loki-mode 11.3.5 → 11.3.7

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: An autonomous software factory that knows what it is supposed to deliver, and proves it did. Use when the user says Loki Mode or asks to build, fix or verify software autonomously.
 ---
 
-# Loki Mode v11.3.5
+# Loki Mode v11.3.7
 
 **Current entry points (Loki 10 engine):** `loki "<task>"`, `loki owner/repo#N` and `loki quick "<task>"` run the Loki 10 engine and end with a signed receipt (`loki verify`). `loki backlog owner/repo --all` runs many issues in parallel. Guide: `docs/v10/GUIDE.md`. The skill instructions below, and `loki start`, describe the previous bash loop. PRD-file starts (`loki start ./prd.md`) and the opencode provider still run on it until FC38-SWEEP ports them; the legacy-engine command and the LOKI_ENGINE switch remain removed. Prefer `loki owner/repo#N` for issues.
 
@@ -483,4 +483,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v11.3.5 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**
+**v11.3.7 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**

package/VERSION

@@ -1 +1 @@
-11.3.5
+11.3.7

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "11.3.5"
+__version__ = "11.3.7"
 
 # Expose the control app for easy import
 try:

package/docs/CLI-REFERENCE.md

@@ -1,6 +1,6 @@
 # CLI reference
 
-Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.3.5. Do not edit by hand.
+Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.3.7. Do not edit by hand.
 Hidden and legacy-only commands are omitted; see `docs/v10/CLI-MODERN.md` for the full inventory.
 
 | Command | Description |

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 Loki Mode, by [Autonomi](https://www.autonomi.dev/), turns a spec or an issue into a verified pull request with a receipt you can check. This page covers installing it, a first run, and the options around it.
 
-**Version:** v11.3.5
+**Version:** v11.3.7
 
 **Engine note:** `loki "<task>"`, `loki owner/repo#N` and `loki quick` run the Loki 10 engine. `loki start` still routes to the older engine, which is being removed; prefer `loki owner/repo#N`. See the [user guide](v10/GUIDE.md).
 

