loki-mode 11.74.2 → 11.75.1

package/docs/v10/roadmap-10/01-measurement.md

@@ -1,113 +0,0 @@
-# 01 Measurement (enabler for every other score)
-
-Why: every cost, speed and quality claim so far is either unmeasured or refuted. C-F1 run1 reported 1.81x but the ledger showed about 12.3x raw. Run4 had Loki at 1.41x MORE than lean raw on 6 tasks (CI 1.21-1.68), NOT PROVEN on 8. Medium cost is null on 10, 2 and 11 of 21 rows. The seeded-defect catch rate has never been measured. The newest public SWE-bench result is from 2026-01.
-
-Rule: no score in README.md moves without a result file cited here.
-
-## MEAS-1 Bench rows carry version, profile and one cost truth
-
-Story: as the CTO, I need every bench row to say which build and profile produced it and what it really cost, so a claim cannot mix versions or cost sources.
-
-Acceptance:
-- Every Loki row in `benchmarks/bench` output has non-null `loki_version` and `cost_profile` (dry-run fixture test).
-- `cost_claim.py` mixed-version refusal stays red-first in a test.
-- On a 6-task run, the list of rows where |events cost - reported cost| > 5% is empty; the ledger total is cross-checked against receipt `cost.usd`.
-- The real engine rc is stored per row (today `rc` is null; `attribution.py` `run_loki` about line 455-490). Stdout and stderr are kept per row.
-
-Todo:
-- [ ] Stamp loki_version and cost_profile in `benchmarks/bench/adapters/loki*.py` and `attribution.py`
-- [ ] Store real rc and keep stdout/stderr in `adapters/_base.py` run_cli
-- [ ] Reconcile events cost, efficiency and ledger in `attribution.py` and `loki-ts/src/engine10/cost.ts`
-- [ ] Red-first fixture tests for all three
-
-## MEAS-2 Bench Wall uses the task interpreter
-
-Story: as the bench, Loki rows must be able to reach VERIFIED, otherwise Loki pays for Wall and gets no proof.
-
-Acceptance:
-- On the run4 task set, 0 rows log "ran under the system interpreter".
-- Loki verdict VERIFIED on >= 80% of accepted rows.
-- Bench seeds that ship no test still yield a Loki-executed check (or the bench records why PARTIAL is correct).
-
-Todo:
-- [ ] Wall RUNNER_CMD resolves the task venv interpreter (`loki-ts/src/engine10/stages/wall.ts`)
-- [ ] Bench venv setup exposes `python` on PATH
-- [ ] Regression fixture: bench row with venv goes VERIFIED
-
-## MEAS-3 C-F1 run5
-
-Story: as the founder, I want one trustworthy cost and time comparison against raw Claude Code.
-
-Acceptance:
-- Arms: raw-configured, raw-lean, raw-bare, loki, loki-lean. n=3. sonnet-5-5. Cap set. 20 tasks including coord-1 and longspec-1 group tasks.
-- 0 UNMEASURED raw-bare cells.
-- Group tasks: 3 of 3 Loki rows have a non-null summed group cost and do not exit in 0.2s.
-- One verdict line per arm per floor appended to `docs/v10/METRICS.md` C-F1 section.
-
-Todo:
-- [ ] Measure raw-bare floor in the attribution floor runner
-- [ ] Re-measure group cells on >= v11.17.16 (USER/LOGNAME fix)
-- [ ] Grow task set from 8 to 20 (mix of small, medium, group)
-- [ ] Run, append verdicts, link result dir
-
-## MEAS-4 Medium A/B with cost never null
-
-Acceptance:
-- `provider_cost()` accepts partial-stream cost; null-cost rows 0 of N on rerun (`eval/loki10/harness.py` about line 698).
-- All 14 medium tasks, n=3, arms run back to back at equal `--parallel`.
-- Bootstrap CI reported per arm (S41-17).
-
-Todo:
-- [ ] Partial-stream cost accepted
-- [ ] Run all 14 tasks, n=3
-- [ ] Record in METRICS.md with CI
-
-## MEAS-5 Seeded-defect catch rate
-
-Story: as a buyer, I want to know how often Seal says VERIFIED on broken code.
-
-Acceptance:
-- A runner executes real agent sessions against the 100-case corpus and writes `benchmarks/seeded-defects/results/wrong-pass.json`.
-- Top tier vs floor tier wrong-pass reported; P4 `floor-does-not-raise-wrong-pass` case PASS.
-- METRICS.md False-SEALED row filled (target 0 of 100).
-
-Todo:
-- [ ] Runner script over the corpus
-- [ ] Top vs floor runs
-- [ ] METRICS row and moat case flip
-
-## MEAS-6 Public benchmarks
-
-Story: SWE-bench Verified is saturated (about 96%); buyers now read Terminal-Bench 2.0 and SWE-bench Pro.
-
-Acceptance:
-- SWE-bench Pro pilot (119 instances) run with Loki and raw Claude Code; results JSON committed under `benchmarks/results/swebench-pro-pilot/`.
-- Terminal-Bench 2.0 adapter and one full run, results committed.
-- SWE-bench pinned subset marked verified=true or replaced; recall@8 recorded.
-
-Todo:
-- [ ] Run SWE-bench Pro pilot both arms
-- [ ] Terminal-Bench 2.0 adapter plus run
-- [ ] Verify pinned SWE-bench ids, publish recall@8
-
-## MEAS-7 Time to first sealed PR, real provider, nightly
-
-Acceptance:
-- Nightly job runs `scripts/first-run-gate.sh --real --entry start-empty` with a token secret and fails above budget.
-- Stub `--entry start-empty` also runs in nightly.
-- METRICS.md row "time to first sealed PR" has a dated number; p50 <= 120s.
-
-Todo:
-- [ ] Add stub start-empty entry to `.github/workflows/nightly.yml`
-- [ ] Add real-provider entry with secret, guarded so forks skip
-- [ ] METRICS row
-
-## MEAS-8 Public scoreboard
-
-Acceptance:
-- One generator reads the result files from MEAS-3..7 and renders the scoreboard; numbers in README.md and METRICS.md match it (test).
-- Every number shows date, version, n and CI.
-
-Todo:
-- [ ] Generator (extend the existing summarize tooling, do not add a parallel one)
-- [ ] Drift test README vs METRICS vs generator

