loki-mode 11.65.4 → 11.65.6

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: Runs an autonomous software factory that knows what it is supposed to deliver and proves it did, with a signed receipt. Use when the user says Loki Mode or asks to build, fix or verify software autonomously.
 ---
 
-# Loki Mode v11.65.4
+# Loki Mode v11.65.6
 
 **Current entry points (Loki 10 engine):** `loki "<task>"`, `loki owner/repo#N` and `loki quick "<task>"` run the Loki 10 engine and end with a signed receipt (`loki verify`). `loki backlog owner/repo --all` runs many issues in parallel. Guide: `docs/v10/GUIDE.md`. The skill instructions below, and `loki start`, describe the previous bash loop. PRD-file starts (`loki start ./prd.md`) and the opencode provider still run on it until FC38-SWEEP ports them; the legacy-engine command and the LOKI_ENGINE switch remain removed. Prefer `loki owner/repo#N` for issues.
 
@@ -476,4 +476,4 @@ Implemented, planned and deprecated items, with the version each landed in: `ski
 
 ---
 
-**v11.65.4 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**
+**v11.65.6 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**

package/VERSION

@@ -1 +1 @@
-11.65.4
+11.65.6

package/autonomy/run.sh

@@ -16508,24 +16508,15 @@ _dispatch_reviewer() {
     fi
     case "${PROVIDER_NAME:-claude}" in
         claude)
-            # SECURITY-REVIEW MODEL GUARD (evidence-based routing, item 4b):
-            # By DEFAULT reviewers pass NO --model, so they run on the account
-            # default model and are NEVER routed to Fable by a mid-flight model
-            # override or LOKI_FABLE_ARCHITECT (those only rewrite the
-            # iteration's tier_param, not this dispatch). The ONLY way to pin the
-            # reviewer model is the explicit opt-in LOKI_ADVISOR_MODEL below,
-            # which honors haiku|sonnet|opus and REFUSES fable for the reason
-            # stated here. This must stay true. The official model-config docs
-            # CONTRADICT
-            # routing security review to Fable: Fable's safety classifiers
-            # refuse cybersecurity content, and in non-interactive (-p)
-            # mode a flagged request ends the turn with stop_reason
-            # "refusal" instead of a transparent Opus re-run. A refused
-            # security reviewer would return no VERDICT and break the
-            # unanimous-council gate. Defensive-cyber capability lives in
-            # Mythos 5 (Project Glasswing), not Fable. If a future change
-            # adds --model here, the security-sentinel reviewer must be
-            # pinned to opus, never fable.
+            # REVIEWER MODEL PIN: by DEFAULT reviewers pass NO --model, so they
+            # run on the account default model; a mid-flight model override or
+            # LOKI_FABLE_ARCHITECT only rewrites the iteration's tier_param, not
+            # this dispatch. The ONLY way to pin the reviewer model is the
+            # explicit opt-in LOKI_ADVISOR_MODEL below (haiku|sonnet|opus).
+            # A reviewer turn that ends with no VERDICT is never a PASS: the
+            # unanimous-council gate counts it as no verdict. On the raw-SDK
+            # judge path a refusal ends in a named outcome (refused:<category>)
+            # in the gate record (sdk_invoker.ts judgeOutcomeNote).
             # EMBED 2 + 3 (v7.33.0). This is a trust-gate council subcall.
             # $prompt_text is fully self-contained (the diff, changed files,
             # checks, and strict VERDICT/FINDINGS output format), output is
@@ -16550,18 +16541,15 @@ _dispatch_reviewer() {
             # account default). When the operator/user sets LOKI_ADVISOR_MODEL to
             # an allowlisted alias, pin the trust-gate reviewer to it for a
             # stronger/consistent judge - the founder's "advisor will be opus if
-            # needed or user opted". FABLE IS REFUSED here: the model-config docs
-            # say Fable's safety classifiers refuse cybersecurity content and end
-            # a -p turn with stop_reason "refusal", which would return no VERDICT
-            # and break the unanimous-council gate. So only haiku|sonnet|opus are
-            # honored; fable (or any other value) is ignored with no --model.
+            # needed or user opted". Only the tier aliases haiku|sonnet|opus are
+            # honored; any other value is ignored with no --model.
             if [ -n "${LOKI_ADVISOR_MODEL:-}" ]; then
                 local _adv _adv_norm
                 _adv="${LOKI_ADVISOR_MODEL}"
                 _adv_norm="$(printf '%s' "$_adv" | tr '[:upper:]' '[:lower:]' | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//')"
                 case "$_adv_norm" in
                     haiku|sonnet|opus) _rv_argv+=("--model" "$_adv_norm") ;;
-                    *) : ;;  # fable and invalid values: no --model (account default)
+                    *) : ;;  # any other value: no --model (account default)
                 esac
             fi
             if loki_is_supervised_simple_web; then

