loki-mode 11.3.4 → 11.3.6

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: An autonomous software factory that knows what it is supposed to deliver, and proves it did. Use when the user says Loki Mode or asks to build, fix or verify software autonomously.
 ---
 
-# Loki Mode v11.3.4
+# Loki Mode v11.3.6
 
 **Current entry points (Loki 10 engine):** `loki "<task>"`, `loki owner/repo#N` and `loki quick "<task>"` run the Loki 10 engine and end with a signed receipt (`loki verify`). `loki backlog owner/repo --all` runs many issues in parallel. Guide: `docs/v10/GUIDE.md`. The skill instructions below, and `loki start`, describe the previous bash loop. PRD-file starts (`loki start ./prd.md`) and the opencode provider still run on it until FC38-SWEEP ports them; the legacy-engine command and the LOKI_ENGINE switch remain removed. Prefer `loki owner/repo#N` for issues.
 
@@ -483,4 +483,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v11.3.4 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**
+**v11.3.6 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**

package/VERSION

@@ -1 +1 @@
-11.3.4
+11.3.6

package/autonomy/run.sh

@@ -5386,7 +5386,7 @@ except Exception:
 }
 
 #===============================================================================
-# Rule of Two (moat P9): a GitHub token never reaches an agent session via the
+# Rule of Two (moat P9): Loki never passes the GitHub token into the agent's environment via the
 # IMPLICIT resolution paths this module withholds (env vars, gh config store,
 # git credential.helper, SSH agent/ssh command). Not an absolute claim -- see
 # the disclosed residuals at the end of this header (an explicit named-account

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "11.3.4"
+__version__ = "11.3.6"
 
 # Expose the control app for easy import
 try:

package/docs/CLI-REFERENCE.md

@@ -1,6 +1,6 @@
 # CLI reference
 
-Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.3.4. Do not edit by hand.
+Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.3.6. Do not edit by hand.
 Hidden and legacy-only commands are omitted; see `docs/v10/CLI-MODERN.md` for the full inventory.
 
 | Command | Description |

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 Loki Mode, by [Autonomi](https://www.autonomi.dev/), turns a spec or an issue into a verified pull request with a receipt you can check. This page covers installing it, a first run, and the options around it.
 
-**Version:** v11.3.4
+**Version:** v11.3.6
 
 **Engine note:** `loki "<task>"`, `loki owner/repo#N` and `loki quick` run the Loki 10 engine. `loki start` still routes to the older engine, which is being removed; prefer `loki owner/repo#N`. See the [user guide](v10/GUIDE.md).
 