package/docs/v10/roadmap-10/02-cost.md

@@ -1,75 +0,0 @@
-# 02 Cost (target: at least 2x cheaper than Claude Code, proven)
-
-Now 6. Winner today: Aider on raw spend; Cursor Composer at about $0.07 per task.
-
-Why we are not 10:
-- Run4: Loki 1.41x more than lean raw on 6 tasks; pooled 1.11x NOT PROVEN with acceptance 0.750 vs 0.958.
-- Plan and Wall run as fixed sessions even on small tasks: run4 sized all 31 tasks normal (19 "no test runner detected", 12 over 600 chars), `plan_skipped=false` everywhere. Overhead stages are 31% of spend on medium; the planner costs as much as implement.
-- Implement cache reads 1.9x raw (9.23M vs 4.79M) because the brief gives no test to run, so the session explores.
-- Best measured point is lean config 0.68x raw (opus, single arm, no CI). The lean knobs are built but OFF.
-
-Bar for 10: `cost_claim` reports PROVEN_AT(0.5) against all 3 floors, n >= 3, one version, ledger-checked, with acceptance >= floor.
-
-Depends on: 01 MEAS-1, MEAS-2, MEAS-3.
-
-## COST-A Small-task lean path actually triggers
-
-Story: as a user with a small fix, I pay for one implement session plus verify, not Plan plus Wall plus implement.
-
-Acceptance:
-- `plan_skipped=true` on >= 60% of C-F1 tasks.
-- Acceptance >= floor on the same run.
-- "no test runner detected" no longer forces normal size when the repo has a discoverable test command.
-
-Todo:
-- [ ] Revisit `SMALL_NO_RUNNER` and `MAX_CHARS` defaults in `loki-ts/src/engine10/sizing.ts` behind a measured loki-lean arm
-- [ ] Better runner detection (feeds sizing)
-- [ ] Flip default only after MEAS-3 shows acceptance held
-
-## COST-B Focused implement brief
-
-Story: the implementer gets the up-to-20 relevant files and the exact test command, so it does not explore.
-
-Acceptance:
-- Implement cache reads per completed down >= 30% on medium, n=2.
-- Completion not lower.
-
-Todo:
-- [ ] Brief builder in `loki-ts/src/e10ext/context.ts`
-- [ ] Wire into `stages/implement.ts` (Captain edit if hot)
-- [ ] Paid A/B
-
-## COST-C Flip measured-OFF knobs
-
-| Knob | Flip when |
-|---|---|
-| `--cost lean` / `LOKI_COST_PROFILE` | loki-lean arm CI upper bound <= 0.5 and acceptance >= floor |
-| `LOKI_IMPLEMENT_HAIKU_FIRST` | same arm plus escalation rate recorded |
-| `LOKI_E10_TRIM` | implement cache reads down >= 25% on medium, completion not lower |
-| `LOKI_E10_ATTEMPTS=2` | medium completion >= 18/21, cost not red |
-
-Todo:
-- [ ] One paid arm per knob, results in METRICS.md
-- [ ] Flip each knob that passes, in its own release
-
-## COST-D Cost correctness followups
-
-Todo:
-- [ ] Alias duplicate flags: make cost flag aliases resolve to one value and reject conflicting duplicates
-- [ ] `autonomy/run.sh` about line 7626: BUDGET_LIMIT ".5" handled like the TS `parseCapUsd` fix (TEN-COST-59); run.sh and goal_score.ts change together
-- [ ] Price table negative-price test (reject negative or NaN prices)
-- [ ] TEN-COST-59 sibling sweep: every other dollar parser accepts ".5" and "5."
-- [ ] BUDGET_BURN pulse miscount: pulse counts 128-132 "active" engineers when the real number is single digits; fix the counter in `scripts/v10-pulse.sh`
-
-Acceptance: each item has a FAILURE-CLASSES row, a red-first test, and a sibling sweep note.
-
-## COST-E Publish the claim
-
-Acceptance:
-- PROVEN_AT(0.5) line in METRICS.md with run dir, version, n, CI.
-- Scoreboard (MEAS-8) shows it.
-- Receipt `cost.usd` matches ledger within 5% on every row used.
-
-Todo:
-- [ ] Run after COST-A..C land
-- [ ] Publish