package/docs/v10/BOARD.md

@@ -879,7 +879,7 @@ Source: ~/git/autonomi-dev/research/2026-09-30-adoption/SWARM-PROMPT-ADOPTION.md
 | CP-START | FC-20 (LATER list): root-cause the CP home Start "HTTP 404" (route mismatch, stale CP process serving a newer UI, or the loopback guard) and fix it at the shared layer (UI and server version match; a stale CP restarts or refuses a newer UI); never show a bare HTTP status, show a sentence with the next step; repo chip lists registered repos by name plus Browse; choosing a smaller model shows one muted line ("haiku: fastest, may be less accurate") and never blocks. The composer itself is redefined by CP-ASK (founder 22:03Z): greenfield-from-composer is dropped | packages/control-plane server and ui plus tests | MEDIUM | a forced 404 renders a sentence, a version-skewed UI gets the restart sentence | ready@2026-10-03T22:05Z | Founder bug via steering 22:01Z, rescoped by founder 22:03Z. Do not displace FC-15 or FC-16. |
 | CP-ASK | Founder 22:03Z: "we are not a vibe coding tool". The CP home box becomes Ask Loki: search, learn, compare runs, and ask anything about Loki Mode, past runs, receipts, repos and issues. Default provider claude (or any configured provider and model the user picks); the model gets all of that data (read-only tools or MCP over runs, receipts, events, METRICS, repos, gh issues and PRs); answers are async jobs the user can leave and come back to, listed in the CP. Read-only: Ask never edits a repo or starts a build | Architect slices first (10-40 slices, feature flag); packages/control-plane routes and ui, a read-only data layer, provider invocation | HIGH | the founder asks "compare my last two runs on FireLater" and gets a cited answer async in the CP; Ask cannot write to any repo | building@2026-10-04T00:06Z | Plan docs/v10/CP-ASK-PLAN.md (15 slices behind LOKI_CP_ASK=1, waves {1,4,6,8} {2,5,7} {3,9} 10 11 {12,13} 14 15); founder questions decided as FOUNDER-QUEUE row 20. Slice 1 (MCP read-only mode) seated. Founder direct directive 22:03Z. Architect plan first. | 00:33Z: slices 1 (9f454444a, plus fix-forward F1/F2 7bcffc70f, opus APPROVE), 4 (2a0ad3fc1) and 8 (d1b38e508) merged; flag off; next wave 2/5/6/7. 
 | FC-21 | FC-21: (a) a limit in implement still runs verify on the existing work plus the fix rounds the budget allows, never seal directly; (b) the run cap scales with task size (sizing and Project Model), with a generous subscription default set in loki.yaml; (c) implement is told its remaining time; (d) the CLI summary, CP and PR body read receipt.verdict (one outcome) | loki-ts/src/engine10 run orchestration, the budget and sizing modules, the CLI summary, plus tests | MEDIUM | a fake implement limit is followed by verify; CLI outcome equals receipt.verdict for 4 verdicts; a large task gets a larger cap; core cap under 5000 | released@2026-10-03T23:33Z | Released in v10.10.5. FireLater#17 gate on 10.10.3 PARTIAL (steering 22:08Z). P0 tier with FC-16/FC-15. Built 21fec9deb; opus review-fc21 APPROVE on merge e80abc63a (suites 1719/0, budget 27/0, tsc rc=0 with real node_modules); merged 881f1275f. Advisories A1-A4 filed as FC-21b. Ships in one train with FC-15 and FC-16. |
-| FC-21b | FC-21 follow-ups, next train (steering 23:00Z): (1) an implement limit forces PARTIAL only while checks are red or unrun; if the fix rounds make the impacted checks green with n>0 the run earns VERIFIED (L3: what ran is the evidence, not how long implement took); (2) size the run cap from the Project Model and plan (packages and files touched) or a plan-session estimate, never from task-text character count (L0); (3) the CLI outcome must equal receipt.verdict, so a cap stop after a limit cannot print BUDGET_STOP over a PARTIAL or FAILED receipt (L7, was advisory A4); (A1) machine.ts:145 mustJump keys on reason limit only, require r.killed too; (A2) a spec-conflict resume gets the full original budget in the time note and limitS, and the note lands after FINISH_LINE; (A3) yamlRunCapS matches run_cap_s at any depth under budgets, CRLF yaml falls back silently, ls-files count off by one | loki-ts/src/engine10/machine.ts, stages/implement.ts, stages/seal.ts, output.ts, src/util/run_cap.ts, project_model sizing, plus tests | HIGH | a limit then fix-green with n>0 seals VERIFIED, a limit with a red or unrun check seals PARTIAL; the cap for a short task touching many packages exceeds the cap for one file; CLI outcome equals receipt.verdict on a cap stop after a limit; a thrown limit without a kill never reaches VERIFIED; nested per_stage run_cap_s is ignored; a resumed implement gets the remaining time | building@2026-10-03T23:59Z | Plan docs/v10/FC21B-FC22-PLAN.md (slices S1 graph+yaml_key, S5 cap sizing, S4 verdict+L7+A1+A2; S4 last). From review-fc21 22:53Z plus steering 23:00Z. HIGH because it changes the verdict rule (opus reviewer). Architect plan first for the sizing source. e10ext is 1 line under its 1500 cap. Queue after the FireLater#17 gate on 10.10.4. |