package/docs/environment-variables.md

@@ -134,7 +134,7 @@ banners you might expect. These variables control the remaining `[INFO]` and
 |---|---|---|
 | `LOKI_DURABLE_STATE` | `0` | `1` enables durable state **and** the richer process-exit contract that lets Kubernetes distinguish a deterministic failure from a crash. See [exit codes](./exit-codes.md). |
 | `LOKI_SDK_LOOP` | unset | Routes the run through the Bun/TypeScript runner instead of bash. Both implement the same exit contract. |
-| `LOKI_ALLOW_AGENT_GITHUB_TOKEN` | unset | By default `GH_TOKEN`, `GITHUB_TOKEN`, `GH_ENTERPRISE_TOKEN`, and `GITHUB_ENTERPRISE_TOKEN` are withheld from agent sessions. The two routes differ: on the bash route (`autonomy/run.sh`) the withheld tokens are re-granted only for Loki's own trusted calls, namely the `gh()` CLI wrapper, the `_loki_net` helper used by the optional local-PR path in `on_run_complete()`, the session-end `create_session_pr` call, and `autonomy/lib/proof-check.sh`'s network probe. On the Bun route (`loki-ts/src/runner/github_token.ts`'s `withholdGithubTokens()`) the tokens are dropped from the process outright, with no re-grant and no push/PR step of its own. Exactly `1` lets the agent inherit the tokens as before, on either route; that is a Rule of Two exposure, and a one-line stderr warning is printed. |
+| `LOKI_ALLOW_AGENT_GITHUB_TOKEN` | unset | By default `GH_TOKEN`, `GITHUB_TOKEN`, `GH_ENTERPRISE_TOKEN`, and `GITHUB_ENTERPRISE_TOKEN` are withheld from the agent's environment (the agent runs as the user, so OS keychain and credential files are not yet isolated; P9-ISOLATION is in design). The two routes differ: on the bash route (`autonomy/run.sh`) the withheld tokens are re-granted only for Loki's own trusted calls, namely the `gh()` CLI wrapper, the `_loki_net` helper used by the optional local-PR path in `on_run_complete()`, the session-end `create_session_pr` call, and `autonomy/lib/proof-check.sh`'s network probe. On the Bun route (`loki-ts/src/runner/github_token.ts`'s `withholdGithubTokens()`) the tokens are dropped from the process outright, with no re-grant and no push/PR step of its own. Exactly `1` lets the agent inherit the tokens as before, on either route; that is a Rule of Two exposure, and a one-line stderr warning is printed. |
 | `LOKI_AI_MARKING` | unset (off) | `1` (exactly) adds machine-readable trailers to the Loki commit (`AI-Generated: true`, `AI-Provider`, `AI-Model`, `Loki-Receipt`, after `Loki-Run`) and one `AI-Generated: true (...)` marker line under the verdict in the PR body. Values are single-line and bounded. Off, the commit and PR body are byte-identical to before. |
 
