loki-mode 11.3.5 → 11.3.6

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: An autonomous software factory that knows what it is supposed to deliver, and proves it did. Use when the user says Loki Mode or asks to build, fix or verify software autonomously.
 ---
 
-# Loki Mode v11.3.5
+# Loki Mode v11.3.6
 
 **Current entry points (Loki 10 engine):** `loki "<task>"`, `loki owner/repo#N` and `loki quick "<task>"` run the Loki 10 engine and end with a signed receipt (`loki verify`). `loki backlog owner/repo --all` runs many issues in parallel. Guide: `docs/v10/GUIDE.md`. The skill instructions below, and `loki start`, describe the previous bash loop. PRD-file starts (`loki start ./prd.md`) and the opencode provider still run on it until FC38-SWEEP ports them; the legacy-engine command and the LOKI_ENGINE switch remain removed. Prefer `loki owner/repo#N` for issues.
 
@@ -483,4 +483,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v11.3.5 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**
+**v11.3.6 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**

package/VERSION

@@ -1 +1 @@
-11.3.5
+11.3.6

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "11.3.5"
+__version__ = "11.3.6"
 
 # Expose the control app for easy import
 try:

package/docs/CLI-REFERENCE.md

@@ -1,6 +1,6 @@
 # CLI reference
 
-Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.3.5. Do not edit by hand.
+Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.3.6. Do not edit by hand.
 Hidden and legacy-only commands are omitted; see `docs/v10/CLI-MODERN.md` for the full inventory.
 
 | Command | Description |

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 Loki Mode, by [Autonomi](https://www.autonomi.dev/), turns a spec or an issue into a verified pull request with a receipt you can check. This page covers installing it, a first run, and the options around it.
 
-**Version:** v11.3.5
+**Version:** v11.3.6
 
 **Engine note:** `loki "<task>"`, `loki owner/repo#N` and `loki quick` run the Loki 10 engine. `loki start` still routes to the older engine, which is being removed; prefer `loki owner/repo#N`. See the [user guide](v10/GUIDE.md).
 