+| FC-21b | FC-21 follow-ups, next train (steering 23:00Z): (1) an implement limit forces PARTIAL only while checks are red or unrun; if the fix rounds make the impacted checks green with n>0 the run earns VERIFIED (L3: what ran is the evidence, not how long implement took); (2) size the run cap from the Project Model and plan (packages and files touched) or a plan-session estimate, never from task-text character count (L0); (3) the CLI outcome must equal receipt.verdict, so a cap stop after a limit cannot print BUDGET_STOP over a PARTIAL or FAILED receipt (L7, was advisory A4); (A1) machine.ts:145 mustJump keys on reason limit only, require r.killed too; (A2) a spec-conflict resume gets the full original budget in the time note and limitS, and the note lands after FINISH_LINE; (A3) yamlRunCapS matches run_cap_s at any depth under budgets, CRLF yaml falls back silently, ls-files count off by one | loki-ts/src/engine10/machine.ts, stages/implement.ts, stages/seal.ts, output.ts, src/util/run_cap.ts, project_model sizing, plus tests | HIGH | a limit then fix-green with n>0 seals VERIFIED, a limit with a red or unrun check seals PARTIAL; the cap for a short task touching many packages exceeds the cap for one file; CLI outcome equals receipt.verdict on a cap stop after a limit; a thrown limit without a kill never reaches VERIFIED; nested per_stage run_cap_s is ignored; a resumed implement gets the remaining time | released@2026-10-04T02:52Z | Plan docs/v10/FC21B-FC22-PLAN.md (slices S1 graph+yaml_key, S5 cap sizing, S4 verdict+L7+A1+A2; S4 last). From review-fc21 22:53Z plus steering 23:00Z. HIGH because it changes the verdict rule (opus reviewer). Architect plan first for the sizing source. e10ext is 1 line under its 1500 cap. Queue after the FireLater#17 gate on 10.10.4. |
 | FC-16b | FC-16 follow-ups: package_suite.ts:33 detects go by first token only (make test, GOFLAGS=x go test fall to the generic path); go -json parsing; load_owner killTree process-group kill; unittest atexit forged trailer | loki-ts/src/engine10 package_suite, load_owner, test classify, plus tests | MEDIUM | make test wrapping go test classifies with runner go; a forged unittest trailer from atexit is not a pass | merged@2026-10-04T00:55Z | Engineer fix-fc16b in worktree. From review-fc16-fc02-integ rounds 4-6. package_suite results never feed seal proof today. Also owed: an end-to-end test running a go Wall file through RealBaseTestRunner (the seal.test.ts case does not guard wall.ts). | 00:33Z: review-fc16b BLOCKED 1b3f594cb (forged go events, unittest multi-Ran); fix 626b46c74 in opus re-review. 
 | FC-22 | FC-22: (a) impacted-test selection is scoped by the Project Model, touched packages plus their real dependents (manifest or import edges), never every package; (b) a selected package with no installed deps gets the Project Model's own install command run once before verify, recorded as a check with its cwd, opt-out by config | loki-ts/src/e10ext/select.ts, project_model resolve and gather, engine10 verify pre-step, plus tests | HIGH | a backend-only change in the monorepo-fc01 fixture selects no frontend test; a selected package without node_modules gets one recorded install check; no guessed command; e10ext under 1500 | merged@2026-10-04T01:08Z | Plan docs/v10/FC21B-FC22-PLAN.md (S1 then S2 selection and S3 install). FireLater#17 gate on 10.10.5 (run e10-20261003T233414Z-30ca) PARTIAL only from 4 over-selected frontend tests (steering 23:47Z). HIGH because selection feeds verify proof. Architect plan first; e10ext is 1 line under its cap. Next train with FC-21b and FC-23. | 00:33Z: S1 merged 88e9e43fb (review-s1 APPROVE). S2 e9e04fe1d in opus review-s2; S3 cb6486550 in opus review-s3. 01:08Z: S3 merged 736f4d436 (review-s3 APPROVE on d2e61c2ff, 3627/0, tsc 0; discard.ts L2 tension to CTO). S2 merged b4022e6fb (review-s2 APPROVE on a62aba7b2, 3624/0, tsc 0) behind LOKI_E10_SCOPE default off. Before the flag flips: F1 root-owned keep test with a non-relative import, F2 verify test.scoped_out event test. The install library is wired by S4. 
-| FC-23 | FC-23: the Wall writes tests matching the package's module system and test conventions from the Project Model; a lint or type error inside a Wall file is harness-owned, the Wall file is regenerated once or discarded with a NOT PROVEN note, and no fix round is spent on it | loki-ts/src/engine10/stages/wall.ts, the fix-round target filter, project_model conventions, plus tests | MEDIUM | a CommonJS package gets a Wall test with no import.meta; a forced type error in a Wall file yields regenerate-or-discard and zero fix rounds | building@2026-10-03T23:59Z | released@2026-10-04T00:51Z | Merged c0a1c43c2 (38c782386, review-fc23 sonnet APPROVE; nits: duplicate NOT PROVEN line for a discarded file, merged comment in verify.ts). 
+| FC-23 | FC-23: the Wall writes tests matching the package's module system and test conventions from the Project Model; a lint or type error inside a Wall file is harness-owned, the Wall file is regenerated once or discarded with a NOT PROVEN note, and no fix round is spent on it | loki-ts/src/engine10/stages/wall.ts, the fix-round target filter, project_model conventions, plus tests | MEDIUM | a CommonJS package gets a Wall test with no import.meta; a forced type error in a Wall file yields regenerate-or-discard and zero fix rounds | released@2026-10-04T00:51Z | released@2026-10-04T00:51Z | Merged c0a1c43c2 (38c782386, review-fc23 sonnet APPROVE; nits: duplicate NOT PROVEN line for a discarded file, merged comment in verify.ts). 