 `LOKI_DURABLE_STATE=1` is the one to set in a Job or task definition. Without

package/docs/v10/FAILURE-CLASSES.md

@@ -760,3 +760,29 @@ L0 review rule (ENGINE-LAWS.md L0): a fix that adds an `if` or a regex about the
 - Mechanism: plainTestEnv (util/check_result.ts) now starts from tokenFreeEnv(base), so a test command never carries credentials; the guard treats plainTestEnv as token-free (SAFE) and a call window now ends at the next call line. Allowlist: verify.ts and wall.ts entries removed (0 violations), load_owner.ts@2 lowered to @1 (the pgrep call, still a real full-env spawn).
 - Fixture: tests/util/plain_test_env_tokens.test.ts (planted token family in the parent; plainTestEnv, a child, and a real Wall base run see none; red when plainTestEnv is mutated back to a full copy) and planted cases in full_env_spawn_guard.test.ts (raw process.env spawns still flag 1, plainTestEnv flags 0).
 - Sibling question (fast gate): the WALL-COLOR merge did not run this guard. scripts/select-tests.sh rule R4 maps a changed loki-ts/src file only to bun tests whose text contains that file's src-relative stem (for example engine10/stages/wall); full_env_spawn_guard.test.ts walks all of src and names none, so it is never selected, and the fast gate only runs bun typecheck for it. Not fixed here; a follow-up slice should make a loki-ts/src change select the walk-all-src guard tests.
+
+## FC-89 A guard that walks all of loki-ts/src names no stem, so the fast gate never selected it (FASTGATE-GLOBAL-GUARDS)
+- User saw: WALL-COLOR (FC-69) reached main red; the diff-selected fast gate ran only a typecheck. Third miss of the CTO rule that global guards always run.
+- Law: a guard whose scope is the whole tree must be selected by what it is, not by which file changed; a selection keyed on a name in the test text cannot see a test that names nothing.
+- Cause (measured): R4 selects a bun test only if its text contains the changed file's src-relative stem. Tests such as budget.test.ts and l2_destructive_registry.test.ts (and pr_body_golden, session, term_width, project_model) read every file under loki-ts/src and name none, so a diff to engine10/stages/wall.ts never selected them. The hard-coded scripts/global-guards.tsv rows covered some guards by hand and rotted for the rest.
+- Siblings swept: every loki-ts/tests/**/*.test.ts that walks a src-rooted path (17 found, listed by the marker); three false positives that only walk tmp or tests dirs carry the audited opt-out.
+- Mechanism: a test that walks the src tree carries the line "// select: walk-all-src". scripts/select-tests.sh emit_marked_walkers finds them by content and emits each as an R8 row on every diff (skipping any already covered by a global-guards.tsv row or directory row), so a new walker needs no list edit.
+- Fixture: tests/test-select-tests.sh FC-89 (a diff touching only loki-ts/src/engine10/stages/wall.ts selects full_env_spawn_guard, fc25_raw_spawn_guard, l0_guard, spawn_env_guard, budget, l2_destructive_registry, never_below_raw; every marked file is selected; a completeness scan fails on any src-walking test with neither "select: walk-all-src" nor "select: not-src-walker (reason)"). Mutation: deleting the marker from l2_destructive_registry.test.ts turns it red on both the selection and the completeness check.
+
+## FC-90 Deleting the token env vars left the user's gh login and git credential helpers reachable (GH-KEYRING)
+- User saw: nothing yet (found by audit). With GH_TOKEN, GITHUB_TOKEN, GH_ENTERPRISE_TOKEN, GITHUB_ENTERPRISE_TOKEN and SSH_AUTH_SOCK removed, `gh auth token` exited 0 and `gh api user` returned the user's login on the founder machine, and git held `osxkeychain` plus `!gh auth git-credential` helpers over an HTTPS origin.
+- Law: P9 (agent and test code never holds the user's credential) is a property of every credential store a child can reach, not of the env vars alone; one shared mechanism builds the withheld env, so no env builder can delete a subset and call it token-free.
+- Cause (measured): tokenFreeEnv (util/safe_git.ts) and plainTestEnv (util/check_result.ts) only deleted the vars. gh then falls back to GH_CONFIG_DIR/hosts.yml and the OS keyring, and git calls its configured helpers on an HTTPS push. withholdGithubTokens already closed this for the worker, but only for the worker env. Measured with gh: GH_CONFIG_DIR alone leaves `gh auth token` exit 0 (keyring); a sentinel token alone makes `gh auth status` fail but a named-account read (`gh auth token --user`) still reads hosts.yml; both together close it.
+- Mechanism: util/credential_env.ts hardenCredentialEnv is the one function: the 4 vars become a non-working sentinel, GH_CONFIG_DIR is a per-process empty mode-700 directory, credential.helper is reset through GIT_CONFIG_COUNT/KEY/VALUE appended after existing entries (the user's gitconfig is never edited and identity survives), GIT_TERMINAL_PROMPT=0 and GCM_INTERACTIVE=never. tokenFreeEnv (so plainTestEnv, safeGitEnv) and withholdGithubTokens both call it; the LOKI_ALLOW_AGENT_GITHUB_TOKEN opt-out stays in withholdGithubTokens only, test envs are always hardened. The empty dir is made once per process (not per call), under LOKI_RUN_TMP when it is a real directory, else the OS temp dir, and removed by exact path at exit (the old per-call scoped dirs leaked).
+- Siblings swept: withholdGithubTokens (now shared), tokenFreeEnv callers (attempts, wall_snapshot, verify_pr, start), plainTestEnv callers (wall, verify, load_owner), the worker assertion (sentinel prefix now exported from credential_env.ts), and the bash route (_loki_withhold_github_tokens at autonomy/run.sh main() already sets the sentinel, a scoped GH_CONFIG_DIR, the helper reset and an EXIT trap removal). Raw `process.env` spawns elsewhere inherit an already-withheld process env (runner after autonomous.ts withholdGithubTokens, worker after supervisor.ts) and are policed by full_env_spawn_guard.
+- Fixture: tests/util/fc90_credential_env.test.ts (a fake HOME with a planted gh hosts.yml and a planted global git credential helper, each with a positive control on the raw env; red on the old tokenFreeEnv, red when the GH_CONFIG_DIR line, the credential.helper reset or the sentinel is removed; plus a count of loki-gh-config-* dirs in an isolated TMPDIR before and after).
+- CI note (fix-forward, cc8e17512 red on ubuntu): the named-account control `gh auth token --user` returned empty on gh for Linux because a flat hosts.yml is not read by a named lookup there (the multi-account `users:` shape is), while the default `gh auth token` reads only the flat one on the same gh. The fixture now probes the installed gh with each shape in a scratch home, plants the one that works in a separate named home, and skips the named-account test (control and hardened assertion together) when no shape works. Verified on ubuntu:24.04 with gh 2.102.0.
+- Residual: SSH keys under ~/.ssh and GIT_SSH_COMMAND are closed only for the worker env (withholdGithubTokens), not for plainTestEnv; a test command can still `ssh` with the user's default keys.
+
+## FC-88 The release gate repeated the Tests workflow's typecheck and bun suite on the same tree (WF-GATE-DEDUP)
+- User saw: every release waited 6m40s in release.yml's gate step "Bun typecheck + test (protect published loki-ts dist)" (run 37859034694, v11.3.4) for work the Tests workflow had already finished green on the same tree, or on the bump-only parent (FC-70).
+- Law: a gate does only what the verdict it depends on cannot; a second copy of a check is latency with no added safety, and it hides which check is the real one.
+- Cause (measured): the step ran `bun install`, `bun run typecheck` and the full `bun test` plus a Python and pytest setup for the Wall tests. Tests already runs tsc (test.yml "Typecheck loki-ts (tsc)", lines 193-195) and the bun suites (impacted shards, full-suite fallback), and `release` needs required-ci (release.yml, `needs: [gate, required-ci]`), whose REQUIRED list names Tests and accepts the parent verdict for a bump-only commit. The one thing Tests cannot see was never checked in the gate: that the committed dist is a fresh build of the release SHA and that the packed tarball carries it.
+- Siblings swept: publish-npm's pack check (release.yml "Pack once and verify the PACKED tarball", it also rebuilds through prepack; untouched), local-ci.sh's own typecheck and bun test (local tier, not a CI gate; untouched), version-bump-only reuse (unchanged), test.yml typecheck-build (kept as the single typecheck).
+- Mechanism: scripts/ci/verify-release-dist.sh. `build` rebuilds loki-ts/dist and compares all four files to the committed dist byte for byte, ignoring only the debugId; `tarball` does the same for the dist inside `npm pack --ignore-scripts`. The gate runs these two and nothing that Tests runs.
+- Fixture: tests/test-release-gate-dedup.sh (red when the gate reintroduces bun test, pytest or typecheck, loses either dist check, when release stops needing required-ci, or when required-ci stops requiring Tests; plus verifier behavior on a debugId-only tarball and a real byte difference).