package/docs/v10/roadmap-10/03-speed.md

@@ -1,65 +0,0 @@
-# 03 Speed
-
-Now 7. Winner today: Cursor Composer 2.5 Fast (about 6.7 min average per task), Codex.
-
-Why we are not 10:
-- Medium p50 209s default vs raw 56-70s (2.5-4x). Small run4 p50 31.9s vs 24.3s (1.31x).
-- Implement is 72-86% of p50; Wall is 23-29% and is killed at its 90s limit in 9-11 of 21 runs; implement starts within 1ms of Wall closing.
-- Fix rounds add 18.9-35.7s at p90.
-- Pre-model overhead (cold bun child per session) is not measured.
-
-Bar for 10: TEN-SPEED-01 paired time ratio CI lower bound >= 1.0 on small; medium p50 <= raw at equal parallelism.
-
-Owns `loki-ts/src/engine10/stages/wall.ts` for this program.
-
-## SPD-A Wall off the critical path
-
-Story: implement starts immediately; Wall runs beside it and never blocks it.
-
-Acceptance:
-- `LOKI_E10_WALL_CONCURRENT` default on after HIGH review (S41-14).
-- Medium p50 down >= 20% vs 209s at equal `--parallel`.
-- Wall still red-on-base; completion not lower.
-- Wall limit kills <= 2 of 21; Wall share of p50 < 15%.
-
-Todo:
-- [ ] HIGH review S41-14 (opus adversarial)
-- [ ] Measured arm, flip default (`machine.ts`)
-- [ ] `wallLimitS` tuning or skip-on-haiku-timeout in `sizing.ts`
-
-## SPD-B Pre-model overhead
-
-Acceptance:
-- `pre_model` p50 reported per arm on eval rows (`eval/loki10/harness.py`, `stage-profile.py`).
-- p50 < 2s warm.
-
-Todo:
-- [ ] Timer in harness
-- [ ] Warm-process or socket reuse if over 2s
-
-## SPD-C Parallel verify and base jobs
-
-Acceptance:
-- Paid A/B of `LOKI_E10_VERIFY_JOBS=4` and `LOKI_E10_BASE_JOBS=4`: verify plus Wall base time down >= 30%, 0 new flakes over 3 reps.
-- Defaults flipped only if it passes.
-
-Todo:
-- [ ] A/B run
-- [ ] Flip in `stages/verify.ts` and `util/check_result.ts`
-
-## SPD-D Speed tier tasks
-
-Acceptance:
-- `eval/loki10/tasks/spd-*` exist (D61 slice 17).
-- `LOKI_SPEED=0/1` A/B: parallel wall <= 0.5x sequential on decomposable tasks, tokens not higher.
-
-Todo:
-- [ ] Author spd tasks
-- [ ] A/B run, METRICS row
-
-## SPD-E Equal-parallelism scorecard rule
-
-Acceptance: `eval/loki10/summarize` refuses a pool with mixed `--parallel` (red-first test) and runs arms back to back.
-
-Todo:
-- [ ] Guard plus test

