (load_owner.ts pgrep).
+- Evidence: the engine10 worker env is built at engine10/supervisor.ts:136-137 (withholdGithubTokens, tokens become a sentinel, SSH_AUTH_SOCK deleted at runner/github_token.ts:229) and asserted at engine10/worker.ts:21-34, so stages/verify.ts and stages/wall.ts run token-withheld, except under the operator opt-out LOKI_ALLOW_AGENT_GITHUB_TOKEN=1. runner/load_owner.ts is also imported by project_model/package_suite.ts, outside the worker, so it was not provably token-withheld.
+- Mechanism: plainTestEnv (util/check_result.ts) now starts from tokenFreeEnv(base), so a test command never carries credentials; the guard treats plainTestEnv as token-free (SAFE) and a call window now ends at the next call line. Allowlist: verify.ts and wall.ts entries removed (0 violations), load_owner.ts@2 lowered to @1 (the pgrep call, still a real full-env spawn).
+- Fixture: tests/util/plain_test_env_tokens.test.ts (planted token family in the parent; plainTestEnv, a child, and a real Wall base run see none; red when plainTestEnv is mutated back to a full copy) and planted cases in full_env_spawn_guard.test.ts (raw process.env spawns still flag 1, plainTestEnv flags 0).
+- Sibling question (fast gate): the WALL-COLOR merge did not run this guard. scripts/select-tests.sh rule R4 maps a changed loki-ts/src file only to bun tests whose text contains that file's src-relative stem (for example engine10/stages/wall); full_env_spawn_guard.test.ts walks all of src and names none, so it is never selected, and the fast gate only runs bun typecheck for it. Not fixed here; a follow-up slice should make a loki-ts/src change select the walk-all-src guard tests.

package/docs/v10/PROGRESS.md

@@ -2303,3 +2303,9 @@ The swarm is stopped: .loki/V10-STOP exists, the loop has no wake-ups, and the c
 - Fix-forward NIGHTLY-COCKPIT (row FC-50, beforeAll warm-up + 30s render timeout, assertions unchanged): built f7f48a120, cockpit 26/0; TL round 1 BLOCK only on FC-47 id collision, r2 is the rename, in review. Then: merge, push, dispatch nightly, FULL rerun of 37774482965.
 - 11.3.2 train on local main (unpushed), now e18e4ca11: 12 earlier slices plus 133-B4..ER-01-r2, 133-E3-r2, SIGS-DOC (run-all-tests.sh registration union by hand), VPR-1-r2. UNDO-2-r2 merge reverted locally (tripped raw-gh and full-env spawn guards), r3 in HIGH review.
 - Product-code conflicts sent to engineers: XV-1 (seal.ts), MARK-1 (pr.ts), MASS-2 (queue.ts/pr.ts). BLOCKs back to engineers: MCP-D (unauthenticated HTTP task creation), VPR-2-r2 (gh authorAssociation field does not exist), T5-ATTEMPTS-PR-r2 (stale help line, r3 in review).
+
+## 2026-10-08 20:27Z CoS
+- v11.3.3 (eee891534) is on main; release run 37837110730 failed at required-ci. Tests 37837111102 at the bump SHA is red, and bump-only parent reuse was refused: "normalizer: not on the allowlist: deploy/helm/autonomi/Chart.yaml" (release.sh also bumps 2 more Chart.yaml files and docs/CLI-REFERENCE.md). Parent 54a519a22 Tests green; nightly 37836989262 at 54a519a22 green.
+- CTO split: (A) BUMP-REUSE HIGH slice (allowlist + bump-set subset guard + replay), then ship as 11.3.4. (B) RELGATE-REDS: 6 latent reds that guards_for("VERSION") selected (watch-command v6.33.0, manifest-truncation rc=2, quick-receipt-order rc=124, autonomy-and-stop OPTOUT, node_lint web-app rc=127, moat P2.verify-exit-contract); ships separately and does not block A. SEL follow-up: guards_for literal-string selection, LOW.
+- Promote 11.3.2: auto run 37838898754 blocked on the smoke lookup (the pre-run-name smoke 37833604487 is not matched by display_title). Dispatched smoke 37839153237 (v11.3.2) then promote.
+- WALL-SMOKE-GUARD merged into train-1132 at 5be544484 (rides with 11.3.4). WALL-COLOR engineer building.