package/docs/v10/GUARDS.md

@@ -868,3 +868,10 @@ previously mismarked two merged guards (S-16, S-74) as PENDING.
 - **The test that proves it fires:** `tests/test-select-tests.sh` (R8 cases):
   an attempts.ts-only diff and a docs-only diff each select every declared
   guard. Run: `bash tests/test-select-tests.sh`.
+
+## 23. Deleting the token env vars left gh and git credential stores reachable (GH-KEYRING, FC-90)
+
+- **Incident:** with the token vars removed, `gh auth token` still returned the user's login via the keyring and git still ran osxkeychain and gh credential helpers; tokenFreeEnv and plainTestEnv did nothing about either.
+- **Root cause:** each env builder deleted a subset of credential paths itself; only the worker env reset the rest.
+- **Guard:** `loki-ts/tests/util/fc90_credential_env.test.ts` plants a fake gh hosts.yml and a fake global git credential helper in a fake HOME, proves the raw env sees them, and proves an env from plainTestEnv does not; it also pins the one-dir-per-process GH_CONFIG_DIR lifecycle. It lives in loki-ts/tests/util, which `scripts/global-guards.tsv` already selects on every diff.
+- **The test that proves it fires:** removing the GH_CONFIG_DIR line, the credential.helper reset or the sentinel from `loki-ts/src/util/credential_env.ts` turns it red. Run: `cd loki-ts && bun test tests/util/fc90_credential_env.test.ts`.