package/docs/v10/roadmap-10/04-first-run.md

@@ -1,61 +0,0 @@
-# 04 First run and adoption
-
-Now 8. Winner today: Lovable (2-3 minutes, zero install) for greenfield; Cursor and Claude Code for existing repos. Note the founder scoped Loki as "not a vibe coding tool" (FAILURE-CLASSES.md); we compete on existing-repo first success, and offer a zero-install try path, not a vibe builder.
-
-Why we are not 10:
-- Time to first sealed PR has never been measured with a real provider; real gate attempts died in 1-3s with "Not logged in" in a clean HOME.
-- Host needs node, python3, jq, git and curl plus one provider, and `loki setup` is a separate step.
-- MCP deeplink config has no env, so a non-TTY launch without `LOKI_MCP_AUTO_BOOTSTRAP=1` exits 2 (from code reading).
-- git identity missing stays fatal; empty-folder auto-init fails silently without it.
-- v10 preflight fatals emit no `first_run_blocked` telemetry.
-- Measured: stub `loki quick` 111s; real 97s vs 10s raw.
-
-Bar for 10: clean machine to first sealed PR p50 <= 120s, measured nightly (MEAS-7), with zero dead ends: every block prints exactly one actionable line.
-
-## FR-A One command to first sealed PR
-
-Story: `npm i -g loki-mode && loki start "<task>"` in a repo works with no separate setup.
-
-Acceptance:
-- `loki start` in a clean HOME prints exactly one actionable line per missing tool and offers the fix.
-- Gate `--entry start-empty` passes with no `loki setup` call.
-- On a TTY, missing git identity is offered as a repo-local set (never global); empty-folder test passes with no global identity.
-
-Todo:
-- [ ] Fold setup checks into start preflight (`start.ts`, `doctor_fix.ts`)
-- [ ] git identity offer (`preflight.ts`, `first_run_repo.ts`)
-- [ ] Gate test
-
-## FR-B Fewer host requirements
-
-Acceptance: doctor marks jq and curl optional unless the bash route is used; the v10 gate passes with jq and curl off PATH. Clean macOS python3 without `cryptography` does not block the v10 path.
-
-Todo:
-- [ ] `doctor.ts`, `setup-wizard.sh` requirement tiers
-- [ ] Gate run with tools removed from PATH
-
-## FR-C Every block is telemetered and named
-
-Acceptance: each v10 preflight fatal emits `first_run_blocked` with its fixed value (not_a_repo, git_identity, not_logged_in, no_provider, disk). One test asserts one event per value.
-
-Todo:
-- [ ] TS telemetry helper call in `engine10/preflight.ts`
-- [ ] Test
-
-## FR-D IDE and MCP one-click works
-
-Acceptance: README deeplink and `loki mcp install` entries carry `env: {LOKI_MCP_AUTO_BOOTSTRAP: "1"}`; a clean-HOME non-TTY launch answers `tools/list` without exit 2.
-
-Todo:
-- [ ] `README.md` deeplinks, `autonomy/mcp-launch.sh`
-- [ ] Clean-HOME launch test
-
-## FR-E Zero-install try path
-
-Story: a prospect sees a real sealed run in under 3 minutes without installing anything.
-
-Acceptance: a hosted or browser path (extend `loki tour` / Control Plane, do not build a new product) replays or runs a sample and shows `loki verify` passing on the receipt. Time from link to verified receipt < 3 min.
-
-Todo:
-- [ ] Decide host (Control Plane or static page with the browser verifier from PRF-B)
-- [ ] Build and measure