package/docs/v10/FAILURE-CLASSES.md

@@ -768,3 +768,30 @@ L0 review rule (ENGINE-LAWS.md L0): a fix that adds an `if` or a regex about the
 - Siblings swept: every loki-ts/tests/**/*.test.ts that walks a src-rooted path (17 found, listed by the marker); three false positives that only walk tmp or tests dirs carry the audited opt-out.
 - Mechanism: a test that walks the src tree carries the line "// select: walk-all-src". scripts/select-tests.sh emit_marked_walkers finds them by content and emits each as an R8 row on every diff (skipping any already covered by a global-guards.tsv row or directory row), so a new walker needs no list edit.
 - Fixture: tests/test-select-tests.sh FC-89 (a diff touching only loki-ts/src/engine10/stages/wall.ts selects full_env_spawn_guard, fc25_raw_spawn_guard, l0_guard, spawn_env_guard, budget, l2_destructive_registry, never_below_raw; every marked file is selected; a completeness scan fails on any src-walking test with neither "select: walk-all-src" nor "select: not-src-walker (reason)"). Mutation: deleting the marker from l2_destructive_registry.test.ts turns it red on both the selection and the completeness check.
+
+## FC-90 Deleting the token env vars left the user's gh login and git credential helpers reachable (GH-KEYRING)
+- User saw: nothing yet (found by audit). With GH_TOKEN, GITHUB_TOKEN, GH_ENTERPRISE_TOKEN, GITHUB_ENTERPRISE_TOKEN and SSH_AUTH_SOCK removed, `gh auth token` exited 0 and `gh api user` returned the user's login on the founder machine, and git held `osxkeychain` plus `!gh auth git-credential` helpers over an HTTPS origin.
+- Law: P9 (agent and test code never holds the user's credential) is a property of every credential store a child can reach, not of the env vars alone; one shared mechanism builds the withheld env, so no env builder can delete a subset and call it token-free.
+- Cause (measured): tokenFreeEnv (util/safe_git.ts) and plainTestEnv (util/check_result.ts) only deleted the vars. gh then falls back to GH_CONFIG_DIR/hosts.yml and the OS keyring, and git calls its configured helpers on an HTTPS push. withholdGithubTokens already closed this for the worker, but only for the worker env. Measured with gh: GH_CONFIG_DIR alone leaves `gh auth token` exit 0 (keyring); a sentinel token alone makes `gh auth status` fail but a named-account read (`gh auth token --user`) still reads hosts.yml; both together close it.
+- Mechanism: util/credential_env.ts hardenCredentialEnv is the one function: the 4 vars become a non-working sentinel, GH_CONFIG_DIR is a per-process empty mode-700 directory, credential.helper is reset through GIT_CONFIG_COUNT/KEY/VALUE appended after existing entries (the user's gitconfig is never edited and identity survives), GIT_TERMINAL_PROMPT=0 and GCM_INTERACTIVE=never. tokenFreeEnv (so plainTestEnv, safeGitEnv) and withholdGithubTokens both call it; the LOKI_ALLOW_AGENT_GITHUB_TOKEN opt-out stays in withholdGithubTokens only, test envs are always hardened. The empty dir is made once per process (not per call), under LOKI_RUN_TMP when it is a real directory, else the OS temp dir, and removed by exact path at exit (the old per-call scoped dirs leaked).
+- Siblings swept: withholdGithubTokens (now shared), tokenFreeEnv callers (attempts, wall_snapshot, verify_pr, start), plainTestEnv callers (wall, verify, load_owner), the worker assertion (sentinel prefix now exported from credential_env.ts), and the bash route (_loki_withhold_github_tokens at autonomy/run.sh main() already sets the sentinel, a scoped GH_CONFIG_DIR, the helper reset and an EXIT trap removal). Raw `process.env` spawns elsewhere inherit an already-withheld process env (runner after autonomous.ts withholdGithubTokens, worker after supervisor.ts) and are policed by full_env_spawn_guard.
+- Fixture: tests/util/fc90_credential_env.test.ts (a fake HOME with a planted gh hosts.yml and a planted global git credential helper, each with a positive control on the raw env; red on the old tokenFreeEnv, red when the GH_CONFIG_DIR line, the credential.helper reset or the sentinel is removed; plus a count of loki-gh-config-* dirs in an isolated TMPDIR before and after).
