loki-mode 11.71.2 → 11.72.0

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: Runs an autonomous software factory that knows what it is supposed to deliver and proves it did, with a signed receipt. Use when the user says Loki Mode or asks to build, fix or verify software autonomously.
 ---
 
-# Loki Mode v11.71.2
+# Loki Mode v11.72.0
 
 **Current entry points (Loki 10 engine):** `loki "<task>"`, `loki owner/repo#N` and `loki quick "<task>"` run the Loki 10 engine and end with a signed receipt (`loki verify`). `loki backlog owner/repo --all` runs many issues in parallel. Guide: `docs/v10/GUIDE.md`. The skill instructions below, and `loki start`, describe the previous bash loop. PRD-file starts (`loki start ./prd.md`) and the opencode provider still run on it until FC38-SWEEP ports them; the legacy-engine command and the LOKI_ENGINE switch remain removed. Prefer `loki owner/repo#N` for issues.
 
@@ -476,4 +476,4 @@ Implemented, planned and deprecated items, with the version each landed in: `ski
 
 ---
 
-**v11.71.2 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**
+**v11.72.0 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**

package/VERSION

@@ -1 +1 @@
-11.71.2
+11.72.0

package/dashboard/__init__.py

@@ -7,6 +7,6 @@ Modules:
     control: Session control helpers (status, atomic writes, origin check)
 """
 
-__version__ = "11.71.2"
+__version__ = "11.72.0"
 
 __all__ = ["__version__"]

package/docs/CLI-REFERENCE.md

@@ -1,6 +1,6 @@
 # CLI reference
 
-Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.71.2. Do not edit by hand.
+Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.72.0. Do not edit by hand.
 Hidden and legacy-only commands are omitted; see `docs/v10/CLI-MODERN.md` for the full inventory.
 
 | Command | Description |

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 Loki Mode, by [Autonomi](https://www.autonomi.dev/), turns a spec or an issue into a verified pull request with a receipt you can check. This page covers installing it, a first run, and the options around it.
 
-**Version:** v11.71.2
+**Version:** v11.72.0
 
 **Engine note:** `loki start` is the primary command. `loki start`, `loki "<task>"`, `loki owner/repo#N` and `loki quick` all run the Loki 10 engine, whatever the flag order or input form (PRD file, issue ref, task or one-word brief). The previous loop runs only on `--engine legacy`, `LOKI_ENGINE=legacy`, or for one call when a flag Loki 10 cannot honor is present. See the [user guide](v10/GUIDE.md) and the [5-minute quickstart](QUICKSTART.md).
 

package/docs/v10/FAILURE-CLASSES.md

@@ -1931,6 +1931,15 @@ L0 review rule (ENGINE-LAWS.md L0): a fix that adds an `if` or a regex about the
 - Mechanism: the stub records its subcommand and the tests require `reseal` for fix and `explain` for explain; groups are now `loki-issue-`, `loki-issue-publish-`, `loki-pr-fix-`, `loki-pr-publish-`, and a guard requires four distinct groups.
 - Fixture: tests/test-issue-to-pr-action.sh; mutants: drop `SUB="reseal"` (2 failures), make the publish group equal the agent group (guard red).
 