package/docs/v10/roadmap-10/05-deploy.md

@@ -1,61 +0,0 @@
-# 05 Deploy
-
-Now 7.5. Winner today: Replit (code plus database rollback), Vercel plus Neon (database branch per preview), Lovable and Bolt for one-click.
-
-What exists: `loki deploy` (bash only) prints by default, `--execute` behind a VERIFIED receipt gate; Vercel, Netlify, Fly.io, Cloudflare; health checks; auto rollback on Vercel and Fly only; canary; preview/staging destinations (Vercel only); env-file push with names only in records; domain with TLS proof (Vercel, Fly); signed `loki.deploy/1` record.
-
-Why we are not 10: no database setup, no per-PR preview URL, no auto rollback on Netlify or Cloudflare, no continuous health watch, deploy not on the Bun route, Vercel secrets on argv (`-e K=V` visible in `ps`).
-
-Bar for 10: every PR from `loki start --deploy` carries a live preview URL with health; failed health rolls back on all 4 providers; optional DB provisioning; signed record for each step.
-
-## DEP-A Per-PR preview URL
-
-Acceptance: `loki start --deploy --destination preview` puts the preview URL and health status in the PR body for Vercel and Netlify; stub-CLI test asserts the PR body.
-
-Todo:
-- [ ] `cmd_deploy` preview mode for Netlify
-- [ ] PR body wiring in `engine10/stages/pr.ts`
-- [ ] Test
-
-## DEP-B Auto rollback on all providers
-
-Acceptance: Netlify uses its API restore; Cloudflare uses `wrangler rollback`. Stub-CLI test shows FAILED_HEALTH, rollback, post_rollback_health recorded, exit 5.
-
-Todo:
-- [ ] Netlify rollback
-- [ ] Cloudflare rollback
-- [ ] Tests
-
-## DEP-C Database provisioning hook
-
-Acceptance: `loki deploy --db neon|supabase` provisions a DB (or a branch per preview on Neon), writes `DATABASE_URL` through the env-file path, records names only, refuses without CLI auth.
-
-Todo:
-- [ ] Neon branch per preview
-- [ ] Supabase project
-- [ ] Rollback story for schema (document limits honestly)
-
-## DEP-D Health watch
-
-Acceptance: `loki status --probe --watch N` (or Control Plane cron) detects a regression and opens an alert or rollback suggestion; test with a fake server that turns 500.
-
-Todo:
-- [ ] Watch mode in `status.ts`
-- [ ] Test
-
-## DEP-E Deploy on the Bun route
-
-Acceptance: `commands/deploy.ts` registered; print-only output byte-equal to bash (parity test); `--execute` gate tests ported.
-
-Todo:
-- [ ] Port print-only
-- [ ] Port execute gate
-- [ ] Remove the bash path once parity holds (extend, never duplicate)
-
-## DEP-F Secrets never on argv
-
-Acceptance: Vercel env push uses stdin or a file descriptor; a test asserts no secret value appears in the spawned argv.
-
-Todo:
-- [ ] Fix Vercel env push
-- [ ] Sweep other providers