+- CI note (fix-forward, cc8e17512 red on ubuntu): the named-account control `gh auth token --user` returned empty on gh for Linux because a flat hosts.yml is not read by a named lookup there (the multi-account `users:` shape is), while the default `gh auth token` reads only the flat one on the same gh. The fixture now probes the installed gh with each shape in a scratch home, plants the one that works in a separate named home, and skips the named-account test (control and hardened assertion together) when no shape works. Verified on ubuntu:24.04 with gh 2.102.0.
+- Residual: SSH keys under ~/.ssh and GIT_SSH_COMMAND are closed only for the worker env (withholdGithubTokens), not for plainTestEnv; a test command can still `ssh` with the user's default keys.
+
+## FC-88 The release gate repeated the Tests workflow's typecheck and bun suite on the same tree (WF-GATE-DEDUP)
+- User saw: every release waited 6m40s in release.yml's gate step "Bun typecheck + test (protect published loki-ts dist)" (run 37859034694, v11.3.4) for work the Tests workflow had already finished green on the same tree, or on the bump-only parent (FC-70).
+- Law: a gate does only what the verdict it depends on cannot; a second copy of a check is latency with no added safety, and it hides which check is the real one.
+- Cause (measured): the step ran `bun install`, `bun run typecheck` and the full `bun test` plus a Python and pytest setup for the Wall tests. Tests already runs tsc (test.yml "Typecheck loki-ts (tsc)", lines 193-195) and the bun suites (impacted shards, full-suite fallback), and `release` needs required-ci (release.yml, `needs: [gate, required-ci]`), whose REQUIRED list names Tests and accepts the parent verdict for a bump-only commit. The one thing Tests cannot see was never checked in the gate: that the committed dist is a fresh build of the release SHA and that the packed tarball carries it.
+- Siblings swept: publish-npm's pack check (release.yml "Pack once and verify the PACKED tarball", it also rebuilds through prepack; untouched), local-ci.sh's own typecheck and bun test (local tier, not a CI gate; untouched), version-bump-only reuse (unchanged), test.yml typecheck-build (kept as the single typecheck).
+- Mechanism: scripts/ci/verify-release-dist.sh. `build` rebuilds loki-ts/dist and compares all four files to the committed dist byte for byte, ignoring only the debugId; `tarball` does the same for the dist inside `npm pack --ignore-scripts`. The gate runs these two and nothing that Tests runs.
+- Fixture: tests/test-release-gate-dedup.sh (red when the gate reintroduces bun test, pytest or typecheck, loses either dist check, when release stops needing required-ci, or when required-ci stops requiring Tests; plus verifier behavior on a debugId-only tarball and a real byte difference).
+
+## FC-99 Worktree sprawl exhausted the disk and stalled builds (AUTO-REAP)
+- User saw: .claude/worktrees grew to 377 worktrees / 56G (cap 15) on the founder's laptop; the volume hit 96% full and ENOSPC stalled builds.
+- Law: whatever creates a resource owns its removal; a count cap that only reports (WORKTREE_COUNT at 15) is a control nobody acts on.
+- Cause (measured): slice worktrees were created per slice and removed only by a manual scripts/prune-worktrees.sh run; nothing removed them on merge or abandonment, and nothing refused a new one when the disk was nearly full.
+- Siblings swept: prune-worktrees.sh (manual, 30 min safety model; kept as the conservative operator tool), the pulse WORKTREE_COUNT (report only), run.sh and sandbox.sh worktrees (inside user projects, not .claude/worktrees; unchanged).
+- Mechanism: scripts/v10-worktree-reap.sh removes (non-force, by exact path) clean worktrees merged into origin/main or idle past 6h by HEAD reflog mtime and not on an active BOARD row; idle dirty ones are salvaged to wt-save/<name> first (node_modules and .rv deleted, loki-ts/dist discarded); detached unmerged HEADs get a wt-save ref; locked and fresh ones are kept. It runs after each main sync in train-cycle.sh and from .githooks/post-merge. scripts/v10-worktree-add.sh enforces the 40G floor (LOKI_WORKTREE_DISK_FLOOR_GB), reaping first. Pulse emits WORKTREE_SPRAWL above 20.
+- Fixture: tests/test-worktree-reap.sh (merged, idle, detached, dirty-idle, .rv, dist-only, dirty-fresh, locked, fresh, BOARD-held, floor refusal, pulse 20 vs 21).
+- Known limits: a locked worktree whose owning agent is dead is kept (the reaper cannot tell dead from alive, so it never touches a locked one); and slice worktrees created by the agent harness bypass the disk floor unless the dispatcher creates them through scripts/v10-worktree-add.sh.