+## FC-LINE-CAP-GATED-AFTER-MERGE Main went red on core engine10 5091 >= 5000 and e10ext 1513 >= 1500 because the line caps are enforced only by budget.test.ts and structural-checks line_budgets, not before a slice merges
+
+- User-visible vs raw: raw (a red structural gate on main; no user-facing behavior).
+- Law: a cap that blocks main must also block the slice that crosses it; a slice may not merge on a gate that does not run the cap.
+- Cause (measured): `bash scripts/structural-checks.sh` on origin/main 736a43939 printed "core engine10 5091 >= 5000" and "e10ext 1513 >= 1500". Commits 62f946e19 and 484752c3b touched the wall and testmap files in those dirs most recently; whether a slice gate ran line_budgets before merge is not measured here.
+- Siblings swept: modernize 4000, contrib 1200 and SKILL.md 500 are under their caps in the same run (only the two lines above failed).
+- Mechanism: this slice restores headroom without changing a cap or any behavior: comment paragraphs and doc comments in engine10 are reflowed to 230 columns (code unchanged; comment text identical once whitespace and comment markers are stripped), and in e10ext redundant header and doc-comment lines are tightened and one unused import line is removed. Running line_budgets before merge is a separate change, not made here.
+- Fixture: tests/engine10/budget.test.ts and scripts/structural-checks.sh line_budgets are the existing guards; both must exit 0 on this branch.
+
 ## FC-RELEASE-UNNAMED-STACKED-PARENT A release merge shipped stacked parent commits that no reviewer had approved by SHA, including slices on hold, because the approval gate only checked the VERSION line (#436)
 - User-visible vs raw: users received v11.58.0 containing cw20-r2 parents e4c445b73 and 13b46699d, plus cw15/ux350/roadmap100 parents 9bf08f534, dc2e16314, 64e9f1a09 and cf177adf5, while the slice hold stood. Raw: the range held commits no TL or HIGH APPROVE line named; a rebase had also changed f8f263627 after approval.
 - Law broken: D12/D13 (a release carries only what a named reviewer approved); a hold is a block (OPERATING-MODEL.md, Release Manager).
@@ -1981,3 +1990,13 @@ L0 review rule (ENGINE-LAWS.md L0): a fix that adds an `if` or a regex about the
 - Siblings swept: telemetry row (printed the full LOKI_TELEMETRY_ENDPOINT url including path; now host only), update check, model inference (unchanged, still the only REQUIRED row and the only one that sets the exit code), JSON output (same rows with `required: false`), a server name or env value holding a tab, newline or other control character (cleaned to `?` where each record is emitted, and the JSON reader skips a malformed line instead of raising), the three MCP config files (`.mcp.json`, `$LOKI_DIR/mcp-config.json`, `~/.claude/mcp.json`; `url` servers only, stdio servers are local). Unicode line separators U+0085, U+2028 and U+2029 in a server name or url host are masked like C0 and the --json loader splits on "\n" only (splitlines() would break on them and hide hosts).
 - Mechanism: `_LOKI_AIRGAP_EGRESS_ENV` (name and meaning) and `_LOKI_AIRGAP_EGRESS_NOT` (name and reason) sit beside the audit; `_loki_airgap_configured_egress` emits one row per set registry name plus one per MCP url server, host only, with a loopback flag and the exact disable step. tests/test-airgap-commands.sh section 6 greps the tree and fails on any egress-looking name in neither list.
 - Fixture: tests/test-airgap-commands.sh section 6: every registry name set to a host is named (path not leaked), JSON carries the host, nothing configured reports no extra rows and exit 0, an MCP url server is named and a stdio server is not, the tree guard is green, and a fixture tree with a fake `LOKI_FOO_URL` reader turns it red.
+
+
+## FC-WORKER-NO-PROCESS-LIMITS The engine10 worker and every process it starts ran with the caller's resource limits, so a runaway build or fork loop in a worker could exhaust memory or the process table of the whole machine (#265 slice B)
+
+- User-visible vs raw: user-visible (a machine-wide stall during a run).
+- Law: an explicit opt-in limit must either hold for the worker tree or stop the run with a named reason; it must never run unlimited silently, and an unset knob must leave the spawn untouched.
+- Cause (measured): `git grep -n ulimit -- autonomy providers loki-ts/src` returned no hit in any spawn wrapper, and spawnWorker in loki-ts/src/runner/worker_proc.ts passed [cmd, ...args] straight to spawn. Node cannot set rlimits, so a shell wrapper at this one call site is the only mechanism.
+- Siblings swept: bash-route provider spawns are owned by the #335 confinement wrapper, and the subagent cap is #265 slice C; both are out of scope here. The detached deep-verify spawn in loki-ts/src/engine10/supervisor.ts is the same class (a model-driven child under the worker env) and now goes through `ulimitArgv` too (r2); an invalid knob records `deep verify not spawned: <reason>` in NOT PROVEN instead of spawning. Mutant: spawn the raw deepArgv and the new deep_wiring test (ulimit -u reads 2000 in the deep child) goes red.
+- Mechanism: ulimitArgv in runner/worker_proc.ts wraps argv in `/bin/sh -c 'ulimit ... || exit 97; shift N; exec "$@"'` only when LOKI_ULIMIT_VMEM_KB or LOKI_ULIMIT_NPROC is set. Values travel as positional arguments, never in the script text, and a value that is not a positive integer is refused before any spawn. A ulimit the OS refuses (macOS rejects -v) exits 97 with a named reason.
+- Fixture: loki-ts/tests/runner/worker_proc.test.ts covers the applied limit, the byte-identical unset argv, the refused injection value, the exit-97 path, and a mutant that drops the exit.