package/docs/v10/roadmap-10/06-stability.md

@@ -1,64 +0,0 @@
-# 06 Stability
-
-Now 7.5. Winner today: no clear leader; the bar is a public status page plus sustained green.
-
-Why we are not 10:
-- Main Tests red about 10 hours on 2026-10-17 (28 of last 30 failed); over 200 runs since 10-02, 87 success, 106 failure; longest green streak 23.
-- Failures: structural line budgets (engine10 core 5015 >= 5000), moat P9 allowtoken-only-fetch-callers, L2 destructive registry, 7 FC-01 resolver and multi-root verify tests, stub e2e "worker killed by the supervisor backstop", shell shards 3, 4, 5.
-- Releases ship while Tests is red by decision (D102); caps break when parallel slices merge (FC-60) and nothing enforces them after merge.
-- Latest nightly read success while every test job was skipped (same-SHA skip).
-
-Bar for 10: 24 hours of consecutive green on main, red-to-green under 1 hour, merged-train guards on every push, public status page.
-
-## STAB-1 Main green now
-
-Todo:
-- [ ] Engine10 core under 4950 with headroom (fix/e10-core-budget branch, mapPool into util/check_result.ts)
-- [ ] P9 allowToken pin fixed (FC-25c a), moat P9 PROVEN
-- [ ] L2 destructive git call registry current
-- [ ] 7 FC-01 resolver / multi-root verify tests green
-- [ ] Supervisor backstop kills in stub e2e diagnosed (FAILURE-CLASSES row first)
-- [ ] Shell shards 3, 4, 5 green
-
-Acceptance: three consecutive green Tests runs on main, each cited by run id.
-
-## STAB-2 Merged-train guard job
-
-Story: a cap that each slice passes alone but the merged main breaks is caught within minutes.
-
-Acceptance: on every main push, a fast job runs budget, L0, moat P9 and structural checks; on red it opens a BOARD P0 row within 5 minutes (fixture test).
-
-Todo:
-- [ ] Job in `.github/workflows/tests.yml` (extend, no new workflow)
-- [ ] Auto P0 row writer
-
-## STAB-3 Nightly honesty
-
-Acceptance: a nightly where every test job was skipped concludes neutral or failure, never success.
-
-Todo:
-- [ ] `.github/workflows/nightly.yml` conclusion rule plus test
-
-## STAB-4 Green streak and time-to-fix in pulse
-
-Acceptance: pulse prints current green streak and `MAIN_RED_MINUTES`; VIOLATION when red over 60 minutes.
-
-Todo:
-- [ ] `scripts/v10-pulse.sh`
-- [ ] Fix BUDGET_BURN active-engineer miscount (see 02 COST-D)
-
-## STAB-5 Public status page
-
-Acceptance: a page shows main CI streak, last release, npm dist-tags and incident history, generated from the same data as pulse.
-
-Todo:
-- [ ] Generator plus publish step
-
-## STAB-6 Repo hygiene
-
-Todo:
-- [ ] Triage 295 unmerged local branches (delete only those whose work is on main or parked)
-- [ ] Fix BOARD unparsed rows Q17-05b, Q18-03e, A-112b
-- [ ] METRICS.md:45 moat count and ENGINE-MEASURE.md refreshed for v10
-- [ ] Drift audit cadence kept (pulse DRIFT AUDIT DUE)
-- [ ] Remove stale local tag mismatch (local v11.17.53 vs npm next)

package/docs/v10/roadmap-10/07-quality.md

@@ -1,57 +0,0 @@
-# 07 Delivered quality and autonomy
-
-Now 7.5. Winner today: Claude Code and Codex; Terminal-Bench 2.0 about 82% is the public bar; SWE-bench Verified is saturated (about 96%) and no longer differentiates.
-
-Why we are not 10:
-- Small tier (29 tasks, opus): raw 27/29 at $0.2363 p50 39s; v10 default 26/29 at $0.3946 p50 85.5s. Lean 27/29 at $0.1616 p50 40s but not default.
-- Medium: no arm meets 85.7% completion at <= $0.5085 per completed. pub-werkzeug-3105 and 3271 fail in all arms.
-- D50: Loki+sonnet 50% vs raw sonnet 90% (false ALREADY_SATISFIED, empty diff, BLOCKED); 2 of 4 losses real on rerun.
-- Moat: P3 Wall (3 cases) and P4 model freedom (2 cases) pending; P9 regressed on main.
-- A-119b: weakening via helper file or snapshot still ends VERIFIED.
-
-Bar for 10: medium completion >= 85.7% at <= $0.5085 per completed with CI; Loki beats raw at every model tier; moat 9 of 9; public Terminal-Bench 2.0 and SWE-bench Pro numbers at or above raw Claude Code.
-
-## QUAL-A Beat raw on medium
-
-Acceptance: MEAS-4 run shows completion >= 85.7% and cost < $0.5085 per completed, CI reported.
-
-Todo:
-- [ ] Root-cause werkzeug-3105 and 3271 (FAILURE-CLASSES rows)
-- [ ] Apply COST-B brief and SPD-A Wall changes, re-measure
-
-## QUAL-B Close the D50 sonnet loss
-
-Acceptance: Loki+sonnet >= raw sonnet at n=3 on the D50 set; humanize-174 and aiq-52 pass.
-
-Todo:
-- [ ] False ALREADY_SATISFIED guard in intake
-- [ ] Empty-diff retry rule in implement
-- [ ] Re-run D50
-
-## QUAL-C Moat 9 of 9
-
-Todo:
-- [ ] P3: check-author step, `--freeze` interface, implementer prompt no longer authors checks (3 cases PASS)
-- [ ] P4: high and small tiers resolve to distinct models (`three-setups-resolve` PASS)
-- [ ] P4: floor-does-not-raise-wrong-pass PASS (needs MEAS-5)
-- [ ] P9 stays PROVEN (STAB-1)
-- [ ] Moat suite runs on every main push, not only full-suite (feeds STAB-2)
-
-Acceptance: `bash tests/moat/run.sh` reports 9 of 9 PROVEN, `pending.txt` empty of P3/P4.
-
-## QUAL-D Close A-119b weakening holes
-
-Acceptance: A-119b repro cases (helper `eq=()=>{}`, snapshot weakening) end FAILED or PARTIAL with rc != 0.
-
-Todo:
-- [ ] `engine10/stages/verify.ts` detection
-- [ ] Moat case for each repro
-
-## QUAL-E Public benchmark numbers
-
-Acceptance: MEAS-6 results published on the scoreboard with Loki and raw Claude Code side by side.
-
-Todo:
-- [ ] Terminal-Bench 2.0 score
-- [ ] SWE-bench Pro pilot score
-- [ ] Q18-03e followups: jsonc, toml, import-attributes and symlink cases in the project model