package/docs/v10/GUARDS.md

@@ -868,3 +868,10 @@ previously mismarked two merged guards (S-16, S-74) as PENDING.
 - **The test that proves it fires:** `tests/test-select-tests.sh` (R8 cases):
   an attempts.ts-only diff and a docs-only diff each select every declared
   guard. Run: `bash tests/test-select-tests.sh`.
+
+## 23. Deleting the token env vars left gh and git credential stores reachable (GH-KEYRING, FC-90)
+
+- **Incident:** with the token vars removed, `gh auth token` still returned the user's login via the keyring and git still ran osxkeychain and gh credential helpers; tokenFreeEnv and plainTestEnv did nothing about either.
+- **Root cause:** each env builder deleted a subset of credential paths itself; only the worker env reset the rest.
+- **Guard:** `loki-ts/tests/util/fc90_credential_env.test.ts` plants a fake gh hosts.yml and a fake global git credential helper in a fake HOME, proves the raw env sees them, and proves an env from plainTestEnv does not; it also pins the one-dir-per-process GH_CONFIG_DIR lifecycle. It lives in loki-ts/tests/util, which `scripts/global-guards.tsv` already selects on every diff.
+- **The test that proves it fires:** removing the GH_CONFIG_DIR line, the credential.helper reset or the sentinel from `loki-ts/src/util/credential_env.ts` turns it red. Run: `cd loki-ts && bun test tests/util/fc90_credential_env.test.ts`.