package/dashboard/__init__.py

@@ -7,6 +7,6 @@ Modules:
     control: Session control helpers (status, atomic writes, origin check)
 """
 
-__version__ = "11.65.4"
+__version__ = "11.65.6"
 
 __all__ = ["__version__"]

package/dashboard/server.py

@@ -3956,8 +3956,8 @@ class StartBuildRequest(BaseModel):
     # deliberate session-scope reset, run.sh:15623), which is why start-time uses
     # env, not the override file.
     model: Optional[str] = None
-    # Advisor / reviewer model (opt-in Opus judge). haiku|sonnet|opus; fable NOT
-    # accepted. Exported as LOKI_ADVISOR_MODEL into the run env; run.sh reads it at
+    # Advisor / reviewer model (opt-in Opus judge). haiku|sonnet|opus; any other
+    # value is rejected. Exported as LOKI_ADVISOR_MODEL into the run env; run.sh reads it at
     # the reviewer-dispatch site (run.sh:10199) to pin the code-review judge while
     # execution stays on the chosen/default execution model. Absent/invalid -> no
     # advisor pin (reviewers use the account default).

package/docs/CLI-REFERENCE.md

@@ -1,6 +1,6 @@
 # CLI reference
 
-Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.65.4. Do not edit by hand.
+Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.65.6. Do not edit by hand.
 Hidden and legacy-only commands are omitted; see `docs/v10/CLI-MODERN.md` for the full inventory.
 
 | Command | Description |

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 Loki Mode, by [Autonomi](https://www.autonomi.dev/), turns a spec or an issue into a verified pull request with a receipt you can check. This page covers installing it, a first run, and the options around it.
 
-**Version:** v11.65.4
+**Version:** v11.65.6
 
 **Engine note:** `loki start` is the primary command. `loki start`, `loki "<task>"`, `loki owner/repo#N` and `loki quick` all run the Loki 10 engine, whatever the flag order or input form (PRD file, issue ref, task or one-word brief). The previous loop runs only on `--engine legacy`, `LOKI_ENGINE=legacy`, or for one call when a flag Loki 10 cannot honor is present. See the [user guide](v10/GUIDE.md) and the [5-minute quickstart](QUICKSTART.md).
 