package/docs/v10/roadmap-10/08-proof.md

@@ -1,48 +0,0 @@
-# 08 Proof and trust
-
-Now 9. Winner today: Loki. No competitor signs a record binding spec, tests and result. This is the moat; the work here is making it verifiable by a stranger.
-
-What exists: VERIFIED needs agent-independent proof by default (D104, D105); Ed25519 receipts signed by default; offline `loki verify` (hash, schema, events prefix and seq, JWT attestation, sealed line, drift; `--export-dsse`, `--url` with `.well-known/loki-provenance.json`, `--require-exogenous`); CycloneDX AI-BOM; `loki tour`; gate badge; loki-seal plugin; 67 moat cases.
-
-Why we are not 10:
-- Trust root is a self-generated local key; a third party needs the JWK out of band; unknown kid reads UNCHECKED; no transparency log; no published key directory.
-- No browser verifier; `vendor/autonomi-verify/embed.js` is a closed prebuilt bundle.
-- Not shown that the receipt records proof opt-outs (`LOKI_EXOGENOUS_PROOF=0`, `LOKI_PROOF_REQUIRE_EXOGENOUS=0`, `LOKI_VERIFY_ALLOW_UNSIGNED=1`); check `seal.ts` first.
-- No published catch rate (MEAS-5); no independent audit.
-
-Bar for 10: anyone can verify any Loki receipt in a browser with no install, against a public log, and read an independent audit and a published catch rate.
-
-## PRF-A Third-party verifiable trust root
-
-Acceptance:
-- Receipts optionally logged to a transparency log (Sigstore Rekor); `loki verify` checks inclusion.
-- Public key directory (per user or org) discoverable from the receipt kid.
-- Unknown kid with a log entry verifies as VERIFIED (logged), not UNCHECKED.
-
-Todo:
-- [ ] Rekor upload on seal (opt-in, then default after review)
-- [ ] Inclusion check in `verify_cmd.ts`
-- [ ] Key directory format plus lookup
-
-## PRF-B Browser verifier and open source
-
-Acceptance: a static page verifies a dropped receipt fully client side (same checks as `loki verify`); verifier source is open and built in CI; the vendor bundle is either open-sourced or replaced.
-
-Todo:
-- [ ] Shared verify core compiled for browser
-- [ ] Page (also serves FR-E)
-- [ ] Decide on `vendor/autonomi-verify`
-
-## PRF-C Receipts record every opt-out
-
-Acceptance: every proof-weakening env var that was active is listed in the signed receipt and shown by `loki verify --explain`; test per variable.
-
-Todo:
-- [ ] Read `seal.ts` and confirm current behavior
-- [ ] Record and display
-
-## PRF-D Published catch rate and audit
-
-Todo:
-- [ ] Publish MEAS-5 catch rate on the scoreboard
-- [ ] Commission an independent audit of the receipt chain, `verify_cmd` and the threat model; publish the report and fix list