package/docs/v10/PROGRESS.md

@@ -1,5 +1,9 @@
 # Progress
 
+## 2026-10-09T02:10Z: v11.3.7 train (AUTO-REAP) pushing (CoS)
+- AUTO-REAP 0024b137e merged (TL APPROVE delta); guards: 19 rows, sigpipe red 1748>1742 fixed by here-strings in test-worktree-reap.sh, rerun 4/0 and 38/0.
+- In flight: WF-2MIN-3 TL review, WF-2MIN-4 built (ed92048b8), ENV-INTAKE r1fix, CANARY-SHAPE.
+
 ## 2026-10-04T02:21Z: 11.0.0 pushed, release run 37170767617 in progress (CoS)
 - Founder 01:35Z: one MAJOR 11.0.0 in 1-2 hours; 02:08Z: no tests until next week, only tsc, build and dist guard. Source of truth: docs/v10/RELEASE-11.md.
 - train11 merged into main (44839e531): A1b, A2a, A2b, A3a-f, A4a, A4b, A4-ASK-2, A5, A6a, A6b, B2-B8, Tier C docs in docs/v11/ (c7bc9378a, unverified claims stripped).
@@ -2285,27 +2289,33 @@ The swarm is stopped: .loki/V10-STOP exists, the loop has no wake-ups, and the c
 - RECEIPT-TRUTH 66931a217 (11.3.2): HIGH round 5 with high-receipt-truth; branch frozen.
 - Next: merge PRICE-TRUTH-2 and PLAN-TIMEOUT by SHA, dist rebuild if needed, moat on the final SHA, push, Tests green on that SHA, then release.sh patch --bump-only with scratchpad changelog-1131.md.
 
-## 2026-10-08 07:43Z CoS
+## 2026-10-08T07:43Z: CoS
 - PRICE-TRUTH-2 merged by SHA 884d22be1 as 82eb1ad31 (FC-45/FC-46 rows conflict resolved, both kept); post-merge util+budget 175/0, test-pricing-parity rc 0; git diff 884d22be1 HEAD^2 empty.
 - 11.3.1 now blocked only on PLAN-TIMEOUT: high-cifast parity byte-identical (236s->2s, 455s->4s), 169-commit plan 15s; P1 timeout-minutes 8, P2 timing test, P3 always-run set, P4 rebase onto 82eb1ad31 sent to sec-fsmonitor.
 - 11.3.2 approved queue (hold until 11.3.1 cut, merge by SHA): 132-E2 057b332e9, 132-B4 36284ebb5, 132-F1 82837ec9f. In review: 132-E3, 132-F3, 133-E2, GOV-FORMULA 76afb31a8. 132-E4 31b5c304b built, target missed (4x 23.7s vs 12s at load 20-26), TL deferred until load drops.
 - Found: tests/cli/test-alias-forwarding.sh fails 3 cases on cdbec7679 (help count 27 vs [12,23], local-ci parity rule missing, report export json kpis exit parity); check in the FULL tier run before the cut.
 
-## 2026-10-08 08:17Z CoS
+## 2026-10-08T08:17Z: CoS
 - RECEIPT-TRUTH round 6 APPROVED by HIGH at 1b5bbaef5 (R5-1/2/4 mutations red, moat rc 0 with P9 PROVEN, CP 519/0); queued for 11.3.2.
 - FC-47 (CTO ruling): select-tests --run is a no-op on R0 and docs diffs (early exits before DO_RUN). Interim rule: TLs on R0 diffs name and run suites explicitly and report the number of suites executed. Fix slice SEL-RUN-FC47 goes after PLAN-TIMEOUT, then a one-shot audit of the R0 merges since v11.3.0.
 - PLAN-TIMEOUT engineer had no edits from 07:40Z to 08:14Z; re-pinged with a commit-now instruction.
 
 - 2026-10-08T10:27Z CoS: PLAN-TIMEOUT-1 merged by SHA b43536756 (TL APPROVE: fast-gate 10, train-verdict-reuse 40, select-tests 42, rc 0; git diff approved..HEAD^2 empty). Full local tier on 82eb1ad31 hit the 45-min cap (rc 124); reds classified env-only (receipt_attest needs cryptography; indexer + typecheck worktree-path only, green in main). bun 2004/0, util 175/0, moat rc 0 5/9. Lost ~1h: TL verdict sat in an idle teammate; next time read the subagent transcript after 10 min instead of waiting. Pushing the 11.3.1 train now.
 