package/docs/v10/FAILURE-CLASSES.md

@@ -768,3 +768,21 @@ L0 review rule (ENGINE-LAWS.md L0): a fix that adds an `if` or a regex about the
 - Siblings swept: every loki-ts/tests/**/*.test.ts that walks a src-rooted path (17 found, listed by the marker); three false positives that only walk tmp or tests dirs carry the audited opt-out.
 - Mechanism: a test that walks the src tree carries the line "// select: walk-all-src". scripts/select-tests.sh emit_marked_walkers finds them by content and emits each as an R8 row on every diff (skipping any already covered by a global-guards.tsv row or directory row), so a new walker needs no list edit.
 - Fixture: tests/test-select-tests.sh FC-89 (a diff touching only loki-ts/src/engine10/stages/wall.ts selects full_env_spawn_guard, fc25_raw_spawn_guard, l0_guard, spawn_env_guard, budget, l2_destructive_registry, never_below_raw; every marked file is selected; a completeness scan fails on any src-walking test with neither "select: walk-all-src" nor "select: not-src-walker (reason)"). Mutation: deleting the marker from l2_destructive_registry.test.ts turns it red on both the selection and the completeness check.
+
+## FC-90 Deleting the token env vars left the user's gh login and git credential helpers reachable (GH-KEYRING)
+- User saw: nothing yet (found by audit). With GH_TOKEN, GITHUB_TOKEN, GH_ENTERPRISE_TOKEN, GITHUB_ENTERPRISE_TOKEN and SSH_AUTH_SOCK removed, `gh auth token` exited 0 and `gh api user` returned the user's login on the founder machine, and git held `osxkeychain` plus `!gh auth git-credential` helpers over an HTTPS origin.
+- Law: P9 (agent and test code never holds the user's credential) is a property of every credential store a child can reach, not of the env vars alone; one shared mechanism builds the withheld env, so no env builder can delete a subset and call it token-free.
+- Cause (measured): tokenFreeEnv (util/safe_git.ts) and plainTestEnv (util/check_result.ts) only deleted the vars. gh then falls back to GH_CONFIG_DIR/hosts.yml and the OS keyring, and git calls its configured helpers on an HTTPS push. withholdGithubTokens already closed this for the worker, but only for the worker env. Measured with gh: GH_CONFIG_DIR alone leaves `gh auth token` exit 0 (keyring); a sentinel token alone makes `gh auth status` fail but a named-account read (`gh auth token --user`) still reads hosts.yml; both together close it.
+- Mechanism: util/credential_env.ts hardenCredentialEnv is the one function: the 4 vars become a non-working sentinel, GH_CONFIG_DIR is a per-process empty mode-700 directory, credential.helper is reset through GIT_CONFIG_COUNT/KEY/VALUE appended after existing entries (the user's gitconfig is never edited and identity survives), GIT_TERMINAL_PROMPT=0 and GCM_INTERACTIVE=never. tokenFreeEnv (so plainTestEnv, safeGitEnv) and withholdGithubTokens both call it; the LOKI_ALLOW_AGENT_GITHUB_TOKEN opt-out stays in withholdGithubTokens only, test envs are always hardened. The empty dir is made once per process (not per call), under LOKI_RUN_TMP when it is a real directory, else the OS temp dir, and removed by exact path at exit (the old per-call scoped dirs leaked).
+- Siblings swept: withholdGithubTokens (now shared), tokenFreeEnv callers (attempts, wall_snapshot, verify_pr, start), plainTestEnv callers (wall, verify, load_owner), the worker assertion (sentinel prefix now exported from credential_env.ts), and the bash route (_loki_withhold_github_tokens at autonomy/run.sh main() already sets the sentinel, a scoped GH_CONFIG_DIR, the helper reset and an EXIT trap removal). Raw `process.env` spawns elsewhere inherit an already-withheld process env (runner after autonomous.ts withholdGithubTokens, worker after supervisor.ts) and are policed by full_env_spawn_guard.
+- Fixture: tests/util/fc90_credential_env.test.ts (a fake HOME with a planted gh hosts.yml and a planted global git credential helper, each with a positive control on the raw env; red on the old tokenFreeEnv, red when the GH_CONFIG_DIR line, the credential.helper reset or the sentinel is removed; plus a count of loki-gh-config-* dirs in an isolated TMPDIR before and after).
+- CI note (fix-forward, cc8e17512 red on ubuntu): the named-account control `gh auth token --user` returned empty on gh for Linux because a flat hosts.yml is not read by a named lookup there (the multi-account `users:` shape is), while the default `gh auth token` reads only the flat one on the same gh. The fixture now probes the installed gh with each shape in a scratch home, plants the one that works in a separate named home, and skips the named-account test (control and hardened assertion together) when no shape works. Verified on ubuntu:24.04 with gh 2.102.0.
+- Residual: SSH keys under ~/.ssh and GIT_SSH_COMMAND are closed only for the worker env (withholdGithubTokens), not for plainTestEnv; a test command can still `ssh` with the user's default keys.
+
+## FC-88 The release gate repeated the Tests workflow's typecheck and bun suite on the same tree (WF-GATE-DEDUP)
+- User saw: every release waited 6m40s in release.yml's gate step "Bun typecheck + test (protect published loki-ts dist)" (run 37859034694, v11.3.4) for work the Tests workflow had already finished green on the same tree, or on the bump-only parent (FC-70).
+- Law: a gate does only what the verdict it depends on cannot; a second copy of a check is latency with no added safety, and it hides which check is the real one.
+- Cause (measured): the step ran `bun install`, `bun run typecheck` and the full `bun test` plus a Python and pytest setup for the Wall tests. Tests already runs tsc (test.yml "Typecheck loki-ts (tsc)", lines 193-195) and the bun suites (impacted shards, full-suite fallback), and `release` needs required-ci (release.yml, `needs: [gate, required-ci]`), whose REQUIRED list names Tests and accepts the parent verdict for a bump-only commit. The one thing Tests cannot see was never checked in the gate: that the committed dist is a fresh build of the release SHA and that the packed tarball carries it.
+- Siblings swept: publish-npm's pack check (release.yml "Pack once and verify the PACKED tarball", it also rebuilds through prepack; untouched), local-ci.sh's own typecheck and bun test (local tier, not a CI gate; untouched), version-bump-only reuse (unchanged), test.yml typecheck-build (kept as the single typecheck).
+- Mechanism: scripts/ci/verify-release-dist.sh. `build` rebuilds loki-ts/dist and compares all four files to the committed dist byte for byte, ignoring only the debugId; `tarball` does the same for the dist inside `npm pack --ignore-scripts`. The gate runs these two and nothing that Tests runs.
+- Fixture: tests/test-release-gate-dedup.sh (red when the gate reintroduces bun test, pytest or typecheck, loses either dist check, when release stops needing required-ci, or when required-ci stops requiring Tests; plus verifier behavior on a debugId-only tarball and a real byte difference).

package/docs/v10/GUARDS.md

@@ -868,3 +868,10 @@ previously mismarked two merged guards (S-16, S-74) as PENDING.
 - **The test that proves it fires:** `tests/test-select-tests.sh` (R8 cases):
   an attempts.ts-only diff and a docs-only diff each select every declared
   guard. Run: `bash tests/test-select-tests.sh`.
+
+## 23. Deleting the token env vars left gh and git credential stores reachable (GH-KEYRING, FC-90)
+
+- **Incident:** with the token vars removed, `gh auth token` still returned the user's login via the keyring and git still ran osxkeychain and gh credential helpers; tokenFreeEnv and plainTestEnv did nothing about either.
+- **Root cause:** each env builder deleted a subset of credential paths itself; only the worker env reset the rest.
+- **Guard:** `loki-ts/tests/util/fc90_credential_env.test.ts` plants a fake gh hosts.yml and a fake global git credential helper in a fake HOME, proves the raw env sees them, and proves an env from plainTestEnv does not; it also pins the one-dir-per-process GH_CONFIG_DIR lifecycle. It lives in loki-ts/tests/util, which `scripts/global-guards.tsv` already selects on every diff.
+- **The test that proves it fires:** removing the GH_CONFIG_DIR line, the credential.helper reset or the sentinel from `loki-ts/src/util/credential_env.ts` turns it red. Run: `cd loki-ts && bun test tests/util/fc90_credential_env.test.ts`.