package/docs/v10/roadmap-10/09-safety.md

@@ -1,74 +0,0 @@
-# 09 Safety and security
-
-Now 8.5. Bar set by: Codex (offline agent phase, secrets stripped before the agent runs, domain allowlist), Claude Code (OS sandbox: Seatbelt on macOS, bubblewrap on Linux), Copilot (default security scans, restricted push branches).
-
-Why we are not 10:
-- `loki share` uploads a PUBLIC gist by default from `loki report` output with no redact call (`autonomy/loki` cmd_report / share). Live leak risk.
-- `redact.ts` misses secret words mid-name: `AWS_SECRET_ACCESS_KEY`, `PGPASSWORD`, `MYSQL_PWD`, `DB_PASS`, `PRIVATE_KEY`, `SECRET_KEY_BASE`, `client_secret_value`; unterminated `password="...`; the `=>` form. Python `proof_redact.py` catches them (parity gap).
-- URL userinfo ReDoS (2.8s on 100KB). SECURITY-26 fix `fb2408cfc` was BLOCKED: the added `\b` lets hash-glued URLs leak userinfo.
-- Default agent mode is bypassPermissions; engine10 has no sandbox; the bash denylist is literal (`rm -r -f /`, `find / -delete`, `shutil.rmtree` pass).
-- `policyGate` covers only the PR action and allows when no policy file exists.
-- npm publish has no `--provenance`, uses a long-lived `NPM_TOKEN`; actions mostly tag-pinned.
-- SARIF and `redact.ts` keep separate pattern lists; SARIF never gates.
-
-Owns `loki-ts/src/util/redact.ts` for this program. All tests build secrets by string concatenation so gitleaks does not flag them. HIGH tier: opus adversarial reviewer on every item.
-
-## SAFE-1 Share is private and redacted
-
-Acceptance: `loki share` defaults to a secret gist, requires `--public` explicitly, and runs output through redaction; test with seeded secrets shows none uploaded.
-
-Todo:
-- [ ] Flip default, add redact call
-- [ ] Test
-
-## SAFE-2 Redaction parity and ReDoS
-
-Todo:
-- [ ] Rework SECURITY-26 on main: URL userinfo scheme `/([a-z][a-z0-9+.-]{0,63}:\/\/)[^\s/?#@]+@/gi` (no `\b`), regression tests for `"sha256:"+h+"https://admin:...@db"`, `h+"postgres://u:...@db"`, `"x".repeat(80)+"://u:p@h"`; ReDoS test limit 250ms
-- [ ] N2: unterminated quoted values redacted
-- [ ] N3: mid-name keywords (AWS_SECRET_ACCESS_KEY, PGPASSWORD, MYSQL_PWD, DB_PASS, PRIVATE_KEY, SECRET_KEY_BASE)
-- [ ] N4: `=>` assignment form
-- [ ] Parity test: the same corpus through `redact.ts` and `proof_redact.py` gives the same masked set
-
-Acceptance: parity test green; adversarial 100KB and 1MB inputs linear; opus HIGH reviewer APPROVE.
-
-## SAFE-3 Sandbox by default on engine10
-
-Acceptance: engine10 agent runs inside the OS sandbox (Seatbelt / bubblewrap, or the provider's own sandbox) with write access limited to the worktree; `bypassPermissions` only inside the sandbox; denylist tests cover `rm -r -f /`, `find / -delete`, `python -c shutil.rmtree`.
-
-Todo:
-- [ ] Sandbox wrapper in runner
-- [ ] Shape-based denylist (not literal strings)
-- [ ] Escape tests
-
-## SAFE-4 Egress allowlist and offline phase
-
-Acceptance: optional offline agent phase after dependency install; domain allowlist enforced; secrets stripped from the agent env before the agent runs (spawn env guard extended).
-
-Todo:
-- [ ] Allowlist config plus enforcement
-- [ ] Offline phase flag
-- [ ] Env strip test
-
-## SAFE-5 Policy gate everywhere
-
-Acceptance: `policyGate` runs for commit, push, deploy and network actions; missing check.js fails closed; tests per action.
-
-Todo:
-- [ ] Extend `util/run_outputs.ts` call sites
-
-## SAFE-6 Supply chain
-
-Acceptance: `npm publish --provenance` via OIDC (`id-token: write`), no long-lived NPM_TOKEN; all actions SHA-pinned; SLSA provenance for the tarball; `npm view loki-mode` shows provenance.
-
-Todo:
-- [ ] release.yml publish job
-- [ ] Pin actions by SHA (script plus guard)
-
-## SAFE-7 One pattern list
-
-Acceptance: SARIF export and `redact.ts` read one shared pattern source; SARIF can gate with `--fail-on`; drift test.
-
-Todo:
-- [ ] Shared module, delete the duplicate list
-- [ ] Gate flag