-## 2026-10-08 12:21Z CoS
+## 2026-10-08T12:21Z: CoS
 - 11.3.1 (604145bbc, pushed) release run 37774482965 failed at required-ci NIGHTLY-BLOCK (D90): nightly 37686475225 red since 10-04 on one test, macOS bun cockpit "renders a real inline image ... via the bundled wasm" timed out after 5000ms (cold wasm+font load). npm 11.3.1 NOT published.
 - Fix-forward NIGHTLY-COCKPIT (row FC-50, beforeAll warm-up + 30s render timeout, assertions unchanged): built f7f48a120, cockpit 26/0; TL round 1 BLOCK only on FC-47 id collision, r2 is the rename, in review. Then: merge, push, dispatch nightly, FULL rerun of 37774482965.
 - 11.3.2 train on local main (unpushed), now e18e4ca11: 12 earlier slices plus 133-B4..ER-01-r2, 133-E3-r2, SIGS-DOC (run-all-tests.sh registration union by hand), VPR-1-r2. UNDO-2-r2 merge reverted locally (tripped raw-gh and full-env spawn guards), r3 in HIGH review.
 - Product-code conflicts sent to engineers: XV-1 (seal.ts), MARK-1 (pr.ts), MASS-2 (queue.ts/pr.ts). BLOCKs back to engineers: MCP-D (unauthenticated HTTP task creation), VPR-2-r2 (gh authorAssociation field does not exist), T5-ATTEMPTS-PR-r2 (stale help line, r3 in review).
 
-## 2026-10-08 20:27Z CoS
+## 2026-10-08T20:27Z: CoS
 - v11.3.3 (eee891534) is on main; release run 37837110730 failed at required-ci. Tests 37837111102 at the bump SHA is red, and bump-only parent reuse was refused: "normalizer: not on the allowlist: deploy/helm/autonomi/Chart.yaml" (release.sh also bumps 2 more Chart.yaml files and docs/CLI-REFERENCE.md). Parent 54a519a22 Tests green; nightly 37836989262 at 54a519a22 green.
 - CTO split: (A) BUMP-REUSE HIGH slice (allowlist + bump-set subset guard + replay), then ship as 11.3.4. (B) RELGATE-REDS: 6 latent reds that guards_for("VERSION") selected (watch-command v6.33.0, manifest-truncation rc=2, quick-receipt-order rc=124, autonomy-and-stop OPTOUT, node_lint web-app rc=127, moat P2.verify-exit-contract); ships separately and does not block A. SEL follow-up: guards_for literal-string selection, LOW.
 - Promote 11.3.2: auto run 37838898754 blocked on the smoke lookup (the pre-run-name smoke 37833604487 is not matched by display_title). Dispatched smoke 37839153237 (v11.3.2) then promote.
 - WALL-SMOKE-GUARD merged into train-1132 at 5be544484 (rides with 11.3.4). WALL-COLOR engineer building.
+
+## 2026-10-09T01:48Z: CoS
+- 11.3.6 (GH-KEYRING) published to next: release run 37869841774 success, tag v11.3.6 at 549b3b7fe; CTO smoke PASS (trivial-sum VERIFIED, 28s). latest stays 11.3.2 pending backstop plus smoke promotion.
+- guards-always pushed to main at 1d20b928e (push rc=0): 19/19 --guards-only rows rc=0 (~/loki-ci-logs/ga-guards-2141b.log), sigpipe CEILING 1789 -> 1742.
+- ENV-INTAKE bb2d57569: opus r1 BLOCK (F1 supply_guard registry token exfil, F2 seal commit hooks get worker env, F3 LOKI_* secrets incl. PR bot token and receipt signing key reach repo tests, F4 stray ' + R + ' arg in run.sh lint calls). CTO: F3 counts against 11.3.6 and earlier; signing key must never be in any child env. Fix slice ENV-INTAKE-R1FIX building; r2 pending; B9 n=9 two-bug +5.2% (rerun on fixed head). GHSA-p656 held.
+- Disk P0 cleared earlier (83G free). AUTO-REAP cf94b8bd4 in TL review; WF-2MIN-3 (CTO GO: one tarball, merge release+publish-npm, npm-visible non-blocking) building; CANARY-SHAPE building.