loki-mode 11.54.4 → 11.55.1

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: Runs an autonomous software factory that knows what it is supposed to deliver and proves it did, with a signed receipt. Use when the user says Loki Mode or asks to build, fix or verify software autonomously.
 ---
 
-# Loki Mode v11.54.4
+# Loki Mode v11.55.1
 
 **Current entry points (Loki 10 engine):** `loki "<task>"`, `loki owner/repo#N` and `loki quick "<task>"` run the Loki 10 engine and end with a signed receipt (`loki verify`). `loki backlog owner/repo --all` runs many issues in parallel. Guide: `docs/v10/GUIDE.md`. The skill instructions below, and `loki start`, describe the previous bash loop. PRD-file starts (`loki start ./prd.md`) and the opencode provider still run on it until FC38-SWEEP ports them; the legacy-engine command and the LOKI_ENGINE switch remain removed. Prefer `loki owner/repo#N` for issues.
 
@@ -476,4 +476,4 @@ Implemented, planned and deprecated items, with the version each landed in: `ski
 
 ---
 
-**v11.54.4 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**
+**v11.55.1 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**

package/VERSION

@@ -1 +1 @@
-11.54.4
+11.55.1

package/dashboard/__init__.py

@@ -7,6 +7,6 @@ Modules:
     control: Session control helpers (status, atomic writes, origin check)
 """
 
-__version__ = "11.54.4"
+__version__ = "11.55.1"
 
 __all__ = ["__version__"]

package/docs/CLI-REFERENCE.md

@@ -1,6 +1,6 @@
 # CLI reference
 
-Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.54.4. Do not edit by hand.
+Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.55.1. Do not edit by hand.
 Hidden and legacy-only commands are omitted; see `docs/v10/CLI-MODERN.md` for the full inventory.
 
 | Command | Description |

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 Loki Mode, by [Autonomi](https://www.autonomi.dev/), turns a spec or an issue into a verified pull request with a receipt you can check. This page covers installing it, a first run, and the options around it.
 
-**Version:** v11.54.4
+**Version:** v11.55.1
 
 **Engine note:** `loki start` is the primary command. `loki start`, `loki "<task>"`, `loki owner/repo#N` and `loki quick` all run the Loki 10 engine, whatever the flag order or input form (PRD file, issue ref, task or one-word brief). The previous loop runs only on `--engine legacy`, `LOKI_ENGINE=legacy`, or for one call when a flag Loki 10 cannot honor is present. See the [user guide](v10/GUIDE.md) and the [5-minute quickstart](QUICKSTART.md).
 

package/docs/v10/FAILURE-CLASSES.md

@@ -1425,3 +1425,13 @@ L0 review rule (ENGINE-LAWS.md L0): a fix that adds an `if` or a regex about the
 - Trust boundary: closed for repo content and for any write the judged agent makes inside the repo. NOT closed against a same-user process that can read ~/.loki/cache/fast-verify/key: it can forge a valid MAC. A same-user agent that is allowed to read the home directory therefore defeats this cache; the only complete answer for that threat is --no-cache (the fast scan is milliseconds), which the exogenous gates should use.
 - Sibling not closed (engine10 cache): loki-ts/src/engine10/cache.ts keys repomap and testmap by HEAD^{tree} plus a hand-bumped "repomap2-" prefix, so a builder change does not invalidate stored maps (same class as the hand-bumped CACHE_SCHEMA removed here). It selects tests and does not return findings, so it is not a verdict, but the fix is the same idea: derive the builder version from the builder's bytes at build time instead of a manual prefix. Tracked as a follow-up, not changed here because the TS bundle has no stable source path to hash at runtime.
 - Fixture: tests/mcp/test_phase1_tools.py test_stored_text_appears_only_inside_untrusted_content (red with loki_verify_fast trusted: leaks ['loki_verify_fast']; green after) and tests/test-fast-verify.sh CACHE BINDING block (planted repo-local and forged-MAC empty-list entries; red when the MAC check is replaced by `if False:`, green with it), plus the CACHE KEY and CACHE FILES blocks there: a test-path file moved to a product path must FAIL (red when the path is dropped from cache_key), a copy of fast_verify.py with disabled rules must not poison the real rules' cache (red when PRODUCER is a fixed string), the key and cache json are 0600 and the dir 0700 (red when the key is written 0666), and no verify cache file appears in a repo (red when cache_path points at root/.loki/cache/fast-verify.json). Tests that run fast_verify set LOKI_FAST_VERIFY_CACHE_DIR to a run tmp or pass --no-cache, never the real ~/.loki.
+
+## FC-CATALOG-CAPABILITY-DRIFT-UNCHECKED A catalog entry whose capabilities drifted from the API failed only at request time
+- User-visible: a catalog entry whose thinking types or effort levels drifted from what the model accepts fails only at request time, as an API error mid-run. Raw: the catalog (providers/model_catalog.json) is static and never compared with models.retrieve.
+- Law broken: a capability the harness relies on is claimed without being checked against its source of truth.
+- Siblings swept: effortForTier clamp (bash and Bun, parity-checked), claudeEffortLevels, the catalog freshness row (age only, offline).
+- Mechanism: loki doctor "Model capabilities" row. With ANTHROPIC_API_KEY it calls models.retrieve per claude catalog id and prints each mismatch (effort levels, API-expressible thinking types); without a key or offline it warns and never changes the tally or exit code. The bench runner takes --effort sweep, expanding to the catalog levels for --model.
+- Fixture: loki-ts/tests/commands/doctor.test.ts "model capability row", tests/test_bench_runner.py sweep tests, tests/test-bash-bun-parity.sh effort clamp cells. Red when the comparison, the sweep catalog read or the clamp model argument is removed.
+
+- Mechanism: run_group sets base = baseRef on every non-fix unit before writing dag.json, so dispatch and the journal key use the same value. The adoption is further bound to the signed task sha256, the unit branch tip and the verified receipt. #317b: task.sha256 covers items only, so the receipt also signs unit_spec.sha256 (unitSpecSha256 in unit_mode.ts over id, items, acceptance, writeSet, base), written by the seal stage and recomputed by adoptJournaled from the same function; an absent, empty or mismatched value rejects the adoption. No time bound is needed: a key that names the base and card never matches work built on another base, and a moved base misses.
+- Fixture: loki-ts/tests/engine10/seal_group.test.ts "#317: local HEAD ahead of origin/HEAD, every unit starts at the journal-key base". Red before the fix (unit base undefined), green after. #317b fixtures: "a colliding key whose signed unit spec has a different acceptance is not adopted" and "a receipt with no signed unit_spec is not adopted", red with the spec check removed or acceptance left out of the hash.