package/docs/v10/FAILURE-CLASSES.md

@@ -1857,3 +1857,20 @@ L0 review rule (ENGINE-LAWS.md L0): a fix that adds an `if` or a regex about the
 - Mechanism: scripts/first-run-gate.sh stub claude branches on the session. The Wall author (task.md names the brief) writes tests/loki_wall_hello.test.js content as an agent-independent test; only the implement session (`Loki 10 implement stage` in its prompt) builds hello.js and hello.test.js; project-model and plan sessions write nothing. The engine is unchanged: it already reports PARTIAL when only agent-authored tests ran, and that is the honest verdict for the old stub.
 - Fixture: tests/test-first-run-gate.sh extracts the stub from the gate and runs it per session (plan and project-model write nothing, the Wall author writes only loki_wall_hello.test.js, implement builds the CLI); against the origin/main gate three of those four cases are red, against the fixed gate all pass, and `first-run-gate.sh --entry start-empty` ends `PASS outcome-verified: Outcome:    VERIFIED`.
 - Sibling class (dev-machine dist): bin/loki prefers loki-ts/dist/loki.js unless loki-ts/src/cli.ts is newer (bin/loki, the `-nt` freshness guard). It compares only cli.ts, so an edit to any other src file leaves a gitignored dist that silently runs stale code, and a worktree `bun run build` fails and deletes dist. Runs measured through bin/loki in a worktree therefore need dist rebuilt in the main checkout or `BUN_FROM_SOURCE=1`; reviewers state which one they used. No row covered this; this line is the record, and a code fix (compare the newest src mtime) is a separate slice.
+
+## FC-SUBPROCESS-TEST-DEFAULT-TIMEOUT Tests that spawn CLIs ran against bun's 5s default timeout and failed on a loaded host with no logic fault
+- User-visible vs raw: raw (red tests on main, no user message).
+- Law: a test file that spawns CLIs sets its time budget through the one shared setter, setLoadAwareTimeout in loki-ts/tests/preload.ts (FC-TEST-TIMEOUT-OVERRIDES-CLI); it does not rely on bun's 5s default or a per-test literal.
+- Cause (measured): "header [1] and a dict attestation exit 1 with attestation: FAILED" in loki-ts/tests/commands/proof_verify_parity.test.ts runs 2 forged shapes x (1 in-process verify + 2 spawned CLIs) plus signing; on origin/main a78f48031 at load about 24 it failed with "this test timed out after 5000ms" and passed with `--timeout 60000` (1 pass, 0 fail, 5.44s). rev-b saw it fail at 5044.65ms at load 30. eng-mcpchain measured loki-ts/tests/providers/mcp_config.test.ts "bash and TS produce the same launch for the same fixture" failing the same way.
+- Not the fix: `timeout` under [test] in loki-ts/bunfig.toml. Measured on bun 1.3.13: with it set, the dict attestation test still failed at 5045.87ms, so bun ignores the key.
+- Siblings swept (measured with `git grep -lE "Bun\.spawn|spawnSync|execFileSync|execSync|child_process" -- loki-ts/tests` minus `git grep -l "setLoadAwareTimeout|setDefaultTimeout" -- loki-ts/tests`): 164 files spawn a subprocess, 154 of them set no timeout (engine10 81, runner 15, util 14, commands 11, features 10, e10ext 7, project_model 4, integration 3, council 3, providers 2, others 4). Only the two measured failing files are bounded here. The other 154 are out of scope for this change because none has been timed and bounding all of them blind would hide real slowness; each file that fails the same way gets the same one-line call. Per-test durations were not recorded.
+- Mechanism: setLoadAwareTimeout(30_000) at file level in both measured files, scaled by machine load and overridable with LOKI_TEST_TIMEOUT_SCALE and LOKI_TEST_TIMEOUT_MS.
+- Fixture: the two named tests; red at the 5000ms default under load, green after (bun test of both files: 36 pass, 0 fail). Mutant on the sibling: setLoadAwareTimeout(1) in mcp_config.test.ts turns the file red with hook timeouts (3.55ms, 3.16ms); restored.
+
+## FC-MODEL-OVERRIDE-TEST-TOO-SLOW tests/test-model-override.sh took 445s at load 20-29 and exceeded the 300s shard budget, so a reviewer could not run it to completion
+- User-visible vs raw: raw (a guard nobody can finish running is a guard nobody trusts; no user message).
+- Law: a guard script finishes inside the shard budget at the documented load, or it is split; a slow guard is not a skipped guard.
+- Cause (measured, per-line $SECONDS stamps): two parity matrices took 181s and 249s of the 445s. Each of their 224 cells started a fresh python3 that imported dashboard.server (0.75s per import at load 28), so 448 imports cost about 340s.
+- Siblings swept: the resolver matrix (section 7) and the session-pin matrix (section 9) both used the per-cell python leg. The estimator leg (`loki plan`) and the bash legs are different processes by design and stay per cell. Other python3 -c calls in the file run once.
+- Mechanism: one `py_batch` helper resolves every cell in a single interpreter. Each cell runs against a fresh copy of the ambient environment plus its own exports, the same input the per-cell `env "$@" python3` gave. Cell counts stay at 224 and 224.
+- Fixture: after the change the file finishes in 103s with 71 passed, 0 failed (before: 445s, 71 passed). Mutant: dashboard/server.py `_clamp_to_max_tier` opus arm returning the alias unchanged makes the resolver matrix report PARITY MISMATCH on the fable cells; restored and re-run green.